Nexusで特定のセグメントのみRouteleakをする方法

Cisco
スポンサーリンク
スポンサーリンク

前提

対象OS:NX-OS搭載機器
CML2でいうNexus9000です。
知識:CCNA取得レベル。加えてBGPと再配送を知っていること。

検証環境

CML2.5で行いました。

達成条件

192.168.1.0/24のセグメントに所属しているalpine-1が他のセグメントに所属しているalpine-2(192.168.2.1)やalpine-4(192.168.2.1)に疎通できるようになること。

疎通確認

alpine-1からalpine-3へ

同じセグメントなのでpingは通ります。

alpine-1からalpine-2へ

異なるセグメントであり、VRF:AAAに経路情報がないためpingは通りません。

構成図

 

絵だけだと足りない情報を補足します。
・alpine-1と3はDGWとして192.168.1.254を設定
・apline-2と4はDGWとして192.168.2.254を設定
・VRF:仮想的なルーティングテーブルのこと。

事前確認

①show runを取得(※後述しますが、interface vlan100,200にhsrpの設定が抜けてました)

Nexus-1# show runn
!Command: show running-config
!No configuration change since last restart
!Time: Wed Mar 15 14:55:05 2023
version 10.3(1) Bios:version
hostname Nexus-1
vdc Nexus-1 id 1
  limit-resource vlan minimum 16 maximum 4094
  limit-resource vrf minimum 2 maximum 4096
  limit-resource port-channel minimum 0 maximum 511
  limit-resource m4route-mem minimum 58 maximum 58
  limit-resource m6route-mem minimum 8 maximum 8
feature sftp-server
cfs eth distribute
feature interface-vlan
feature hsrp
feature lacp
feature vpc
no password strength-check
username admin password 5 $5$ICPCEP$AeZr1hMgjBsbSe55y9hhvMaUJHy/pMuV/a.neHCLD4C  role network-admin
username cisco password 5 $5$NNGKBI$L/Vcw3fHBztmmFTqszmwRMKudNj0j.lC5jYJBE./tZA  role network-admin
username cisco passphrase  lifetime 99999 warntime 14 gracetime 3
ip domain-lookup
copp profile strict
snmp-server user admin network-admin auth md5 49436605AF5246C441270214679480FF88A3 priv aes-128 330D517180938A1CD0E9948AAE2401221D74 localizedV2key
snmp-server user cisco network-admin auth md5 52234D72C03863BC03266B092CB18AEB9DAB priv aes-128 165E0E21A4BBB622BA84E1CAFB675628102B localizedV2key
rmon event 1 log trap public description FATAL(1) owner PMON@FATAL
rmon event 2 log trap public description CRITICAL(2) owner PMON@CRITICAL
rmon event 3 log trap public description ERROR(3) owner PMON@ERROR
rmon event 4 log trap public description WARNING(4) owner PMON@WARNING
rmon event 5 log trap public description INFORMATION(5) owner PMON@INFO
vlan 1,100,200
vlan 100
  name peer-link
vrf context AAA
vrf context BBB
vrf context management
vpc domain 1
  peer-switch
  role priority 100
  peer-keepalive destination 172.16.10.2
  peer-gateway
  auto-recovery
  ip arp synchronize
interface Vlan1
  no ip redirects
  no ipv6 redirects
interface Vlan100
  no shutdown
  vrf member AAA
  no ip redirects
  ip address 192.168.1.252/24
  no ipv6 redirects
interface Vlan200
  no shutdown
  vrf member BBB
  no ip redirects
  ip address 192.168.2.252/24
  no ipv6 redirects
interface port-channel1
  switchport mode trunk
  switchport trunk native vlan 100
  switchport trunk allowed vlan 100,200
  spanning-tree port type network
  vpc peer-link
interface Ethernet1/1
  switchport mode trunk
  switchport trunk native vlan 100
  switchport trunk allowed vlan 100,200
  spanning-tree port type network
  channel-group 1 mode active
interface Ethernet1/2
  switchport mode trunk
  switchport trunk native vlan 100
  switchport trunk allowed vlan 100,200
  spanning-tree port type network
  channel-group 1 mode active
interface Ethernet1/3
  switchport mode trunk
  switchport access vlan 100
  switchport trunk native vlan 100
  switchport trunk allowed vlan 100,200
interface mgmt0
  vrf member management
  ip address 172.16.10.1/24
icam monitor scale
line console
line vty
boot nxos bootflash:/nxos64-cs.10.3.1.F.bin
nexus-2# show running-config
!Command: show running-config
!No configuration change since last restart
!Time: Wed Mar 15 15:08:18 2023
version 10.3(1) Bios:version
hostname nexus-2
vdc nexus-2 id 1
  limit-resource vlan minimum 16 maximum 4094
  limit-resource vrf minimum 2 maximum 4096
  limit-resource port-channel minimum 0 maximum 511
  limit-resource m4route-mem minimum 58 maximum 58
  limit-resource m6route-mem minimum 8 maximum 8
feature sftp-server
cfs eth distribute
feature interface-vlan
feature hsrp
feature lacp
feature vpc
no password strength-check
username admin password 5 $5$NMPAMN$CM7.rnb9gqpDEDDD0f438Bzpx45hMIRAF3rCOQ/TeE4  role network-admin
username cisco password 5 $5$AIPLEN$1uwbCGw37V9.K3LCKur5rmy8BnzyBryC8zftez8KDg3  role network-admin
username cisco passphrase  lifetime 99999 warntime 14 gracetime 3
ip domain-lookup
copp profile strict
snmp-server user admin network-admin auth md5 367B37472D7E496B023DB7A25281F4BAADAD priv aes-128 2141334232116C664963E5B644D0F5BE85DC localizedV2key
snmp-server user cisco network-admin auth md5 01731260551D6E2B713A8EB2588FA4F9BDEA priv aes-128 005054751F4F3C72525EA2984AD4A6E0B6E8 localizedV2key
rmon event 1 log trap public description FATAL(1) owner PMON@FATAL
rmon event 2 log trap public description CRITICAL(2) owner PMON@CRITICAL
rmon event 3 log trap public description ERROR(3) owner PMON@ERROR
rmon event 4 log trap public description WARNING(4) owner PMON@WARNING
rmon event 5 log trap public description INFORMATION(5) owner PMON@INFO
vlan 1,100,200
vlan 100
  name peer-link
vrf context AAA
vrf context BBB
vrf context management
vpc domain 1
  peer-switch
  role priority 200
  peer-keepalive destination 172.16.10.1
  peer-gateway
  auto-recovery
  ip arp synchronize
interface Vlan1
  no ip redirects
  no ipv6 redirects
interface Vlan100
  no shutdown
  vrf member AAA
  no ip redirects
  ip address 192.168.1.253/24
  no ipv6 redirects
interface Vlan200
  no shutdown
  vrf member BBB
  no ip redirects
  ip address 192.168.2.253/24
  no ipv6 redirects
interface port-channel1
  switchport mode trunk
  switchport trunk native vlan 100
  switchport trunk allowed vlan 100,200
  spanning-tree port type network
  vpc peer-link
interface Ethernet1/1
  switchport mode trunk
  switchport trunk native vlan 100
  switchport trunk allowed vlan 100,200
  spanning-tree port type network
  channel-group 1 mode active
interface Ethernet1/2
  switchport mode trunk
  switchport trunk native vlan 100
  switchport trunk allowed vlan 100,200
  spanning-tree port type network
  channel-group 1 mode active
interface Ethernet1/3
  switchport mode trunk
  switchport access vlan 200
  switchport trunk native vlan 100
  switchport trunk allowed vlan 100,200
interface mgmt0
  vrf member management
  ip address 172.16.10.2/24
icam monitor scale
line console
line vty
boot nxos bootflash:/nxos64-cs.10.3.1.F.bin

②show ip route vrf allでルーティングテーブルの状態を確認

Nexus-1# show ip route vrf all
IP Route Table for VRF “default”
‘*’ denotes best ucast next-hop
‘**’ denotes best mcast next-hop
‘[x/y]’ denotes [preference/metric]
‘%<string>’ in via output denotes VRF <string>
IP Route Table for VRF “management”
‘*’ denotes best ucast next-hop
‘**’ denotes best mcast next-hop
‘[x/y]’ denotes [preference/metric]
‘%<string>’ in via output denotes VRF <string>
172.16.10.0/24, ubest/mbest: 1/0, attached
    *via 172.16.10.1, mgmt0, [0/0], 00:12:42, direct
172.16.10.1/32, ubest/mbest: 1/0, attached
    *via 172.16.10.1, mgmt0, [0/0], 00:12:42, local
IP Route Table for VRF “AAA”
‘*’ denotes best ucast next-hop
‘**’ denotes best mcast next-hop
‘[x/y]’ denotes [preference/metric]
‘%<string>’ in via output denotes VRF <string>
192.168.1.0/24, ubest/mbest: 1/0, attached
    *via 192.168.1.252, Vlan100, [0/0], 00:09:16, direct
192.168.1.252/32, ubest/mbest: 1/0, attached
    *via 192.168.1.252, Vlan100, [0/0], 00:09:16, local
IP Route Table for VRF “BBB”
‘*’ denotes best ucast next-hop
‘**’ denotes best mcast next-hop
‘[x/y]’ denotes [preference/metric]
‘%<string>’ in via output denotes VRF <string>
192.168.2.0/24, ubest/mbest: 1/0, attached
    *via 192.168.2.252, Vlan200, [0/0], 00:09:13, direct
192.168.2.252/32, ubest/mbest: 1/0, attached
    *via 192.168.2.252, Vlan200, [0/0], 00:09:13, local
nexus-2# show ip rounexus-2# show ip route bvrnexus-2# show ip route vrf allnexus-2# show ip route vrf all
IP Route Table for VRF “default”
‘*’ denotes best ucast next-hop
‘**’ denotes best mcast next-hop
‘[x/y]’ denotes [preference/metric]
‘%<string>’ in via output denotes VRF <string>
IP Route Table for VRF “management”
‘*’ denotes best ucast next-hop
‘**’ denotes best mcast next-hop
‘[x/y]’ denotes [preference/metric]
‘%<string>’ in via output denotes VRF <string>
172.16.10.0/24, ubest/mbest: 1/0, attached
    *via 172.16.10.2, mgmt0, [0/0], 00:25:03, direct
172.16.10.2/32, ubest/mbest: 1/0, attached
    *via 172.16.10.2, mgmt0, [0/0], 00:25:03, local
IP Route Table for VRF “AAA”
‘*’ denotes best ucast next-hop
‘**’ denotes best mcast next-hop
‘[x/y]’ denotes [preference/metric]
‘%<string>’ in via output denotes VRF <string>
192.168.1.0/24, ubest/mbest: 1/0, attached
    *via 192.168.1.253, Vlan100, [0/0], 00:21:44, direct
192.168.1.253/32, ubest/mbest: 1/0, attached
    *via 192.168.1.253, Vlan100, [0/0], 00:21:44, local
IP Route Table for VRF “BBB”
‘*’ denotes best ucast next-hop
‘**’ denotes best mcast next-hop
‘[x/y]’ denotes [preference/metric]
‘%<string>’ in via output denotes VRF <string>
192.168.2.0/24, ubest/mbest: 1/0, attached
    *via 192.168.2.253, Vlan200, [0/0], 00:21:44, direct
192.168.2.253/32, ubest/mbest: 1/0, attached
    *via 192.168.2.253, Vlan200, [0/0], 00:21:44, local

設定変更

NexusではIOSと異なり、staticによるVRF Routeleakを実施することができません。
そのため、MP-BGPを使用してroute-targetによるタグを利用してRouteleakを実現します。
※どうやら機能的には可能みたいですが、負荷が非常に高くなるため設定できないようにされているようです。おそらく隠しコマンドがあるはず…?余談でした。

設定方法は以下の段取りで行います。

①BGPの起動

feature bgp
route-map ALL permit 10
!
router bgp 65535
vrf AAA
address-family ipv4 unicast
redistribute direct route-map ALL
!
router bgp 65535
vrf BBB
address-family ipv4 unicast
redistribute direct route-map ALL

route-targetはMP-BGPの拡張コミュニティ属性を使用するためBGPを使います。
そのためfeatureコマンドでbgpを有効にする必要があります。
また、BGPのテーブルに載せたルート情報をさらにタグ付けすることでVRF間での経路情報を共有を実現しているため、Routeleakさせたい経路を含むセグメントを一度全てBGPへ再配布する必要があります。

そのため、コマンド例のように ALLという名前のroute-mapを使用してdirect(connected)をBGPに再配布しています。これによってVRF:AAAでいう以下の情報がBGPへ再配布されました。
[再配布された経路(show ip route vrf allより抜粋)]
192.168.1.0/24, ubest/mbest: 1/0, attached
*via 192.168.1.253, Vlan100, [0/0], 00:21:44, direct

②prefix-listの作成

ip prefix-list AAA-to-BBB seq 10 permit 192.168.1.0/24
ip prefix-list BBB-to-AAA seq 10 permit 192.168.2.0/24
後述するroute-mapのmatch ip addressコマンドに紐づけるprefix-listを定義します。
タグ付けしたいセグメントやIPアドレスはここで指定します。

③route-mapの定義とタグ付け

route-map m-AAA-to-BBB permit 10
match ip address prefix-list AAA-to-BBB
set extcommunity rt 1000:2000

route-map m-BBB-to-AAA permit 20
match ip address prefix-list BBB-to-AAA
set extcommunity rt 2000:1000

タグ付けを行うためのroute-mapを作成します。
match ip address prefix-listコマンドで先ほど作成したprefix-listを選択します。
その後、set extcommunity rtコマンドでタグ付けを行います。
今回は以下のような採番ルールとしました。
・1000→AAA、2000→BBB
・X:Y→Xは配布元のVRF名、Yは配布先のVRF名とする

④エクスポート及びインポートのルートターゲットの作成

vrf context AAA
address-family ipv4 unicast
export map m-AAA-to-BBB
route-target import 2000:1000
!
vrf context BBB
address-family ipv4 unicast
export map m-BBB-to-AAA
route-target import 1000:2000
各VRFコンテキストに入った後、タグ付けを行います。
export mapコマンドで先ほど作成したroute-mapを指定します。これが、route-target exportコマンド代わりになります。
また、挿入させたいルートのタグを、route-target importコマンドで定義します。

事後確認

①show runを取得(※後述しますが、interface vlan100,200にhsrpの設定が抜けてました)

Nexus-1# show runnNexus-1# show running-config
!Command: show running-config
!Running configuration last done at: Wed Mar 15 14:59:31 2023
!Time: Wed Mar 15 15:02:45 2023
version 10.3(1) Bios:version
hostname Nexus-1
vdc Nexus-1 id 1
  limit-resource vlan minimum 16 maximum 4094
  limit-resource vrf minimum 2 maximum 4096
  limit-resource port-channel minimum 0 maximum 511
  limit-resource m4route-mem minimum 58 maximum 58
  limit-resource m6route-mem minimum 8 maximum 8
feature sftp-server
cfs eth distribute
feature bgp
feature interface-vlan
feature hsrp
feature lacp
feature vpc
no password strength-check
username admin password 5 $5$ICPCEP$AeZr1hMgjBsbSe55y9hhvMaUJHy/pMuV/a.neHCLD4C  role network-admin
username cisco password 5 $5$NNGKBI$L/Vcw3fHBztmmFTqszmwRMKudNj0j.lC5jYJBE./tZA  role network-admin
username cisco passphrase  lifetime 99999 warntime 14 gracetime 3
ip domain-lookup
copp profile strict
snmp-server user admin network-admin auth md5 49436605AF5246C441270214679480FF88A3 priv aes-128 330D517180938A1CD0E9948AAE2401221D74 localizedV2key
snmp-server user cisco network-admin auth md5 52234D72C03863BC03266B092CB18AEB9DAB priv aes-128 165E0E21A4BBB622BA84E1CAFB675628102B localizedV2key
rmon event 1 log trap public description FATAL(1) owner PMON@FATAL
rmon event 2 log trap public description CRITICAL(2) owner PMON@CRITICAL
rmon event 3 log trap public description ERROR(3) owner PMON@ERROR
rmon event 4 log trap public description WARNING(4) owner PMON@WARNING
rmon event 5 log trap public description INFORMATION(5) owner PMON@INFO
vlan 1,100,200
vlan 100
  name peer-link
ip prefix-list AAA-to-BBB seq 10 permit 192.168.1.0/24
ip prefix-list BBB-to-AAA seq 10 permit 192.168.2.0/24
route-map ALL permit 10
route-map m-AAA-to-BBB permit 10
  match ip address prefix-list AAA-to-BBB
  set extcommunity rt 1000:2000
route-map m-BBB-to-AAA permit 20
  match ip address prefix-list BBB-to-AAA
  set extcommunity rt 2000:1000
vrf context AAA
  address-family ipv4 unicast
    route-target import 2000:1000
    export map m-AAA-to-BBB
vrf context BBB
  address-family ipv4 unicast
    route-target import 1000:2000
    export map m-BBB-to-AAA
vrf context management
vpc domain 1
  peer-switch
  role priority 100
  peer-keepalive destination 172.16.10.2
  peer-gateway
  auto-recovery
  ip arp synchronize
interface Vlan1
  no ip redirects
  no ipv6 redirects
interface Vlan100
  no shutdown
  vrf member AAA
  no ip redirects
  ip address 192.168.1.252/24
  no ipv6 redirects
interface Vlan200
  no shutdown
  vrf member BBB
  no ip redirects
  ip address 192.168.2.252/24
  no ipv6 redirects
interface port-channel1
  switchport mode trunk
  switchport trunk native vlan 100
  switchport trunk allowed vlan 100,200
  spanning-tree port type network
  vpc peer-link
interface Ethernet1/1
  switchport mode trunk
  switchport trunk native vlan 100
  switchport trunk allowed vlan 100,200
  spanning-tree port type network
  channel-group 1 mode active
interface Ethernet1/2
  switchport mode trunk
  switchport trunk native vlan 100
  switchport trunk allowed vlan 100,200
  spanning-tree port type network
  channel-group 1 mode active
interface Ethernet1/3
  switchport mode trunk
  switchport access vlan 100
  switchport trunk native vlan 100
  switchport trunk allowed vlan 100,200
interface mgmt0
  vrf member management
  ip address 172.16.10.1/24
icam monitor scale
line console
line vty
boot nxos bootflash:/nxos64-cs.10.3.1.F.bin
router bgp 65535
  vrf AAA
    address-family ipv4 unicast
      redistribute direct route-map ALL
  vrf BBB
    address-family ipv4 unicast
      redistribute direct route-map ALL
nexus-2# show runnexus-2# show running-config
!Command: show running-config
!Running configuration last done at: Wed Mar 15 15:08:59 2023
!Time: Wed Mar 15 15:09:51 2023
version 10.3(1) Bios:version
hostname nexus-2
vdc nexus-2 id 1
  limit-resource vlan minimum 16 maximum 4094
  limit-resource vrf minimum 2 maximum 4096
  limit-resource port-channel minimum 0 maximum 511
  limit-resource m4route-mem minimum 58 maximum 58
  limit-resource m6route-mem minimum 8 maximum 8
feature sftp-server
cfs eth distribute
feature bgp
feature interface-vlan
feature hsrp
feature lacp
feature vpc
no password strength-check
username admin password 5 $5$NMPAMN$CM7.rnb9gqpDEDDD0f438Bzpx45hMIRAF3rCOQ/TeE4  role network-admin
username cisco password 5 $5$AIPLEN$1uwbCGw37V9.K3LCKur5rmy8BnzyBryC8zftez8KDg3  role network-admin
username cisco passphrase  lifetime 99999 warntime 14 gracetime 3
ip domain-lookup
copp profile strict
snmp-server user admin network-admin auth md5 367B37472D7E496B023DB7A25281F4BAADAD priv aes-128 2141334232116C664963E5B644D0F5BE85DC localizedV2key
snmp-server user cisco network-admin auth md5 01731260551D6E2B713A8EB2588FA4F9BDEA priv aes-128 005054751F4F3C72525EA2984AD4A6E0B6E8 localizedV2key
rmon event 1 log trap public description FATAL(1) owner PMON@FATAL
rmon event 2 log trap public description CRITICAL(2) owner PMON@CRITICAL
rmon event 3 log trap public description ERROR(3) owner PMON@ERROR
rmon event 4 log trap public description WARNING(4) owner PMON@WARNING
rmon event 5 log trap public description INFORMATION(5) owner PMON@INFO
vlan 1,100,200
vlan 100
  name peer-link
ip prefix-list AAA-to-BBB seq 10 permit 192.168.1.0/24
ip prefix-list BBB-to-AAA seq 10 permit 192.168.2.0/24
route-map ALL permit 10
route-map m-AAA-to-BBB permit 10
  match ip address prefix-list AAA-to-BBB
  set extcommunity rt 1000:2000
route-map m-BBB-to-AAA permit 20
  match ip address prefix-list BBB-to-AAA
  set extcommunity rt 2000:1000
vrf context AAA
  address-family ipv4 unicast
    route-target import 2000:1000
    export map m-AAA-to-BBB
vrf context BBB
  address-family ipv4 unicast
    route-target import 1000:2000
    export map m-BBB-to-AAA
vrf context management
vpc domain 1
  peer-switch
  role priority 200
  peer-keepalive destination 172.16.10.1
  peer-gateway
  auto-recovery
  ip arp synchronize
interface Vlan1
  no ip redirects
  no ipv6 redirects
interface Vlan100
  no shutdown
  vrf member AAA
  no ip redirects
  ip address 192.168.1.253/24
  no ipv6 redirects
interface Vlan200
  no shutdown
  vrf member BBB
  no ip redirects
  ip address 192.168.2.253/24
  no ipv6 redirects
interface port-channel1
  switchport mode trunk
  switchport trunk native vlan 100
  switchport trunk allowed vlan 100,200
  spanning-tree port type network
  vpc peer-link
interface Ethernet1/1
  switchport mode trunk
  switchport trunk native vlan 100
  switchport trunk allowed vlan 100,200
  spanning-tree port type network
  channel-group 1 mode active
interface Ethernet1/2
  switchport mode trunk
  switchport trunk native vlan 100
  switchport trunk allowed vlan 100,200
  spanning-tree port type network
  channel-group 1 mode active
interface Ethernet1/3
  switchport mode trunk
  switchport access vlan 200
  switchport trunk native vlan 100
  switchport trunk allowed vlan 100,200
interface mgmt0
  vrf member management
  ip address 172.16.10.2/24
icam monitor scale
line console
line vty
boot nxos bootflash:/nxos64-cs.10.3.1.F.bin
router bgp 65535
  vrf AAA
    address-family ipv4 unicast
      redistribute direct route-map ALL
  vrf BBB
    address-family ipv4 unicast
      redistribute direct route-map ALL

②show ip route vrf allでルーティングテーブルの状態を確認

Nexus-1# show ip route vfrNexus-1# show ip route vrf allNexus-1# show ip route vrf all
IP Route Table for VRF “default”
‘*’ denotes best ucast next-hop
‘**’ denotes best mcast next-hop
‘[x/y]’ denotes [preference/metric]
‘%<string>’ in via output denotes VRF <string>
IP Route Table for VRF “management”
‘*’ denotes best ucast next-hop
‘**’ denotes best mcast next-hop
‘[x/y]’ denotes [preference/metric]
‘%<string>’ in via output denotes VRF <string>
172.16.10.0/24, ubest/mbest: 1/0, attached
    *via 172.16.10.1, mgmt0, [0/0], 00:19:36, direct
172.16.10.1/32, ubest/mbest: 1/0, attached
    *via 172.16.10.1, mgmt0, [0/0], 00:19:36, local
IP Route Table for VRF “AAA”
‘*’ denotes best ucast next-hop
‘**’ denotes best mcast next-hop
‘[x/y]’ denotes [preference/metric]
‘%<string>’ in via output denotes VRF <string>
192.168.1.0/24, ubest/mbest: 1/0, attached
    *via 192.168.1.252, Vlan100, [0/0], 00:16:10, direct
192.168.1.252/32, ubest/mbest: 1/0, attached
    *via 192.168.1.252, Vlan100, [0/0], 00:16:10, local
192.168.2.0/24, ubest/mbest: 1/0, attached
    *via 192.168.2.252%BBB, Vlan200, [20/0], 00:02:47, bgp-65535, external, tag 65535
IP Route Table for VRF “BBB”
‘*’ denotes best ucast next-hop
‘**’ denotes best mcast next-hop
‘[x/y]’ denotes [preference/metric]
‘%<string>’ in via output denotes VRF <string>
192.168.1.0/24, ubest/mbest: 1/0, attached
    *via 192.168.1.252%AAA, Vlan100, [20/0], 00:02:47, bgp-65535, external, tag 65535
192.168.2.0/24, ubest/mbest: 1/0, attached
    *via 192.168.2.252, Vlan200, [0/0], 00:16:07, direct
192.168.2.252/32, ubest/mbest: 1/0, attached
    *via 192.168.2.252, Vlan200, [0/0], 00:16:07, local
nexus-2# show ip route vrf alnexus-2# show ip route vrf all
IP Route Table for VRF “default”
‘*’ denotes best ucast next-hop
‘**’ denotes best mcast next-hop
‘[x/y]’ denotes [preference/metric]
‘%<string>’ in via output denotes VRF <string>
IP Route Table for VRF “management”
‘*’ denotes best ucast next-hop
‘**’ denotes best mcast next-hop
‘[x/y]’ denotes [preference/metric]
‘%<string>’ in via output denotes VRF <string>
172.16.10.0/24, ubest/mbest: 1/0, attached
    *via 172.16.10.2, mgmt0, [0/0], 00:27:15, direct
172.16.10.2/32, ubest/mbest: 1/0, attached
    *via 172.16.10.2, mgmt0, [0/0], 00:27:15, local
IP Route Table for VRF “AAA”
‘*’ denotes best ucast next-hop
‘**’ denotes best mcast next-hop
‘[x/y]’ denotes [preference/metric]
‘%<string>’ in via output denotes VRF <string>
192.168.1.0/24, ubest/mbest: 1/0, attached
    *via 192.168.1.253, Vlan100, [0/0], 00:23:56, direct
192.168.1.253/32, ubest/mbest: 1/0, attached
    *via 192.168.1.253, Vlan100, [0/0], 00:23:56, local
192.168.2.0/24, ubest/mbest: 1/0, attached
    *via 192.168.2.253%BBB, Vlan200, [20/0], 00:01:09, bgp-65535, external, tag 65535
IP Route Table for VRF “BBB”
‘*’ denotes best ucast next-hop
‘**’ denotes best mcast next-hop
‘[x/y]’ denotes [preference/metric]
‘%<string>’ in via output denotes VRF <string>
192.168.1.0/24, ubest/mbest: 1/0, attached
    *via 192.168.1.253%AAA, Vlan100, [20/0], 00:01:09, bgp-65535, external, tag 65535
192.168.2.0/24, ubest/mbest: 1/0, attached
    *via 192.168.2.253, Vlan200, [0/0], 00:23:56, direct
192.168.2.253/32, ubest/mbest: 1/0, attached
    *via 192.168.2.253, Vlan200, [0/0], 00:23:56, local
赤字のように、各VRFのルーティングテーブルで異なるVRFからのルートが表示されるようになりました。

③hsrp設定完了後のshow ip route vrf allの出力

hsrpの設定を忘れていたので設定完了後に再度取得したものを載せます

Nexus-1# Nexus-1# show ip route vrf all
IP Route Table for VRF “default”
‘*’ denotes best ucast next-hop
‘**’ denotes best mcast next-hop
‘[x/y]’ denotes [preference/metric]
‘%<string>’ in via output denotes VRF <string>
IP Route Table for VRF “management”
‘*’ denotes best ucast next-hop
‘**’ denotes best mcast next-hop
‘[x/y]’ denotes [preference/metric]
‘%<string>’ in via output denotes VRF <string>
172.16.10.0/24, ubest/mbest: 1/0, attached
    *via 172.16.10.1, mgmt0, [0/0], 01:10:50, direct
172.16.10.1/32, ubest/mbest: 1/0, attached
    *via 172.16.10.1, mgmt0, [0/0], 01:10:50, local
IP Route Table for VRF “AAA”
‘*’ denotes best ucast next-hop
‘**’ denotes best mcast next-hop
‘[x/y]’ denotes [preference/metric]
‘%<string>’ in via output denotes VRF <string>
192.168.1.0/24, ubest/mbest: 1/0, attached
    *via 192.168.1.252, Vlan100, [0/0], 01:07:24, direct
192.168.1.252/32, ubest/mbest: 1/0, attached
    *via 192.168.1.252, Vlan100, [0/0], 01:07:24, local
192.168.1.254/32, ubest/mbest: 1/0, attached
    *via 192.168.1.254, Vlan100, [0/0], 00:11:30, hsrp
192.168.2.0/24, ubest/mbest: 1/0, attached
    *via 192.168.2.252%BBB, Vlan200, [20/0], 00:54:01, bgp-65535, external, tag 65535
IP Route Table for VRF “BBB”
‘*’ denotes best ucast next-hop
‘**’ denotes best mcast next-hop
‘[x/y]’ denotes [preference/metric]
‘%<string>’ in via output denotes VRF <string>
192.168.1.0/24, ubest/mbest: 1/0, attached
    *via 192.168.1.252%AAA, Vlan100, [20/0], 00:54:01, bgp-65535, external, tag 65535
192.168.2.0/24, ubest/mbest: 1/0, attached
    *via 192.168.2.252, Vlan200, [0/0], 01:07:21, direct
192.168.2.252/32, ubest/mbest: 1/0, attached
    *via 192.168.2.252, Vlan200, [0/0], 01:07:21, local
192.168.2.254/32, ubest/mbest: 1/0, attached
    *via 192.168.2.254, Vlan200, [0/0], 00:09:07, hsrp
Nexus-2# show ip route vrf all
IP Route Table for VRF “default”
‘*’ denotes best ucast next-hop
‘**’ denotes best mcast next-hop
‘[x/y]’ denotes [preference/metric]
‘%<string>’ in via output denotes VRF <string>
IP Route Table for VRF “management”
‘*’ denotes best ucast next-hop
‘**’ denotes best mcast next-hop
‘[x/y]’ denotes [preference/metric]
‘%<string>’ in via output denotes VRF <string>
172.16.10.0/24, ubest/mbest: 1/0, attached
    *via 172.16.10.2, mgmt0, [0/0], 01:10:57, direct
172.16.10.2/32, ubest/mbest: 1/0, attached
    *via 172.16.10.2, mgmt0, [0/0], 01:10:57, local
IP Route Table for VRF “AAA”
‘*’ denotes best ucast next-hop
‘**’ denotes best mcast next-hop
‘[x/y]’ denotes [preference/metric]
‘%<string>’ in via output denotes VRF <string>
192.168.1.0/24, ubest/mbest: 1/0, attached
    *via 192.168.1.253, Vlan100, [0/0], 01:07:38, direct
192.168.1.253/32, ubest/mbest: 1/0, attached
    *via 192.168.1.253, Vlan100, [0/0], 01:07:38, local
192.168.1.254/32, ubest/mbest: 1/0, attached
    *via 192.168.1.254, Vlan100, [0/0], 00:11:26, hsrp
192.168.2.0/24, ubest/mbest: 1/0, attached
    *via 192.168.2.253%BBB, Vlan200, [20/0], 00:44:51, bgp-65535, external, tag 65535
IP Route Table for VRF “BBB”
‘*’ denotes best ucast next-hop
‘**’ denotes best mcast next-hop
‘[x/y]’ denotes [preference/metric]
‘%<string>’ in via output denotes VRF <string>
192.168.1.0/24, ubest/mbest: 1/0, attached
    *via 192.168.1.253%AAA, Vlan100, [20/0], 00:44:51, bgp-65535, external, tag 65535
192.168.2.0/24, ubest/mbest: 1/0, attached
    *via 192.168.2.253, Vlan200, [0/0], 01:07:38, direct
192.168.2.253/32, ubest/mbest: 1/0, attached
    *via 192.168.2.253, Vlan200, [0/0], 01:07:38, local
192.168.2.254/32, ubest/mbest: 1/0, attached
    *via 192.168.2.254, Vlan200, [0/0], 00:09:45, hsrp

疎通確認

VRF間で無事に目的のセグメントをRouteleakできたので
alpine-1から他のalpineに対して疎通してみましょう。

alpine-1からalpine-2へのping(成功)

alpine-1からalpine-4へのping(成功)

alpine-1からalpine-3へのping(成功) ※元々疎通できます。

まとめ

・VRF Routeleakで異なるVRFの疎通は可能
・特定の経路のみを配布したい場合はroute-mapを使用したタグ付けが必要
・NX-OS搭載機器ではBGPによるVRF Routeleakしか出来ない

[参考]
https://www.cisco.com/c/ja_jp/support/docs/ios-nx-os-software/nx-os-software/213908-configure-vrf-route-leak-on-nexus.html

コメント