Академический Документы
Профессиональный Документы
Культура Документы
CSR1000V VXLAN
LABDCN-3016
Alejandro Marino – Customer Support Engineer, Services
1|Page
Table of Contents
INTRODUCTION ................................................................................................................................................ 3
PREREQUISITES ................................................................................................................................................ 4
Requirements ......................................................................................................................... 4
Limitations ............................................................................................................................. 4
Components Used .................................................................................................................. 4
Definitions.............................................................................................................................. 4
DISCLAIMER ...................................................................................................................................................... 4
LAB ACCESS ....................................................................................................................................................... 5
Access Details and Login Credentials ................................................................................... 5
LAB TOPOLOGY AND ADDRESSING ........................................................................................................... 8
Pod and VLAN Assignment .................................................................................................. 8
IP Addressing ......................................................................................................................... 8
Network Diagram................................................................................................................... 8
Logging into vCenter and network devices ........................................................................... 8
vCenter ............................................................................................................................... 8
Network Devices ................................................................................................................ 9
TASK 1: INFRASTRUCTURE ROUTER ....................................................................................................... 10
TASK 2: SITE 1 INFRASTRUCTURE VIRTUAL SWITCH (NEXUS 1000V) .......................................... 11
Task 2.1: Site 1 Nexus 1000v Port-Profile Configuration ................................................... 11
TASK 3: SITE 1 CLOUD SERVICE ROUTER .............................................................................................. 13
Task 3.1: CSR Networking Configuration........................................................................... 14
Task 3.2: CSR Networking Configuration........................................................................... 17
TASK 4: SITE 2 NEXUS 1000V CONFIGURATION .................................................................................... 18
Task 4.1: VxLAN Configuration ......................................................................................... 18
TASK 5: VERIFICATION ................................................................................................................................ 24
Verify the backbone router IP PIM configuration: .......................................................... 25
Verify the backbone router sees the IGMP Group messages from the Site 2 Nexus
1000V hypervisor physical interfaces:............................................................................. 26
Verify the CSR1000 has a PIM adjacency to the backbone router and contains a route to
the 239.1.119.150 group .................................................................................................. 26
Verify the NVE is up and a peering to the Site 2 hypervisor host VMK (11.1.119.74) has
been formed: .................................................................................................................... 27
Verify the CSR1000 forwarding table: ............................................................................ 27
Verify the Site2 hypervisor host has been programmed correctly and the Mcast statistics
are incrementing............................................................................................................... 28
2|Page
Introduction
This document describes configuring VxLAN (Virtual eXtensible Local Area Network) between the
Cisco Nexus 1000V Virtual Switch and Cloud Services Router 1000V in multicast VTEP distribution
mode. VxLAN creates a Layer 2 overlay network allowing for network isolation though a
standardized protocol.
This feature enables the Cisco CSR 1000V to act as a Layer 2 VxLAN gateway to provide support to
bridge traffic across VxLAN segments in a hypervisor and on VLANs on physical servers. The
CSR1000V supplements the Cisco Nexus 1000V VxLAN Gateway feature with the ability to add Layer
3 and VPN services.
3|Page
Prerequisites
Requirements
Cisco Nexus 1000V Virtual Switch Version 5.2(1)SV3(1.6) or later
Cisco Cloud Service Router 1000V 3.17.00.S / 15.6(1)S
A multicast enabled & aware network
Limitations
The CSR 1000V only supports multicast VTEP learning. Unicast & BGP VTEP distributions are
not supported.
Nexus 1000V versions prior to SV3(1.1) use UDP/8472 for VxLAN VTEP distribution. This is a
static setting which cannot be modified. If using one of these earlier versions, modify the
CSR1000V VxLAN port with the command "vxlan udp port 8472". Starting in version
SV3(1.1), the IANA assigned port of 4789 is the default.
Components Used
All virtual components (CSR, N1000V, Virtual Machines) are hosted behind an infrastructure
Nexus 1000V Virtual Switch.
A Nexus 5500 Series switch with L3 module connects all physical servers.
Definitions
VTEP - VXLAN uses VXLAN tunnel endpoint (VTEP) devices to map tenants' end devices to
VXLAN segments and to perform VXLAN encapsulation and de-encapsulation.
NVE - The Network Virtualization Endpoint to maps a VNI (VxLAN ID) to a multicast group
and a VTEP.
VNI - VXLAN uses a 24-bit segment ID known as the VXLAN network identifier (VNID).
Disclaimer
This training document is to familiarize with the deployment of VXLAN on the Nexus 1000V and
CSR1000V VXLAN. Although the lab design and configuration examples could be used as a reference,
it’s not a real design, thus not all recommended features are used, or enabled optimally. For the
design related questions please contact your representative at Cisco, or a Cisco partner.
4|Page
Lab Access
a.
3. After entering you email and class name, fill out the registration information.
a.
4. Pick a Pod (Note that the instructor will let you know which pod to pick)
5|Page
a.
5. If the pod is not available, wait to become available. Once the pod is available you should be
able to access it.
a.
6. Under the topology diagram, click on the Virtual Center box below to get connect to remote
session.
6|Page
a.
b. The username and password for the remote session is Administrator/ Cisco123
If you have any questions or you are unable to log into the remote session, please reach out to the
instructors for assistance.
7|Page
Lab Topology and Addressing
IP Addressing
IP Addressing
Device IP Address Username password
ESXi vmk0 SITE_1 10.1.119.73 root Cisco123
ESXi vmk0 SITE_2 10.1.119.74 root Cisco123
Nexus 1000v Site 1 10.1.119.75 admin Cisco123
Nexus 1000v Site 2 10.1.119.76 admin Cisco123
CSR1000V Site 1 10.1.119.77 admin Cisco123
PC1 11.1.119.100 Administrator Cisco123
PC2 11.1.119.101 Administrator Cisco123
Network Diagram
vCenter
To Access vCenter double click on the VMware vSphere Client icon ,and then login using Windows
session credentials
8|Page
Network Devices
For access to the Nexus 1000v on Site 1 and Site 2, Nexus 5500 and both ESXi host use the already
saved session in PuTTY.
9|Page
Task 1: Infrastructure Router
The infrastructure router/switch provides physical networking to all hypervisor hosts. Additional
multicast configuration may be required for multi-router topologies.
Refer to “Pod and VLAN Assignment” table for VLAN assignment to the respective pod.
a) Since the CSR1000V is a Layer3 device it will learn routes via PIM. Configure a PIM RP on the
routing device(s) for the backbone network.
b) The Nexus 5500 acts as both a L2 and L3 device therefore an IGMP querier for Site 2 Nexus
1000V must be configured.
c) In the next section a loopback for CSR<-->N1K communication will be provisioned. The
loopback address must be reachable by all VxLAN nodes and therefore advertised into the
routing protocol. Below we configured OSPF between the infrastructure router on
VLAN205X and the CSR1000V GigabitEthernet1 interface.
d) Interface Eth 1/1 will be configured as trunk and allow VLAN 205X, the link speed needs to
be 1G.
a. (where X = Pod# -1 -- see “Pod and VLAN Assignment” table)
From the putty session SSH into the N5K using username and password admin/Cisco123, and
configure it with the configuration below.
Commands:
# Cisco Nexus 5500 - Infrastructure
10 | P a g e
Task 2: Site 1 Infrastructure Virtual Switch (Nexus 1000V)
The CSR and Virtual Machine at Site1 reside behind a Nexus 1000V switch.
Commands:
# Site 1 Nexus 1000v
11 | P a g e
N1K(config-port-prof)# switchport access vlan 206X
N1K(config-port-prof)# no shutdown
N1K(config-port-prof)# description Assigned to VMs in VLAN206X
N1K(config-port-prof)# state enabled
12 | P a g e
Task 3: Site 1 Cloud Service Router
13 | P a g e
Task 3.1: CSR Networking Configuration
1. From vSphere Client, access the settings on the CSR 1000V VM by doing a right click on the
“Site 1 Cloud Services Router” VM.
a.
2. Configure the CSR Network Adapters 1 & 2 with the CSR-vlan205X Port-Profile and Adapter
3 with CSR-vTrunk.
a.
3. Assign port-profile VLAN 206X to “Network adapter 1” of PC1
14 | P a g e
a.
b.
4. Access CSR1000 VM via vSphere Client console and configure an IP address on the
GigabitEthernet1 interface, and create a Loopback0 interface. Here, loopback0’s network
should be advertised over OSPF to the backbone router.
15 | P a g e
a.
Commands
# Site 1 CSR1000v
CSR-1K> enable
CSR-1K# configure terminal
!
CSR-1K(config)# ip multicast-routing distributed
!
CSR-1K(config)# interface Loopback0
CSR-1K(config-if)# ip address 11.119.119.1 255.255.255.0
CSR-1K(config-if)# ip pim sparse-mode
CSR-1K(config-if)# ip ospf network point-to-point
CSR-1K(config-if)# exit
!
CSR-1K(config)# interface GigabitEthernet1
CSR-1K(config-if)# mtu 9216
CSR-1K(config-if)# ip address 11.1.119.30 255.255.255.0
CSR-1K(config-if)# ip pim sparse-mode
CSR-1K(config-if)# ip igmp version 3
CSR-1K(config-if)# negotiation auto
CSR-1K(config-if)# no shutdown
CSR-1K(config-if)# exit
!
CSR-1K(config-router)# router ospf 1
CSR-1K(config-router)# network 11.119.119.0 0.0.0.255 area 0
CSR-1K(config-router)# network 11.1.119.0 0.0.0.255 area 0
CSR-1K(config-router)# exit
!
CSR-1K(config)# ip pim bidir-enable
CSR-1K(config)# ip pim rp-address 11.1.119.254 bidir
CSR-1K(config)# ip pim ssm default
CSR-1K(config)# ip route 0.0.0.0 0.0.0.0 GigabitEthernet1 11.1.119.254
16 | P a g e
Task 3.2: CSR Networking Configuration
In bridge domains the Virtual Network Identifier (VNI) designates the VxLAN Segment ID. This value
is encoded in the VXLAN frame header and must match the segment-id defined in Site2's Nexus
1000V.
The Network Virtualization Endpoint (NVE) maps the VNI (VxLAN ID) to a multicast group and
simultaneously creates a Virtual Tunnel Endpoint (VTEP) bound to the loopback. The VTEP is a
termination endpoint for VxLAN frame encapsulation / decapsulation.
GigabitEthernet3 acts as an 802.1q trunking interface to bridge non-VxLAN frames from virtual
machines into the CSR. As an alternative sub-interfaces could be utilized.
1. Create a bridge domain with VNI 6001. Bind the bridge-domain to GigabitEthernet3 with
service-instance 3.
2. Create a NVE interface mapping the VNI(6001) to the multicast group (239.1.119.150). Bind
nve1 to the loopback0 interface.
3. Add the service instance to GigabitEthernet3. Set the 802.1q VLAN to be encapsulated in
VxLAN. Set a symmetrical rewrite policy.
Commands:
# Site 1 CSR1000v
17 | P a g e
Task 4: Site 2 Nexus 1000v Configuration
Commands:
# Site 2 Nexus 1000v
18 | P a g e
N1K_2(config-port-prof)# vmware port-group
N1K_2(config-port-prof)# switchport mode access
N1K_2(config-port-prof)# switchport access vlan 205X
N1K_2(config-port-prof)# capability vxlan
N1K_2(config-port-prof)# no shutdown
N1K_2(config-port-prof)# state enabled
Screenshots:
a) Assign Port-Profile bd-6001 to network adapter 1 of PC2
a.
b.
19 | P a g e
b) Create VMkernel interface on ESX host in Site 2, assign the VKM-VXLAN Port-Profile and
configure IP address 11.1.119.74 to the VMK.
a. Select host with N1K_2, under Configuration > Networking > vDVS and click “Manage
Virtual Adapters”
i.
b. Click “Add”
i.
c. Click “New Virtual Adapter” then “Next >”
20 | P a g e
i.
d. Click “VMkernel” then “Next >”
i.
e. Select port group “VMK-VXLAN” then “Next >”
21 | P a g e
i.
f. Select “Use the following IP settings” and assign IP address and subnet 11.1.119.74 /
255.255.255.0 then “Next >”, “Finish” and close the “Manage Virtual Adapters”
window.
i.
g. Verify that VMKernel interface was created.
22 | P a g e
i.
23 | P a g e
Task 5: Verification
Access PC1 VM via vSphere Client console, open Window’s Command Prompt, and start a ping to
PC2’s IP 11.1.119.101. (Note: If configuration is correct ping should work.)
24 | P a g e
Commands:
25 | P a g e
Verify the backbone router sees the IGMP Group messages from the Site 2 Nexus 1000V hypervisor
physical interfaces:
N5K# show ip igmp snooping groups 239.1.119.150
Type: S - Static, D - Dynamic, R - Router port, F - Fabricpath core port
Verify the CSR1000 has a PIM adjacency to the backbone router and contains a route to the
239.1.119.150 group
Notice the 'x' flag designating this is a VxLAN multicast group.
26 | P a g e
Verify the NVE is up and a peering to the Site 2 hypervisor host VMK (11.1.119.74) has been formed:
Once traffic is flowing between VTEPs the packet counters will increment.
27 | P a g e
Verify the Site2 hypervisor host has been programmed correctly and the Mcast statistics are
incrementing.
1) From the putty, SSH to ESXi 2
28 | P a g e
Appendix
References
CSR1K Configuration Guide:
http://www.cisco.com/c/en/us/td/docs/routers/csr1000/software/configuration/csr1000Vswcfg.ht
ml
29 | P a g e