Объединение распределенных сетей ЦОД. Использование DC GW

10 August 2026

Введение

Современная ИТ-инфраструктура переросла классическую модель одного машзала. Бизнес требует высокой доступности сервисов, низких задержек и надежности. Для решения этих задач строят дополнительные географически разнесенные ЦОДы. Ключевая задача — в объединении всех ЦОД в одну логическую структуру.

Цель

Цель данного руководства — показать вариант подключения географически разнесенных центров обработки данных.

Примечания и предупреждения

Подсказки содержат небольшие пояснения, помогающие быстрее освоить работу с оборудованием, или дополнительную информацию.

Примечания содержат важную информацию о настройке оборудования.

Предупреждения информируют пользователя о ситуациях, которые могут нанести вред, привести к некорректной работе системы или потере данных.

Глоссарий

DC GW — Data Center Gateway

ЦОД — Центр обработки данных

Предлагаемая схема сети

Приведенная ниже схема представляет собой вариант подключения между собой площадок ЦОД, где в каждом ЦОД применена классическая схема IP-фабрики, построенная с использованием архитектуры Spine-Leaf.

Устройства уровня DC GW выполняют роль пограничного маршрутизатора, где основная задача состоит в объединении нескольких дата-центров и предоставлении доступа во внешнюю сеть.

В качестве устройств DC GW будут использоваться маршрутизаторы ME. В приведенных примерах конфигурации и выводах диагностической информации используются маршрутизаторы ME5210S, но также может использоваться любой другой маршрутизатор из данной линейки в зависимости от поставленной задачи.

В схеме используются следующие протоколы и технологии:

Для обеспечения связности между устройствами в качестве IGP используется протокол ISIS.
Для построения L2VPN- и L3VPN-сервисов используется в качестве транспорта MPLS LDP.
Для распространения маршрутов, сервисных меток используется протокол BGP.
В настройках BGP используется address-family vpnv4 unicast.

Ниже дополнительно рассмотрен пример использования EVPN/VXLAN.

Пример конфигурации оборудования и проверка работоспособности

Упрощенная исходная схема:

Линковочные сети:

Spine_1-Leaf_1: 172.16.1.0/30

Spine_1-Leaf_2: 172.16.2.0/30

Spine_2-Leaf_1: 172.16.1.4/30

Spine_2-Leaf_2: 172.16.2.4/30

DC_GW_1_1-Spine_1_1: 172.16.1.8/30

DC_GW_1_1-Spine_1_2: 172.16.2.8/30

DC_GW_1_2-Spine_1_1: 172.16.1.12/30

DC_GW_1_2-Spine_1_2: 172.16.2.12/30

DC_GW_1_1-DC_GW_1_2: 172.16.3.0/30

DC_GW_1_1-DC_GW_2_1: 172.16.3.4/30

DC_GW_1_2-DC_GW_2_2: 172.16.3.8/30

DC_GW_2_1-DC_GW_2_2: 172.16.3.12/30

Конфигурирование протокола ISIS

Пример настройки ISIS на маршрутизаторе DC_GW_1_1:

router isis test
  interface loopback 0
    address-family ipv4 unicast
    exit
    passive
  exit
  interface tengigabitethernet 0/0/1
    address-family ipv4 unicast
      bfd fast-detect
    exit
    level level-1
    exit
    point-to-point
  exit
  interface tengigabitethernet 0/0/3
    address-family ipv4 unicast
      bfd fast-detect
    exit
    level level-1
    exit
    point-to-point
  exit
  host-name R5_23_5_DC_GW_1_1
  level level-1
  exit
  net 49.0001.0000.0000.0011.00
exit

Аналогично настраиваются остальные маршрутизаторы: DC_GW_1_2, DC_GW_2_1, DC_GW_2_2.

Конфигурирование BGP

Для обмена маршрутной информацией между маршрутизаторами DC_GW используется протокол BGP.

Для обмена L3VPN-маршрутами между автономными системами используется inter-AS Option B.

На схеме представлена конфигурация iBGP между маршрутизаторами DC_GW и стык с соседней AS по Opt. B:

Пример конфигурации iBGP между маршрутизаторами DC-GW и стыка с соседней AS по Opt. B:

DC_GW_1_1	DC_GW_1_2
router bgp 100 address-family vpnv4 unicast accept-nonexistent-rt-paths <=== Команда позволяет принимать VPN маршруты по протоколу BGP для несуществующих на устройстве экземпляров vrf. exit bgp router-id 10.0.10.1 neighbor 10.0.10.2 address-family vpnv4 unicast exit remote-as 100 send-community send-community-ext update-source 10.0.10.1 exit neighbor 172.16.3.6 address-family vpnv4 unicast route-map out out exit remote-as 200 send-community send-community-ext exit exit	router bgp 100 address-family vpnv4 unicast accept-nonexistent-rt-paths exit bgp router-id 10.0.10.2 neighbor 10.0.10.1 address-family vpnv4 unicast exit remote-as 100 send-community send-community-ext update-source 10.0.10.2 exit neighbor 172.16.3.14 address-family vpnv4 unicast route-map out out exit remote-as 200 send-community send-community-ext exit exit

DC_GW_1_1

DC_GW_1_2

router bgp 100
  address-family vpnv4 unicast
    accept-nonexistent-rt-paths <=== Команда позволяет принимать VPN маршруты по протоколу BGP
                                     для несуществующих на устройстве экземпляров vrf.
  exit
  bgp router-id 10.0.10.1
  neighbor 10.0.10.2
    address-family vpnv4 unicast
    exit
    remote-as 100
    send-community
    send-community-ext
    update-source 10.0.10.1
  exit
  neighbor 172.16.3.6
    address-family vpnv4 unicast
      route-map out out
    exit
    remote-as 200
    send-community
    send-community-ext
  exit
exit

router bgp 100
  address-family vpnv4 unicast
    accept-nonexistent-rt-paths
  exit
  bgp router-id 10.0.10.2
  neighbor 10.0.10.1
    address-family vpnv4 unicast
    exit
    remote-as 100
    send-community
    send-community-ext
    update-source 10.0.10.2
  exit
  neighbor 172.16.3.14
    address-family vpnv4 unicast
      route-map out out
    exit
    remote-as 200
    send-community
    send-community-ext
  exit
exit

Аналогично настраивается BGP на маршрутизаторах из AS 200 DC_GW_2_1 и DC_GW_2_2.

Проверка состояния BGP-сессий:

0/ME5210S:DC_GW_1_1# show  bgp vpnv4 unicast summary 
  BGP router identifier 10.0.10.1, local AS number 100
  Graceful Restart is disabled
  BGP table state: active
  Neighbor                   AS          MsgRcvd       MsgSent       Up/Down    St/PfxRcd     
  -------------------------- ----------- ------------- ------------- ---------- ------------- 
  10.0.10.2                  100         5             6             00h01m40s  0             
  172.16.3.6                 200         6             7             00h01m40s  0             

  Total entries: 2

Проверка сессии до соседа 172.16.3.6 :

0/ME5210S:DC_GW_1_1# show  bgp vpnv4 unicast neighbors 172.16.3.6 
Tue May 19 07:17:11 2026
  BGP router identifier 10.0.10.1, local AS number 100
    
    BGP neighbor is 172.16.3.6
    Description: 
     Remote AS 200, local AS 100, external link
     Remote router ID 10.0.20.1
      BGP STATE: established, LAST EVENT: recv-update
      Last read: 00h00m16s, Last update: 00h00m16s
      Hold time is 180 secs, keepalive interval is 60 secs
      Configured hold time is 180 secs, keepalive interval is 60 secs
      Last error seen is none
      Last error received is 0000 (Code: "None", subcode: "None"), never ago
      Last error sent is 0000 (Code: "None", subcode: "None"), never ago
      Peer uptime is 00h00m16s 
      Connections established: 1, retried: 1; Connect-retry timer: 120
      Local socket: 172.16.3.5:179, remote: 172.16.3.6:46330
      Session authentication: disabled
      ORF entry count is 0
      Graceful restart is aware-only
        Stale path timeout time is 200 secs
        Restart time is 00h00m00s secs
      'idle' hold time is 0 millisecs
      Route refresh messages: sent 0, received 0
      BFD status: not-required 
      BFD desired: false 
      Confederation member: false 
      Reflector client: non-client
      Peer group: not set
      Peer group description: 
      Enforcing first AS: enable
      Established trap is true 
      Backward trap is true 
      TCP open mode: active
      BGP neighbor may be up to 1 hops away
      Capabilities sent:  mp-ipv4-vpn route-refresh graceful-restart route-refresh-cisco four-octet-as enhanced-route-refresh 
      Capabilities received:  mp-ipv4-vpn route-refresh graceful-restart route-refresh-cisco four-octet-as mp-l2vpn-vpls enhanced-route-refresh 
      Capabilities negotiated:  mp-ipv4-vpn route-refresh graceful-restart route-refresh-cisco four-octet-as enhanced-route-refresh 
      Maximum prefixes allowed: 0; Restart interval: 90 secs; Notification threshold: 75%; Action: warn
      Prefixes 0 received, 0 in out rib, 0 advertised
      
      Open         msg: received 1, transmitted 2
      Notification msg: received 0, transmitted 0
      Update       msg: received 1, transmitted 1
      Keepalives   msg: received 1, transmitted 1
      Refresh      msg: received 0, transmitted 0
      Total        msg: received 3, transmitted 4
      
      
      Address Family: VPNv4 Unicast
        Status: enabled, state established
          Update group: 0
          Reflector client: non-client
          Count of local AS allowed in received route: 0
          Advertisement interval: 0 sec
          AS-origination interval: 30 sec
          Withdraw interval: 30 sec
          ORF capability: none
          Nexthop calculation: enabled
          Inbound soft-reconfiguration: disabled
          Route-map name: not applied for import, "out" for export
          In prefixes: 33, 0 RIB stored for peer, 0 accepted, 0 rejected, 0 active
            Denied: 0 policed, 0 martians, 0 looped AS, 0 bad nexthop, 0 AS length, 0 community, 0 locally originated
          Out prefixes: 37, 0 advertised, 4 denied
          In Adj-RIB-In: 0 local RIB, 0 bests paths
          Flapped: 0, 0 suppressed, 0 historical
          Withdrawn: 0 input, 0 output, 0 explicit input, 0 explicit output

Конфигурирование услуг L2VPN и L3VPN

Пример 1

В данном примере описывается создание L3VPN-сервисов.

Терминация сервисов будет на устройствах Spine. Следовательно, необходимо поднять BGP-сессию между DC_GW и Spine для каждого сервиса. Также между коммутаторами Spine необходимо поднять VRRP для резервирования шлюза. Коммутаторы Leaf будут использованы в качестве L2.

Конфигурация одного сервиса:

Создание сервиса vrf USER1.

DC_GW_1_1	DC_GW_1_2
vrf USER1 description L3VPN export route-target 200:1 import route-target 200:1 rd 10.0.10.1:100 exit	vrf USER1 description L3VPN export route-target 200:1 import route-target 200:1 rd 10.0.10.2:100 exit

DC_GW_1_1

DC_GW_1_2

vrf USER1
  description L3VPN
  export route-target 200:1
  import route-target 200:1
  rd 10.0.10.1:100
exit

vrf USER1
  description L3VPN
  export route-target 200:1
  import route-target 200:1
  rd 10.0.10.2:100
exit

Для наглядности на схеме отображено логическое подключение BGP и выделен L2-сегмент:

Конфигурация BGP на DC_GW_1_1 и DC_GW_1_2:

DC_GW_1_1	DC_GW_1_2
Привязка ранее созданных vrf к интерфейсам.
interface hundredgigabitethernet 0/0/1.100 encapsulation outer-vid 100 ipv4 address 172.16.2.1/30 vrf USER1 exit interface hundredgigabitethernet 0/0/2.150 encapsulation outer-vid 150 ipv4 address 172.16.2.5/30 vrf USER1 exit	interface hundredgigabitethernet 0/0/1.200 encapsulation outer-vid 200 ipv4 address 172.16.2.9/30 vrf USER1 exit interface hundredgigabitethernet 0/0/2.250 encapsulation outer-vid 250 ipv4 address 172.16.2.13/30 vrf USER1 exit
router bgp 100 address-family vpnv4 unicast accept-nonexistent-rt-paths exit bgp router-id 10.0.10.1 vrf USER1 neighbor 172.16.2.2 address-family ipv4 unicast next-hop-self exit remote-as 100 update-source 172.16.2.1 exit neighbor 172.16.2.6 address-family ipv4 unicast next-hop-self exit remote-as 100 update-source 172.16.2.5 exit exit exit	router bgp 100 address-family vpnv4 unicast accept-nonexistent-rt-paths exit bgp router-id 10.0.10.2 vrf USER1 neighbor 172.16.2.10 address-family ipv4 unicast next-hop-self exit remote-as 100 update-source 172.16.2.9 exit neighbor 172.16.2.14 address-family ipv4 unicast next-hop-self exit remote-as 100 update-source 172.16.2.13 exit exit exit

DC_GW_1_1

DC_GW_1_2

Привязка ранее созданных vrf к интерфейсам.

interface hundredgigabitethernet 0/0/1.100
  encapsulation outer-vid 100
  ipv4 address 172.16.2.1/30
  vrf USER1
exit

interface hundredgigabitethernet 0/0/2.150
  encapsulation outer-vid 150
  ipv4 address 172.16.2.5/30
  vrf USER1
exit

interface hundredgigabitethernet 0/0/1.200
  encapsulation outer-vid 200
  ipv4 address 172.16.2.9/30
  vrf USER1
exit

interface hundredgigabitethernet 0/0/2.250
  encapsulation outer-vid 250
  ipv4 address 172.16.2.13/30
  vrf USER1
exit

router bgp 100
  address-family vpnv4 unicast
    accept-nonexistent-rt-paths
  exit
  bgp router-id 10.0.10.1
  vrf USER1
    neighbor 172.16.2.2
      address-family ipv4 unicast
        next-hop-self
      exit
      remote-as 100
      update-source 172.16.2.1
    exit
    neighbor 172.16.2.6
      address-family ipv4 unicast
        next-hop-self
      exit
      remote-as 100
      update-source 172.16.2.5
    exit
  exit
exit

router bgp 100
  address-family vpnv4 unicast
    accept-nonexistent-rt-paths
  exit
  bgp router-id 10.0.10.2
  vrf USER1
    neighbor 172.16.2.10
      address-family ipv4 unicast
        next-hop-self
      exit
      remote-as 100
      update-source 172.16.2.9
    exit
    neighbor 172.16.2.14
      address-family ipv4 unicast
        next-hop-self
      exit
      remote-as 100
      update-source 172.16.2.13
    exit
  exit
exit

Конфигурация BGP со стороны Spine_1_1 и Spine_1_2:

SPINE_1_1	SPINE_1_2
ip vrf USER1 exit interface vlan 100 ip vrf USER1 ip address 172.16.2.2 255.255.255.252 exit interface vlan 200 ip vrf USER1 ip address 172.16.2.10 255.255.255.252 exit router bgp 100 bgp router-id 10.0.1.1 address-family ipv4 unicast exit ! vrf USER1 address-family ipv4 unicast exit ! neighbor 172.16.2.1 remote-as 100 update-source vlan 100 address-family ipv4 unicast exit exit ! neighbor 172.16.2.9 remote-as 100 update-source vlan 200 address-family ipv4 unicast exit exit exit exit	ip vrf USER1 exit interface vlan 150 ip vrf USER1 ip address 172.16.2.6 255.255.255.252 exit interface vlan 250 ip vrf USER1 ip address 172.16.2.14 255.255.255.252 exit router bgp 100 bgp router-id 10.0.1.2 address-family ipv4 unicast exit ! vrf USER1 address-family ipv4 unicast exit ! neighbor 172.16.2.5 remote-as 100 update-source vlan 150 address-family ipv4 unicast exit exit ! neighbor 172.16.2.13 remote-as 100 update-source vlan 250 address-family ipv4 unicast exit exit exit exit

SPINE_1_1

SPINE_1_2

ip vrf USER1
exit

interface vlan 100
 ip vrf USER1
 ip address 172.16.2.2 255.255.255.252
exit

interface vlan 200
 ip vrf USER1
 ip address 172.16.2.10 255.255.255.252
exit

router bgp 100
 bgp router-id 10.0.1.1
 address-family ipv4 unicast
 exit
 !
 vrf USER1
  address-family ipv4 unicast
  exit
  !
  neighbor 172.16.2.1
   remote-as 100
   update-source vlan 100                             
   address-family ipv4 unicast
   exit
  exit
  !
  neighbor 172.16.2.9
   remote-as 100
   update-source vlan 200
   address-family ipv4 unicast
   exit
  exit
 exit
exit

ip vrf USER1
exit

interface vlan 150
 ip vrf USER1
 ip address 172.16.2.6 255.255.255.252
exit

interface vlan 250                                    
 ip vrf USER1
 ip address 172.16.2.14 255.255.255.252
exit

router bgp 100
 bgp router-id 10.0.1.2
 address-family ipv4 unicast                          
 exit
 !
 vrf USER1
  address-family ipv4 unicast
  exit
  !
  neighbor 172.16.2.5
   remote-as 100
   update-source vlan 150
   address-family ipv4 unicast
   exit
  exit
  !
  neighbor 172.16.2.13
   remote-as 100
   update-source vlan 250
   address-family ipv4 unicast
   exit
  exit
 exit
exit

Проверка успешности поднятия BGP-сессии:

0/ME5210S:DC_GW_1_1# show  bgp vrf USER1 summary 
  BGP router identifier 10.0.10.1, vrf USER1, local AS number 100
  Graceful Restart is disabled
  BGP table state: active
  Tx packets DSCP/PCP/MPLS-EXP fields: 48/7/6
  Neighbor                   AS          MsgRcvd       MsgSent       Up/Down    St/PfxRcd     
  -------------------------- ----------- ------------- ------------- ---------- ------------- 
  172.16.2.2                 100         2             4             00h00m22s  0             
  172.16.2.6                 100         2             4             00h00m22s  0             

  Total entries: 2

Конфигурация коммутаторов Leaf_1_1 и Leaf_1_2 не приведена. Данные устройства настроены в режиме L2.

Далее необходимо затерминировать сервис на коммутаторах Spine. Для обеспечения резервирования также необходимо настроить VRRP:

SPINE_1_1	SPINE_1_2
interface vlan 101 ip vrf USER1 ip address 192.168.1.2 255.255.255.0 vrrp 1 ip 192.168.1.1 no vrrp 1 shutdown no vrrp 1 preempt vrrp 1 priority 101 exit	interface vlan 101 ip vrf USER1 ip address 192.168.1.3 255.255.255.0 vrrp 1 ip 192.168.1.1 no vrrp 1 shutdown no vrrp 1 preempt vrrp 1 priority 99 exit

SPINE_1_1

SPINE_1_2

interface vlan 101
 ip vrf USER1
 ip address 192.168.1.2 255.255.255.0
 vrrp 1 ip 192.168.1.1
 no vrrp 1 shutdown
 no vrrp 1 preempt
 vrrp 1 priority 101                                  
exit

interface vlan 101
 ip vrf USER1
 ip address 192.168.1.3 255.255.255.0
 vrrp 1 ip 192.168.1.1
 no vrrp 1 shutdown
 no vrrp 1 preempt
 vrrp 1 priority 99
exit

Проверка состояния VRRP:

SPINE_1_1	SPINE_1_2
SPINE_1_1#show vrrp Interface: vlan 101 Virtual Router 1 Virtual Router name Supported version VRRPv2 Checksum calculation mode with pseudo-header State is Master Accept control is DROP Virtual IP adresses are 192.168.1.1 Source IP address is 192.168.1.2(default) Virtual MAC address is 00:00:5e:00:01:01 Advertisement interval is 1.000 sec Preemption disabled Priority is 101 Tracking is disabled Master Router is 192.168.1.2(local), priority is 101 Master Advertisement interval is 1.000 sec Master Down Interval is 3.600 sec Skew Time is 0.605 sec Active-Active disabled	SPINE_1_2#show vrrp Interface: vlan 101 Virtual Router 1 Virtual Router name Supported version VRRPv2 Checksum calculation mode with pseudo-header State is Backup Accept control is DROP Virtual IP adresses are 192.168.1.1 Source IP address is 192.168.1.3(default) Virtual MAC address is 00:00:5e:00:01:01 Advertisement interval is 1.000 sec Preemption disabled Priority is 99 Tracking is disabled Master Router is 192.168.1.2, priority is 101 Master Advertisement interval is 1.000 sec Master Down Interval is 3.610 sec Skew Time is 0.613 sec Active-Active disabled

SPINE_1_1

SPINE_1_2

SPINE_1_1#show vrrp 

Interface: vlan 101
Virtual Router 1
Virtual Router name 
Supported version VRRPv2
Checksum calculation mode with pseudo-header
State is Master
Accept control is DROP
Virtual IP adresses are 192.168.1.1
Source IP address is 192.168.1.2(default)
Virtual MAC address is 00:00:5e:00:01:01
Advertisement interval is 1.000 sec
Preemption disabled
Priority is 101
Tracking is disabled
Master Router is 192.168.1.2(local), priority is 101 
Master Advertisement interval is 1.000 sec
Master Down Interval is 3.600 sec
Skew Time is 0.605 sec
Active-Active disabled

SPINE_1_2#show vrrp 

Interface: vlan 101
Virtual Router 1
Virtual Router name 
Supported version VRRPv2
Checksum calculation mode with pseudo-header
State is Backup
Accept control is DROP
Virtual IP adresses are 192.168.1.1
Source IP address is 192.168.1.3(default)
Virtual MAC address is 00:00:5e:00:01:01
Advertisement interval is 1.000 sec
Preemption disabled
Priority is 99
Tracking is disabled
Master Router is 192.168.1.2, priority is 101 
Master Advertisement interval is 1.000 sec
Master Down Interval is 3.610 sec
Skew Time is 0.613 sec
Active-Active disabled

Далее необходимо выполнить редистрибуцию данной сети в BGP, а также настроить route-map для фильтрации маршрутов:

SPINE_1_1	SPINE_1_2
route-map map 1 permit match ip address prefix-list loc exit ip prefix-list loc seq 5 permit 192.168.1.0/24 router bgp 100 vrf USER1 address-family ipv4 unicast redistribute connected route-map map exit exit exit	route-map map 1 permit match ip address prefix-list loc exit ip prefix-list loc seq 5 permit 192.168.1.0/24 router bgp 100 vrf USER1 address-family ipv4 unicast redistribute connected route-map map exit exit exit

SPINE_1_1

SPINE_1_2

route-map map 1 permit
 match ip address prefix-list loc
exit

ip prefix-list loc seq 5 permit 192.168.1.0/24

router bgp 100
 vrf USER1
  address-family ipv4 unicast
   redistribute connected route-map map
  exit
 exit
exit

route-map map 1 permit
 match ip address prefix-list loc
exit

ip prefix-list loc seq 5 permit 192.168.1.0/24

router bgp 100
  vrf USER1
  address-family ipv4 unicast
   redistribute connected route-map map
  exit
 exit
exit

Проверка маршрутов на маршрутизаторе DC_GW_1_1:

0/ME5210S:DC_GW_1_1# show  bgp vrf USER1  
Tue May 26 09:32:46 2026
  BGP router identifier 10.0.10.1, vrf USER1, local AS number 100
  Graceful Restart is disabled
  BGP table state: active
  Tx packets DSCP/PCP/MPLS-EXP fields: 48/7/6
  
  Status codes: d damped, h history, > best, b backup, S stale, * active, u untracked, i internal
  Origin codes: i igp, e egp, n none
  
  Network                  Next hop         Metric  LocPrf  Weight  Path 
  ------------------------ ---------------- ------- ------- ------- ----- 
  >    172.16.2.8/30       10.0.10.2        0       100     32768   ? 
  >    172.16.2.12/30      10.0.10.2        0       100     32768   ? 
  >    192.168.0.0/24      172.16.3.6       0       100     32768   200 ? 
  *>i  192.168.1.0/24      172.16.2.6       0       100     0       ? 
  * i  192.168.1.0/24      172.16.2.2       0       100     0       ? 

  Total entries: 5

Проверка маршрутов, получаемых из соседней AS:

0/ME5210S:DC_GW_1_1# show  bgp vpnv4 unicast 
Tue May 26 09:37:50 2026
  BGP router identifier 10.0.10.1, local AS number 100 
  Graceful Restart is disabled
  BGP table state: active
  
  Status codes: d damped, h history, > best, b backup, S stale, * active, u untracked, i internal
  Origin codes: i igp, e egp, ? incomplete
  
  Route Distinguisher        IP Prefix             Next hop         Metric  Rcvd/Lcl label  LocPrf  Weight  Path 
  -------------------------- --------------------- ---------------- ------- --------------- ------- ------- ----- 
  u>   10.0.10.1:100         172.16.2.0/30                          0       -/35            100     32768   ? 
  u>   10.0.10.1:100         172.16.2.4/30                          0       -/35            100     32768   ? 
  u>   10.0.10.1:100         192.168.1.0/24                         0       -/35            100     32768   ? 
  u>i  10.0.10.2:100         172.16.2.8/30         10.0.10.2        0       24/41           100     0       ? 
  u>i  10.0.10.2:100         172.16.2.12/30        10.0.10.2        0       24/41           100     0       ? 
  u>i  10.0.10.2:100         192.168.1.0/24        10.0.10.2        0       24/41           100     0       ? 
  u>   10.0.20.1:200         192.168.0.0/24        172.16.3.6       0       24/42           100     0       200 ? 
  u i  10.0.20.1:200         192.168.0.0/24        172.16.3.14      0       89/-            100     0       200 ? 
  u>   10.0.20.2:200         192.168.0.0/24        172.16.3.6       0       25/43           100     0       200 ? 
  u i  10.0.20.2:200         192.168.0.0/24        172.16.3.14      0       90/-            100     0       200 ? 

  Total entries: 10

На коммутаторах Spine:

SPINE_1_1	SPINE_2_1
SPINE_1_1#show ip route vrf USER1 Maximum Parallel Paths: 1 (1 after reset) Load balancing: src-dst-mac-ip IP Forwarding: enabled Codes: > - best, C - connected, S - static, R - RIP, O - OSPF intra-area, OIA - OSPF inter-area, OE1 - OSPF external 1, OE2 - OSPF external 2, B - BGP, i - IS-IS, L1 - IS-IS level-1, P - PBR L2 - IS-IS level-2, ia - IS-IS inter area [d/m]: d - route's distance, m - route's metric C 172.16.2.0/30 is directly connected, vlan 100 B 172.16.2.4/30 [200/0] via 172.16.2.9, 01:43:59, vlan 200 C 172.16.2.8/30 is directly connected, vlan 200 B 172.16.2.12/30 [200/0] via 172.16.2.1, 01:44:00, vlan 100 B 192.168.0.0/24 [200/0] via 172.16.2.1, 00:25:13, vlan 100 C 192.168.1.0/24 is directly connected, vlan 101	SPINE_2_1#show ip route vrf USER1 Maximum Parallel Paths: 1 (1 after reset) Load balancing: src-dst-mac-ip IP Forwarding: enabled Codes: > - best, C - connected, S - static, R - RIP, O - OSPF intra-area, OIA - OSPF inter-area, OE1 - OSPF external 1, OE2 - OSPF external 2, B - BGP, i - IS-IS, L1 - IS-IS level-1, P - PBR L2 - IS-IS level-2, ia - IS-IS inter area [d/m]: d - route's distance, m - route's metric C 172.16.2.16/30 is directly connected, vlan 100 B 172.16.2.20/30 [200/0] via 172.16.2.25, 00:23:37, vlan 200 C 172.16.2.24/30 is directly connected, vlan 200 B 172.16.2.28/30 [200/0] via 172.16.2.17, 00:49:43, vlan 100 C 192.168.0.0/24 is directly connected, vlan 101 B 192.168.1.0/24 [200/0] via 172.16.2.17, 00:49:43, vlan 100

SPINE_1_1

SPINE_2_1

SPINE_1_1#show ip route vrf USER1
Maximum Parallel Paths: 1 (1 after reset)
Load balancing: src-dst-mac-ip
IP Forwarding: enabled
Codes: > - best, C - connected, S - static,
       R - RIP,
       O - OSPF intra-area, OIA - OSPF inter-area,
       OE1 - OSPF external 1, OE2 - OSPF external 2,
       B - BGP, i - IS-IS, L1 - IS-IS level-1,
       P - PBR
       L2 - IS-IS level-2, ia - IS-IS inter area
[d/m]: d - route's distance, m - route's metric

C    172.16.2.0/30 is directly connected, vlan 100                         
B    172.16.2.4/30 [200/0] via 172.16.2.9, 01:43:59, vlan 200              
C    172.16.2.8/30 is directly connected, vlan 200                         
B    172.16.2.12/30 [200/0] via 172.16.2.1, 01:44:00, vlan 100             
B    192.168.0.0/24 [200/0] via 172.16.2.1, 00:25:13, vlan 100             
C    192.168.1.0/24 is directly connected, vlan 101

SPINE_2_1#show ip route vrf USER1
Maximum Parallel Paths: 1 (1 after reset)
Load balancing: src-dst-mac-ip
IP Forwarding: enabled
Codes: > - best, C - connected, S - static,
       R - RIP,
       O - OSPF intra-area, OIA - OSPF inter-area,
       OE1 - OSPF external 1, OE2 - OSPF external 2,
       B - BGP, i - IS-IS, L1 - IS-IS level-1,
       P - PBR
       L2 - IS-IS level-2, ia - IS-IS inter area
[d/m]: d - route's distance, m - route's metric

C    172.16.2.16/30 is directly connected, vlan 100                        
B    172.16.2.20/30 [200/0] via 172.16.2.25, 00:23:37, vlan 200            
C    172.16.2.24/30 is directly connected, vlan 200                        
B    172.16.2.28/30 [200/0] via 172.16.2.17, 00:49:43, vlan 100            
C    192.168.0.0/24 is directly connected, vlan 101                        
B    192.168.1.0/24 [200/0] via 172.16.2.17, 00:49:43, vlan 100

Проверка доступности сервисов с коммутатора Leaf_1_1.

LEAF_1_1#ping 192.168.0.5 source 192.168.1.5
Pinging 192.168.0.5 with 18 bytes of data:

18 bytes from 192.168.0.5: icmp_seq=1. time=0 ms
18 bytes from 192.168.0.5: icmp_seq=2. time=0 ms
18 bytes from 192.168.0.5: icmp_seq=3. time=0 ms
18 bytes from 192.168.0.5: icmp_seq=4. time=0 ms

----192.168.0.5 PING Statistics----
4 packets transmitted, 4 packets received, 0% packet loss
round-trip (ms) min/avg/max = 0/0/0


LEAF_1_1#

Пример 2

В данном примере описывается создание L3VPN-сервисов.

Терминация сервисов будет на коммутаторах Leaf. Для обеспечения связности между устройствами Leaf, Spine, DC_GW используется протокол BGP. Схема логического взаимодействия приведена ниже.

Настройка BGP на коммутаторах Spine:

SPINE_1_1	SPINE_1_2
router bgp 100 bgp router-id 10.0.1.1 address-family ipv4 unicast exit ! address-family l2vpn evpn exit ! peer-group LEAF remote-as 100 update-source loopback 1 fall-over bfd route-reflector-client exit ! neighbor 10.0.0.1 peer-group LEAF address-family ipv4 unicast exit ! address-family l2vpn evpn exit exit ! neighbor 10.0.0.2 peer-group LEAF address-family ipv4 unicast exit ! address-family l2vpn evpn exit exit ! neighbor 10.2.1.1 remote-as 200 update-source loopback 1 ebgp-multihop address-family ipv4 unicast exit ! address-family l2vpn evpn next-hop-unchanged exit exit ! neighbor 10.2.1.2 remote-as 200 update-source loopback 1 ebgp-multihop address-family ipv4 unicast exit ! address-family l2vpn evpn next-hop-unchanged exit exit ! vrf USER1 address-family ipv4 unicast redistribute connected exit ! neighbor 110.0.1.1 remote-as 100 update-source vlan 110 soft-reconfiguration inbound address-family ipv4 unicast exit exit ! neighbor 110.0.2.2 remote-as 100 update-source vlan 111 route-reflector-client soft-reconfiguration inbound address-family ipv4 unicast exit exit ! neighbor 110.0.3.2 remote-as 100 update-source vlan 112 route-reflector-client soft-reconfiguration inbound address-family ipv4 unicast exit exit ! neighbor 110.0.4.1 remote-as 100 update-source vlan 210 soft-reconfiguration inbound address-family ipv4 unicast exit exit exit exit	router bgp 100 bgp router-id 10.0.1.2 address-family ipv4 unicast exit ! address-family l2vpn evpn exit ! peer-group LEAF remote-as 100 update-source loopback 1 fall-over bfd route-reflector-client exit ! neighbor 10.0.0.1 peer-group LEAF address-family ipv4 unicast exit ! address-family l2vpn evpn exit exit ! neighbor 10.0.0.2 peer-group LEAF address-family ipv4 unicast exit ! address-family l2vpn evpn exit exit ! neighbor 10.2.1.1 remote-as 200 update-source loopback 1 ebgp-multihop address-family ipv4 unicast exit ! address-family l2vpn evpn next-hop-unchanged exit exit ! neighbor 10.2.1.2 remote-as 200 update-source loopback 1 ebgp-multihop address-family ipv4 unicast exit ! address-family l2vpn evpn next-hop-unchanged exit exit ! vrf USER1 address-family ipv4 unicast redistribute connected exit ! neighbor 160.0.0.1 remote-as 100 update-source vlan 160 soft-reconfiguration inbound address-family ipv4 unicast exit exit ! neighbor 160.0.1.2 remote-as 100 update-source vlan 161 route-reflector-client soft-reconfiguration inbound address-family ipv4 unicast exit exit ! neighbor 160.0.2.2 remote-as 100 update-source vlan 162 route-reflector-client soft-reconfiguration inbound address-family ipv4 unicast exit exit ! neighbor 160.0.3.1 remote-as 100 update-source vlan 260 soft-reconfiguration inbound address-family ipv4 unicast exit exit exit exit

SPINE_1_1

SPINE_1_2

router bgp 100
 bgp router-id 10.0.1.1
 address-family ipv4 unicast
 exit
 !
 address-family l2vpn evpn
 exit
 !
 peer-group LEAF
  remote-as 100
  update-source loopback 1
  fall-over bfd
  route-reflector-client
 exit
 !
 neighbor 10.0.0.1                                    
  peer-group LEAF
  address-family ipv4 unicast
  exit
  !
  address-family l2vpn evpn
  exit
 exit
 !
 neighbor 10.0.0.2
  peer-group LEAF
  address-family ipv4 unicast
  exit
  !
  address-family l2vpn evpn
  exit
 exit
 !
 neighbor 10.2.1.1
  remote-as 200
  update-source loopback 1
  ebgp-multihop
  address-family ipv4 unicast                         
  exit
  !
  address-family l2vpn evpn
   next-hop-unchanged
  exit
 exit
 !
 neighbor 10.2.1.2
  remote-as 200
  update-source loopback 1
  ebgp-multihop
  address-family ipv4 unicast
  exit
  !
  address-family l2vpn evpn
   next-hop-unchanged
  exit
 exit
 !
 vrf USER1
  address-family ipv4 unicast
   redistribute connected                             
  exit
  !
  neighbor 110.0.1.1
   remote-as 100
   update-source vlan 110
   soft-reconfiguration inbound
   address-family ipv4 unicast
   exit
  exit
  !
  neighbor 110.0.2.2
   remote-as 100
   update-source vlan 111
   route-reflector-client
   soft-reconfiguration inbound
   address-family ipv4 unicast
   exit
  exit
  !
  neighbor 110.0.3.2
   remote-as 100
   update-source vlan 112                             
   route-reflector-client
   soft-reconfiguration inbound
   address-family ipv4 unicast
   exit
  exit
  !
  neighbor 110.0.4.1
   remote-as 100
   update-source vlan 210
   soft-reconfiguration inbound
   address-family ipv4 unicast
   exit
  exit
 exit
exit

router bgp 100
 bgp router-id 10.0.1.2                               
 address-family ipv4 unicast
 exit
 !
 address-family l2vpn evpn
 exit
 !
 peer-group LEAF
  remote-as 100
  update-source loopback 1
  fall-over bfd
  route-reflector-client
 exit
 !
 neighbor 10.0.0.1
  peer-group LEAF
  address-family ipv4 unicast
  exit
  !
  address-family l2vpn evpn
  exit
 exit
 !                                                    
 neighbor 10.0.0.2
  peer-group LEAF
  address-family ipv4 unicast
  exit
  !
  address-family l2vpn evpn
  exit
 exit
 !
 neighbor 10.2.1.1
  remote-as 200
  update-source loopback 1
  ebgp-multihop
  address-family ipv4 unicast
  exit
  !
  address-family l2vpn evpn
   next-hop-unchanged
  exit
 exit
 !
 neighbor 10.2.1.2                                    
  remote-as 200
  update-source loopback 1
  ebgp-multihop
  address-family ipv4 unicast
  exit
  !
  address-family l2vpn evpn
   next-hop-unchanged
  exit
 exit
 !
 vrf USER1
  address-family ipv4 unicast
   redistribute connected
  exit
  !
  neighbor 160.0.0.1
   remote-as 100
   update-source vlan 160
   soft-reconfiguration inbound
   address-family ipv4 unicast
   exit                                               
  exit
  !
  neighbor 160.0.1.2
   remote-as 100
   update-source vlan 161
   route-reflector-client
   soft-reconfiguration inbound
   address-family ipv4 unicast
   exit
  exit
  !
  neighbor 160.0.2.2
   remote-as 100
   update-source vlan 162
   route-reflector-client
   soft-reconfiguration inbound
   address-family ipv4 unicast
   exit
  exit
  !
  neighbor 160.0.3.1
   remote-as 100                                      
   update-source vlan 260
   soft-reconfiguration inbound
   address-family ipv4 unicast
   exit
  exit
 exit
exit

Настройка BGP на коммутаторах Leaf:

LEAF_1_1	LEAF_1_2
router bgp 100 bgp router-id 10.0.0.1 address-family ipv4 unicast redistribute connected exit ! address-family l2vpn evpn exit ! peer-group SPINE remote-as 100 update-source loopback 1 fall-over bfd exit ! neighbor 10.0.1.1 peer-group SPINE address-family ipv4 unicast exit ! address-family l2vpn evpn exit exit ! neighbor 10.0.1.2 peer-group SPINE address-family ipv4 unicast exit ! address-family l2vpn evpn exit exit ! vrf user1 address-family ipv4 unicast redistribute connected exit exit ! vrf USER1 address-family ipv4 unicast redistribute connected exit ! neighbor 110.0.3.1 remote-as 100 update-source vlan 112 soft-reconfiguration inbound address-family ipv4 unicast exit exit ! neighbor 160.0.1.1 remote-as 100 update-source vlan 161 soft-reconfiguration inbound address-family ipv4 unicast exit exit exit exit	router bgp 100 bgp router-id 10.0.0.2 address-family ipv4 unicast redistribute connected exit ! address-family l2vpn evpn exit ! peer-group SPINE remote-as 100 update-source loopback 1 fall-over bfd exit ! neighbor 10.0.1.1 peer-group SPINE address-family ipv4 unicast exit ! address-family l2vpn evpn exit exit ! neighbor 10.0.1.2 peer-group SPINE address-family ipv4 unicast exit ! address-family l2vpn evpn exit exit ! vrf user1 address-family ipv4 unicast redistribute connected exit exit ! vrf USER1 address-family ipv4 unicast redistribute connected exit ! neighbor 110.0.2.1 remote-as 100 update-source vlan 111 soft-reconfiguration inbound address-family ipv4 unicast exit exit ! neighbor 160.0.2.1 remote-as 100 update-source vlan 162 soft-reconfiguration inbound address-family ipv4 unicast exit exit exit exit

LEAF_1_1

LEAF_1_2

router bgp 100
 bgp router-id 10.0.0.1
 address-family ipv4 unicast
  redistribute connected
 exit
 !
 address-family l2vpn evpn                            
 exit
 !
 peer-group SPINE
  remote-as 100
  update-source loopback 1
  fall-over bfd
 exit
 !
 neighbor 10.0.1.1
  peer-group SPINE
  address-family ipv4 unicast
  exit
  !
  address-family l2vpn evpn
  exit
 exit
 !
 neighbor 10.0.1.2
  peer-group SPINE
  address-family ipv4 unicast
  exit
  !                                                   
  address-family l2vpn evpn
  exit
 exit
 !
 vrf user1
  address-family ipv4 unicast
   redistribute connected
  exit
 exit
 !
 vrf USER1
  address-family ipv4 unicast
   redistribute connected
  exit
  !
  neighbor 110.0.3.1
   remote-as 100
   update-source vlan 112
   soft-reconfiguration inbound
   address-family ipv4 unicast
   exit
  exit                                                
  !
  neighbor 160.0.1.1
   remote-as 100
   update-source vlan 161
   soft-reconfiguration inbound
   address-family ipv4 unicast
   exit
  exit
 exit
exit

router bgp 100
 bgp router-id 10.0.0.2
 address-family ipv4 unicast
  redistribute connected
 exit
 !
 address-family l2vpn evpn
 exit
 !
 peer-group SPINE
  remote-as 100
  update-source loopback 1
  fall-over bfd
 exit
 !
 neighbor 10.0.1.1
  peer-group SPINE
  address-family ipv4 unicast
  exit                                                
  !
  address-family l2vpn evpn
  exit
 exit
 !
 neighbor 10.0.1.2
  peer-group SPINE
  address-family ipv4 unicast
  exit
  !
  address-family l2vpn evpn
  exit
 exit
 !
 vrf user1
  address-family ipv4 unicast
   redistribute connected
  exit
 exit
 !
 vrf USER1
  address-family ipv4 unicast                         
   redistribute connected
  exit
  !
  neighbor 110.0.2.1
   remote-as 100
   update-source vlan 111
   soft-reconfiguration inbound
   address-family ipv4 unicast
   exit
  exit
  !
  neighbor 160.0.2.1
   remote-as 100
   update-source vlan 162
   soft-reconfiguration inbound
   address-family ipv4 unicast
   exit
  exit
 exit
exit

Пример конфигурации на маршрутизаторах DC_GW:

DC_GW_1_1	DC_GW_1_2
vrf USER1 description L3VPN export route-target 200:1 import route-target 200:1 rd 10.0.10.1:1 exit interface hundredgigabitethernet 0/0/1.110 encapsulation outer-vid 110 ipv4 address 110.0.1.1/30 vrf USER1 exit interface hundredgigabitethernet 0/0/2.160 encapsulation outer-vid 160 ipv4 address 160.0.0.1/30 vrf USER1 exit router bgp 100 vrf USER1 neighbor 110.0.1.2 address-family ipv4 unicast next-hop-self exit remote-as 100 update-source 110.0.1.1 exit neighbor 160.0.0.2 address-family ipv4 unicast next-hop-self exit remote-as 100 update-source 160.0.0.1 exit exit exit	vrf USER1 description L3VPN export route-target 200:1 import route-target 200:1 rd 10.0.10.2:100 exit interface hundredgigabitethernet 0/0/1.210 encapsulation outer-vid 210 ipv4 address 110.0.4.1/30 vrf USER1 exit interface hundredgigabitethernet 0/0/2.260 encapsulation outer-vid 260 ipv4 address 160.0.3.1/30 vrf USER1 exit router bgp 100 vrf USER1 neighbor 110.0.4.2 address-family ipv4 unicast next-hop-self exit remote-as 100 update-source 110.0.4.1 exit neighbor 160.0.3.2 address-family ipv4 unicast next-hop-self exit remote-as 100 update-source 160.0.3.1 exit exit exit

DC_GW_1_1

DC_GW_1_2

vrf USER1
  description L3VPN
  export route-target 200:1
  import route-target 200:1
  rd 10.0.10.1:1
exit
interface hundredgigabitethernet 0/0/1.110
  encapsulation outer-vid 110
  ipv4 address 110.0.1.1/30
  vrf USER1
exit
interface hundredgigabitethernet 0/0/2.160
  encapsulation outer-vid 160
  ipv4 address 160.0.0.1/30
  vrf USER1
exit
router bgp 100
  vrf USER1
    neighbor 110.0.1.2
      address-family ipv4 unicast
        next-hop-self
      exit
      remote-as 100
      update-source 110.0.1.1
    exit
    neighbor 160.0.0.2
      address-family ipv4 unicast
        next-hop-self
      exit
      remote-as 100
      update-source 160.0.0.1
    exit
  exit
exit

vrf USER1
  description L3VPN
  export route-target 200:1
  import route-target 200:1
  rd 10.0.10.2:100
exit
interface hundredgigabitethernet 0/0/1.210
  encapsulation outer-vid 210
  ipv4 address 110.0.4.1/30
  vrf USER1
exit
interface hundredgigabitethernet 0/0/2.260
  encapsulation outer-vid 260
  ipv4 address 160.0.3.1/30
  vrf USER1
exit
router bgp 100
  vrf USER1
    neighbor 110.0.4.2
      address-family ipv4 unicast
        next-hop-self
      exit
      remote-as 100
      update-source 110.0.4.1
    exit
    neighbor 160.0.3.2
      address-family ipv4 unicast
        next-hop-self
      exit
      remote-as 100
      update-source 160.0.3.1
    exit
  exit
exit

Проверка успешности поднятия BGP-сессии:

SPINE_1_1#show ip bgp neighbors vrf USER1
 
Address Family: IPv4 Unicast, VRF: USER1
----------------------------------------

  BGP neighbor      Remote AS       Router ID        Type          State          Uptime       Hold Time   Keepalive  
---------------- --------------- ---------------- ----------- --------------- --------------- ----------- ----------- 
   110.0.1.1           100          10.0.10.1       Static      ESTABLISHED     00,00:05:43       90          30      
   110.0.2.2           100          160.0.2.2       Static      ESTABLISHED     00,00:00:57       90          30      
   110.0.3.2           100          110.0.3.2       Static      ESTABLISHED     00,00:05:43       90          30      
   110.0.4.1           100          10.0.10.2       Static      ESTABLISHED     00,00:05:44       90          30

На маршрутизаторе DC_GW:

0/ME5210S:DC_GW_1_1# show  bgp vrf USER1 summary 
Thu Jun 18 09:52:26 2026
  BGP router identifier 10.0.10.1, vrf USER1, local AS number 100
  Graceful Restart is disabled
  BGP table state: active
  Tx packets DSCP/PCP/MPLS-EXP fields: 48/7/6
  Neighbor                   AS          MsgRcvd       MsgSent       Up/Down    St/PfxRcd     
  -------------------------- ----------- ------------- ------------- ---------- ------------- 
  110.0.1.2                  100         913           1012          00h17m14s  6             
  160.0.0.2                  100         671           739           05h16m09s  7             

  Total entries: 2

Проверка маршрутов на Leaf_1_1:

LEAF_1_1#show ip route vrf USER1
Maximum Parallel Paths: 32 (32 after reset)
Load balancing: src-dst-mac-ip
Load balancing hash Salt value: 0
Load balancing hash Seed value: 0
IP Forwarding: enabled
Codes: > - best, C - connected, S - static,
       R - RIP,
       O - OSPF intra-area, OIA - OSPF inter-area,
       OE1 - OSPF external 1, OE2 - OSPF external 2,
       B - BGP, i - IS-IS, L1 - IS-IS level-1,
       P - PBR
       L2 - IS-IS level-2, ia - IS-IS inter area
[d/m]: d - route's distance, m - route's metric

B    110.0.1.0/30 [200/0] via 110.0.3.1, 00:44:55, vlan 112                
B    110.0.1.0/30 [200/0] via 160.0.1.1, 00:44:55, vlan 161                
B    110.0.2.0/30 [200/0] via 110.0.3.1, 00:40:27, vlan 112                
B    110.0.2.0/30 [200/0] via 160.0.1.1, 00:40:27, vlan 161                
C    110.0.3.0/30 is directly connected, vlan 112                          
B    110.0.4.0/30 [200/0] via 110.0.3.1, 00:44:59, vlan 112                
B    110.0.4.0/30 [200/0] via 160.0.1.1, 00:44:59, vlan 161                
B    110.1.1.0/30 [200/0] via 110.0.3.1, 00:45:25, vlan 112                
B    110.1.1.0/30 [200/0] via 160.0.1.1, 00:45:26, vlan 161                
B    110.1.2.0/30 [200/0] via 110.0.3.1, 00:45:26, vlan 112                
B    110.1.2.0/30 [200/0] via 160.0.1.1, 00:45:26, vlan 161                
B    110.1.3.0/30 [200/0] via 110.0.3.1, 00:45:26, vlan 112                
B    110.1.3.0/30 [200/0] via 160.0.1.1, 00:45:26, vlan 161                
B    110.1.4.0/30 [200/0] via 110.0.3.1, 00:45:26, vlan 112                
B    110.1.4.0/30 [200/0] via 160.0.1.1, 00:45:26, vlan 161                
B    160.0.0.0/30 [200/0] via 160.0.1.1, 05:44:33, vlan 161                
C    160.0.1.0/30 is directly connected, vlan 161                          
B    160.0.2.0/30 [200/0] via 110.0.3.1, 00:40:26, vlan 112                
B    160.0.2.0/30 [200/0] via 160.0.1.1, 00:40:26, vlan 161                
B    160.0.3.0/30 [200/0] via 160.0.1.1, 06:08:02, vlan 161

Из вывода выше видно, что Leaf_1_1 получил маршруты из Pod_2.

Пример 3

В данном примере описывается создание L2VPN- и L3VPN-сервисов.

Как описывалось ранее, маршрутизаторы ME поддерживают технологию EVPN/VXLAN, но имеют ограничения по функциональности. Таким образом, на маршрутизаторах ME возможно построить только L2VPN-сервисы (VPLS и VPWS).

На схеме отображено построение и объединение POD с использованием EVPN/VXLAN на коммутаторах Spine (в данном случае MES):

Из приведенной схемы видно, что маршрутизаторы DC_GW используются для объединения и распространения маршрутной информации между площадками POD по Opt. B. Также данные маршрутизаторы могут подключаться к другим сетям, например к ISP. На коммутаторах Spine поднимается EVPN/VXLAN, как в своём POD, так и между соседней площадкой.

Для распространения маршрутной информации в пределах AS может использоваться OSPF или ISIS. В данном примере используется OSPF.

Пример конфигурации OSPF на коммутаторах Leaf:

LEAF_1_1	LEAF_1_2
router ospf 1 network 172.16.1.2 area 0.0.0.0 network 172.16.1.10 area 0.0.0.0 router-id 10.0.0.1 redistribute connected subnets exit ! interface ip 172.16.1.2 ip ospf network point-to-point exit ! interface ip 172.16.1.10 ip ospf network point-to-point exit interface vlan 101 ip address 172.16.1.2 255.255.255.252 exit ! interface vlan 103 ip address 172.16.1.10 255.255.255.252 exit	router ospf 1 network 172.16.1.6 area 0.0.0.0 network 172.16.1.14 area 0.0.0.0 router-id 10.0.0.2 redistribute connected subnets exit ! interface ip 172.16.1.6 ip ospf network point-to-point exit ! interface ip 172.16.1.14 ip ospf network point-to-point exit ! interface vlan 102 ip address 172.16.1.6 255.255.255.252 exit ! interface vlan 104 ip address 172.16.1.14 255.255.255.252 exit

LEAF_1_1

LEAF_1_2

router ospf 1
 network 172.16.1.2 area 0.0.0.0
 network 172.16.1.10 area 0.0.0.0
 router-id 10.0.0.1
 redistribute connected subnets                       
exit
!
interface ip 172.16.1.2
 ip ospf network point-to-point
exit
!
interface ip 172.16.1.10
 ip ospf network point-to-point
exit

interface vlan 101                                    
 ip address 172.16.1.2 255.255.255.252
exit
!
interface vlan 103
 ip address 172.16.1.10 255.255.255.252
exit

router ospf 1
 network 172.16.1.6 area 0.0.0.0
 network 172.16.1.14 area 0.0.0.0
 router-id 10.0.0.2
 redistribute connected subnets
exit
!
interface ip 172.16.1.6
 ip ospf network point-to-point
exit
!
interface ip 172.16.1.14
 ip ospf network point-to-point
exit                                                  
!
interface vlan 102
 ip address 172.16.1.6 255.255.255.252
exit
!
interface vlan 104
 ip address 172.16.1.14 255.255.255.252
exit

Пример конфигурации OSPF на коммутаторах Spine:

SPINE_1_1	SPINE_1_2
router ospf 1 network 172.16.1.1 area 0.0.0.0 network 172.16.1.5 area 0.0.0.0 network 172.16.2.2 area 0.0.0.0 network 172.16.2.10 area 0.0.0.0 router-id 10.0.1.1 redistribute connected subnets exit ! interface ip 172.16.1.1 ip ospf network point-to-point exit ! interface ip 172.16.1.5 ip ospf network point-to-point exit ! interface ip 172.16.2.2 ip ospf network point-to-point exit ! interface ip 172.16.2.10 ip ospf network point-to-point exit interface vlan 100 ip address 172.16.2.2 255.255.255.252 exit ! interface vlan 101 ip address 172.16.1.1 255.255.255.252 exit ! interface vlan 102 ip address 172.16.1.5 255.255.255.252 exit ! interface vlan 200 ip address 172.16.2.10 255.255.255.252 exit	router ospf 1 network 172.16.1.9 area 0.0.0.0 network 172.16.1.13 area 0.0.0.0 network 172.16.2.6 area 0.0.0.0 network 172.16.2.14 area 0.0.0.0 router-id 10.0.1.2 exit ! interface ip 172.16.1.9 ip ospf network point-to-point exit ! interface ip 172.16.1.13 ip ospf network point-to-point exit ! interface ip 172.16.2.6 ip ospf network point-to-point exit ! interface ip 172.16.2.14 ip ospf network point-to-point exit ! interface vlan 103 ip address 172.16.1.9 255.255.255.252 exit ! interface vlan 104 ip address 172.16.1.13 255.255.255.252 exit ! interface vlan 150 ip address 172.16.2.6 255.255.255.252 exit ! interface vlan 250 ip address 172.16.2.14 255.255.255.252 exit

SPINE_1_1

SPINE_1_2

router ospf 1
 network 172.16.1.1 area 0.0.0.0
 network 172.16.1.5 area 0.0.0.0                      
 network 172.16.2.2 area 0.0.0.0
 network 172.16.2.10 area 0.0.0.0
 router-id 10.0.1.1
 redistribute connected subnets
exit
!
interface ip 172.16.1.1
 ip ospf network point-to-point
exit
!
interface ip 172.16.1.5
 ip ospf network point-to-point
exit
!
interface ip 172.16.2.2
 ip ospf network point-to-point
exit
!
interface ip 172.16.2.10
 ip ospf network point-to-point
exit
interface vlan 100
 ip address 172.16.2.2 255.255.255.252
exit
!
interface vlan 101
 ip address 172.16.1.1 255.255.255.252                
exit
!
interface vlan 102
 ip address 172.16.1.5 255.255.255.252
exit
!
interface vlan 200                                    
 ip address 172.16.2.10 255.255.255.252
exit

router ospf 1
 network 172.16.1.9 area 0.0.0.0
 network 172.16.1.13 area 0.0.0.0                     
 network 172.16.2.6 area 0.0.0.0
 network 172.16.2.14 area 0.0.0.0
 router-id 10.0.1.2
exit
!
interface ip 172.16.1.9
 ip ospf network point-to-point
exit
!
interface ip 172.16.1.13
 ip ospf network point-to-point
exit
!
interface ip 172.16.2.6
 ip ospf network point-to-point
exit
!
interface ip 172.16.2.14
 ip ospf network point-to-point
exit
!
interface vlan 103
 ip address 172.16.1.9 255.255.255.252
exit
!
interface vlan 104
 ip address 172.16.1.13 255.255.255.252
exit
!
interface vlan 150
 ip address 172.16.2.6 255.255.255.252
exit
!
interface vlan 250                                    
 ip address 172.16.2.14 255.255.255.252
exit

Проверка соседства по OSPF и наличия маршрутов:

SPINE_1_1#show ip ospf neighbor 
Neighbor Addr   Neighbor ID     PID IP Interface    Pri State             Dead time Interface
--------------- --------------- --- --------------- --- ----------------- --------- ----------
172.16.1.2      10.0.0.1          1 172.16.1.1        1 full/ -           00:00:30  vlan101  
172.16.1.6      10.0.0.2          1 172.16.1.5        1 full/ -           00:00:33  vlan102  
172.16.2.9      10.0.10.2         1 172.16.2.10       1 full/ -           00:00:39  vlan200  

SPINE_1_1#show ip route ospf 
Maximum Parallel Paths: 1 (1 after reset)
Load balancing: src-dst-mac-ip
IP Forwarding: enabled
Codes: > - best, C - connected, S - static,
       R - RIP,
       O - OSPF intra-area, OIA - OSPF inter-area,
       OE1 - OSPF external 1, OE2 - OSPF external 2,
       B - BGP, i - IS-IS, L1 - IS-IS level-1,
       P - PBR
       L2 - IS-IS level-2, ia - IS-IS inter area
[d/m]: d - route's distance, m - route's metric

OE2  10.0.0.1/32 [110/20] via 172.16.1.2, 02:29:29, vlan 101               
OE2  10.0.0.2/32 [110/20] via 172.16.1.6, 02:27:27, vlan 102               
OE2  10.2.0.1/32 [110/21] via 172.16.2.9, 02:31:43, vlan 200               
OE2  10.2.1.1/32 [110/21] via 172.16.2.9, 02:31:43, vlan 200               
OE2  10.2.1.2/32 [110/21] via 172.16.2.9, 02:31:43, vlan 200               
O    172.16.1.8/30 [30/20] via 172.16.1.2, 02:29:29, vlan 101              
O    172.16.1.12/30 [30/20] via 172.16.1.6, 02:27:27, vlan 102             
O    172.16.2.12/30 [30/11] via 172.16.2.9, 02:31:43, vlan 200

Настройка OSPF на маршрутизаторах DC_GW. Для изоляции от общей таблицы маршрутизации необходимо поднять соседство в VRF EVPN_VXLAN:

DC_GW_1_1	DC_GW_1_2
router ospfv2 1 vrf EVPN_VXLAN area 0.0.0.0 interface hundredgigabitethernet 0/0/1.100 network point-to-point exit interface hundredgigabitethernet 0/0/2.150 network point-to-point exit exit redistribution bgp 1 metric-conversion same exit router-id 10.0.10.1 exit exit	router ospfv2 1 vrf EVPN_VXLAN area 0.0.0.0 interface hundredgigabitethernet 0/0/1.200 network point-to-point exit interface hundredgigabitethernet 0/0/2.250 network point-to-point exit exit redistribution bgp 1 metric-conversion same exit router-id 10.0.10.2 exit exit

DC_GW_1_1

DC_GW_1_2

router ospfv2 1
  vrf EVPN_VXLAN
    area 0.0.0.0
      interface hundredgigabitethernet 0/0/1.100
        network point-to-point
      exit
      interface hundredgigabitethernet 0/0/2.150
        network point-to-point
      exit
    exit
    redistribution bgp 1
      metric-conversion same
    exit
    router-id 10.0.10.1
  exit
exit

router ospfv2 1
  vrf EVPN_VXLAN
    area 0.0.0.0
      interface hundredgigabitethernet 0/0/1.200
        network point-to-point
      exit
      interface hundredgigabitethernet 0/0/2.250
        network point-to-point
      exit
    exit
    redistribution bgp 1
      metric-conversion same
    exit
    router-id 10.0.10.2
  exit
exit

Из приложенной конфигурации видно, что выполняется редистрибуция маршрутов из BGP в OSPF с использованием metric-conversion same. Данная команда учитывает параметр веса (MED) при редистрибуции, что позволяет исключить возникновение неоптимального маршрута. По умолчанию используется constant, что сбрасывает метрику в 0.

Проверка соседства на маршрутизаторе DC_GW:

0/ME5210S:DC_GW_1_1# show  ospfv2  vrf EVPN_VXLAN neighbors 
Thu Jun 18 10:34:22 2026
  Routing Process: 1, VRF EVPN_VXLAN, ID 10.0.10.1
  Instance ID: 0
    Router is an area border router
  
  Neighbor ID      Area ID          Pri  State               BFD           Dead Time  Last state change  Address          Interface 
  ---------------- ---------------- ---- ------------------- ------------- ---------- ------------------ ---------------- ---------- 
  10.0.1.1         0.0.0.0          1    full                not-required  00:00:30   00h59m02s          172.16.2.2       hu0/0/1.100 
  10.0.1.2         0.0.0.0          1    full                not-required  00:00:30   05h57m57s          172.16.2.6       hu0/0/2.150

Необходимо учесть, что при отправке маршрутов в соседнюю AS был настроен route-map, который пропускает только loopback-адреса устройств.

Аналогичная проверка соседства на коммутаторе Spine и наличия маршрутов:

SPINE_1_1#show ip route  
Maximum Parallel Paths: 1 (1 after reset)
Load balancing: src-dst-mac-ip
Load balancing hash Salt value: 0
Load balancing hash Seed value: 0
IP Forwarding: enabled
Codes: > - best, C - connected, S - static,
       R - RIP,
       O - OSPF intra-area, OIA - OSPF inter-area,
       OE1 - OSPF external 1, OE2 - OSPF external 2,
       B - BGP, i - IS-IS, L1 - IS-IS level-1,
       P - PBR
       L2 - IS-IS level-2, ia - IS-IS inter area
[d/m]: d - route's distance, m - route's metric

OE2  10.0.0.1/32 [110/20] via 172.16.1.2, 17:45:40, vlan 101               
OE2  10.0.0.2/32 [110/20] via 172.16.1.6, 17:45:40, vlan 102               
C    10.0.1.1/32 is directly connected, loopback 1                         
OE2  10.0.1.2/32 [110/20] via 172.16.2.9, 17:45:40, vlan 200               
OE2  10.2.0.1/32 [110/0] via 172.16.2.1, 17:45:40, vlan 100, tag           
3489661028                                                                 
OE2  10.2.1.1/32 [110/0] via 172.16.2.1, 17:45:40, vlan 100, tag           
3489661028                                                                 
OE2  10.2.1.2/32 [110/0] via 172.16.2.1, 17:45:40, vlan 100, tag           
3489661028                                                                 
C    172.16.1.0/30 is directly connected, vlan 101                         
C    172.16.1.4/30 is directly connected, vlan 102                         
O    172.16.1.8/30 [30/20] via 172.16.1.2, 17:45:40, vlan 101              
O    172.16.1.12/30 [30/20] via 172.16.1.6, 17:45:41, vlan 102             
C    172.16.2.0/30 is directly connected, vlan 100                         
O    172.16.2.4/30 [30/11] via 172.16.2.1, 17:45:41, vlan 100              
C    172.16.2.8/30 is directly connected, vlan 200                         
O    172.16.2.12/30 [30/11] via 172.16.2.9, 17:45:41, vlan 200             
S    172.30.0.0/20 [1/2] via 172.31.0.1, 17:46:17, oob                     
C    172.31.0.0/20 is directly connected, oob

Из вывода выше видно, что имеются loopback-адреса устройств из соседнего POD_2. Это связано с тем, что между POD уже настроена BGP-сессия и выполнена редистрибуция. Теперь, используя данные loopback-адреса, необходимо построить сессию BGP EVPN между коммутаторами Spine, а также настроить BGP до коммутаторов Leaf.

Конфигурация BGP на коммутаторах Spine:

SPINE_1_1	SPINE_1_2
router bgp 100 bgp router-id 10.0.1.1 address-family ipv4 unicast exit ! address-family l2vpn evpn exit ! peer-group LEAF remote-as 100 update-source loopback 1 fall-over bfd route-reflector-client exit ! neighbor 10.0.0.1 peer-group LEAF address-family ipv4 unicast exit ! address-family l2vpn evpn exit exit ! neighbor 10.0.0.2 peer-group LEAF address-family ipv4 unicast exit ! address-family l2vpn evpn exit exit ! neighbor 10.2.1.1 remote-as 200 update-source loopback 1 ebgp-multihop address-family ipv4 unicast exit ! address-family l2vpn evpn next-hop-unchanged exit exit ! neighbor 10.2.1.2 remote-as 200 update-source loopback 1 ebgp-multihop address-family ipv4 unicast exit ! address-family l2vpn evpn next-hop-unchanged exit exit !	router bgp 100 bgp router-id 10.0.1.2 address-family ipv4 unicast exit ! address-family l2vpn evpn exit ! peer-group LEAF remote-as 100 update-source loopback 1 fall-over bfd route-reflector-client exit ! neighbor 10.0.0.1 peer-group LEAF address-family ipv4 unicast exit ! address-family l2vpn evpn exit exit ! neighbor 10.0.0.2 peer-group LEAF address-family ipv4 unicast exit ! address-family l2vpn evpn exit exit ! neighbor 10.2.1.1 remote-as 200 update-source loopback 1 ebgp-multihop address-family ipv4 unicast exit ! address-family l2vpn evpn next-hop-unchanged exit exit ! neighbor 10.2.1.2 remote-as 200 update-source loopback 1 ebgp-multihop address-family ipv4 unicast exit ! address-family l2vpn evpn next-hop-unchanged exit exit !

SPINE_1_1

SPINE_1_2

router bgp 100
 bgp router-id 10.0.1.1
 address-family ipv4 unicast
 exit
 !
 address-family l2vpn evpn
 exit
 !
 peer-group LEAF
  remote-as 100
  update-source loopback 1
  fall-over bfd
  route-reflector-client
 exit
 !
 neighbor 10.0.0.1                                    
  peer-group LEAF
  address-family ipv4 unicast
  exit
  !
  address-family l2vpn evpn
  exit
 exit
 !
 neighbor 10.0.0.2
  peer-group LEAF
  address-family ipv4 unicast
  exit
  !
  address-family l2vpn evpn
  exit
 exit
 !
 neighbor 10.2.1.1
  remote-as 200
  update-source loopback 1
  ebgp-multihop
  address-family ipv4 unicast                         
  exit
  !
  address-family l2vpn evpn
   next-hop-unchanged
  exit
 exit
 !
 neighbor 10.2.1.2
  remote-as 200
  update-source loopback 1
  ebgp-multihop
  address-family ipv4 unicast
  exit
  !
  address-family l2vpn evpn
   next-hop-unchanged
  exit
 exit
!

router bgp 100
 bgp router-id 10.0.1.2                               
 address-family ipv4 unicast
 exit
 !
 address-family l2vpn evpn
 exit
 !
 peer-group LEAF
  remote-as 100
  update-source loopback 1
  fall-over bfd
  route-reflector-client
 exit
 !
 neighbor 10.0.0.1
  peer-group LEAF
  address-family ipv4 unicast
  exit
  !
  address-family l2vpn evpn
  exit
 exit
 !                                                    
 neighbor 10.0.0.2
  peer-group LEAF
  address-family ipv4 unicast
  exit
  !
  address-family l2vpn evpn
  exit
 exit
 !
 neighbor 10.2.1.1
  remote-as 200
  update-source loopback 1
  ebgp-multihop
  address-family ipv4 unicast
  exit
  !
  address-family l2vpn evpn
   next-hop-unchanged
  exit
 exit
 !
 neighbor 10.2.1.2                                    
  remote-as 200
  update-source loopback 1
  ebgp-multihop
  address-family ipv4 unicast
  exit
  !
  address-family l2vpn evpn
   next-hop-unchanged
  exit
 exit
!

Пример конфигурации на коммутаторах Leaf:

LEAF_1_1	LEAF_1_2
router bgp 100 bgp router-id 10.0.0.1 ! address-family l2vpn evpn exit ! peer-group SPINE remote-as 100 update-source loopback 1 fall-over bfd exit ! neighbor 10.0.1.1 peer-group SPINE address-family ipv4 unicast exit ! address-family l2vpn evpn exit exit ! neighbor 10.0.1.2 peer-group SPINE address-family ipv4 unicast exit ! address-family l2vpn evpn exit exit ! vrf user1 address-family ipv4 unicast redistribute connected exit exit !	router bgp 100 bgp router-id 10.0.0.2 ! address-family l2vpn evpn exit ! peer-group SPINE remote-as 100 update-source loopback 1 fall-over bfd exit ! neighbor 10.0.1.1 peer-group SPINE address-family ipv4 unicast exit ! address-family l2vpn evpn exit exit ! neighbor 10.0.1.2 peer-group SPINE address-family ipv4 unicast exit ! address-family l2vpn evpn exit exit ! vrf user1 address-family ipv4 unicast redistribute connected exit exit !

LEAF_1_1

LEAF_1_2

router bgp 100
 bgp router-id 10.0.0.1
 !
 address-family l2vpn evpn                            
 exit
 !
 peer-group SPINE
  remote-as 100
  update-source loopback 1
  fall-over bfd
 exit
 !
 neighbor 10.0.1.1
  peer-group SPINE
  address-family ipv4 unicast
  exit
  !
  address-family l2vpn evpn
  exit
 exit
 !
 neighbor 10.0.1.2
  peer-group SPINE
  address-family ipv4 unicast
  exit
  !                                                   
  address-family l2vpn evpn
  exit
 exit
 !
 vrf user1
  address-family ipv4 unicast
   redistribute connected
  exit
 exit
!

router bgp 100
 bgp router-id 10.0.0.2
 !
 address-family l2vpn evpn
 exit
 !
 peer-group SPINE
  remote-as 100
  update-source loopback 1
  fall-over bfd
 exit
 !
 neighbor 10.0.1.1
  peer-group SPINE
  address-family ipv4 unicast
  exit
  !
  address-family l2vpn evpn                           
  exit
 exit
 !
 neighbor 10.0.1.2
  peer-group SPINE
  address-family ipv4 unicast
  exit
  !
  address-family l2vpn evpn
  exit
 exit
 !
 vrf user1
  address-family ipv4 unicast
   redistribute connected
  exit
 exit
!

Организация публичного доступа для L3VPN-сервисов

Пример 1

К примеру 2 раздела «Конфигурирование услуг L2VPN и L3VPN» необходимо добавить возможность выхода в публичную сеть.

В схеме ниже рассмотрены подключение и конфигурация для POD_2 аналогично POD_1:

Маршрутизаторы DC_GW подключаются к соседней AS, от которой получают Full View. Данные маршруты попадают в отдельную таблицу маршрутизации: VRF internet. В сторону сервисов отдаётся маршрут по умолчанию.

Настройка на маршрутизаторе стыка с соседней AS, для этого необходимо создать vrf internet:

vrf internet
  import route-target 123:123
  export route-target 123:123
  rd 10.0.10.1:123
exit

Настройка на DC_GW_1_1 BGP-сессии до соседней AS:

router bgp 100
  vrf internet
    neighbor 70.0.0.2
      address-family ipv4 unicast
      exit
      remote-as 200
      update-source 70.0.0.1
    exit
  exit
exit
interface hundredgigabitethernet 0/0/4.100
  encapsulation outer-vid 100
  ipv4 address 70.0.0.1/30
  vrf internet
exit

Конфигурация устройства с соседней AS не приводится, так как используется простейшая конфигурация BGP. Для простоты разбора данного примера с соседней AS будет анонсироваться только один маршрут: 8.8.8.8/32.

Настройка маршрута по умолчанию:

router static
  vrf internet
    address-family ipv4 unicast
      destination 0.0.0.0/0 70.0.0.2
      exit
    exit
  exit
exit

Теперь необходимо перелить маршрут по умолчанию из vrf internet в vrf user1. При этом необходимо отфильтровать лишние маршруты.

Создание префикс-листа для дефолтного маршрута и добавление в route-map:

prefix-list def
  seq-num 1
    prefix 0.0.0.0/0
  exit
exit
route-map def
  seq-num 1
    match prefix-list destination def
  exit
  seq-num 2
    action deny
  exit
exit

Применение фильтрации:

vrf USER1
  description L3VPN
  export route-target 200:1
  import route-map def
  import route-target 123:123
  import route-target 200:1
  rd 10.0.10.1:1
exit

Проверка маршрутов:

0/ME5210S:DC_GW_1_1(config-vrf)# do show  route vrf USER1 
Fri Jun 19 10:58:20 2026
  Codes: C - connected, S - static, O - OSPF, B - BGP, L - local
      IA - OSPF inter area, EA - OSPF intra area
      N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
      E1 - OSPF external type 1, E2 - OSPF external type 2
      i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2,
      LE1 - IS-IS level1 external, LE2 - IS-IS level2 external
      BI - BGP internal, BE - BGP external, BV - BGP vpn,
      BL - BGP labeled, R - RIP
  
  
  B BI   0.0.0.0/0    via 70.0.0.2 [200/0], 00h00m06s, hu0/0/4.100
  C      110.0.1.0/30     is directly connected, 01d01h23m, hu0/0/1.110
  L      110.0.1.1/32     is directly connected, 01d01h23m, hu0/0/1.110
  B BI   110.0.2.0/30    via 110.0.1.2 [200/0], 01d01h17m, hu0/0/1.110
  B BI   110.0.3.0/30    via 160.0.0.2 [200/0], 01d01h22m, hu0/0/2.160
  B BI   110.0.4.0/30    via 110.0.1.2 [200/0], 01d01h22m, hu0/0/1.110
  B BI   110.1.1.0/30    via 160.0.0.2 [200/0], 02h04m38s, hu0/0/2.160
  B BI   110.1.2.0/30    via 160.0.0.2 [200/0], 02h04m38s, hu0/0/2.160
  B BI   110.1.3.0/30    via 160.0.0.2 [200/0], 02h04m38s, hu0/0/2.160
  B BI   110.1.4.0/30    via 160.0.0.2 [200/0], 02h04m38s, hu0/0/2.160
  C      160.0.0.0/30     is directly connected, 01d06h22m, hu0/0/2.160
  L      160.0.0.1/32     is directly connected, 01d06h22m, hu0/0/2.160
  B BI   160.0.1.0/30    via 110.0.1.2 [200/0], 01d01h22m, hu0/0/1.110
  B BI   160.0.2.0/30    via 110.0.1.2 [200/0], 01d01h17m, hu0/0/1.110
  B BI   160.0.3.0/30    via 160.0.0.2 [200/0], 01d06h22m, hu0/0/2.160
  
  Total entries: 15

Пример настройки фильтрации маршрутов на export:

Для маршрутов, которые попадают под фильтрацию, необходимо дополнительно указать RT.

route-map def
  seq-num 1
    match prefix-list destination def
    set extcommunity set-specific rt value 200:1
  exit
  seq-num 2
    action deny
  exit
exit
vrf USER1
  description L3VPN
  export route-target 200:1
  import route-target 200:1
  rd 10.0.10.1:1
exit
vrf internet
  export route-map def
  import route-target 123:123
  import route-target 200:1
  rd 10.0.10.1:123
exit

Пример 2

В примере рассматривается ещё один вариант организации доступа к сети Интернет для сервисов, находящихся в EVPN/VXLAN-фабрике. В качестве основы будет использоваться пример 3, описанный в разделе: «Конфигурирование услуг L2VPN и L3VPN».

В схеме ниже показаны подключение и конфигурация для POD_2 аналогично POD_1.

Маршрутизаторы DC_GW подключаются к соседней AS, от которой получают Full View. Данные маршруты будут находится в отдельной таблице маршрутизации vrf internet. Для каждого сервиса будет создана дополнительная BGP-сессия в сторону коммутатора Spine. В сторону данных сервисов будет отдаваться маршрут по умолчанию.

Создание на маршрутизаторах DC_GW_1_1 vrf internet и сервиса vrf user1 (аналогично настраиваются остальные коммутаторы DC_GW):

vrf internet
  export route-target 123:123
  import route-target 123:123
  rd 10.0.10.1:123
exit
vrf user1
  export route-target 115:1
  import route-target 115:1
  rd 10.0.10.1:115
exit

Настройка на DC_GW_1_1 BGP-сессии до соседней AS, а также настройка сессии BGP до коммутатора Spine:

router bgp 100
  vrf internet
    address-family ipv4 unicast
    exit
    neighbor 70.0.0.2
      address-family ipv4 unicast
      exit
      remote-as 200
      update-source 70.0.0.1
    exit
  exit
  vrf user1
    address-family ipv4 unicast
    exit
    neighbor 20.0.0.2
      address-family ipv4 unicast
        next-hop-self
        route-map out def2
      exit
      remote-as 100
      update-source 20.0.0.1
    exit
  exit
exit

Конфигурация BGP с соседней AS не приведена, так как используется простейшая конфигурация BGP. Для примера с соседней AS анонсируется только один маршрут: 8.8.8.8/32.

Далее необходимо настроить BGP на коммутаторе Spine_1_1 (аналогично настраиваются остальные коммутаторы Spine).

За исходную конфигурацию устройств Spine и Leaf взяты настройки из примера 3, описанные в разделе: «Конфигурирование услуг L2VPN и L3VPN»

К данной конфигурации необходимо добавить vrf user1 и поднять BGP-сессию с маршрутизатором DC_GW:

ip vrf user1
 vni 100700
 route-target both 100:600
 route-target both 100:700
exit
vxlan inet_115
 vni 100115                                           
 vlan 115
exit
interface vlan 115
 ip vrf user1
 ip address 20.0.0.2 255.255.255.252
exit
interface vlan 215
 ip vrf user1
 ip address 20.0.1.2 255.255.255.252
exit
vrf user1
  address-family ipv4 unicast
   redistribute bgp
  exit
  !
  neighbor 20.0.0.1
   remote-as 100
   update-source vlan 115
   soft-reconfiguration inbound                       
   address-family ipv4 unicast
    route-map test1 out
   exit
  exit
  !
  neighbor 20.0.1.1
   remote-as 100
   update-source vlan 215
   soft-reconfiguration inbound
   address-family ipv4 unicast
    route-map test2 out
   exit
  exit
 exit

Проверка маршрутов на DC_GW:

0/ME5210S:DC_GW_1_1# show  bgp vrf user1 
Wed Jul  1 03:58:34 2026
  BGP router identifier 10.0.10.1, vrf user1, local AS number 100
  Graceful Restart is disabled
  BGP table state: active
  Tx packets DSCP/PCP/MPLS-EXP fields: 48/7/6
  
  Status codes: d damped, h history, > best, b backup, S stale, * active, u untracked, i internal
  Origin codes: i igp, e egp, n none
  
  Network                  Next hop         Metric  LocPrf  Weight  Path 
  ------------------------ ---------------- ------- ------- ------- ----- 
   i   50.0.0.0/24         10.2.0.1         0       100     0       200 ? 
   i   50.0.0.2/32         10.2.0.1         0       100     0       200 ? 
   i   50.0.1.0/24         10.0.0.2         0       100     0       ? 
   i   50.0.1.2/32         10.0.0.2         0       100     0       ? 

  Total entries: 4

Из вывода выше видно, что полученные маршруты невалидны. Это связано с тем, что в качестве next hop используется loopback 1 коммутатора Leaf. Данный адрес на маршрутизаторе DC_GW в клиентском vrf user1 неизвестен и его изучение не требуется. Для того чтобы исправить данную проблему, необходимо изменить next-hop для маршрутов, отдаваемых в сторону DC_GW. В качестве next-hop необходимо указать интерконнект между Spine_1_1 и DC_GW_1_X.

Создание prefix-list для сетей, которые планируется анонсировать во внешнюю сеть:

ip prefix-list test1 seq 5 permit 50.0.0.0/16 le 32

Привязка prefix-list к route-map, где в качестве next-hop указаны vlan115 и vlan215:

route-map test1 1 permit
 match ip address prefix-list test1
 set ip next-hop 20.0.0.2
exit
route-map test2 1 permit
 match ip address prefix-list test1
 set ip next-hop 20.0.1.2
exit

Проверка маршрутов:

0/ME5210S:DC_GW_1_1# show  bgp vrf user1 
Wed Jul  1 04:03:27 2026
  BGP router identifier 10.0.10.1, vrf user1, local AS number 100
  Graceful Restart is disabled
  BGP table state: active
  Tx packets DSCP/PCP/MPLS-EXP fields: 48/7/6
  
  Status codes: d damped, h history, > best, b backup, S stale, * active, u untracked, i internal
  Origin codes: i igp, e egp, n none
  
  Network                  Next hop         Metric  LocPrf  Weight  Path 
  ------------------------ ---------------- ------- ------- ------- ----- 
  *>i  50.0.0.0/24         20.0.0.2         0       100     0       200 ? 
  *>i  50.0.0.2/32         20.0.0.2         0       100     0       200 ? 
  *>i  50.0.1.0/24         20.0.0.2         0       100     0       ? 
  *>i  50.0.1.2/32         20.0.0.2         0       100     0       ? 

  Total entries: 4

Теперь маршруты валидны. Также стоит обратить внимание, что в выводе выше есть маршруты, полученные из соседнего ЦОД. Следовательно, для серверов, которые находятся в ЦОД 2 (vrf user1), будет доступ к внешним сетям. В случае, если данные маршруты не требуются, то есть возможность отфильтровать их на коммутаторах Spine при помощи route-map.

Настройка маршрута по умолчанию:

router static
  vrf internet
    address-family ipv4 unicast
      destination 0.0.0.0/0 70.0.0.2
      exit
    exit
  exit
exit

И распространение данный маршрута по BGP:

router bgp 100
  vrf user1
    address-family ipv4 unicast
      network 0.0.0.0/0
    exit
  exit
exit

Проверка наличия маршрутов в vrf internet:

0/ME5210S:DC_GW_1_1# show  route vrf  internet 
Wed Jul  1 04:12:41 2026
  Codes: C - connected, S - static, O - OSPF, B - BGP, L - local
      IA - OSPF inter area, EA - OSPF intra area
      N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
      E1 - OSPF external type 1, E2 - OSPF external type 2
      i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2,
      LE1 - IS-IS level1 external, LE2 - IS-IS level2 external
      BI - BGP internal, BE - BGP external, BV - BGP vpn,
      BL - BGP labeled, R - RIP
  
  
  S      0.0.0.0/0    via 70.0.0.2 [1/1], 01d18h10m, hu0/0/4.100
  B BE   8.8.8.8/32    via 70.0.0.2 [20/0], 04d21h18m, hu0/0/4.100
  C      70.0.0.0/30     is directly connected, 04d21h18m, hu0/0/4.100
  L      70.0.0.1/32     is directly connected, 04d21h18m, hu0/0/4.100
  B BV   70.0.1.0/30    via 10.0.10.2 [200/0], 00h17m40s

Теперь необходимо перелить маршруты между vrf internet и vrf user1. При этом необходимо отфильтровать лишнее.

Из vrf internet в vrf user1 отдать только маршрут по умолчанию:

prefix-list def
  seq-num 1
    prefix 0.0.0.0/0
  exit
exit

route-map def2
  seq-num 1
    match prefix-list destination def
  exit
  seq-num 2
    action deny
  exit
exit

vrf user1
  import route-map def2
  import route-target 123:123
exit

Проверка наличия маршрута:

0/ME5210S:DC_GW_1_1# show  route vrf user1 
Wed Jul  1 04:23:02 2026
  Codes: C - connected, S - static, O - OSPF, B - BGP, L - local
      IA - OSPF inter area, EA - OSPF intra area
      N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
      E1 - OSPF external type 1, E2 - OSPF external type 2
      i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2,
      LE1 - IS-IS level1 external, LE2 - IS-IS level2 external
      BI - BGP internal, BE - BGP external, BV - BGP vpn,
      BL - BGP labeled, R - RIP
  
  
  B BV   0.0.0.0/0    via 10.0.10.2 [200/0], 00h00m06s
  C      20.0.0.0/30     is directly connected, 01d19h06m, hu0/0/1.115
  L      20.0.0.1/32     is directly connected, 01d19h06m, hu0/0/1.115
  B BI   50.0.0.0/24    via 20.0.0.2 [200/0], 00h22m47s, hu0/0/1.115
  B BI   50.0.0.2/32    via 20.0.0.2 [200/0], 00h22m47s, hu0/0/1.115
  B BI   50.0.1.0/24    via 20.0.0.2 [200/0], 00h22m47s, hu0/0/1.115
  B BI   50.0.1.2/32    via 20.0.0.2 [200/0], 00h22m47s, hu0/0/1.115
  
  Total entries: 7

Аналогично настройка из vrf user1 в vrf internet:

prefix-list serv
  seq-num 1
    prefix 50.0.1.2/32
  exit
  seq-num 2
    prefix 50.0.0.2/32
  exit
exit
route-map serv
  seq-num 1
    match prefix-list destination serv
  exit
  seq-num 2
    action deny
  exit
exit
vrf internet
  import route-map serv
  import route-target 115:1
  rd 10.0.10.1:123
exit

Проверка наличия маршрутов в vrf internet:

0/ME5210S:DC_GW_1_1#  show  route vrf  internet 
Wed Jul  1 04:35:57 2026
  Codes: C - connected, S - static, O - OSPF, B - BGP, L - local
      IA - OSPF inter area, EA - OSPF intra area
      N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
      E1 - OSPF external type 1, E2 - OSPF external type 2
      i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2,
      LE1 - IS-IS level1 external, LE2 - IS-IS level2 external
      BI - BGP internal, BE - BGP external, BV - BGP vpn,
      BL - BGP labeled, R - RIP
  
  
  S      0.0.0.0/0    via 70.0.0.2 [1/1], 01d18h33m, hu0/0/4.100
  B BE   8.8.8.8/32    via 70.0.0.2 [20/0], 04d21h41m, hu0/0/4.100
  B BI   50.0.0.2/32    via 20.0.0.2 [200/0], 00h00m08s, hu0/0/1.115
  B BI   50.0.1.2/32    via 20.0.0.2 [200/0], 00h00m08s, hu0/0/1.115
  C      70.0.0.0/30     is directly connected, 04d21h41m, hu0/0/4.100
  L      70.0.0.1/32     is directly connected, 04d21h41m, hu0/0/4.100
  
  Total entries: 6

Проверка на коммутаторе Leaf:

LEAF_1_2#show ip route vrf user1
Maximum Parallel Paths: 1 (1 after reset)
Load balancing: src-dst-mac-ip
Load balancing hash Salt value: 0
Load balancing hash Seed value: 0
IP Forwarding: enabled
Codes: > - best, C - connected, S - static,
       R - RIP,
       O - OSPF intra-area, OIA - OSPF inter-area,
       OE1 - OSPF external 1, OE2 - OSPF external 2,
       B - BGP, i - IS-IS, L1 - IS-IS level-1,
       P - PBR
       L2 - IS-IS level-2, ia - IS-IS inter area
[d/m]: d - route's distance, m - route's metric

B    0.0.0.0/0 [200/0] via 10.0.1.1, 24:07:47, VNI 100700, router-mac      
ec:b1:e0:68:69:40                                                          
B    20.0.0.1/32 [200/0] via 10.0.1.1, 103:00:11, VNI 100700, router-mac   
ec:b1:e0:68:69:40                                                          
B    50.0.0.0/24 [200/0] via 10.2.0.1, 125:43:42, VNI 100700, router-mac   
90:54:b7:cf:b2:80                                                          
B    50.0.0.2/32 [200/0] via 10.2.0.1, 125:26:12, VNI 100700, router-mac   
90:54:b7:cf:b2:80                                                          
C    50.0.1.0/24 is directly connected, vlan 600

В статье упоминается

Магистральные маршрутизаторы ME

Коммутаторы ЦОД