SlideShare ist ein Scribd-Unternehmen logo
1 von 48
The Secrets to Scalable Multi-
Tenancy
Lukas Krattiger @CCIE21921
February, 2016
• Introduction
• VXLAN with BGP EVPN
• Multi-Tenancy
• Summary
Agenda
Introduction
Overlay Based Data Center Fabrics
Desirable Attributes:
• Mobility
• Segmentation
• Scale
• Automated & Programmable
• Abstracted consumption models
• Full Cross Sectional Bandwidth
• Layer-2 + Layer-3 Connectivity
• Physical + Virtual
RR RR
Overlay Based Data Center: Edge Devices
Network Overlays Hybrid OverlaysHost Overlays
• Virtual end-points only
• Single admin domain
• VXLAN, NVGRE, STT
• Physical and Virtual
• Resiliency + Scale
• X-Organizations/Federation
• Open Standards
• Router/Switch end-points
• Protocols for Resiliency/Loops
• Traditional VPNs
• VXLAN, OTV, VPLS, LISP, FP
V
V
V
V
V
V
FYI
Overlay Services
• Layer 2
• Layer 3
• Layer 2 and Layer 3
Tunnel Encapsulation
Underlay Transport
Network
Control Plane
• Peer Discovery mechanism
• Route Learning and Distribution
– Local Learning
– Remote Learning
Data Plane
• Overlay Layer 2/Layer 3 Unicast traffic
• Overlay Broadcast, Unknown Unicast,
Multicast traffic (BUM traffic) forwarding
– Ingress Replication
– Multicast
Understanding Overlay Technologies
Local LAN
Segment
Physical
Host
Local LAN
Segment
Physical
Host
Virtual Hosts
Local LAN
Segment
Virtual Switch
Edge Device
Edge Device
Edge Device
IP Interface
IP Fabric Overlay Taxonomy (1)
Local LAN
Segment
Physical
Host
Local LAN
Segment
Physical
Host
Virtual Hosts
Local LAN
Segment
Virtual Switch
VTEP
VTEP
VTEP
VTEP – VXLAN Tunnel End-Point
VNI/VNID – VXLAN Network Identifier
VV
V
Encapsulation
IP Fabric Overlay Taxonomy (2)
VXLAN with BGP EVPN
Optimized Networks with VXLAN
1
Overlay
(VXLAN)Integrated
Route/Bridge
Underlay
BGP
(EVPN)
• Standards based Overlay (VXLAN) with Standards
based Control-Plane (BGP)
• Layer-2 MAC and Layer-3 IP information distribution by
Control-Plane (BGP)
• Forwarding decision based on Control-Plane
(minimizes flooding)
• Integrated Routing/Bridging (IRB) for Optimized
Forwarding in the Overlay
• Multi-Tenancy At Scale
What is VXLAN with BGP EVPN?
Control-
Plane
EVPN MP-BGP - RFC 7432
(draft-ietf-l2vpn-evpn)
Data-
Plane
Multi-Protocol Label Switching
(MPLS)
draft-ietf-l2vpn-evpn
Provider Backbone Bridges
(PBB)
draft-ietf-l2vpn-pbb-evpn
Network Virtualization Overlay
(NVO)
draft-ietf-bess-evpn-overlay
 EVPN over NVO Tunnels (e.g. VXLAN) for Data Center
Fabric encapsulations
 Provides Layer 2 and Layer 3 Overlays over simple IP
Networks
Ethernet VPN – EVPN
ID Title Category
RFC 7348
Virtual eXtensible Local Area Network Data Plane
RFC 7432
BGP MPLS based Ethernet VPNs EVPN Control Plane
draft-ietf-bess-evpn-overlay
A Network Virtualization Overlay Solution using EVPN EVPN Control Plane
draft-ietf-bess-evpn-inter-subnet-forwarding
Integrated Routing and Bridging in EVPN EVPN Control Plane
draft-ietf-bess-evpn-prefix-advertisement
IP Prefix Advertisement in E-VPN EVPN Control Plane
Draft-tissa-nvo3-oam-fm
NVO3 Fault Management Mgmt Plane (OAM)
IETF RFC & Drafts – Implemented by Cisco
FYI
VXLAN Evolution with BGP EVPN
Protocol Learning
• Uses MP-BGP with EVPN
Address family
• Workload MAC and IP
Addresses learnt by VXLAN
Edge Devices (NVEs)
• Advertises Layer-2 and Layer-
3 Address-to-VTEP
Association
• Flood Prevention
• Optimized ARP forwarding
IP Services
• VXLAN Routing
• Distributed Anycast Gateway
Multi-Tenancy
• Route Reflector for Scale
External Connectivity
• VXLAN Hardware Gateway
Redundancy (VPC)
• Integrated physical and
virtual Overlays (Hybrid
Overlays)
• Inter-Pod Connectivity
• VXLAN Gateway to other
Encaps/Networks
Multicast Independent*
• Overlay Control-Plane
provides dynamic VTEP
discovery
• Head-End Replication
enables Unicast-only mode
(aka ingress Replication)
*Multicast Independence requires the usage of the Overlay Control-Plane or static configuration
Overlay with Optimized Routing
Spine
RR RR
V
V
V
V
V
V
EVPN Control Plane -- Host and Subnet Route Distribution
BGP Update
• Host-MAC
• Host-IP
• Internal IP Subnet
• External Prefixes
RR
Route-Reflectors deployed
for scaling purposes (iBGP)
BGP Adjacencies
Border
Overlay with Optimized Routing
Spine
RR RR
V
V
V
V
V
V
EVPN Control Plane -- Host and Subnet Route Distribution
BGP Update
• Host-MAC
• Host-IP
• Internal IP Subnet
• External Prefixes
RR
Route-Reflectors deployed
for scaling purposes (iBGP)
BGP Adjacencies
Border
Scalable Multi-Tenancy with Multiprotocol BGP
EVPN Address-Family: Host MAC+IP, internal/external IP Subnets
BGP enhanced for Fast Convergence at Large Scale
Extensions for Fast and Seamless Host Mobility
Distributed Gateway with Traffic Flow Symmetry
ARP Suppression
Distributed IP Anycast Gateway
Spine
RR RR
V
V
V
V
V
V
SVI 200
SVI 100
SVI 100
SVI 100, Gateway IP: 192.168.1.1
SVI 200, Gateway IP: 10.10.10.1
Host1
MAC: AA:AA:AA:AA:AA:AA
IP: 192.168.1.11
VLAN 100
VXLAN VNI 30001
Host3
MAC: CC:CC:CC:CC:CC:CC
IP: 192.168.1.33
VLAN 100
VXLAN VNI 30001
Host2
MAC: BB:BB:BB:BB:BB:BB
IP: 10.10.10.22
VLAN 200
VXLAN VNI 30002
bridge
route
Distributed IP Anycast Gateway
Spine
RR RR
V
V
V
V
V
V
SVI 200
SVI 100
SVI 100
SVI 100, Gateway IP: 192.168.1.1
SVI 200, Gateway IP: 10.10.10.1
Host1
MAC: AA:AA:AA:AA:AA:AA
IP: 192.168.1.11
VLAN 100
VXLAN VNI 30001
Host3
MAC: CC:CC:CC:CC:CC:CC
IP: 192.168.1.33
VLAN 100
VXLAN VNI 30001
Host2
MAC: BB:BB:BB:BB:BB:BB
IP: 10.10.10.22
VLAN 200
VXLAN VNI 30002
bridge
route
Any Subnet Routed Anywhere – Any VTEP can serve any Subnet
Integrated Route & Bridge (IRB) - Route whenever you can, Bridge when needed
No Hairpinning – Optimized East/West and North/South Routing
Seamless Mobility - All Leaf share same Gateway MAC
Reduced Failure Domain – Layer-2/Layer-3 Boundary at Leaf
Optimal Scalability – Route Distributed & closest to the Host
Multi-Destination Traffic
Ingress Replication
Unicast based Replication
• Source VTEP sends unicast copy to every
Destination VTEP
• Requires only Unicast
• Simples way of Traffic Replication
Multicast
Multicast based Replication
• Source VTEP sends single copy, Multicast
replicates it as needed
• Leverages Multicast Routing (PIM)
• Most optimal way of Traffic Replication
Spine
RR RR
V
V
V
V
V
V
Spine
RR RR
V
V
V
V
V
V
Multi-Tenancy
• A mode of operation, where multiple independent instances (tenant)
operate in a shared environment.
• Each instance (i.e. VRF/VLAN) is logically isolated, but physically
integrated.
What is Multi-Tenancy
Multi-Tenancy at Layer-2
• Per-Switch VLAN-to-VNI
mapping
• Per-Port VLAN Significance
Multi-Tenancy at Layer-3
• VRF-to-VNI mapping
• MP-BGP for scaling with VPNs
Where can we apply Multi-Tenancy
Layer-2 Multi-Tenancy
Spine
RR RR
V
V
V
V
V
V
VLAN 100
VLAN 100
Host1
MAC: AA:AA:AA:AA:AA:AA
IP: 192.168.1.11
VLAN 100
VXLAN VNI 30001
Host3
MAC: CC:CC:CC:CC:CC:CC
IP: 192.168.1.33
VLAN 100
VXLAN VNI 30001
bridge
Layer-2 Multi-Tenancy – Bridge Domains
Host1
MAC: AA:AA:AA:AA:AA:AA
IP: 192.168.1.11
VLAN 100
VXLAN VNI 30001
Host3
MAC: CC:CC:CC:CC:CC:CC
IP: 192.168.1.33
VLAN 100
VXLAN VNI 30001
Leaf
VV
VLAN 100 VLAN 100
VXLAN Overlay
(VNI 30001)
Bridge Domain
Layer-2 Multi-Tenancy – Bridge Domains
Host1
MAC: AA:AA:AA:AA:AA:AA
IP: 192.168.1.11
VLAN 100
VXLAN VNI 30001
Host3
MAC: CC:CC:CC:CC:CC:CC
IP: 192.168.1.33
VLAN 100
VXLAN VNI 30001
Leaf
VV
VLAN 100 VLAN 100
VXLAN Overlay (VNI 30001)
Bridge Domain
The Bridge Domain is the Layer-2 Segment from Host to Host
In VXLAN, the Bridge Domain consists of three Components
1) The Ethernet Segment (VLAN), between Host and Switch
2) The Hardware Resources (Bridge Domain) within the Switch
3) The VXLAN Segment (VNI) between Switch and Switch
VLAN-to-VNI mapping
Host1
MAC: AA:AA:AA:AA:AA:AA
IP: 192.168.1.11
VLAN 100
VXLAN VNI 30001
Host3
MAC: CC:CC:CC:CC:CC:CC
IP: 192.168.1.33
VLAN 100
VXLAN VNI 30001
Leaf
VV
VLAN 100 VLAN 100
VXLAN Overlay
(VNI 30001)
Host2
MAC: BB:BB:BB:BB:BB:BB
IP: 192.168.1.22
VLAN 100
VXLAN VNI 30001
Leaf#1
vlan 100
vn-segment 30001
Leaf#2
vlan 100
vn-segment 30001
• VLAN to VNI configuration on a
per-switch basis
• VLAN becomes “Switch Local
Identifier”
• VNI becomes “Network Global
Identifier”
CLI Modes - VLAN based (per-Switch)
FYI
Per-Switch VLAN-to-VNI mapping
Host1
MAC: AA:AA:AA:AA:AA:AA
IP: 192.168.1.11
VLAN 100
VXLAN VNI 30001
Host3
MAC: CC:CC:CC:CC:CC:CC
IP: 192.168.1.33
VLAN 200
VXLAN VNI 30001
Leaf
VV
VLAN 100 VLAN 200
VXLAN Overlay
(VNI 30001)
Host2
MAC: BB:BB:BB:BB:BB:BB
IP: 192.168.1.22
VLAN 100
VXLAN VNI 30001
Leaf#1
vlan 100
vn-segment 30001
Leaf#2
vlan 200
vn-segment 30001
• VLAN to VNI configuration on a
per-switch basis
• VLAN becomes “Switch Local
Identifier”
• VNI becomes “Network Global
Identifier”
• 4k VLAN limitation has been
removed
CLI Modes - VLAN based (per-Switch)
FYI
Per-Port VLAN-to-VNI mapping
Host1
MAC: AA:AA:AA:AA:AA:AA
IP: 192.168.1.11
VLAN 100
VXLAN VNI 30001
Host3
MAC: CC:CC:CC:CC:CC:CC
IP: 192.168.1.33
VLAN 300
VXLAN VNI 30001
Leaf
VV
VLAN 100 VLAN 300
VXLAN Overlay
(VNI 30001)
Host2
MAC: BB:BB:BB:BB:BB:BB
IP: 192.168.1.22
VLAN 200
VXLAN VNI 30001
VLAN 200
Leaf#1
vlan 2500
vn-segment 30001
interface Ethernet 1/8
switchport mode trunk
switchport vlan mapping enable
switchport vlan mapping 100 2500
interface Ethernet 1/9
switchport mode trunk
switchport vlan mapping enable
switchport vlan mapping 200 2500
CLI Modes - VLAN based (per-Port)
FYI
Leaf#1
bridge-domain 100
member vni 30001
encapsulation profile vni VLAN100-30001
dot1q 100 vni 30001
encapsulation profile vni VLAN200-30001
dot1q 200 vni 30001
CLI Modes - Bridge-Domain based (per-Port)
interface Ethernet 1/8
no switchport
service instance 1 vni
encapsulation profile VLAN100-30001 default
interface Ethernet 1/9
no switchport
service instance 1 vni
encapsulation profile VLAN200-30001 default
FYI
Layer-3 Multi-Tenancy
Spine
RR RR
V
V
V
V
V
V
SVI 200
SVI 100
VRF-A (VNI 50001)
VRF-B (VNI 50002)
SVI 100, Gateway IP: 192.168.1.1 (VRF-A)
SVI 200, Gateway IP: 10.10.10.1 (VRF-B)
SVI 300, Gateway IP: 172.16.1.1 (VRF-B)
Host1
IP: 192.168.1.11 (VRF-A)
VLAN 100
Host3
IP: 172.16.1.33 (VRF-B)
VLAN 300
Host2
IP: 10.10.10.22 (VRF-B)
VLAN 200
SVI 300
route
route
Layer-3 Multi-Tenancy – VRF-VNI or L3VNI
Host1
IP: 192.168.1.11 (VRF-A)
VLAN 100
Host3
IP: 172.16.1.33 (VRF-B)
VLAN 300
Leaf
VV
SVI 100
V
Host2
IP: 10.10.10.22 (VRF-B)
VLAN 200
SVI 200 SVI 300
VRF-A
(VNI 50001)
VRF-B
(VNI 50002)
Routing
Domain
VRF-B
Routing
Domain
VRF-A
Layer-3 Multi-Tenancy – VRF-VNI or L3VNI
Host1
IP: 192.168.1.11 (VRF-A)
VLAN 100
Host3
IP: 172.16.1.33 (VRF-B)
VLAN 300
Leaf
VV
VLAN 100
V
Host2
IP: 10.10.10.22 (VRF-B)
VLAN 200
SVI 200 SVI 300
VRF-A
(VNI 50001)
VRF-B
(VNI 50002)
Routing
Domain
VRF-B
Routing
Domain
VRF-A
The Routing Domain is the VRF owning multiple Subnets across multiple Switches
In VXLAN EVPN, the Routing Domain consists of three Components
1) The Routing Domains (VRF), local to the Switch
2) The Routing Domain (L3VNI) between the Switches
3) Multi-Protocol BGP with EVPN Address-Family
Layer-3 Multi-Tenancy – VRF-Lite
Leaf
VV
SVI 300SVI 200SVI 100
Subnet1
IP: 192.168.1.0/24 (VRF-A)
VLAN 100
Subnet2
IP: 10.10.10.0/24 (VRF-B)
VLAN 200
Subnet3
IP: 172.16.1.0/24 (VRF-B)
VLAN 300
Host4
IP: 10.44.44.0/24 (VRF
VLAN 400
SVI 400
VLAN 1002
VLAN 1001
Ethernet
Layer-3 Multi-Tenancy – VRF-Lite
Leaf
VV
SVI 300SVI 200SVI 100 SVI 400
VLAN 1002
VLAN 1001
Ethernet
Subnet1
IP: 192.168.1.0/24 (VRF-A)
VLAN 100
Subnet2
IP: 10.10.10.0/24 (VRF-B)
VLAN 200
Subnet3
IP: 172.16.1.0/24 (VRF-B)
VLAN 300
Host4
IP: 10.44.44.0/24 (VRF
VLAN 400
vrf context VRF-A
interface eth1/10.1001
encapsulation dot1q 1001
vrf member VRF-A
ip address 10.1.1.1/24
ip router ospf 100 area 0.0.0.0
router ospf 100
vrf VRF-A
vrf context VRF-B
interface eth1/10.1002
encapsulation dot1q 1002
vrf member VRF-B
ip address 10.2.2.1/24
ip router ospf 100 area 0.0.0.0
router ospf 100
vrf VRF-B
vrf context VRF-B
interface eth1/10.1002
encapsulation dot1q 1002
vrf member VRF-B
ip address 10.2.2.2/24
ip router ospf 100 area 0.0.0.0
router ospf 100
vrf VRF-B
vrf context VRF-A
interface eth1/10.1001
encapsulation dot1q 1001
vrf member VRF-A
ip address 10.1.1.2/24
ip router ospf 100 area 0.0.0.0
router ospf 100
vrf VRF-A
FYI
Layer-3 Multi-Tenancy – MPLS L3VPN
Leaf
VV
SVI 300SVI 200SVI 100 SVI 400
VPN Label “Red”
VPN Label “Blue”
MPLS
Subnet1
IP: 192.168.1.0/24 (VRF-A)
VLAN 100
Subnet2
IP: 10.10.10.0/24 (VRF-B)
VLAN 200
Subnet3
IP: 172.16.1.0/24 (VRF-B)
VLAN 300
Host4
IP: 10.44.44.0/24 (VRF
VLAN 400
Layer-3 Multi-Tenancy – MPLS L3VPN
Leaf
VV
SVI 300SVI 200SVI 100 SVI 400
VPN Label “Red”
VPN Label “Blue”
MPLS
Subnet1
IP: 192.168.1.0/24 (VRF-A)
VLAN 100
Subnet2
IP: 10.10.10.0/24 (VRF-B)
VLAN 200
Subnet3
IP: 172.16.1.0/24 (VRF-B)
VLAN 300
Host4
IP: 10.44.44.0/24 (VRF
VLAN 400
vrf context VRF-A
rd 1.1.1.1:100
address-family ipv4 unicast
route-target import 100:100
route-target export 100:100
vrf context VRF-B
rd 1.1.1.1:200
address-family ipv4 unicast
route-target import 200:200
route-target export 200:200
vrf context VRF-B
rd 1.1.1.2:200
address-family ipv4 unicast
route-target import 200:200
route-target export 200:200
vrf context VRF-A
rd 1.1.1.2:100
address-family ipv4 unicast
route-target import 100:100
route-target export 100:100
router bgp 65500
address-family ipv4 unicast
neighbor 1.1.1.2 remote-as 65500
address-family vpnv4 unicast
send-community extended
vrf VRF-A
address-family ipv4 unicast
vrf VRF-B
address-family ipv4 unicast
router bgp 65500
address-family ipv4 unicast
neighbor 1.1.1.1 remote-as 65500
address-family vpnv4 unicast
send-community extended
vrf VRF-A
address-family ipv4 unicast
vrf VRF-B
address-family ipv4 unicast
FYI
Layer-3 Multi-Tenancy – VXLAN EVPN
Leaf
VV
SVI 300SVI 200SVI 100
Host1
MAC: AA:AA:AA:AA:AA:AA
IP: 192.168.1.11 (VRF-A)
VLAN 100
VXLAN VNI 30001
Host2
MAC: BB:BB:BB:BB:BB:BB
IP: 10.10.10.22 (VRF-B)
VLAN 200
VXLAN VNI 30002
Host3
MAC: CC:CC:CC:CC:CC:CC
IP: 172.16.1.33 (VRF-B)
VLAN 300
VXLAN VNI 30003
Host4
MAC: DD:DD:DD:DD:DD
IP: 10.44.44.44 (VRF-A)
VLAN 400
VXLAN VNI 30004
SVI 400
L3VNI 50002
L3VNI 50001
VXLAN
Layer-3 Multi-Tenancy – VXLAN EVPN
Leaf
VV
SVI 300SVI 200SVI 100 SVI 400
L3VNI 50002
L3VNI 50001
VXLAN
Host1
MAC: AA:AA:AA:AA:AA:AA
IP: 192.168.1.11 (VRF-A)
VLAN 100
VXLAN VNI 30001
Host2
MAC: BB:BB:BB:BB:BB:BB
IP: 10.10.10.22 (VRF-B)
VLAN 200
VXLAN VNI 30002
Host3
MAC: CC:CC:CC:CC:CC:CC
IP: 172.16.1.33 (VRF-B)
VLAN 300
VXLAN VNI 30003
Host4
MAC: DD:DD:DD:DD:DD
IP: 10.44.44.44 (VRF-A)
VLAN 400
VXLAN VNI 30004
vrf context VRF-A
vni 50001
rd auto
address-family ipv4 unicast
route-target both auto
route-target both auto evpn
vrf context VRF-B
vni 50002
rd auto
address-family ipv4 unicast
route-target both auto
route-target both auto evpn
vrf context VRF-B
vni 50002
rd auto
address-family ipv4 unicast
route-target both auto
route-target both auto evpn
vrf context VRF-A
vni 50001
rd auto
address-family ipv4 unicast
route-target both auto
route-target both auto evpn
router bgp 65500
address-family ipv4 unicast
neighbor 1.1.1.2 remote-as 65500
address-family l2vpn evpn
send-community extended
vrf VRF-A
address-family ipv4 unicast
advertise l2vpn evpn
vrf VRF-B
address-family ipv4 unicast
advertise l2vpn evpn
router bgp 65500
address-family ipv4 unicast
neighbor 1.1.1.1 remote-as 65500
address-family l2vpn evpn
send-community extended
vrf VRF-A
address-family ipv4 unicast
advertise l2vpn evpn
vrf VRF-B
address-family ipv4 unicast
advertise l2vpn evpn
Integrated Route & Bridge + Multi-Tenancy
Spine
RR RR
V
V
V
V
V
V
SVI 200
SVI 100
SVI 100
Host1
MAC: AA:AA:AA:AA:AA:AA
IP: 192.168.1.11
VLAN 100
VXLAN VNI 30001
Host3
MAC: CC:CC:CC:CC:CC:CC
IP: 192.168.1.33
VLAN 100
VXLAN VNI 30001
Host2
MAC: BB:BB:BB:BB:BB:BB
IP: 10.10.10.22
VLAN 200
VXLAN VNI 30002
bridge
L2VNI 30001
route
L3VNI 50001
VRF-A (VNI 50001)
SVI 100, Gateway IP: 192.168.1.1 (VRF-A)
SVI 200, Gateway IP: 10.10.10.1 (VRF-A)
Integrated Route & Bridge + Multi-Tenancy
Spine
RR RR
V
V
V
V
V
V
SVI 200
SVI 100
SVI 100
Host1
MAC: AA:AA:AA:AA:AA:AA
IP: 192.168.1.11 (VRF-A)
VLAN 100
VXLAN VNI 30001
Host3
MAC: CC:CC:CC:CC:CC:CC
IP: 192.168.1.33 (VRF-A)
VLAN 100
VXLAN VNI 30001
Host2
MAC: BB:BB:BB:BB:BB:BB
IP: 10.10.10.22 (VRF-A)
VLAN 200
VXLAN VNI 30002
VRF-A (VNI 50001)
SVI 100, Gateway IP: 192.168.1.1 (VRF-A)
SVI 200, Gateway IP: 10.10.10.1 (VRF-A)
Summary
Hardware and Software Support
Spine
RR RR
V
V
V
V
V
V
Nexus 9300 / Nexus 9500 – Leaf, Spine (RR), Border [Shipping]
Nexus 7000/7700 with F3 I/O Modules – Spine (RR), Layer-3 & LISP Border [Shipping]
Nexus 7000/7700 with F3 I/O Modules – Leaf, MPLS Border [Roadmap]
Nexus 5600 – Leaf, Spine (RR), Border [Roadmap]
ASR 9000 – Border [Roadmap]
FYI
• VXLAN EVPN provides a scalable Multi-Tenancy architecture
• Integrated Route and Bridging provides routing granularity from
Subnet down to Host level
• Optimized forwarding based on VXLAN Encapsulation with BGP
EVPN reachability protocol
• Routing when you can, Bridging when you need
• Moving away from Flood&Learn to a more scalable Solution
• ACI provides same functions plus Automation plus, plus, plus
Summary
• Cisco Application Centric Infrastructure
• http://www.cisco.com/go/ACI
• Cisco Nexus 9000 Series Switches - VXLAN Network with MP-BGP EVPN Control
Plane
• http://www.cisco.com/c/en/us/products/collateral/switches/nexus-9000-series-switches/guide-
c07-734107.html
• Cisco Nexus 7000: VXLAN BGP EVPN
• http://www.cisco.com/c/en/us/td/docs/switches/datacenter/sw/nx-
os/vxlan/configuration/guide/b_NX-
OS_VXLAN_Configuration_Guide/configuring_vxlan_bgp_evpn.html
Additional Resources
TechWiseTV Workshop: Secrets of Scalable Multi-Tenancy

Weitere ähnliche Inhalte

Mehr von Robb Boyd

TechWiseTV Workshop: Cisco Catalyst 9500 Series High-Performance Switch Archi...
TechWiseTV Workshop: Cisco Catalyst 9500 Series High-Performance Switch Archi...TechWiseTV Workshop: Cisco Catalyst 9500 Series High-Performance Switch Archi...
TechWiseTV Workshop: Cisco Catalyst 9500 Series High-Performance Switch Archi...
Robb Boyd
 

Mehr von Robb Boyd (20)

TechWiseTV Workshop - Q&A - Application Hosting on the Cisco Catalyst 9000 Sw...
TechWiseTV Workshop - Q&A - Application Hosting on the Cisco Catalyst 9000 Sw...TechWiseTV Workshop - Q&A - Application Hosting on the Cisco Catalyst 9000 Sw...
TechWiseTV Workshop - Q&A - Application Hosting on the Cisco Catalyst 9000 Sw...
 
TechWiseTV Workshop: Cisco Catalyst 9100 Access Points for Wi-Fi 6
TechWiseTV Workshop: Cisco Catalyst 9100 Access Points for Wi-Fi 6TechWiseTV Workshop: Cisco Catalyst 9100 Access Points for Wi-Fi 6
TechWiseTV Workshop: Cisco Catalyst 9100 Access Points for Wi-Fi 6
 
TechWiseTV Workshop: Application Hosting on Catalyst 9000 Series Switches
TechWiseTV Workshop: Application Hosting on Catalyst 9000 Series SwitchesTechWiseTV Workshop: Application Hosting on Catalyst 9000 Series Switches
TechWiseTV Workshop: Application Hosting on Catalyst 9000 Series Switches
 
TechWiseTV Workshop 314 - Q&A Cisco SD-WAN Security
TechWiseTV Workshop 314 - Q&A Cisco SD-WAN Security TechWiseTV Workshop 314 - Q&A Cisco SD-WAN Security
TechWiseTV Workshop 314 - Q&A Cisco SD-WAN Security
 
Technical Overview of Cisco Catalyst 9200 Series Switches
Technical Overview of Cisco Catalyst 9200 Series SwitchesTechnical Overview of Cisco Catalyst 9200 Series Switches
Technical Overview of Cisco Catalyst 9200 Series Switches
 
The Enhanced Cisco Container Platform
The Enhanced Cisco Container PlatformThe Enhanced Cisco Container Platform
The Enhanced Cisco Container Platform
 
TechWiseTV Workshop: Improving Performance and Agility with Cisco HyperFlex
TechWiseTV Workshop: Improving Performance and Agility with Cisco HyperFlexTechWiseTV Workshop: Improving Performance and Agility with Cisco HyperFlex
TechWiseTV Workshop: Improving Performance and Agility with Cisco HyperFlex
 
TechWiseTV Workshop: SD-WAN Security
TechWiseTV Workshop: SD-WAN SecurityTechWiseTV Workshop: SD-WAN Security
TechWiseTV Workshop: SD-WAN Security
 
TechWiseTV Workshop: Cisco Catalyst 9800 Series Wireless Controller
TechWiseTV Workshop: Cisco Catalyst 9800 Series Wireless ControllerTechWiseTV Workshop: Cisco Catalyst 9800 Series Wireless Controller
TechWiseTV Workshop: Cisco Catalyst 9800 Series Wireless Controller
 
Protect Kubernetes Environments with Cisco Stealthwatch Cloud
Protect Kubernetes Environments with Cisco Stealthwatch CloudProtect Kubernetes Environments with Cisco Stealthwatch Cloud
Protect Kubernetes Environments with Cisco Stealthwatch Cloud
 
Incredible Compute Density: Cisco DNA Center Platform: Digging Deeper with APIs
Incredible Compute Density: Cisco DNA Center Platform: Digging Deeper with APIsIncredible Compute Density: Cisco DNA Center Platform: Digging Deeper with APIs
Incredible Compute Density: Cisco DNA Center Platform: Digging Deeper with APIs
 
Infrastructure Solutions for Deploying AI/ML/DL Workloads at Scale
Infrastructure Solutions for Deploying AI/ML/DL Workloads at ScaleInfrastructure Solutions for Deploying AI/ML/DL Workloads at Scale
Infrastructure Solutions for Deploying AI/ML/DL Workloads at Scale
 
TechWiseTV Workshop Q&A: Cisco UCS C4200
TechWiseTV Workshop Q&A: Cisco UCS C4200TechWiseTV Workshop Q&A: Cisco UCS C4200
TechWiseTV Workshop Q&A: Cisco UCS C4200
 
TechWiseTV Workshop: Cisco UCS C4200
TechWiseTV Workshop: Cisco UCS C4200TechWiseTV Workshop: Cisco UCS C4200
TechWiseTV Workshop: Cisco UCS C4200
 
TechWiseTV Workshop: ASR 9000
TechWiseTV Workshop: ASR 9000 TechWiseTV Workshop: ASR 9000
TechWiseTV Workshop: ASR 9000
 
TechWiseTV Workshop: Q&A Cisco Hybrid Cloud Platform for Google Cloud
TechWiseTV Workshop: Q&A Cisco Hybrid Cloud Platform for Google CloudTechWiseTV Workshop: Q&A Cisco Hybrid Cloud Platform for Google Cloud
TechWiseTV Workshop: Q&A Cisco Hybrid Cloud Platform for Google Cloud
 
TechWiseTV Workshop: Cisco SD-WAN
TechWiseTV Workshop: Cisco SD-WANTechWiseTV Workshop: Cisco SD-WAN
TechWiseTV Workshop: Cisco SD-WAN
 
TechWiseTV Workshop: Extending Intent-Based Networking to IoT
TechWiseTV Workshop: Extending Intent-Based Networking to IoTTechWiseTV Workshop: Extending Intent-Based Networking to IoT
TechWiseTV Workshop: Extending Intent-Based Networking to IoT
 
TechWiseTV Workshop: Cisco Catalyst 9500 Series High-Performance Switch Archi...
TechWiseTV Workshop: Cisco Catalyst 9500 Series High-Performance Switch Archi...TechWiseTV Workshop: Cisco Catalyst 9500 Series High-Performance Switch Archi...
TechWiseTV Workshop: Cisco Catalyst 9500 Series High-Performance Switch Archi...
 
TechWiseTV Workshop: Cisco Hybrid Cloud Platform for Google Cloud
TechWiseTV Workshop:  Cisco Hybrid Cloud Platform for Google CloudTechWiseTV Workshop:  Cisco Hybrid Cloud Platform for Google Cloud
TechWiseTV Workshop: Cisco Hybrid Cloud Platform for Google Cloud
 

Kürzlich hochgeladen

+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...
+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...
+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...
?#DUbAI#??##{{(☎️+971_581248768%)**%*]'#abortion pills for sale in dubai@
 
Cloud Frontiers: A Deep Dive into Serverless Spatial Data and FME
Cloud Frontiers:  A Deep Dive into Serverless Spatial Data and FMECloud Frontiers:  A Deep Dive into Serverless Spatial Data and FME
Cloud Frontiers: A Deep Dive into Serverless Spatial Data and FME
Safe Software
 

Kürzlich hochgeladen (20)

Polkadot JAM Slides - Token2049 - By Dr. Gavin Wood
Polkadot JAM Slides - Token2049 - By Dr. Gavin WoodPolkadot JAM Slides - Token2049 - By Dr. Gavin Wood
Polkadot JAM Slides - Token2049 - By Dr. Gavin Wood
 
Boost Fertility New Invention Ups Success Rates.pdf
Boost Fertility New Invention Ups Success Rates.pdfBoost Fertility New Invention Ups Success Rates.pdf
Boost Fertility New Invention Ups Success Rates.pdf
 
Mcleodganj Call Girls 🥰 8617370543 Service Offer VIP Hot Model
Mcleodganj Call Girls 🥰 8617370543 Service Offer VIP Hot ModelMcleodganj Call Girls 🥰 8617370543 Service Offer VIP Hot Model
Mcleodganj Call Girls 🥰 8617370543 Service Offer VIP Hot Model
 
+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...
+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...
+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...
 
ICT role in 21st century education and its challenges
ICT role in 21st century education and its challengesICT role in 21st century education and its challenges
ICT role in 21st century education and its challenges
 
presentation ICT roal in 21st century education
presentation ICT roal in 21st century educationpresentation ICT roal in 21st century education
presentation ICT roal in 21st century education
 
DEV meet-up UiPath Document Understanding May 7 2024 Amsterdam
DEV meet-up UiPath Document Understanding May 7 2024 AmsterdamDEV meet-up UiPath Document Understanding May 7 2024 Amsterdam
DEV meet-up UiPath Document Understanding May 7 2024 Amsterdam
 
Apidays New York 2024 - APIs in 2030: The Risk of Technological Sleepwalk by ...
Apidays New York 2024 - APIs in 2030: The Risk of Technological Sleepwalk by ...Apidays New York 2024 - APIs in 2030: The Risk of Technological Sleepwalk by ...
Apidays New York 2024 - APIs in 2030: The Risk of Technological Sleepwalk by ...
 
Biography Of Angeliki Cooney | Senior Vice President Life Sciences | Albany, ...
Biography Of Angeliki Cooney | Senior Vice President Life Sciences | Albany, ...Biography Of Angeliki Cooney | Senior Vice President Life Sciences | Albany, ...
Biography Of Angeliki Cooney | Senior Vice President Life Sciences | Albany, ...
 
Corporate and higher education May webinar.pptx
Corporate and higher education May webinar.pptxCorporate and higher education May webinar.pptx
Corporate and higher education May webinar.pptx
 
EMPOWERMENT TECHNOLOGY GRADE 11 QUARTER 2 REVIEWER
EMPOWERMENT TECHNOLOGY GRADE 11 QUARTER 2 REVIEWEREMPOWERMENT TECHNOLOGY GRADE 11 QUARTER 2 REVIEWER
EMPOWERMENT TECHNOLOGY GRADE 11 QUARTER 2 REVIEWER
 
FWD Group - Insurer Innovation Award 2024
FWD Group - Insurer Innovation Award 2024FWD Group - Insurer Innovation Award 2024
FWD Group - Insurer Innovation Award 2024
 
Introduction to Multilingual Retrieval Augmented Generation (RAG)
Introduction to Multilingual Retrieval Augmented Generation (RAG)Introduction to Multilingual Retrieval Augmented Generation (RAG)
Introduction to Multilingual Retrieval Augmented Generation (RAG)
 
Cloud Frontiers: A Deep Dive into Serverless Spatial Data and FME
Cloud Frontiers:  A Deep Dive into Serverless Spatial Data and FMECloud Frontiers:  A Deep Dive into Serverless Spatial Data and FME
Cloud Frontiers: A Deep Dive into Serverless Spatial Data and FME
 
Understanding the FAA Part 107 License ..
Understanding the FAA Part 107 License ..Understanding the FAA Part 107 License ..
Understanding the FAA Part 107 License ..
 
MS Copilot expands with MS Graph connectors
MS Copilot expands with MS Graph connectorsMS Copilot expands with MS Graph connectors
MS Copilot expands with MS Graph connectors
 
Web Form Automation for Bonterra Impact Management (fka Social Solutions Apri...
Web Form Automation for Bonterra Impact Management (fka Social Solutions Apri...Web Form Automation for Bonterra Impact Management (fka Social Solutions Apri...
Web Form Automation for Bonterra Impact Management (fka Social Solutions Apri...
 
Apidays New York 2024 - Accelerating FinTech Innovation by Vasa Krishnan, Fin...
Apidays New York 2024 - Accelerating FinTech Innovation by Vasa Krishnan, Fin...Apidays New York 2024 - Accelerating FinTech Innovation by Vasa Krishnan, Fin...
Apidays New York 2024 - Accelerating FinTech Innovation by Vasa Krishnan, Fin...
 
Apidays New York 2024 - Passkeys: Developing APIs to enable passwordless auth...
Apidays New York 2024 - Passkeys: Developing APIs to enable passwordless auth...Apidays New York 2024 - Passkeys: Developing APIs to enable passwordless auth...
Apidays New York 2024 - Passkeys: Developing APIs to enable passwordless auth...
 
Strategies for Landing an Oracle DBA Job as a Fresher
Strategies for Landing an Oracle DBA Job as a FresherStrategies for Landing an Oracle DBA Job as a Fresher
Strategies for Landing an Oracle DBA Job as a Fresher
 

TechWiseTV Workshop: Secrets of Scalable Multi-Tenancy

  • 1. The Secrets to Scalable Multi- Tenancy Lukas Krattiger @CCIE21921 February, 2016
  • 2. • Introduction • VXLAN with BGP EVPN • Multi-Tenancy • Summary Agenda
  • 4. Overlay Based Data Center Fabrics Desirable Attributes: • Mobility • Segmentation • Scale • Automated & Programmable • Abstracted consumption models • Full Cross Sectional Bandwidth • Layer-2 + Layer-3 Connectivity • Physical + Virtual RR RR
  • 5. Overlay Based Data Center: Edge Devices Network Overlays Hybrid OverlaysHost Overlays • Virtual end-points only • Single admin domain • VXLAN, NVGRE, STT • Physical and Virtual • Resiliency + Scale • X-Organizations/Federation • Open Standards • Router/Switch end-points • Protocols for Resiliency/Loops • Traditional VPNs • VXLAN, OTV, VPLS, LISP, FP V V V V V V FYI
  • 6. Overlay Services • Layer 2 • Layer 3 • Layer 2 and Layer 3 Tunnel Encapsulation Underlay Transport Network Control Plane • Peer Discovery mechanism • Route Learning and Distribution – Local Learning – Remote Learning Data Plane • Overlay Layer 2/Layer 3 Unicast traffic • Overlay Broadcast, Unknown Unicast, Multicast traffic (BUM traffic) forwarding – Ingress Replication – Multicast Understanding Overlay Technologies
  • 7. Local LAN Segment Physical Host Local LAN Segment Physical Host Virtual Hosts Local LAN Segment Virtual Switch Edge Device Edge Device Edge Device IP Interface IP Fabric Overlay Taxonomy (1)
  • 8. Local LAN Segment Physical Host Local LAN Segment Physical Host Virtual Hosts Local LAN Segment Virtual Switch VTEP VTEP VTEP VTEP – VXLAN Tunnel End-Point VNI/VNID – VXLAN Network Identifier VV V Encapsulation IP Fabric Overlay Taxonomy (2)
  • 10. Optimized Networks with VXLAN 1 Overlay (VXLAN)Integrated Route/Bridge Underlay BGP (EVPN)
  • 11. • Standards based Overlay (VXLAN) with Standards based Control-Plane (BGP) • Layer-2 MAC and Layer-3 IP information distribution by Control-Plane (BGP) • Forwarding decision based on Control-Plane (minimizes flooding) • Integrated Routing/Bridging (IRB) for Optimized Forwarding in the Overlay • Multi-Tenancy At Scale What is VXLAN with BGP EVPN?
  • 12. Control- Plane EVPN MP-BGP - RFC 7432 (draft-ietf-l2vpn-evpn) Data- Plane Multi-Protocol Label Switching (MPLS) draft-ietf-l2vpn-evpn Provider Backbone Bridges (PBB) draft-ietf-l2vpn-pbb-evpn Network Virtualization Overlay (NVO) draft-ietf-bess-evpn-overlay  EVPN over NVO Tunnels (e.g. VXLAN) for Data Center Fabric encapsulations  Provides Layer 2 and Layer 3 Overlays over simple IP Networks Ethernet VPN – EVPN
  • 13. ID Title Category RFC 7348 Virtual eXtensible Local Area Network Data Plane RFC 7432 BGP MPLS based Ethernet VPNs EVPN Control Plane draft-ietf-bess-evpn-overlay A Network Virtualization Overlay Solution using EVPN EVPN Control Plane draft-ietf-bess-evpn-inter-subnet-forwarding Integrated Routing and Bridging in EVPN EVPN Control Plane draft-ietf-bess-evpn-prefix-advertisement IP Prefix Advertisement in E-VPN EVPN Control Plane Draft-tissa-nvo3-oam-fm NVO3 Fault Management Mgmt Plane (OAM) IETF RFC & Drafts – Implemented by Cisco FYI
  • 14. VXLAN Evolution with BGP EVPN Protocol Learning • Uses MP-BGP with EVPN Address family • Workload MAC and IP Addresses learnt by VXLAN Edge Devices (NVEs) • Advertises Layer-2 and Layer- 3 Address-to-VTEP Association • Flood Prevention • Optimized ARP forwarding IP Services • VXLAN Routing • Distributed Anycast Gateway Multi-Tenancy • Route Reflector for Scale External Connectivity • VXLAN Hardware Gateway Redundancy (VPC) • Integrated physical and virtual Overlays (Hybrid Overlays) • Inter-Pod Connectivity • VXLAN Gateway to other Encaps/Networks Multicast Independent* • Overlay Control-Plane provides dynamic VTEP discovery • Head-End Replication enables Unicast-only mode (aka ingress Replication) *Multicast Independence requires the usage of the Overlay Control-Plane or static configuration
  • 15. Overlay with Optimized Routing Spine RR RR V V V V V V EVPN Control Plane -- Host and Subnet Route Distribution BGP Update • Host-MAC • Host-IP • Internal IP Subnet • External Prefixes RR Route-Reflectors deployed for scaling purposes (iBGP) BGP Adjacencies Border
  • 16. Overlay with Optimized Routing Spine RR RR V V V V V V EVPN Control Plane -- Host and Subnet Route Distribution BGP Update • Host-MAC • Host-IP • Internal IP Subnet • External Prefixes RR Route-Reflectors deployed for scaling purposes (iBGP) BGP Adjacencies Border Scalable Multi-Tenancy with Multiprotocol BGP EVPN Address-Family: Host MAC+IP, internal/external IP Subnets BGP enhanced for Fast Convergence at Large Scale Extensions for Fast and Seamless Host Mobility Distributed Gateway with Traffic Flow Symmetry ARP Suppression
  • 17. Distributed IP Anycast Gateway Spine RR RR V V V V V V SVI 200 SVI 100 SVI 100 SVI 100, Gateway IP: 192.168.1.1 SVI 200, Gateway IP: 10.10.10.1 Host1 MAC: AA:AA:AA:AA:AA:AA IP: 192.168.1.11 VLAN 100 VXLAN VNI 30001 Host3 MAC: CC:CC:CC:CC:CC:CC IP: 192.168.1.33 VLAN 100 VXLAN VNI 30001 Host2 MAC: BB:BB:BB:BB:BB:BB IP: 10.10.10.22 VLAN 200 VXLAN VNI 30002 bridge route
  • 18. Distributed IP Anycast Gateway Spine RR RR V V V V V V SVI 200 SVI 100 SVI 100 SVI 100, Gateway IP: 192.168.1.1 SVI 200, Gateway IP: 10.10.10.1 Host1 MAC: AA:AA:AA:AA:AA:AA IP: 192.168.1.11 VLAN 100 VXLAN VNI 30001 Host3 MAC: CC:CC:CC:CC:CC:CC IP: 192.168.1.33 VLAN 100 VXLAN VNI 30001 Host2 MAC: BB:BB:BB:BB:BB:BB IP: 10.10.10.22 VLAN 200 VXLAN VNI 30002 bridge route Any Subnet Routed Anywhere – Any VTEP can serve any Subnet Integrated Route & Bridge (IRB) - Route whenever you can, Bridge when needed No Hairpinning – Optimized East/West and North/South Routing Seamless Mobility - All Leaf share same Gateway MAC Reduced Failure Domain – Layer-2/Layer-3 Boundary at Leaf Optimal Scalability – Route Distributed & closest to the Host
  • 19. Multi-Destination Traffic Ingress Replication Unicast based Replication • Source VTEP sends unicast copy to every Destination VTEP • Requires only Unicast • Simples way of Traffic Replication Multicast Multicast based Replication • Source VTEP sends single copy, Multicast replicates it as needed • Leverages Multicast Routing (PIM) • Most optimal way of Traffic Replication Spine RR RR V V V V V V Spine RR RR V V V V V V
  • 21. • A mode of operation, where multiple independent instances (tenant) operate in a shared environment. • Each instance (i.e. VRF/VLAN) is logically isolated, but physically integrated. What is Multi-Tenancy
  • 22. Multi-Tenancy at Layer-2 • Per-Switch VLAN-to-VNI mapping • Per-Port VLAN Significance Multi-Tenancy at Layer-3 • VRF-to-VNI mapping • MP-BGP for scaling with VPNs Where can we apply Multi-Tenancy
  • 23. Layer-2 Multi-Tenancy Spine RR RR V V V V V V VLAN 100 VLAN 100 Host1 MAC: AA:AA:AA:AA:AA:AA IP: 192.168.1.11 VLAN 100 VXLAN VNI 30001 Host3 MAC: CC:CC:CC:CC:CC:CC IP: 192.168.1.33 VLAN 100 VXLAN VNI 30001 bridge
  • 24. Layer-2 Multi-Tenancy – Bridge Domains Host1 MAC: AA:AA:AA:AA:AA:AA IP: 192.168.1.11 VLAN 100 VXLAN VNI 30001 Host3 MAC: CC:CC:CC:CC:CC:CC IP: 192.168.1.33 VLAN 100 VXLAN VNI 30001 Leaf VV VLAN 100 VLAN 100 VXLAN Overlay (VNI 30001) Bridge Domain
  • 25. Layer-2 Multi-Tenancy – Bridge Domains Host1 MAC: AA:AA:AA:AA:AA:AA IP: 192.168.1.11 VLAN 100 VXLAN VNI 30001 Host3 MAC: CC:CC:CC:CC:CC:CC IP: 192.168.1.33 VLAN 100 VXLAN VNI 30001 Leaf VV VLAN 100 VLAN 100 VXLAN Overlay (VNI 30001) Bridge Domain The Bridge Domain is the Layer-2 Segment from Host to Host In VXLAN, the Bridge Domain consists of three Components 1) The Ethernet Segment (VLAN), between Host and Switch 2) The Hardware Resources (Bridge Domain) within the Switch 3) The VXLAN Segment (VNI) between Switch and Switch
  • 26. VLAN-to-VNI mapping Host1 MAC: AA:AA:AA:AA:AA:AA IP: 192.168.1.11 VLAN 100 VXLAN VNI 30001 Host3 MAC: CC:CC:CC:CC:CC:CC IP: 192.168.1.33 VLAN 100 VXLAN VNI 30001 Leaf VV VLAN 100 VLAN 100 VXLAN Overlay (VNI 30001) Host2 MAC: BB:BB:BB:BB:BB:BB IP: 192.168.1.22 VLAN 100 VXLAN VNI 30001
  • 27. Leaf#1 vlan 100 vn-segment 30001 Leaf#2 vlan 100 vn-segment 30001 • VLAN to VNI configuration on a per-switch basis • VLAN becomes “Switch Local Identifier” • VNI becomes “Network Global Identifier” CLI Modes - VLAN based (per-Switch) FYI
  • 28. Per-Switch VLAN-to-VNI mapping Host1 MAC: AA:AA:AA:AA:AA:AA IP: 192.168.1.11 VLAN 100 VXLAN VNI 30001 Host3 MAC: CC:CC:CC:CC:CC:CC IP: 192.168.1.33 VLAN 200 VXLAN VNI 30001 Leaf VV VLAN 100 VLAN 200 VXLAN Overlay (VNI 30001) Host2 MAC: BB:BB:BB:BB:BB:BB IP: 192.168.1.22 VLAN 100 VXLAN VNI 30001
  • 29. Leaf#1 vlan 100 vn-segment 30001 Leaf#2 vlan 200 vn-segment 30001 • VLAN to VNI configuration on a per-switch basis • VLAN becomes “Switch Local Identifier” • VNI becomes “Network Global Identifier” • 4k VLAN limitation has been removed CLI Modes - VLAN based (per-Switch) FYI
  • 30. Per-Port VLAN-to-VNI mapping Host1 MAC: AA:AA:AA:AA:AA:AA IP: 192.168.1.11 VLAN 100 VXLAN VNI 30001 Host3 MAC: CC:CC:CC:CC:CC:CC IP: 192.168.1.33 VLAN 300 VXLAN VNI 30001 Leaf VV VLAN 100 VLAN 300 VXLAN Overlay (VNI 30001) Host2 MAC: BB:BB:BB:BB:BB:BB IP: 192.168.1.22 VLAN 200 VXLAN VNI 30001 VLAN 200
  • 31. Leaf#1 vlan 2500 vn-segment 30001 interface Ethernet 1/8 switchport mode trunk switchport vlan mapping enable switchport vlan mapping 100 2500 interface Ethernet 1/9 switchport mode trunk switchport vlan mapping enable switchport vlan mapping 200 2500 CLI Modes - VLAN based (per-Port) FYI
  • 32. Leaf#1 bridge-domain 100 member vni 30001 encapsulation profile vni VLAN100-30001 dot1q 100 vni 30001 encapsulation profile vni VLAN200-30001 dot1q 200 vni 30001 CLI Modes - Bridge-Domain based (per-Port) interface Ethernet 1/8 no switchport service instance 1 vni encapsulation profile VLAN100-30001 default interface Ethernet 1/9 no switchport service instance 1 vni encapsulation profile VLAN200-30001 default FYI
  • 33. Layer-3 Multi-Tenancy Spine RR RR V V V V V V SVI 200 SVI 100 VRF-A (VNI 50001) VRF-B (VNI 50002) SVI 100, Gateway IP: 192.168.1.1 (VRF-A) SVI 200, Gateway IP: 10.10.10.1 (VRF-B) SVI 300, Gateway IP: 172.16.1.1 (VRF-B) Host1 IP: 192.168.1.11 (VRF-A) VLAN 100 Host3 IP: 172.16.1.33 (VRF-B) VLAN 300 Host2 IP: 10.10.10.22 (VRF-B) VLAN 200 SVI 300 route route
  • 34. Layer-3 Multi-Tenancy – VRF-VNI or L3VNI Host1 IP: 192.168.1.11 (VRF-A) VLAN 100 Host3 IP: 172.16.1.33 (VRF-B) VLAN 300 Leaf VV SVI 100 V Host2 IP: 10.10.10.22 (VRF-B) VLAN 200 SVI 200 SVI 300 VRF-A (VNI 50001) VRF-B (VNI 50002) Routing Domain VRF-B Routing Domain VRF-A
  • 35. Layer-3 Multi-Tenancy – VRF-VNI or L3VNI Host1 IP: 192.168.1.11 (VRF-A) VLAN 100 Host3 IP: 172.16.1.33 (VRF-B) VLAN 300 Leaf VV VLAN 100 V Host2 IP: 10.10.10.22 (VRF-B) VLAN 200 SVI 200 SVI 300 VRF-A (VNI 50001) VRF-B (VNI 50002) Routing Domain VRF-B Routing Domain VRF-A The Routing Domain is the VRF owning multiple Subnets across multiple Switches In VXLAN EVPN, the Routing Domain consists of three Components 1) The Routing Domains (VRF), local to the Switch 2) The Routing Domain (L3VNI) between the Switches 3) Multi-Protocol BGP with EVPN Address-Family
  • 36. Layer-3 Multi-Tenancy – VRF-Lite Leaf VV SVI 300SVI 200SVI 100 Subnet1 IP: 192.168.1.0/24 (VRF-A) VLAN 100 Subnet2 IP: 10.10.10.0/24 (VRF-B) VLAN 200 Subnet3 IP: 172.16.1.0/24 (VRF-B) VLAN 300 Host4 IP: 10.44.44.0/24 (VRF VLAN 400 SVI 400 VLAN 1002 VLAN 1001 Ethernet
  • 37. Layer-3 Multi-Tenancy – VRF-Lite Leaf VV SVI 300SVI 200SVI 100 SVI 400 VLAN 1002 VLAN 1001 Ethernet Subnet1 IP: 192.168.1.0/24 (VRF-A) VLAN 100 Subnet2 IP: 10.10.10.0/24 (VRF-B) VLAN 200 Subnet3 IP: 172.16.1.0/24 (VRF-B) VLAN 300 Host4 IP: 10.44.44.0/24 (VRF VLAN 400 vrf context VRF-A interface eth1/10.1001 encapsulation dot1q 1001 vrf member VRF-A ip address 10.1.1.1/24 ip router ospf 100 area 0.0.0.0 router ospf 100 vrf VRF-A vrf context VRF-B interface eth1/10.1002 encapsulation dot1q 1002 vrf member VRF-B ip address 10.2.2.1/24 ip router ospf 100 area 0.0.0.0 router ospf 100 vrf VRF-B vrf context VRF-B interface eth1/10.1002 encapsulation dot1q 1002 vrf member VRF-B ip address 10.2.2.2/24 ip router ospf 100 area 0.0.0.0 router ospf 100 vrf VRF-B vrf context VRF-A interface eth1/10.1001 encapsulation dot1q 1001 vrf member VRF-A ip address 10.1.1.2/24 ip router ospf 100 area 0.0.0.0 router ospf 100 vrf VRF-A FYI
  • 38. Layer-3 Multi-Tenancy – MPLS L3VPN Leaf VV SVI 300SVI 200SVI 100 SVI 400 VPN Label “Red” VPN Label “Blue” MPLS Subnet1 IP: 192.168.1.0/24 (VRF-A) VLAN 100 Subnet2 IP: 10.10.10.0/24 (VRF-B) VLAN 200 Subnet3 IP: 172.16.1.0/24 (VRF-B) VLAN 300 Host4 IP: 10.44.44.0/24 (VRF VLAN 400
  • 39. Layer-3 Multi-Tenancy – MPLS L3VPN Leaf VV SVI 300SVI 200SVI 100 SVI 400 VPN Label “Red” VPN Label “Blue” MPLS Subnet1 IP: 192.168.1.0/24 (VRF-A) VLAN 100 Subnet2 IP: 10.10.10.0/24 (VRF-B) VLAN 200 Subnet3 IP: 172.16.1.0/24 (VRF-B) VLAN 300 Host4 IP: 10.44.44.0/24 (VRF VLAN 400 vrf context VRF-A rd 1.1.1.1:100 address-family ipv4 unicast route-target import 100:100 route-target export 100:100 vrf context VRF-B rd 1.1.1.1:200 address-family ipv4 unicast route-target import 200:200 route-target export 200:200 vrf context VRF-B rd 1.1.1.2:200 address-family ipv4 unicast route-target import 200:200 route-target export 200:200 vrf context VRF-A rd 1.1.1.2:100 address-family ipv4 unicast route-target import 100:100 route-target export 100:100 router bgp 65500 address-family ipv4 unicast neighbor 1.1.1.2 remote-as 65500 address-family vpnv4 unicast send-community extended vrf VRF-A address-family ipv4 unicast vrf VRF-B address-family ipv4 unicast router bgp 65500 address-family ipv4 unicast neighbor 1.1.1.1 remote-as 65500 address-family vpnv4 unicast send-community extended vrf VRF-A address-family ipv4 unicast vrf VRF-B address-family ipv4 unicast FYI
  • 40. Layer-3 Multi-Tenancy – VXLAN EVPN Leaf VV SVI 300SVI 200SVI 100 Host1 MAC: AA:AA:AA:AA:AA:AA IP: 192.168.1.11 (VRF-A) VLAN 100 VXLAN VNI 30001 Host2 MAC: BB:BB:BB:BB:BB:BB IP: 10.10.10.22 (VRF-B) VLAN 200 VXLAN VNI 30002 Host3 MAC: CC:CC:CC:CC:CC:CC IP: 172.16.1.33 (VRF-B) VLAN 300 VXLAN VNI 30003 Host4 MAC: DD:DD:DD:DD:DD IP: 10.44.44.44 (VRF-A) VLAN 400 VXLAN VNI 30004 SVI 400 L3VNI 50002 L3VNI 50001 VXLAN
  • 41. Layer-3 Multi-Tenancy – VXLAN EVPN Leaf VV SVI 300SVI 200SVI 100 SVI 400 L3VNI 50002 L3VNI 50001 VXLAN Host1 MAC: AA:AA:AA:AA:AA:AA IP: 192.168.1.11 (VRF-A) VLAN 100 VXLAN VNI 30001 Host2 MAC: BB:BB:BB:BB:BB:BB IP: 10.10.10.22 (VRF-B) VLAN 200 VXLAN VNI 30002 Host3 MAC: CC:CC:CC:CC:CC:CC IP: 172.16.1.33 (VRF-B) VLAN 300 VXLAN VNI 30003 Host4 MAC: DD:DD:DD:DD:DD IP: 10.44.44.44 (VRF-A) VLAN 400 VXLAN VNI 30004 vrf context VRF-A vni 50001 rd auto address-family ipv4 unicast route-target both auto route-target both auto evpn vrf context VRF-B vni 50002 rd auto address-family ipv4 unicast route-target both auto route-target both auto evpn vrf context VRF-B vni 50002 rd auto address-family ipv4 unicast route-target both auto route-target both auto evpn vrf context VRF-A vni 50001 rd auto address-family ipv4 unicast route-target both auto route-target both auto evpn router bgp 65500 address-family ipv4 unicast neighbor 1.1.1.2 remote-as 65500 address-family l2vpn evpn send-community extended vrf VRF-A address-family ipv4 unicast advertise l2vpn evpn vrf VRF-B address-family ipv4 unicast advertise l2vpn evpn router bgp 65500 address-family ipv4 unicast neighbor 1.1.1.1 remote-as 65500 address-family l2vpn evpn send-community extended vrf VRF-A address-family ipv4 unicast advertise l2vpn evpn vrf VRF-B address-family ipv4 unicast advertise l2vpn evpn
  • 42. Integrated Route & Bridge + Multi-Tenancy Spine RR RR V V V V V V SVI 200 SVI 100 SVI 100 Host1 MAC: AA:AA:AA:AA:AA:AA IP: 192.168.1.11 VLAN 100 VXLAN VNI 30001 Host3 MAC: CC:CC:CC:CC:CC:CC IP: 192.168.1.33 VLAN 100 VXLAN VNI 30001 Host2 MAC: BB:BB:BB:BB:BB:BB IP: 10.10.10.22 VLAN 200 VXLAN VNI 30002 bridge L2VNI 30001 route L3VNI 50001 VRF-A (VNI 50001) SVI 100, Gateway IP: 192.168.1.1 (VRF-A) SVI 200, Gateway IP: 10.10.10.1 (VRF-A)
  • 43. Integrated Route & Bridge + Multi-Tenancy Spine RR RR V V V V V V SVI 200 SVI 100 SVI 100 Host1 MAC: AA:AA:AA:AA:AA:AA IP: 192.168.1.11 (VRF-A) VLAN 100 VXLAN VNI 30001 Host3 MAC: CC:CC:CC:CC:CC:CC IP: 192.168.1.33 (VRF-A) VLAN 100 VXLAN VNI 30001 Host2 MAC: BB:BB:BB:BB:BB:BB IP: 10.10.10.22 (VRF-A) VLAN 200 VXLAN VNI 30002 VRF-A (VNI 50001) SVI 100, Gateway IP: 192.168.1.1 (VRF-A) SVI 200, Gateway IP: 10.10.10.1 (VRF-A)
  • 45. Hardware and Software Support Spine RR RR V V V V V V Nexus 9300 / Nexus 9500 – Leaf, Spine (RR), Border [Shipping] Nexus 7000/7700 with F3 I/O Modules – Spine (RR), Layer-3 & LISP Border [Shipping] Nexus 7000/7700 with F3 I/O Modules – Leaf, MPLS Border [Roadmap] Nexus 5600 – Leaf, Spine (RR), Border [Roadmap] ASR 9000 – Border [Roadmap] FYI
  • 46. • VXLAN EVPN provides a scalable Multi-Tenancy architecture • Integrated Route and Bridging provides routing granularity from Subnet down to Host level • Optimized forwarding based on VXLAN Encapsulation with BGP EVPN reachability protocol • Routing when you can, Bridging when you need • Moving away from Flood&Learn to a more scalable Solution • ACI provides same functions plus Automation plus, plus, plus Summary
  • 47. • Cisco Application Centric Infrastructure • http://www.cisco.com/go/ACI • Cisco Nexus 9000 Series Switches - VXLAN Network with MP-BGP EVPN Control Plane • http://www.cisco.com/c/en/us/products/collateral/switches/nexus-9000-series-switches/guide- c07-734107.html • Cisco Nexus 7000: VXLAN BGP EVPN • http://www.cisco.com/c/en/us/td/docs/switches/datacenter/sw/nx- os/vxlan/configuration/guide/b_NX- OS_VXLAN_Configuration_Guide/configuring_vxlan_bgp_evpn.html Additional Resources