X-Git-Url: https://git.proxmox.com/?p=pve-docs.git;a=blobdiff_plain;f=vxlan-and-evpn.adoc;h=9dd36dc32539030955c95ca8b7377e30d50e2785;hp=73ae4a6b3c41aec54c924f52fcd7e107b4efc7c5;hb=5dde3d645834b204257e8d5b3ce8b65e6842abe8;hpb=445822a94613be87eb68f126f21d56249d0e88ca diff --git a/vxlan-and-evpn.adoc b/vxlan-and-evpn.adoc index 73ae4a6..9dd36dc 100644 --- a/vxlan-and-evpn.adoc +++ b/vxlan-and-evpn.adoc @@ -490,162 +490,188 @@ line vty ! ---- +VXLAN layer3 routing with anycast gateway +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -VXLAN layer2 with vlan aware linux bridges -~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +With this need, each vmbr bridge will be the gateway for the vm. +Same vmbr on different node, will have same ip address and same mac address, +to have working vm live migration and no network disruption. -We use 1 vmbr bridge, each vxlan is mapped to a vlan +VXLAN layer3 routing only work with FRR and non-aware bridge. +(vlan aware bridge support is buggy currently). -image::images/vxlan-l2-vlanaware.svg["vxlan l2 bridge vlan aware",align="center"] -multicast mode -^^^^^^^^^^^^^^ - -* node1 +sysctl.conf tuning ---- -auto eno1 -iface eno1 inet manual +#enable routing +net.ipv4.ip_forward=1 +net.ipv6.conf.all.forwarding=1 +#disable reverse path filtering +net.ipv4.conf.default.rp_filter=0 +net.ipv4.conf.all.rp_filter=0 +#allow frr to work with vrf +net.ipv4.tcp_l3mdev_accept=1 +---- -auto vmbr0 -iface vmbr0 inet static - address 192.168.0.1 - netmask 255.255.255.0 - bridge_ports eno1 vxlan2 vxlan3 - bridge_stp off - bridge_fd 0 - bridge_vlan_aware yes +asymmetric model +^^^^^^^^^^^^^^^^ -auto vxlan2 -iface vxlan2 inet manual - vxlan-svcnodeip 225.20.1.1 - vxlan-physdev eno1 - bridge-access 2 +This is the simplest mode. To get it work, all vxlan need to be defined on all nodes. -auto vxlan3 -iface vxlan3 inet manual - vxlan-svcnodeip 225.20.1.1 - vxlan-physdev eno1 - bridge-access 3 ----- +The asymmetric model allows routing and bridging on the VXLAN tunnel ingress, +but only bridging on the egress. +This results in bi-directional VXLAN traffic traveling on different VNIs +in each direction (always the destination VNI) across the routed infrastructure. +image::images/vxlan-l3-asymmetric.svg["vxlan l3 asymmetric",align="center"] -* node2 + +* node1 ---- auto eno1 iface eno1 inet manual - + auto vmbr0 iface vmbr0 inet static - address 192.168.0.2 - netmask 255.255.255.0 - bridge_ports eno1 vxlan2 vxlan3 + address 192.168.0.1 + netmask 255.255.255.0 + bridge_ports eno1 + bridge_stp off + bridge_fd 0 + +auto vxlan2 +iface vxlan2 inet manual + vxlan-local-tunnelip 192.168.0.1 + bridge-learning off + bridge-arp-nd-suppress on + bridge-unicast-flood off + bridge-multicast-flood off + + +auto vmbr2 +iface vmbr2 inet static + address 10.0.2.254 + netmask 255.255.255.0 + hwaddress 44:39:39:FF:40:94 + bridge_ports vxlan2 bridge_stp off bridge_fd 0 - bridge_vlan_aware yes -auto vxlan2 -iface vxlan2 inet manual - vxlan-svcnodeip 225.20.1.1 - vxlan-physdev eno1 - bridge-access 2 auto vxlan3 iface vxlan3 inet manual - vxlan-svcnodeip 225.20.1.1 - vxlan-physdev eno1 - bridge-access 3 ----- - - -* node3 + vxlan-local-tunnelip 192.168.0.1 + bridge-learning off + bridge-arp-nd-suppress on + bridge-unicast-flood off + bridge-multicast-flood off ----- -auto eno1 -iface eno1 inet manual -auto vmbr0 -iface vmbr0 inet static - address 192.168.0.3 +auto vmbr3 +iface vmbr3 inet static + address 10.0.3.254 netmask 255.255.255.0 - bridge_ports eno1 vxlan2 vxlan3 + hwaddress 44:39:39:FF:40:94 + bridge_ports vxlan3 bridge_stp off bridge_fd 0 - bridge_vlan_aware yes +---- -auto vxlan2 -iface vxlan2 inet manual - vxlan-svcnodeip 225.20.1.1 - vxlan-physdev eno1 - bridge-access 2 -auto vxlan3 -iface vxlan3 inet manual - vxlan-svcnodeip 225.20.1.1 - vxlan-physdev eno1 - bridge-access 3 ----- +frr.conf +---- +router bgp 1234 + bgp router-id 192.168.0.1 + no bgp default ipv4-unicast + coalesce-time 1000 + neighbor 192.168.0.2 remote-as 1234 + neighbor 192.168.0.3 remote-as 1234 + ! + address-family l2vpn evpn + neighbor 192.168.0.2 activate + neighbor 192.168.0.3 activate + advertise-all-vni + exit-address-family +! +line vty +! +---- -unicast mode -^^^^^^^^^^^^ -* node1 +* node2 ---- auto eno1 iface eno1 inet manual - + auto vmbr0 iface vmbr0 inet static - address 192.168.0.1 + address 192.168.0.2 + netmask 255.255.255.0 + bridge_ports eno1 + bridge_stp off + bridge_fd 0 + +auto vxlan2 +iface vxlan2 inet manual + vxlan-local-tunnelip 192.168.0.2 + bridge-learning off + bridge-arp-nd-suppress on + bridge-unicast-flood off + bridge-multicast-flood off + + +auto vmbr2 +iface vmbr2 inet static + address 10.0.2.254 netmask 255.255.255.0 - bridge_ports eno1 vxlan2 vxlan3 + hwaddress 44:39:39:FF:40:94 + bridge_ports vxlan2 bridge_stp off bridge_fd 0 - bridge_vlan_aware yes -auto vxlan2 -iface vxlan2 inet manual - vxlan_remoteip 192.168.0.2 - vxlan_remoteip 192.168.0.3 - bridge-access 2 auto vxlan3 iface vxlan3 inet manual - vxlan_remoteip 192.168.0.2 - vxlan_remoteip 192.168.0.3 - bridge-access 3 ----- - + vxlan-local-tunnelip 192.168.0.2 + bridge-learning off + bridge-arp-nd-suppress on + bridge-unicast-flood off + bridge-multicast-flood off -* node2 ----- -auto eno1 -iface eno1 inet manual - -auto vmbr0 -iface vmbr0 inet static - address 192.168.0.2 +auto vmbr3 +iface vmbr3 inet static + address 10.0.3.254 netmask 255.255.255.0 - bridge_ports eno1 vxlan2 vxlan3 + hwaddress 44:39:39:FF:40:94 + bridge_ports vxlan3 bridge_stp off bridge_fd 0 - bridge_vlan_aware yes +---- -auto vxlan2 -iface vxlan2 inet manual - vxlan_remoteip 192.168.0.1 - vxlan_remoteip 192.168.0.3 - bridge-access 2 -auto vxlan3 -iface vxlan3 inet manual - vxlan_remoteip 192.168.0.1 - vxlan_remoteip 192.168.0.3 - bridge-access 3 +frr.conf + +---- +router bgp 1234 + bgp router-id 192.168.0.2 + no bgp default ipv4-unicast + coalesce-time 1000 + neighbor 192.168.0.1 remote-as 1234 + neighbor 192.168.0.3 remote-as 1234 + ! + address-family l2vpn evpn + neighbor 192.168.0.1 activate + neighbor 192.168.0.3 activate + advertise-all-vni + exit-address-family +! +line vty +! ---- @@ -654,60 +680,127 @@ iface vxlan3 inet manual ---- auto eno1 iface eno1 inet manual - + auto vmbr0 iface vmbr0 inet static - address 192.168.0.3 + address 192.168.0.3 + netmask 255.255.255.0 + bridge_ports eno1 + bridge_stp off + bridge_fd 0 + +auto vxlan2 +iface vxlan2 inet manual + vxlan-local-tunnelip 192.168.0.3 + bridge-learning off + bridge-arp-nd-suppress on + bridge-unicast-flood off + bridge-multicast-flood off + + +auto vmbr2 +iface vmbr2 inet static + address 10.0.2.254 netmask 255.255.255.0 - bridge_ports eno1 vxlan2 vxlan3 + hwaddress 44:39:39:FF:40:94 + bridge_ports vxlan2 bridge_stp off bridge_fd 0 - bridge_vlan_aware yes -auto vxlan2 -iface vxlan2 inet manual - vxlan_remoteip 192.168.0.2 - vxlan_remoteip 192.168.0.3 - bridge-access 2 auto vxlan3 iface vxlan3 inet manual - vxlan_remoteip 192.168.0.2 - vxlan_remoteip 192.168.0.3 - bridge-access 3 + vxlan-local-tunnelip 192.168.0.3 + bridge-learning off + bridge-arp-nd-suppress on + bridge-unicast-flood off + bridge-multicast-flood off + + +auto vmbr3 +iface vmbr3 inet static + address 10.0.3.254 + netmask 255.255.255.0 + hwaddress 44:39:39:FF:40:94 + bridge_ports vxlan3 + bridge_stp off + bridge_fd 0 ---- -bgp-evpn -^^^^^^^^ +frr.conf + +---- +router bgp 1234 + bgp router-id 192.168.0.3 + no bgp default ipv4-unicast + coalesce-time 1000 + neighbor 192.168.0.1 remote-as 1234 + neighbor 192.168.0.2 remote-as 1234 + ! + address-family l2vpn evpn + neighbor 192.168.0.1 activate + neighbor 192.168.0.2 activate + advertise-all-vni + exit-address-family +! +line vty +! +---- -Note: currently FRR is working only with 1 vlan aware bridge -* node1 +symmetric model +^^^^^^^^^^^^^^^ + +With this model, you don't need to have all vxlan on all nodes. +This model will also be needed to route traffic to an external router. + +The symmetric model routes and bridges on both the ingress and the egress leafs. +This results in bi-directional traffic being able to travel on the same VNI, hence the symmetric name. +However, a new specialty transit VNI is used for all routed VXLAN traffic, called the L3VNI. +All traffic that needs to be routed will be routed onto the L3VNI, tunneled across the layer 3 Infrastructure, +routed off the L3VNI to the appropriate VLAN and ultimately bridged to the destination. +A vrf is needed for the L3VNI, so all vmbr bridge need to be in the vrf if they want to be able to reach each others. + +image::images/vxlan-l3-symmetric.svg["vxlan l3 symmetric",align="center"] + + +* node1 ---- +auto vrf1 +iface vrf1 + vrf-table auto + auto eno1 iface eno1 inet manual - + auto vmbr0 iface vmbr0 inet static - address 192.168.0.1 - netmask 255.255.255.0 - bridge_ports eno1 vxlan2 vxlan3 - bridge_stp off - bridge_fd 0 - bridge_vlan_aware yes + address 192.168.0.1 + netmask 255.255.255.0 + bridge_ports eno1 + bridge_stp off + bridge_fd 0 -auto vxlan0 -iface vxlan0 inet manual +auto vxlan2 +iface vxlan2 inet manual vxlan-local-tunnelip 192.168.0.1 bridge-learning off bridge-arp-nd-suppress on bridge-unicast-flood off bridge-multicast-flood off - bridge-access 2 +auto vmbr2 +iface vmbr2 inet static + bridge_ports vxlan2 + bridge_stp off + bridge_fd 0 + address 10.0.2.254 + netmask 255.255.255.0 + hwaddress 44:39:39:FF:40:94 #must be same on each node vmbr2 + vrf vrf1 auto vxlan3 iface vxlan3 inet manual @@ -716,14 +809,44 @@ iface vxlan3 inet manual bridge-arp-nd-suppress on bridge-unicast-flood off bridge-multicast-flood off - bridge-access 3 ----- +auto vmbr3 +iface vmbr3 inet static + bridge_ports vxlan3 + bridge_stp off + bridge_fd 0 + address 10.0.3.254 + netmask 255.255.255.0 + hwaddress 44:39:39:FF:40:94 #must be same on each node vmbr3 + vrf vrf1 -/etc/frr/frr.conf +#interconnect vxlan-vfr l3vni +auto vxlan4000 +iface vxlan4000 inet manual + vxlan-local-tunnelip 192.168.0.1 + bridge-learning off + bridge-arp-nd-suppress on + bridge-unicast-flood off + bridge-multicast-flood off + + +auto vmbr4000 +iface vmbr4000 inet manual + bridge_ports vxlan4000 + bridge_stp off + bridge_fd 0 + hwaddress 44:39:39:FF:40:90 #must be different on each node + vrf vrf1 +---- + +frr.conf ---- +vrf vrf1 + vni 4000 +! router bgp 1234 + bgp router-id 192.168.0.1 no bgp default ipv4-unicast coalesce-time 1000 neighbor 192.168.0.2 remote-as 1234 @@ -735,6 +858,18 @@ router bgp 1234 advertise-all-vni exit-address-family ! +router bgp 1234 vrf vrf1 +! + bgp router-id 192.168.0.1 + ! + address-family ipv4 unicast + redistribute connected + exit-address-family + ! + address-family l2vpn evpn + advertise ipv4 unicast + exit-address-family +! line vty ! ---- @@ -743,27 +878,38 @@ line vty * node2 ---- +auto vrf1 +iface vrf1 + vrf-table auto + auto eno1 iface eno1 inet manual - + auto vmbr0 iface vmbr0 inet static - address 192.168.0.2 - netmask 255.255.255.0 - bridge_ports eno1 vxlan2 vxlan3 - bridge_stp off - bridge_fd 0 - bridge_vlan_aware yes + address 192.168.0.2 + netmask 255.255.255.0 + bridge_ports eno1 + bridge_stp off + bridge_fd 0 -auto vxlan0 -iface vxlan0 inet manual +auto vxlan2 +iface vxlan2 inet manual vxlan-local-tunnelip 192.168.0.2 bridge-learning off bridge-arp-nd-suppress on bridge-unicast-flood off bridge-multicast-flood off - bridge-access 2 +auto vmbr2 +iface vmbr2 inet static + bridge_ports vxlan2 + bridge_stp off + bridge_fd 0 + address 10.0.2.254 + netmask 255.255.255.0 + hwaddress 44:39:39:FF:40:94 #must be same on each node vmbr2 + vrf vrf1 auto vxlan3 iface vxlan3 inet manual @@ -772,14 +918,45 @@ iface vxlan3 inet manual bridge-arp-nd-suppress on bridge-unicast-flood off bridge-multicast-flood off - bridge-access 3 + +auto vmbr3 +iface vmbr3 inet static + bridge_ports vxlan3 + bridge_stp off + bridge_fd 0 + address 10.0.3.254 + netmask 255.255.255.0 + hwaddress 44:39:39:FF:40:94 #must be same on each node vmbr3 + vrf vrf1 + +#interconnect vxlan-vfr l3vni +auto vxlan4000 +iface vxlan4000 inet manual + vxlan-local-tunnelip 192.168.0.2 + bridge-learning off + bridge-arp-nd-suppress on + bridge-unicast-flood off + bridge-multicast-flood off + + +auto vmbr4000 +iface vmbr4000 inet manual + bridge_ports vxlan4000 + bridge_stp off + bridge_fd 0 + hwaddress 44:39:39:FF:40:91 #must be different on each node + vrf vrf1 ---- -/etc/frr/frr.conf +frr.conf ---- +vrf vrf1 + vni 4000 +! router bgp 1234 + bgp router-id 192.168.0.2 no bgp default ipv4-unicast coalesce-time 1000 neighbor 192.168.0.1 remote-as 1234 @@ -791,6 +968,18 @@ router bgp 1234 advertise-all-vni exit-address-family ! +router bgp 1234 vrf vrf1 +! + bgp router-id 192.168.0.2 + ! + address-family ipv4 unicast + redistribute connected + exit-address-family + ! + address-family l2vpn evpn + advertise ipv4 unicast + exit-address-family +! line vty ! ---- @@ -799,27 +988,38 @@ line vty * node3 ---- +auto vrf1 +iface vrf1 + vrf-table auto + auto eno1 iface eno1 inet manual - + auto vmbr0 iface vmbr0 inet static - address 192.168.0.3 - netmask 255.255.255.0 - bridge_ports eno1 vxlan2 vxlan3 - bridge_stp off - bridge_fd 0 - bridge_vlan_aware yes + address 192.168.0.3 + netmask 255.255.255.0 + bridge_ports eno1 + bridge_stp off + bridge_fd 0 -auto vxlan0 -iface vxlan0 inet manual +auto vxlan2 +iface vxlan2 inet manual vxlan-local-tunnelip 192.168.0.3 bridge-learning off bridge-arp-nd-suppress on bridge-unicast-flood off bridge-multicast-flood off - bridge-access 2 +auto vmbr2 +iface vmbr2 inet static + bridge_ports vxlan2 + bridge_stp off + bridge_fd 0 + address 10.0.2.254 + netmask 255.255.255.0 + hwaddress 44:39:39:FF:40:94 #must be same on each node vmbr2 + vrf vrf1 auto vxlan3 iface vxlan3 inet manual @@ -828,13 +1028,45 @@ iface vxlan3 inet manual bridge-arp-nd-suppress on bridge-unicast-flood off bridge-multicast-flood off - bridge-access 3 + +auto vmbr3 +iface vmbr3 inet static + bridge_ports vxlan3 + bridge_stp off + bridge_fd 0 + address 10.0.3.254 + netmask 255.255.255.0 + hwaddress 44:39:39:FF:40:94 #must be same on each node vmbr3 + vrf vrf1 + +#interconnect vxlan-vfr l3vni +auto vxlan4000 +iface vxlan4000 inet manual + vxlan-local-tunnelip 192.168.0.3 + bridge-learning off + bridge-arp-nd-suppress on + bridge-unicast-flood off + bridge-multicast-flood off + + +auto vmbr4000 +iface vmbr4000 inet manual + bridge_ports vxlan4000 + bridge_stp off + bridge_fd 0 + hwaddress 44:39:39:FF:40:92 #must be different on each node + vrf vrf1 ---- -/etc/frr/frr.conf +frr.conf + ---- +vrf vrf1 + vni 4000 +! router bgp 1234 + bgp router-id 192.168.0.3 no bgp default ipv4-unicast coalesce-time 1000 neighbor 192.168.0.1 remote-as 1234 @@ -846,6 +1078,18 @@ router bgp 1234 advertise-all-vni exit-address-family ! +router bgp 1234 vrf vrf1 +! + bgp router-id 192.168.0.3 + ! + address-family ipv4 unicast + redistribute connected + exit-address-family + ! + address-family l2vpn evpn + advertise ipv4 unicast + exit-address-family +! line vty ! ----