LTRDCT-2223.Pdf
Total Page:16
File Type:pdf, Size:1020Kb
Implementing VXLAN In a Data Center Lilian Quan, Principle Engineer, INSBU Erum Frahim, Technical Leader, Services Kevin Cook, Solution Architecture LTRDCT-2223 Agenda . VxLAN Overview . Flood-&-Learn VXLAN . VXLAN with MP-BGP EVPN Control Plane . VXLAN Design Options . MP-BGP EVPN VXLAN Configuration . Lab Introduction Agenda . VxLAN Overview . Flood-&-Learn VXLAN . VXLAN with MP-BGP EVPN Control Plane . VXLAN Design Options . MP-BGP EVPN VXLAN Configuration . Lab Introduction Recap – What is VXLAN ? Tunnel Ethernet Frames Endpoints NETWORK OVERLAY Host Host 1 4 IP Addr IP Network IP Addr Host 1.1.1.1 2.2.2.2 Host 2 Switch Switch 5 Host Host 3 IP/UDP Packets 6 PLANE DATA DATA Outer Outer Outer Outer Outer Outer VXLAN Inner Inner Optiona Original CRC MAC MAC MAC MAC l Inner Ethernet 802.1Q IP DA IP SA UDP ID CRC DA SA (24 bits) DA SA 802.1Q Payload VXLAN Encapsulation Original Ethernet Frame • VXLAN uses MAC in UDP encapsulation (UDP destination port 4789) 5 Why VXLAN? VXLAN provides a Network with Segmentation, IP Mobility, and Scale • “Standards” based Overlay • Leverages Layer-3 ECMP – all links forwarding • Increased Name-Space to 16M identifier • Segmentation and Multi-Tenancy • Integration of Physical and Virtual • It’s SDN 6 VXLAN VTEP VXLAN terminates its tunnels on VTEPs (Virtual Tunnel End Point). Each VTEP has two interfaces, one is to provide bridging function for local hosts, the other has an IP identification in the core network for VXLAN encapsulation/decapsulation. Underlay Network (IP Routing) VTEP VTEP IP Interface IP Interface Local LAN Segment Local LAN Segment Host Host Host Host 7 VXLAN Underlay Network – IP Routing • IP routed Network • Flexible topologies IP Transport Network • Recommend a network with redundant paths using ECMP for load sharing • Support any routing protocols --- OSFP, EIGRP, IS-IS, BGP, etc. • All proven best practices for IP routing network apply 8 VXLAN Underlay Network – Typical DC Topologies Fabric Design 3-Tier Design DC Spine DC Core DC Aggregation DC Access DC Leaf DC Interconnect Collapsed Core/Aggregation 2-Tier Design DC-1 DC-2 DC Core/ Aggregation DC Access WAN 9 VXLAN BUM Traffic Handling • BUM Traffic --- Multi-destination traffic • Broadcast • Unknown Layer-2 Unicast • Multicast VTEP-3 • BUM Traffic transport mechanisms Multicast or / Unicast Replication • Multicast replication in the underlay network IP Network • Requests the underlay network to run IP multicast • Ingress unicast replication VTEP-1 VTEP-2 • One unicast replica per remote VTEP • Increase traffic load throughout the network 10 Agenda . VxLAN Overview . Flood-&-Learn VXLAN . VXLAN with MP-BGP EVPN Control Plane . VXLAN Design Options . MP-BGP EVPN VXLAN Configuration . VxLAN Capability on Nexus 9000 Series Switches . Lab Introduction Flood-&-Learn VxLAN End End System . No VXLAN control plane End System . Data driven flood-&-learn VTEP IP VTEP3 - 3 - 3 Multicast/Unicast Replication VTEP-1 VTEP-2 IP Network VTEP 1 VTEP 2 End System A End System B IP-1 IP-2 MAC-A MAC-B IP-A IP-B 12 Challenges with Flood-&-Learn VXLAN Deployments Scale, Mobility and Security Limitations VXLAN Overlay VTEP VTEP VTEP VTEP VTEP VTEP VTEP LIMITED SCALE LIMITED WORKLOAD MOBILITY Security Risk • Flood and learn (BUM)- • Centralized Gateways – Traffic • No authentication for VXLAN Inefficient Bandwidth Utilization Hair-pining devices (VTEPs) • Resource Intensive – Large • Sub-Optimal Traffic Flow MAC Tables Barrier for Scaling out Large Data Centers and Cloud Deployments13 Agenda . VxLAN Overview . Flood-&-Learn VXLAN . VXLAN with MP-BGP EVPN Control Plane . VXLAN Design Options . MP-BGP EVPN VXLAN Configuration . VxLAN Capability on Nexus 9000 Series Switches . Lab Introduction What is VXLAN/EVPN? • Standards based Overlay (VXLAN) with Standards based Control-Plane (BGP) • Layer-2 MAC and Layer-3 IP information distribution by Control-Plane (BGP) • Forwarding decision based on Control-Plane (minimizes flooding) • Integrated Routing/Bridging (IRB) for Optimized Forwarding in the Overlay Control- EVPN MP-BGP - RFC 7432 Plane (draft-ietf-l2vpn-evpn) Provider Backbone Bridges Data- Multi-Protocol Label Switching (MPLS) Network Virtualization Overlay (NVO) (PBB) Plane draft-ietf-l2vpn-evpn draft-sd-l2vpn-evpn-overlay draft-ietf-l2vpn-pbb-evpn EVPN over NVO Tunnels (VXLAN, NVGRE, MPLSoE) for Data Center Fabric encapsulations Provides Layer-2 and Layer-3 Overlays over simple IP Networks 15 Cisco Supported VXLAN IETF Drafts ID Title Ver Category Comments RFC 7348 Virtual eXtensible Local Area Data Plane Flood and Learn based implemented Network RFC 7432 BGP MPLS based Ethernet VPNs EVPN Control Plane Control Plane is based on this RFC draft-ietf-bess-evpn-overlay A Network Virtualization Overlay 0 EVPN Control Plane Implemented Solution using EVPN draft-ietf-bess-evpn-inter- Integrated Routing and Bridging in 0 EVPN Control Plane Implemented subnet-forwarding EVPN draft-rabadan-l2vpn-evpn- IP Prefix Advertisement in EVPN 2 EVPN Control Plane Implemented evpn-prefix-advertisement Draft-tissa-nvo3-oam-fm NVO3 Fault Management 1 Mgmt Plane Working in progress 16 Functions of VXLAN/EVPN Host/Network Advertise host/network reachability Reachability information through control protocol (MP- Advertisement BGP) VTEP Security & Authenticate VTEPs through BGP peer Authentication authentication Distributed Anycast Gateway Seamless and Optimal vm-mobility Early ARP termination ARP Suppression Localize ARP learning process Minimize network flooding Dynamic Ingress Replication Unicast Alternative to Multicast underlay 17 EVPN Primer --- MP-BGP Review Virtual Routing and Forwarding (VRF) Layer-3 segmentation for tenants’ routing space BGP advertisement: VPN-IPv4 Addr = RD:16.1/16 Route Distinguisher (RD): BGP Next-Hop = PE1 8-byte field, VRF parameters; unique value to make Route Target = 100:1 eBGP: Label=42 eBGP: VPN IP routes unique: RD + VPN IP prefix 16.1/16 16.1/16 IP Subnet IP Subnet PE1 P P PE2 Selective distribute VPN routes: CE1 Blue VPN CE2 Route Target (RT): 8-byte field, VRF parameter, unique value to define the import/export rules for ipVRFvrfparameters:blue-vpn VPNv4 routes NameRD 1:100 = blue-vpn RDroute = 1:100-target export 1:100 Importroute- targetRoute import-Target 1:100 = 100:1 Export Route-Target = 100:1 VPN Address-Family: Distribute the MP-BGP VPN routes 18 MP-BGP for VXLAN EVPN Control Plane EVPN Control Plane – Reachability Distribution • EVPN Control Plane -- Host and Subnet Route Distribution BGP Update Spine • Host-MAC • Host-IP • Internal IP Subnet • External Prefixes VTEP VTEP VTEP VTEP Leaf . Use MP-BGP with EVPN Address Family on leaf nodes to distribute internal host MAC/IP addresses, subnet routes and external reachability information . MP-BGP enhancements to carry up to 100s of thousands of routes with reduced convergence time 19 EVPN Control Plane -- Host Advertisement Install host info to RIB/FIB: Install host info to RIB/FIB: H-MAC-1 MAC table BGP Update: H-MAC-1 MAC table BGP Update: H-IP-1 VRF IP host table 4 H-MAC-1 H-MAC-1 4 H-IP-1 VRF IP host table H-IP-1 Host VNI VTEP H-IP-1 3 Route IP VTEP-1 MAC Host VNI VTEP VTEP-1 3 Reflector VNI-1 IP MAC-1 H-IP-1 VNII-1 VTEP-1 VNI-1 H-MAC-1 H-IP-1 VNII-1 VTEP-1 2 VTEP-2 VTEP-3 BGP Update: H-MAC-1 H-IP-1 VTEP-1 VNI-1 1 VTEP-1 MAC Host VNI VTEP IP H-MAC-1 H-IP-1 VNII-1 VTEP-1 Local learning of host info: H-MAC-1 H-IP-1 H-MAC-1 (MAC table) VLAN-1 /VNI-1 H-IP-1 (VRF IP host table ) 20 VXLAN BGP Control Plane EVPN Control Plane --- Host Movement NLRI: Spine • Host H-MAC-1, H-IP-1 • NVE VTEP-1 • VNI 5000 Ext. Community: • Encapsulation: VXLAN VTEP-1 VTEP-2 VTEP-3 VTEP-4 Leaf • Cost • Sequence number :0 Host 1 H-MAC-1 H-IP-1 VLAN 10 VXLAN 5000 1. Host 1 attaches to VTEP-1 2. VTEP-1 detects Host1 and advertises H1 with seq #0 3. Other VTEPs learn about the host route of Host 1 MAC IP VNI Next-Hop Encap Seq# H-MAC-1 H-IP-1 5000 VTEP-1 VXLAN 0 21 VXLAN BGP Control Plane EVPN Control Plane --- Host Movement NLRI: Spine • Host H-MAC-1, H-IP-1 • NVE VTEP-3 • VNI 5000 Ext. Community: • Encapsulation: VXLAN VTEP-1 VTEP-2 VTEP-3 VTEP-4 Leaf • Cost • Sequence number: 1 Host 1 H-MAC-1 H-IP-1 VLAN 10 VXLAN 5000 1. Host 1 moves to VTEP-3 from VTEP-1 2. VTEP-3 detects Host 1, sends MP-BGP update for Host 1 with its own VTEP address and a new seq #1 3. Other VTEPs learn about the new route of Host 1 MAC IP VNI Next-Hop Encap Seq# H-MAC-1 H-IP-1 5000 VTEP-3 VXLAN 1 22 VXLAN Routing VXLAN EVPN has two slightly different integrated Route/Bridge (IRB) semantics Routing ? IP Transport Network SVI A SVI B VTEP-1 VTEP-2 VTEP-3 VTEP-4 Host 1 Host 2 H-MAC-1 H-MAC-2 H-IP-1 H-IP-2 VNI-A VNI-B Asymmetric Symmetric • Routing on the ingress VTEP and bridging • Routing on both the ingress and the egress on the egress VTEP VTEPs • Requires each VTEP to have all VNIs – • A VTEP only needs to have VNIs in which can result in forwarding table resource they have local hosts. Optimal utilization of wastage. forwarding table resources • Cisco follows Symmetric IRB 23 Symmetric Integrated Routing & Bridging (IRB) (1) • Routing on both ingress and egress VTEPs • Layer-3 VNI Layer-3 VNI (VRF VNI) • Tenant VPN indicator • One per tenant VRF • VTEP Router MAC Layer-2 VNI Layer-2 VNI (Network VNI) (Network VNI) • Ingress VTEP routes packets onto the Layer-3 VNI VTEP VTEP VTEP VTEP • Egress VTEP routes packets to the destination Layer-2 VNI 24 Symmetric Integrated Routing & Bridging (IRB) (2) Egress VTEP routes packets Ingress VTEP S-IP: VTEP-1 from L3 VNI to the routes packets D-IP: VTEP-4 destination VNI- VNI: L3 VNI from source VNI-A 1 2 B/VLAN.