实验案例-VXLAN-EVPN-IOL-XE-EVE-NG亚太代理中文区独家合作伙伴

hbugs001 发表于 2026-10-18 19:52:53

实验案例-VXLAN-EVPN-IOL-XE

<pre><code># VXLAN EVPN 实验报告（Cisco IOL XE 17.18.2）

> **实验目标**：2 台 spine + 4 台 leaf 的 VXLAN EVPN fabric，8 台主机分属 4 个 VLAN，启动配置预配、开机即通。
> **实验平台**：EVE-NG + Cisco IOL + VPCS。
> **关键前提**：必须使用支持 VXLAN/EVPN 的 IOL XE 镜像，见 §0。
> **复现方式**：按 §1 连线、§3 粘贴配置、§4 启动；§5.1 在 VPCS 上验数据面，其余见下篇。
> **最容易失败的地方**：镜像选错、L2 VNI 没走 EVI、`vlan.dat` 残留、SVI 开机起不来（详见 §6）。

---

## 0. 先看这里：镜像版本与关键注意事项

### 0.1 本实验使用的镜像

| 项目 | 值 |
|---|---|
| **IOL 镜像文件** | **`l2-iol-xe-17-18-02.bin`** |
| **操作系统** | **Cisco IOS-XE 17.18.2**，`X86_64BI_LINUX_L2-ADVENTERPRISEK9-M`，RELEASE SOFTWARE (fc3) |
| **编译时间** | Compiled Fri 19-Dec-25 03:28 |
| **EVE-NG 模板** | `iol` |
| **IOL 节点资源** | Ethernet 数量填 `1`（= 4 个口）、RAM 1024 MB、NVRAM 1024 KB、Serial 0 |
| **主机模拟器** | **VPCS 1.3 (0.8.1)**，Build May 20 2026，EVE-NG modified |
| **IOL 镜像类型** | `l2-*` = **三层交换机镜像**：能二层交换，也能路由；不是“纯二层交换机” |

**怎么确认镜像没拿错**：登录任意一台 IOL，执行 `show version`，应同时看到：

```text
Cisco IOS Software , Linux Software (X86_64BI_LINUX_L2-ADVENTERPRISEK9-M),
Version 17.18.2, RELEASE SOFTWARE (fc3)
...
Compiled Fri 19-Dec-25 03:28 by mcpre
...
System image file is "unix:/opt/unetlab/addons/iol/bin/l2-iol-xe-17-18-02.bin"
...
4 Ethernet interfaces
</code></pre>
<p>镜像文件名、<code>Version 17.18.2</code> 和 <code>System image file</code> 必须与上表一致。<br />
同时应看到 <code>4 Ethernet interfaces</code>；如果口数不对，先检查 EVE-NG 节点的<br />
Ethernet 数量（填 <code>1</code> 才是 4 个口）。</p>
<p><strong>换镜像 = 换实验</strong>：VXLAN/EVPN 的配置模型不是每个 IOL 镜像都有（见 §6.1）。</p>
<h3>0.2 五条最关键的注意事项</h3>
<ol>
<li><strong>本实验确认 XE 17.18.2 这一代 IOL 镜像有 <code>interface nve1</code> 和 <code>l2vpn evpn</code></strong>。<br />
15.2 的 <code>l2-adventerprisek9-ms...</code> 实测连命令都不认。<br />
不要用“看起来差不多”的镜像。</li>
<li><strong>L2 VNI 必须走 EVI</strong>：<code>l2vpn evpn instance <id> vlan-based</code> +<br />
<code>vlan configuration <vlan></code> → <code>member evpn-instance</code>。<br />
只配 <code>member vni</code> 会出现“BGP 邻居 Established，但 EVPN 表全空、PfxRcd = 0”。</li>
<li><strong>IOL 必须 <code>vtp mode transparent</code></strong>，否则启动时整个 <code>vlan</code> 块会被静默吞掉。</li>
<li><strong><code>vlan.dat</code> 会跨 stop/start 保留</strong>。改 VLAN 结构后必须 <strong>wipe 再 start</strong>，<br />
用 stop + start 验证会得到“配置没生效”的假象。</li>
<li><strong>每台 leaf 只有 4 个 VLAN 里的 2 个有 access 口</strong>。<br />
另外两个 VLAN 的 SVI 在开机时可能起不来；本实验用<br />
<strong><code>switchport voice vlan <缺失 VLAN></code></strong> 让 VLAN 保持 active，SVI 才能开机 up。</li>
</ol>
<hr />
<h2>1. 实验目标与拓扑</h2>
<h3>1.1 目标</h3>
<ul>
<li><strong>Underlay</strong>：OSPF area 0，所有互联口都是 <code>/30</code> 点对点；</li>
<li><strong>Overlay</strong>：iBGP AS 65000，两台 spine 做 <strong>route reflector</strong>，4 台 leaf 是 <strong>VTEP</strong>；</li>
<li><strong>VXLAN</strong>：4 个 <strong>L2 VNI</strong>（10010/10020/10030/10040），<code>ingress-replication</code> 泛洪；</li>
<li><strong>网关</strong>：每台 leaf 都有全部 4 个 SVI，<strong>同一个网关 IP + 同一个 MAC</strong>（分布式 anycast 网关）；</li>
<li><strong>主机</strong>：8 台 VPCS，分 4 个 VLAN，全部靠启动配置预配；</li>
<li><strong>验证</strong>：同 VLAN 跨 leaf 二层通（<code>ttl=64</code>），跨 VLAN/跨 leaf 三层通（<code>ttl=63</code>）。</li>
</ul>
<h3>1.2 拓扑</h3>
<pre><code class="language-text">                SPINE1 (10.255.0.1)       SPINE2 (10.255.0.2)
               RR，非 VTEP                RR，非 VTEP
               / |    |    \       / |    |    \
         e0/0e0/1 e0/2 e0/3    e0/0e0/1 e0/2 e0/3
            | |    |    |       | |    |    |
         LEAF1LEAF2LEAF3LEAF4 LEAF1LEAF2LEAF3LEAF4
         (VTEP)(VTEP) (VTEP) (VTEP)
            |    |    |    |
         HOST- HOST-HOST-HOST-
         A1/A2 A3/A4B1/B2B3/B4
</code></pre>
<ul>
<li>每台 leaf 用 <code>Ethernet0/0</code> / <code>Ethernet0/1</code> 分别上 SPINE1 / SPINE2；每台 spine 的 4 个口接 4 台 leaf。</li>
<li>每台 leaf 的 <code>Ethernet0/2</code> / <code>Ethernet0/3</code> 接两台主机（access，不打标）。</li>
<li>IOL 模板 Ethernet 填 <code>1</code> 即得 <code>Ethernet0/0..0/3</code>。</li>
</ul>
<h3>1.3 角色与 Loopback</h3>
<table>
<thead>
<tr>
<th>设备</th>
<th>角色</th>
<th>Loopback0</th>
<th>备注</th>
</tr>
</thead>
<tbody>
<tr>
<td>SPINE1</td>
<td>EVPN route reflector</td>
<td>10.255.0.1/32</td>
<td><strong>不是 VTEP</strong>，没有 <code>nve1</code></td>
</tr>
<tr>
<td>SPINE2</td>
<td>EVPN route reflector</td>
<td>10.255.0.2/32</td>
<td>同上</td>
</tr>
<tr>
<td>LEAF1</td>
<td>VTEP</td>
<td>10.255.0.11/32</td>
<td>挂 HOST-A1 / HOST-A2</td>
</tr>
<tr>
<td>LEAF2</td>
<td>VTEP</td>
<td>10.255.0.12/32</td>
<td>挂 HOST-A3 / HOST-A4</td>
</tr>
<tr>
<td>LEAF3</td>
<td>VTEP</td>
<td>10.255.0.13/32</td>
<td>挂 HOST-B1 / HOST-B2</td>
</tr>
<tr>
<td>LEAF4</td>
<td>VTEP</td>
<td>10.255.0.14/32</td>
<td>挂 HOST-B3 / HOST-B4</td>
</tr>
</tbody>
</table>
<h3>1.4 链路与地址（16 条）</h3>
<table>
<thead>
<tr>
<th>#</th>
<th>链路</th>
<th>类型</th>
<th>网段 / 地址</th>
<th>说明</th>
</tr>
</thead>
<tbody>
<tr>
<td>1</td>
<td>SPINE1 <code>Ethernet0/0</code> ↔ LEAF1 <code>Ethernet0/0</code></td>
<td>路由口</td>
<td><code>10.0.1.0/30</code>（SPINE1 <code>.1</code> / LEAF1 <code>.2</code>）</td>
<td>underlay</td>
</tr>
<tr>
<td>2</td>
<td>SPINE1 <code>Ethernet0/1</code> ↔ LEAF2 <code>Ethernet0/0</code></td>
<td>路由口</td>
<td><code>10.0.1.4/30</code>（<code>.5</code> / <code>.6</code>）</td>
<td>underlay</td>
</tr>
<tr>
<td>3</td>
<td>SPINE1 <code>Ethernet0/2</code> ↔ LEAF3 <code>Ethernet0/0</code></td>
<td>路由口</td>
<td><code>10.0.1.8/30</code>（<code>.9</code> / <code>.10</code>）</td>
<td>underlay</td>
</tr>
<tr>
<td>4</td>
<td>SPINE1 <code>Ethernet0/3</code> ↔ LEAF4 <code>Ethernet0/0</code></td>
<td>路由口</td>
<td><code>10.0.1.12/30</code>（<code>.13</code> / <code>.14</code>）</td>
<td>underlay</td>
</tr>
<tr>
<td>5</td>
<td>SPINE2 <code>Ethernet0/0</code> ↔ LEAF1 <code>Ethernet0/1</code></td>
<td>路由口</td>
<td><code>10.0.2.0/30</code>（<code>.1</code> / <code>.2</code>）</td>
<td>underlay</td>
</tr>
<tr>
<td>6</td>
<td>SPINE2 <code>Ethernet0/1</code> ↔ LEAF2 <code>Ethernet0/1</code></td>
<td>路由口</td>
<td><code>10.0.2.4/30</code>（<code>.5</code> / <code>.6</code>）</td>
<td>underlay</td>
</tr>
<tr>
<td>7</td>
<td>SPINE2 <code>Ethernet0/2</code> ↔ LEAF3 <code>Ethernet0/1</code></td>
<td>路由口</td>
<td><code>10.0.2.8/30</code>（<code>.9</code> / <code>.10</code>）</td>
<td>underlay</td>
</tr>
<tr>
<td>8</td>
<td>SPINE2 <code>Ethernet0/3</code> ↔ LEAF4 <code>Ethernet0/1</code></td>
<td>路由口</td>
<td><code>10.0.2.12/30</code>（<code>.13</code> / <code>.14</code>）</td>
<td>underlay</td>
</tr>
<tr>
<td>9</td>
<td>LEAF1 <code>Ethernet0/2</code> ↔ HOST-A1 <code>eth0</code></td>
<td>access</td>
<td>VLAN 10</td>
<td>不打标</td>
</tr>
<tr>
<td>10</td>
<td>LEAF1 <code>Ethernet0/3</code> ↔ HOST-A2 <code>eth0</code></td>
<td>access</td>
<td>VLAN 20</td>
<td>不打标</td>
</tr>
<tr>
<td>11</td>
<td>LEAF2 <code>Ethernet0/2</code> ↔ HOST-A3 <code>eth0</code></td>
<td>access</td>
<td>VLAN 10</td>
<td>不打标</td>
</tr>
<tr>
<td>12</td>
<td>LEAF2 <code>Ethernet0/3</code> ↔ HOST-A4 <code>eth0</code></td>
<td>access</td>
<td>VLAN 20</td>
<td>不打标</td>
</tr>
<tr>
<td>13</td>
<td>LEAF3 <code>Ethernet0/2</code> ↔ HOST-B1 <code>eth0</code></td>
<td>access</td>
<td>VLAN 30</td>
<td>不打标</td>
</tr>
<tr>
<td>14</td>
<td>LEAF3 <code>Ethernet0/3</code> ↔ HOST-B2 <code>eth0</code></td>
<td>access</td>
<td>VLAN 40</td>
<td>不打标</td>
</tr>
<tr>
<td>15</td>
<td>LEAF4 <code>Ethernet0/2</code> ↔ HOST-B3 <code>eth0</code></td>
<td>access</td>
<td>VLAN 30</td>
<td>不打标</td>
</tr>
<tr>
<td>16</td>
<td>LEAF4 <code>Ethernet0/3</code> ↔ HOST-B4 <code>eth0</code></td>
<td>access</td>
<td>VLAN 40</td>
<td>不打标</td>
</tr>
</tbody>
</table>
<blockquote>
<p>EVE-NG 连线界面里的 IOL 端口可能显示为 <code>e0/0</code> 这类短名，<br />
设备内部对应的是 <code>Ethernet0/0</code>；两者是同一个口。</p>
</blockquote>
<h3>1.5 VLAN / VNI 与主机地址</h3>
<table>
<thead>
<tr>
<th>VLAN</th>
<th>名称</th>
<th>VNI</th>
<th>子网</th>
<th>网关（所有 leaf 相同）</th>
</tr>
</thead>
<tbody>
<tr>
<td>10</td>
<td>WEB</td>
<td>10010</td>
<td>10.10.10.0/24</td>
<td>10.10.10.1</td>
</tr>
<tr>
<td>20</td>
<td>APP</td>
<td>10020</td>
<td>10.10.20.0/24</td>
<td>10.10.20.1</td>
</tr>
<tr>
<td>30</td>
<td>DB</td>
<td>10030</td>
<td>10.10.30.0/24</td>
<td>10.10.30.1</td>
</tr>
<tr>
<td>40</td>
<td>OPS</td>
<td>10040</td>
<td>10.10.40.0/24</td>
<td>10.10.40.1</td>
</tr>
</tbody>
</table>
<table>
<thead>
<tr>
<th>主机</th>
<th>IP / 掩码</th>
<th>网关</th>
<th>VLAN</th>
<th>接入 leaf / 端口</th>
</tr>
</thead>
<tbody>
<tr>
<td>HOST-A1</td>
<td>10.10.10.11/24</td>
<td>10.10.10.1</td>
<td>10</td>
<td>LEAF1 <code>Ethernet0/2</code></td>
</tr>
<tr>
<td>HOST-A2</td>
<td>10.10.20.11/24</td>
<td>10.10.20.1</td>
<td>20</td>
<td>LEAF1 <code>Ethernet0/3</code></td>
</tr>
<tr>
<td>HOST-A3</td>
<td>10.10.10.12/24</td>
<td>10.10.10.1</td>
<td>10</td>
<td>LEAF2 <code>Ethernet0/2</code></td>
</tr>
<tr>
<td>HOST-A4</td>
<td>10.10.20.12/24</td>
<td>10.10.20.1</td>
<td>20</td>
<td>LEAF2 <code>Ethernet0/3</code></td>
</tr>
<tr>
<td>HOST-B1</td>
<td>10.10.30.11/24</td>
<td>10.10.30.1</td>
<td>30</td>
<td>LEAF3 <code>Ethernet0/2</code></td>
</tr>
<tr>
<td>HOST-B2</td>
<td>10.10.40.11/24</td>
<td>10.10.40.1</td>
<td>40</td>
<td>LEAF3 <code>Ethernet0/3</code></td>
</tr>
<tr>
<td>HOST-B3</td>
<td>10.10.30.12/24</td>
<td>10.10.30.1</td>
<td>30</td>
<td>LEAF4 <code>Ethernet0/2</code></td>
</tr>
<tr>
<td>HOST-B4</td>
<td>10.10.40.12/24</td>
<td>10.10.40.1</td>
<td>40</td>
<td>LEAF4 <code>Ethernet0/3</code></td>
</tr>
</tbody>
</table>
<hr />
<h2>2. 设计说明</h2>
<h3>2.1 Underlay：OSPF area 0</h3>
<p>所有 spine-leaf 互联口都是路由口（<code>no switchport</code>），配 <code>/30</code> 地址，<br />
并用 <code>ip ospf network point-to-point</code> 避免选 DR/BDR。Loopback0 也放进 area 0，<br />
作为 BGP 的 <code>update-source</code> 和 VXLAN 的 <code>source-interface</code>。</p>
<h3>2.2 Overlay：iBGP EVPN + spine RR</h3>
<ul>
<li>单 AS 65000；</li>
<li>两台 spine 是 route reflector，4 台 leaf 只与 spine 建邻居；</li>
<li>spine 对每个 leaf 配 <code>route-reflector-client</code>；</li>
<li>所有邻居都要 <code>send-community extended</code>，否则 EVPN 的扩展团体传不过去；</li>
<li><code>no bgp default ipv4-unicast</code> 只是避免无意义的 IPv4 单播 AF，不是必须，但推荐。</li>
</ul>
<h3>2.3 数据面：L2 VNI + ingress replication</h3>
<p>每个 VLAN 一个 L2 VNI：</p>
<pre><code class="language-text">VLAN 10 → VNI 10010
VLAN 20 → VNI 10020
VLAN 30 → VNI 10030
VLAN 40 → VNI 10040
</code></pre>
<p><code>interface nve1</code> 下每个 VNI 配 <code>ingress-replication</code>，没有组播 underlay。<br />
每个 VNI 还必须有一个 <strong>EVI</strong>（EVPN instance）：</p>
<pre><code class="language-text">l2vpn evpn instance 10 vlan-based
encapsulation vxlan
replication-type ingress
advertise mac enable

vlan configuration 10
member evpn-instance 10 vni 10010
</code></pre>
<h3>2.4 分布式 anycast 网关</h3>
<p>本实验<strong>不做 L3 VNI / 对称 IRB</strong>。跨子网是这样通的：</p>
<ol>
<li>主机把包发给本地 anycast 网关（比如 LEAF3 的 VLAN 30 SVI）；</li>
<li>LEAF3 查表发现目的 <code>10.10.40.12</code> 在直连的 VLAN 40 里；</li>
<li>LEAF3 在 VLAN 40 上发 ARP，ARP 请求通过 <strong>VNI 10040</strong> 泛洪到 LEAF4；</li>
<li>LEAF4 上的主机应答，LEAF3 把帧封进 VNI 10040 发给 LEAF4。</li>
</ol>
<p><strong>全程没有 L3 VNI</strong>。代价是每个 leaf 都要有全部 4 个 SVI，<br />
且所有 leaf 的同一子网 SVI 必须使用<strong>相同的 IP 和相同的 MAC</strong>：</p>
<pre><code class="language-text">interface Vlan10
no autostate
no ip proxy-arp
mac-address 0000.5e00.0101
ip address 10.10.10.1 255.255.255.0
no shutdown
</code></pre>
<ul>
<li><strong>同 IP</strong>：所有 leaf 都是 <code>10.10.10.1</code>；</li>
<li><strong>同 MAC</strong>：<code>0000.5e00.0101</code>，否则主机 ARP 缓存里的网关 MAC 换 leaf 后就失效；</li>
<li><strong><code>no ip proxy-arp</code></strong>：防止某台 leaf 用自己的 anycast MAC 代替远端主机回答 ARP，<br />
把“远端主机自己的 ARP 应答”变成“网关代理应答”，破坏 MAC-IP 学习。</li>
</ul>
<h3>2.5 为什么需要 <code>switchport voice vlan</code></h3>
<p>每台 leaf 只有 2 个主机口，但需要 4 个 VLAN 的 SVI 都 up。<br />
没有本地 access 口的 VLAN，其 SVI 在<strong>开机时</strong>可能一直是 down；<br />
<code>no autostate</code> 是运行态属性，拉不起已经 down 的 SVI。</p>
<p>解决办法：在主机口上把“缺失的 VLAN”配成 voice VLAN：</p>
<pre><code class="language-text">interface Ethernet0/2
switchport mode access
switchport access vlan 10
switchport voice vlan 30
spanning-tree portfast
</code></pre>
<p>这样 VLAN 30 在本地保持 active，<code>Vlan30</code> 开机即 up；<br />
主机的 untagged 流量仍然走 access VLAN 10，完全不受影响。</p>
<h3>2.6 为什么不做 L3 VNI</h3>
<p>本实验刻意只做 <strong>L2 VNI + anycast SVI</strong>，展示“没有 L3 VNI 时跨子网怎么通”；<br />
不覆盖 VRF-aware EVPN、对称 IRB 和 L3 VNI 模型（可参考 cEOS 的对称 IRB 实验）。</p>
<hr />
<h2>3. 完整设备配置</h2>
<p>以下配置都是<strong>启动配置</strong>，不是 <code>show running-config</code>；缩进和 <code>!</code> 分隔符保留原样。<br />
建议直接作为各 IOL 节点的 Startup Config 导入，避免手工粘贴出错。</p>
<h3>3.1 SPINE1</h3>
<pre><code class="language-text">hostname SPINE1
!
no ip domain-lookup
ip routing
!
interface Loopback0
ip address 10.255.0.1 255.255.255.255
ip ospf 1 area 0
!
interface Ethernet0/0
description to-LEAF1
no switchport
ip address 10.0.1.1 255.255.255.252
ip ospf network point-to-point
ip ospf 1 area 0
no shutdown
!
interface Ethernet0/1
description to-LEAF2
no switchport
ip address 10.0.1.5 255.255.255.252
ip ospf network point-to-point
ip ospf 1 area 0
no shutdown
!
interface Ethernet0/2
description to-LEAF3
no switchport
ip address 10.0.1.9 255.255.255.252
ip ospf network point-to-point
ip ospf 1 area 0
no shutdown
!
interface Ethernet0/3
description to-LEAF4
no switchport
ip address 10.0.1.13 255.255.255.252
ip ospf network point-to-point
ip ospf 1 area 0
no shutdown
!
l2vpn evpn
replication-type ingress
router-id Loopback0
!
router ospf 1
router-id 10.255.0.1
!
router bgp 65000
bgp router-id 10.255.0.1
bgp log-neighbor-changes
no bgp default ipv4-unicast
neighbor 10.255.0.11 remote-as 65000
neighbor 10.255.0.11 update-source Loopback0
neighbor 10.255.0.12 remote-as 65000
neighbor 10.255.0.12 update-source Loopback0
neighbor 10.255.0.13 remote-as 65000
neighbor 10.255.0.13 update-source Loopback0
neighbor 10.255.0.14 remote-as 65000
neighbor 10.255.0.14 update-source Loopback0
!
address-family l2vpn evpn
neighbor 10.255.0.11 activate
neighbor 10.255.0.11 route-reflector-client
neighbor 10.255.0.11 send-community extended
neighbor 10.255.0.12 activate
neighbor 10.255.0.12 route-reflector-client
neighbor 10.255.0.12 send-community extended
neighbor 10.255.0.13 activate
neighbor 10.255.0.13 route-reflector-client
neighbor 10.255.0.13 send-community extended
neighbor 10.255.0.14 activate
neighbor 10.255.0.14 route-reflector-client
neighbor 10.255.0.14 send-community extended
exit-address-family
!
line con 0
logging synchronous
exec-timeout 0 0
!
end
</code></pre>
<h3>3.2 SPINE2</h3>
<pre><code class="language-text">hostname SPINE2
!
no ip domain-lookup
ip routing
!
interface Loopback0
ip address 10.255.0.2 255.255.255.255
ip ospf 1 area 0
!
interface Ethernet0/0
description to-LEAF1
no switchport
ip address 10.0.2.1 255.255.255.252
ip ospf network point-to-point
ip ospf 1 area 0
no shutdown
!
interface Ethernet0/1
description to-LEAF2
no switchport
ip address 10.0.2.5 255.255.255.252
ip ospf network point-to-point
ip ospf 1 area 0
no shutdown
!
interface Ethernet0/2
description to-LEAF3
no switchport
ip address 10.0.2.9 255.255.255.252
ip ospf network point-to-point
ip ospf 1 area 0
no shutdown
!
interface Ethernet0/3
description to-LEAF4
no switchport
ip address 10.0.2.13 255.255.255.252
ip ospf network point-to-point
ip ospf 1 area 0
no shutdown
!
l2vpn evpn
replication-type ingress
router-id Loopback0
!
router ospf 1
router-id 10.255.0.2
!
router bgp 65000
bgp router-id 10.255.0.2
bgp log-neighbor-changes
no bgp default ipv4-unicast
neighbor 10.255.0.11 remote-as 65000
neighbor 10.255.0.11 update-source Loopback0
neighbor 10.255.0.12 remote-as 65000
neighbor 10.255.0.12 update-source Loopback0
neighbor 10.255.0.13 remote-as 65000
neighbor 10.255.0.13 update-source Loopback0
neighbor 10.255.0.14 remote-as 65000
neighbor 10.255.0.14 update-source Loopback0
!
address-family l2vpn evpn
neighbor 10.255.0.11 activate
neighbor 10.255.0.11 route-reflector-client
neighbor 10.255.0.11 send-community extended
neighbor 10.255.0.12 activate
neighbor 10.255.0.12 route-reflector-client
neighbor 10.255.0.12 send-community extended
neighbor 10.255.0.13 activate
neighbor 10.255.0.13 route-reflector-client
neighbor 10.255.0.13 send-community extended
neighbor 10.255.0.14 activate
neighbor 10.255.0.14 route-reflector-client
neighbor 10.255.0.14 send-community extended
exit-address-family
!
line con 0
logging synchronous
exec-timeout 0 0
!
end
</code></pre>
<h3>3.3 LEAF1</h3>
<pre><code class="language-text">hostname LEAF1
!
no ip domain-lookup
ip routing
vtp mode transparent
!
vlan 10
name WEB
vlan 20
name APP
vlan 30
name DB
vlan 40
name OPS
!
interface Loopback0
ip address 10.255.0.11 255.255.255.255
ip ospf 1 area 0
!
interface Ethernet0/0
description to-SPINE1
no switchport
ip address 10.0.1.2 255.255.255.252
ip ospf network point-to-point
ip ospf 1 area 0
no shutdown
!
interface Ethernet0/1
description to-SPINE2
no switchport
ip address 10.0.2.2 255.255.255.252
ip ospf network point-to-point
ip ospf 1 area 0
no shutdown
!
interface Ethernet0/2
description to-HOST-A1
switchport mode access
switchport access vlan 10
switchport voice vlan 30
spanning-tree portfast
no shutdown
!
interface Ethernet0/3
description to-HOST-A2
switchport mode access
switchport access vlan 20
switchport voice vlan 40
spanning-tree portfast
no shutdown
!
interface Vlan10
no autostate
no ip proxy-arp
mac-address 0000.5e00.0101
ip address 10.10.10.1 255.255.255.0
no shutdown
!
interface Vlan20
no autostate
no ip proxy-arp
mac-address 0000.5e00.0101
ip address 10.10.20.1 255.255.255.0
no shutdown
!
interface Vlan30
no autostate
no ip proxy-arp
mac-address 0000.5e00.0101
ip address 10.10.30.1 255.255.255.0
no shutdown
!
interface Vlan40
no autostate
no ip proxy-arp
mac-address 0000.5e00.0101
ip address 10.10.40.1 255.255.255.0
no shutdown
!
l2vpn evpn
replication-type ingress
router-id Loopback0
!
l2vpn evpn instance 10 vlan-based
encapsulation vxlan
replication-type ingress
advertise mac enable
!
l2vpn evpn instance 20 vlan-based
encapsulation vxlan
replication-type ingress
advertise mac enable
!
l2vpn evpn instance 30 vlan-based
encapsulation vxlan
replication-type ingress
advertise mac enable
!
l2vpn evpn instance 40 vlan-based
encapsulation vxlan
replication-type ingress
advertise mac enable
!
vlan configuration 10
member evpn-instance 10 vni 10010
!
vlan configuration 20
member evpn-instance 20 vni 10020
!
vlan configuration 30
member evpn-instance 30 vni 10030
!
vlan configuration 40
member evpn-instance 40 vni 10040
!
interface nve1
no shutdown
source-interface Loopback0
host-reachability protocol bgp
member vni 10010
ingress-replication
member vni 10020
ingress-replication
member vni 10030
ingress-replication
member vni 10040
ingress-replication
!
router ospf 1
router-id 10.255.0.11
!
router bgp 65000
bgp router-id 10.255.0.11
bgp log-neighbor-changes
no bgp default ipv4-unicast
neighbor 10.255.0.1 remote-as 65000
neighbor 10.255.0.1 update-source Loopback0
neighbor 10.255.0.2 remote-as 65000
neighbor 10.255.0.2 update-source Loopback0
!
address-family l2vpn evpn
neighbor 10.255.0.1 activate
neighbor 10.255.0.1 send-community extended
neighbor 10.255.0.2 activate
neighbor 10.255.0.2 send-community extended
exit-address-family
!
line con 0
logging synchronous
exec-timeout 0 0
!
end
</code></pre>
<h3>3.4 LEAF2</h3>
<pre><code class="language-text">hostname LEAF2
!
no ip domain-lookup
ip routing
vtp mode transparent
!
vlan 10
name WEB
vlan 20
name APP
vlan 30
name DB
vlan 40
name OPS
!
interface Loopback0
ip address 10.255.0.12 255.255.255.255
ip ospf 1 area 0
!
interface Ethernet0/0
description to-SPINE1
no switchport
ip address 10.0.1.6 255.255.255.252
ip ospf network point-to-point
ip ospf 1 area 0
no shutdown
!
interface Ethernet0/1
description to-SPINE2
no switchport
ip address 10.0.2.6 255.255.255.252
ip ospf network point-to-point
ip ospf 1 area 0
no shutdown
!
interface Ethernet0/2
description to-HOST-A3
switchport mode access
switchport access vlan 10
switchport voice vlan 30
spanning-tree portfast
no shutdown
!
interface Ethernet0/3
description to-HOST-A4
switchport mode access
switchport access vlan 20
switchport voice vlan 40
spanning-tree portfast
no shutdown
!
interface Vlan10
no autostate
no ip proxy-arp
mac-address 0000.5e00.0101
ip address 10.10.10.1 255.255.255.0
no shutdown
!
interface Vlan20
no autostate
no ip proxy-arp
mac-address 0000.5e00.0101
ip address 10.10.20.1 255.255.255.0
no shutdown
!
interface Vlan30
no autostate
no ip proxy-arp
mac-address 0000.5e00.0101
ip address 10.10.30.1 255.255.255.0
no shutdown
!
interface Vlan40
no autostate
no ip proxy-arp
mac-address 0000.5e00.0101
ip address 10.10.40.1 255.255.255.0
no shutdown
!
l2vpn evpn
replication-type ingress
router-id Loopback0
!
l2vpn evpn instance 10 vlan-based
encapsulation vxlan
replication-type ingress
advertise mac enable
!
l2vpn evpn instance 20 vlan-based
encapsulation vxlan
replication-type ingress
advertise mac enable
!
l2vpn evpn instance 30 vlan-based
encapsulation vxlan
replication-type ingress
advertise mac enable
!
l2vpn evpn instance 40 vlan-based
encapsulation vxlan
replication-type ingress
advertise mac enable
!
vlan configuration 10
member evpn-instance 10 vni 10010
!
vlan configuration 20
member evpn-instance 20 vni 10020
!
vlan configuration 30
member evpn-instance 30 vni 10030
!
vlan configuration 40
member evpn-instance 40 vni 10040
!
interface nve1
no shutdown
source-interface Loopback0
host-reachability protocol bgp
member vni 10010
ingress-replication
member vni 10020
ingress-replication
member vni 10030
ingress-replication
member vni 10040
ingress-replication
!
router ospf 1
router-id 10.255.0.12
!
router bgp 65000
bgp router-id 10.255.0.12
bgp log-neighbor-changes
no bgp default ipv4-unicast
neighbor 10.255.0.1 remote-as 65000
neighbor 10.255.0.1 update-source Loopback0
neighbor 10.255.0.2 remote-as 65000
neighbor 10.255.0.2 update-source Loopback0
!
address-family l2vpn evpn
neighbor 10.255.0.1 activate
neighbor 10.255.0.1 send-community extended
neighbor 10.255.0.2 activate
neighbor 10.255.0.2 send-community extended
exit-address-family
!
line con 0
logging synchronous
exec-timeout 0 0
!
end
</code></pre>
<h3>3.5 LEAF3</h3>
<pre><code class="language-text">hostname LEAF3
!
no ip domain-lookup
ip routing
vtp mode transparent
!
vlan 10
name WEB
vlan 20
name APP
vlan 30
name DB
vlan 40
name OPS
!
interface Loopback0
ip address 10.255.0.13 255.255.255.255
ip ospf 1 area 0
!
interface Ethernet0/0
description to-SPINE1
no switchport
ip address 10.0.1.10 255.255.255.252
ip ospf network point-to-point
ip ospf 1 area 0
no shutdown
!
interface Ethernet0/1
description to-SPINE2
no switchport
ip address 10.0.2.10 255.255.255.252
ip ospf network point-to-point
ip ospf 1 area 0
no shutdown
!
interface Ethernet0/2
description to-HOST-B1
switchport mode access
switchport access vlan 30
switchport voice vlan 10
spanning-tree portfast
no shutdown
!
interface Ethernet0/3
description to-HOST-B2
switchport mode access
switchport access vlan 40
switchport voice vlan 20
spanning-tree portfast
no shutdown
!
interface Vlan10
no autostate
no ip proxy-arp
mac-address 0000.5e00.0101
ip address 10.10.10.1 255.255.255.0
no shutdown
!
interface Vlan20
no autostate
no ip proxy-arp
mac-address 0000.5e00.0101
ip address 10.10.20.1 255.255.255.0
no shutdown
!
interface Vlan30
no autostate
no ip proxy-arp
mac-address 0000.5e00.0101
ip address 10.10.30.1 255.255.255.0
no shutdown
!
interface Vlan40
no autostate
no ip proxy-arp
mac-address 0000.5e00.0101
ip address 10.10.40.1 255.255.255.0
no shutdown
!
l2vpn evpn
replication-type ingress
router-id Loopback0
!
l2vpn evpn instance 10 vlan-based
encapsulation vxlan
replication-type ingress
advertise mac enable
!
l2vpn evpn instance 20 vlan-based
encapsulation vxlan
replication-type ingress
advertise mac enable
!
l2vpn evpn instance 30 vlan-based
encapsulation vxlan
replication-type ingress
advertise mac enable
!
l2vpn evpn instance 40 vlan-based
encapsulation vxlan
replication-type ingress
advertise mac enable
!
vlan configuration 10
member evpn-instance 10 vni 10010
!
vlan configuration 20
member evpn-instance 20 vni 10020
!
vlan configuration 30
member evpn-instance 30 vni 10030
!
vlan configuration 40
member evpn-instance 40 vni 10040
!
interface nve1
no shutdown
source-interface Loopback0
host-reachability protocol bgp
member vni 10010
ingress-replication
member vni 10020
ingress-replication
member vni 10030
ingress-replication
member vni 10040
ingress-replication
!
router ospf 1
router-id 10.255.0.13
!
router bgp 65000
bgp router-id 10.255.0.13
bgp log-neighbor-changes
no bgp default ipv4-unicast
neighbor 10.255.0.1 remote-as 65000
neighbor 10.255.0.1 update-source Loopback0
neighbor 10.255.0.2 remote-as 65000
neighbor 10.255.0.2 update-source Loopback0
!
address-family l2vpn evpn
neighbor 10.255.0.1 activate
neighbor 10.255.0.1 send-community extended
neighbor 10.255.0.2 activate
neighbor 10.255.0.2 send-community extended
exit-address-family
!
line con 0
logging synchronous
exec-timeout 0 0
!
end
</code></pre>
<h3>3.6 LEAF4</h3>
<pre><code class="language-text">hostname LEAF4
!
no ip domain-lookup
ip routing
vtp mode transparent
!
vlan 10
name WEB
vlan 20
name APP
vlan 30
name DB
vlan 40
name OPS
!
interface Loopback0
ip address 10.255.0.14 255.255.255.255
ip ospf 1 area 0
!
interface Ethernet0/0
description to-SPINE1
no switchport
ip address 10.0.1.14 255.255.255.252
ip ospf network point-to-point
ip ospf 1 area 0
no shutdown
!
interface Ethernet0/1
description to-SPINE2
no switchport
ip address 10.0.2.14 255.255.255.252
ip ospf network point-to-point
ip ospf 1 area 0
no shutdown
!
interface Ethernet0/2
description to-HOST-B3
switchport mode access
switchport access vlan 30
switchport voice vlan 10
spanning-tree portfast
no shutdown
!
interface Ethernet0/3
description to-HOST-B4
switchport mode access
switchport access vlan 40
switchport voice vlan 20
spanning-tree portfast
no shutdown
!
interface Vlan10
no autostate
no ip proxy-arp
mac-address 0000.5e00.0101
ip address 10.10.10.1 255.255.255.0
no shutdown
!
interface Vlan20
no autostate
no ip proxy-arp
mac-address 0000.5e00.0101
ip address 10.10.20.1 255.255.255.0
no shutdown
!
interface Vlan30
no autostate
no ip proxy-arp
mac-address 0000.5e00.0101
ip address 10.10.30.1 255.255.255.0
no shutdown
!
interface Vlan40
no autostate
no ip proxy-arp
mac-address 0000.5e00.0101
ip address 10.10.40.1 255.255.255.0
no shutdown
!
l2vpn evpn
replication-type ingress
router-id Loopback0
!
l2vpn evpn instance 10 vlan-based
encapsulation vxlan
replication-type ingress
advertise mac enable
!
l2vpn evpn instance 20 vlan-based
encapsulation vxlan
replication-type ingress
advertise mac enable
!
l2vpn evpn instance 30 vlan-based
encapsulation vxlan
replication-type ingress
advertise mac enable
!
l2vpn evpn instance 40 vlan-based
encapsulation vxlan
replication-type ingress
advertise mac enable
!
vlan configuration 10
member evpn-instance 10 vni 10010
!
vlan configuration 20
member evpn-instance 20 vni 10020
!
vlan configuration 30
member evpn-instance 30 vni 10030
!
vlan configuration 40
member evpn-instance 40 vni 10040
!
interface nve1
no shutdown
source-interface Loopback0
host-reachability protocol bgp
member vni 10010
ingress-replication
member vni 10020
ingress-replication
member vni 10030
ingress-replication
member vni 10040
ingress-replication
!
router ospf 1
router-id 10.255.0.14
!
router bgp 65000
bgp router-id 10.255.0.14
bgp log-neighbor-changes
no bgp default ipv4-unicast
neighbor 10.255.0.1 remote-as 65000
neighbor 10.255.0.1 update-source Loopback0
neighbor 10.255.0.2 remote-as 65000
neighbor 10.255.0.2 update-source Loopback0
!
address-family l2vpn evpn
neighbor 10.255.0.1 activate
neighbor 10.255.0.1 send-community extended
neighbor 10.255.0.2 activate
neighbor 10.255.0.2 send-community extended
exit-address-family
!
line con 0
logging synchronous
exec-timeout 0 0
!
end
</code></pre>
<h3>3.7 VPCS 主机</h3>
<p>每台 VPCS 的启动配置只有两行。下面按主机分开，方便逐台复制：</p>
<p><strong>HOST-A1</strong></p>
<pre><code class="language-text">set pcname HOST-A1
ip 10.10.10.11/24 10.10.10.1
</code></pre>
<p><strong>HOST-A2</strong></p>
<pre><code class="language-text">set pcname HOST-A2
ip 10.10.20.11/24 10.10.20.1
</code></pre>
<p><strong>HOST-A3</strong></p>
<pre><code class="language-text">set pcname HOST-A3
ip 10.10.10.12/24 10.10.10.1
</code></pre>
<p><strong>HOST-A4</strong></p>
<pre><code class="language-text">set pcname HOST-A4
ip 10.10.20.12/24 10.10.20.1
</code></pre>
<p><strong>HOST-B1</strong></p>
<pre><code class="language-text">set pcname HOST-B1
ip 10.10.30.11/24 10.10.30.1
</code></pre>
<p><strong>HOST-B2</strong></p>
<pre><code class="language-text">set pcname HOST-B2
ip 10.10.40.11/24 10.10.40.1
</code></pre>
<p><strong>HOST-B3</strong></p>
<pre><code class="language-text">set pcname HOST-B3
ip 10.10.30.12/24 10.10.30.1
</code></pre>
<p><strong>HOST-B4</strong></p>
<pre><code class="language-text">set pcname HOST-B4
ip 10.10.40.12/24 10.10.40.1
</code></pre>
<h3>3.8 配置要点核对</h3>
<ul>
<li><strong>每台 leaf</strong>：<code>ip routing</code>、<code>vtp mode transparent</code>、4 个 VLAN、4 个 SVI、<br />
4 个 EVI、4 个 <code>vlan configuration</code>、4 个 <code>member vni</code>；</li>
<li><strong>每台 spine</strong>：<code>ip routing</code>、OSPF、<code>l2vpn evpn</code> 全局块、BGP EVPN RR 配置；<br />
<strong>spine 不配 <code>nve1</code></strong>；</li>
<li><strong>所有 SVI</strong>：<code>no autostate</code>、<code>no ip proxy-arp</code>、<code>mac-address 0000.5e00.0101</code>；</li>
<li><strong>所有 leaf 的同一 VLAN SVI</strong>：IP 必须完全相同（<code>.1</code>）；</li>
<li><strong>所有 uplink</strong>：<code>no switchport</code> + <code>ip ospf network point-to-point</code>；</li>
<li><strong>所有主机口</strong>：<code>switchport mode access</code>，不要配成 trunk。</li>
</ul>
<hr />
<h2>4. 在 EVE-NG 中搭建</h2>
<h3>4.1 准备 IOL 镜像</h3>
<ol>
<li>把 <code>l2-iol-xe-17-18-02.bin</code> 放到 <code>/opt/unetlab/addons/iol/bin/</code>；</li>
<li>按 EVE-NG 的 IOL 流程放置有效的 <code>iourc</code> 并修正权限；</li>
<li>添加 IOL 模板节点，镜像选 <code>l2-iol-xe-17-18-02.bin</code>。</li>
</ol>
<blockquote>
<p>镜像自行准备；文件名可以不同，但 <code>show version</code> 必须与 §0.1 一致。</p>
</blockquote>
<h3>4.2 建节点</h3>
<ul>
<li>6 台 IOL：模板 <code>iol</code>，镜像 <code>l2-iol-xe-17-18-02.bin</code>，<strong>Ethernet = 1（4 个口）</strong>，RAM/NVRAM 1024，Serial 0；</li>
<li>8 台 VPCS：模板 <code>vpcs</code>，只有 <code>eth0</code>；</li>
<li>节点名用 <code>SPINE1/2</code>、<code>LEAF1..4</code>、<code>HOST-A1..B4</code>，<strong>只用 ASCII</strong>。</li>
</ul>
<h3>4.3 连线</h3>
<p>按 §1.4 的 16 条链路连接。注意：</p>
<ul>
<li>IOL 的 uplink 用 <code>Ethernet0/0</code> / <code>Ethernet0/1</code>；</li>
<li>主机接 <code>Ethernet0/2</code> / <code>Ethernet0/3</code>；</li>
<li>VPCS 只有 <code>eth0</code>；</li>
<li>不要给主机口配 trunk（§6.6）。</li>
</ul>
<h3>4.4 导入启动配置</h3>
<p>推荐方式：在 EVE-NG 里打开每台 IOL 节点的 <strong>Startup Config</strong>，粘贴 §3 对应的配置；<br />
VPCS 也按 §3.7 分别粘贴。这样开机后不需要手工再配。</p>
<p>如果启动后手工粘贴：<code>enable</code>（无密码）→ <code>configure terminal</code> → 按 §3 粘贴 → <code>end</code>；<br />
需要持久化时再 <code>write memory</code>。</p>
<blockquote>
<p>手工粘贴时，务必先配 <code>vtp mode transparent</code>，再配 <code>vlan</code> 块（§6.3）。</p>
</blockquote>
<h3>4.5 首次启动：必须 wipe</h3>
<p><strong>这是本实验最容易忽略的一步。</strong></p>
<p>在 EVE-NG 中，IOL 的 <code>vlan.dat</code> 不会随 stop/start 清除。旧 <code>vlan.dat</code> 会让<br />
启动配置里的 <code>vlan</code> 块名字不更新，甚至让 <code>switchport voice vlan</code> 行直接从<br />
<code>running-config</code> 消失。同一份配置在 <strong>wipe 后</strong> 100% 正确。</p>
<p>正确顺序：</p>
<pre><code class="language-text">导入启动配置 → 对每台 IOL 执行 Wipe → Start
</code></pre>
<p>以后只要<strong>改了 VLAN 结构</strong>，也要重新 wipe 再 start。<br />
不要用 stop + start 验证预配配置（§6.4）。</p>
<h3>4.6 启动后检查</h3>
<ol>
<li>控制台出现 <code>Press RETURN to get started</code> 后回车；遇到 ZTP/autoinstall 提示也回车打断；</li>
<li><code>enable</code>；</li>
<li>按 <strong>下篇 §5.3</strong> 逐项检查。</li>
</ol>
<hr />
<h2>5. 验收</h2>
<h3>5.1 数据面：在 VPCS 上 ping</h3>
<p>验收<strong>全部在 VPCS 上做</strong>，不要用 IOL 自己 ping 自己。</p>
<table>
<thead>
<tr>
<th>源</th>
<th>目的</th>
<th>路径</th>
<th>预期</th>
<th>关键判据</th>
</tr>
</thead>
<tbody>
<tr>
<td>HOST-B1 10.10.30.11</td>
<td>HOST-B3 10.10.30.12</td>
<td>同 VLAN 30，LEAF3 → LEAF4</td>
<td><strong>5/5</strong></td>
<td><strong><code>ttl=64</code></strong>：纯二层桥接</td>
</tr>
<tr>
<td>HOST-B1 10.10.30.11</td>
<td>HOST-B4 10.10.40.12</td>
<td>跨 VLAN 30 → 40，LEAF3 → LEAF4</td>
<td><strong>5/5</strong></td>
<td><strong><code>ttl=63</code></strong>：恰好一跳</td>
</tr>
<tr>
<td>HOST-B1 10.10.30.11</td>
<td>HOST-B2 10.10.40.11</td>
<td>跨 VLAN 30 → 40，同 LEAF3</td>
<td><strong>5/5</strong></td>
<td><code>ttl=63</code></td>
</tr>
<tr>
<td>HOST-B1 10.10.30.11</td>
<td>HOST-A1 10.10.10.11</td>
<td>跨 VLAN 30 → 10，LEAF3 → LEAF1</td>
<td><strong>5/5</strong></td>
<td><code>ttl=63</code></td>
</tr>
<tr>
<td>HOST-B3 10.10.30.12</td>
<td>HOST-B1 10.10.30.11</td>
<td>同 VLAN 30 反向</td>
<td><strong>5/5</strong></td>
<td><code>ttl=64</code></td>
</tr>
</tbody>
</table>
<p>原始输出示例（HOST-B1 → HOST-B3，同 VLAN 跨 leaf）：</p>
<pre><code class="language-text">HOST-B1> ping 10.10.30.12 -c 5
84 bytes from 10.10.30.12 icmp_seq=1 ttl=64 time=1.726 ms
84 bytes from 10.10.30.12 icmp_seq=2 ttl=64 time=2.655 ms
84 bytes from 10.10.30.12 icmp_seq=3 ttl=64 time=2.530 ms
84 bytes from 10.10.30.12 icmp_seq=4 ttl=64 time=2.622 ms
84 bytes from 10.10.30.12 icmp_seq=5 ttl=64 time=2.592 ms
</code></pre>
<p>原始输出示例（HOST-B1 → HOST-B4，跨 VLAN 跨 leaf）：</p>
<pre><code class="language-text">HOST-B1> ping 10.10.40.12 -c 5
84 bytes from 10.10.40.12 icmp_seq=1 ttl=63 time=3.566 ms
84 bytes from 10.10.40.12 icmp_seq=2 ttl=63 time=2.946 ms
84 bytes from 10.10.40.12 icmp_seq=3 ttl=63 time=2.559 ms
84 bytes from 10.10.40.12 icmp_seq=4 ttl=63 time=2.776 ms
84 bytes from 10.10.40.12 icmp_seq=5 ttl=63 time=2.325 ms
</code></pre>
<blockquote>
<p><strong>TTL 是最便宜的判据</strong>：<br />
同 VLAN 必须 <code>64</code>（没有经过路由器），跨 VLAN 必须 <code>63</code>（恰好经过一个路由器）。<br />
同 VLAN 出现 <code>63</code>，说明它被某个 SVI 路由了一次，路径不对。</p>
</blockquote>
<h3>5.2 控制面：在 leaf 上检查</h3>
<p>先 <code>enable</code>。</p>
<p><strong>OSPF 邻居（每台 leaf 两个 FULL）：</strong></p>
<pre><code class="language-text">LEAF1> show ip ospf neighbor
Neighbor ID Pri State       Dead Time Address       Interface
10.255.0.2    0 FULL/-    00:00:35 10.0.2.1    Ethernet0/1
10.255.0.1    0 FULL/-    00:00:31 10.0.1.1    Ethernet0/0
</code></pre>
<p><strong>BGP EVPN 邻居（两个 Established，PfxRcd > 0）：</strong></p>
<pre><code class="language-text">LEAF1> show bgp l2vpn evpn summary
BGP router identifier 10.255.0.11, local AS number 65000
...
Neighbor    V       AS MsgRcvd MsgSent TblVerInQ OutQ Up/DownState/PfxRcd
10.255.0.1    4    65000 304 264    174 0 0 03:49:58    19
10.255.0.2    4    65000 304 265    174 0 0 03:49:54    19
</code></pre>
<blockquote>
<p>上表是某一时刻的<strong>输出示例</strong>，<code>MsgRcvd</code> / <code>MsgSent</code> / <code>Up/Down</code> / <code>PfxRcd</code><br />
都会随时间变化。<code>PfxRcd</code> 随主机上下线和 ARP 老化在 <strong>19–23</strong> 之间漂移。<br />
<strong>稳定判据是邻居 Established、PfxRcd > 0、MAC-IP 表完整</strong>，不要死记某个数字。</p>
</blockquote>
<p><strong>NVE VNI（4 个都 Up）：</strong></p>
<pre><code class="language-text">LEAF1> show nve vni
InterfaceVNI    Multicast-groupVNI stateModeVLANcfg vrf
nve1    10040    N/A          Up       L2CP40 CLI N/A
nve1    10030    N/A          Up       L2CP30 CLI N/A
nve1    10020    N/A          Up       L2CP20 CLI N/A
nve1    10010    N/A          Up       L2CP10 CLI N/A
</code></pre>
<p><strong>NVE peers（3 个远端 VTEP × 4 个 VNI = 12 个 Up）：</strong></p>
<pre><code class="language-text">LEAF1> show nve peers
InterfaceVNI    Type Peer-IP       RMAC/Num_RTs eVNI state flags UP time
nve1    10010 L2CP 10.255.0.12    3          10010    UP N/A01:32:57
nve1    10010 L2CP 10.255.0.13    1          10010    UP N/A01:32:57
nve1    10010 L2CP 10.255.0.14    1          10010    UP N/A01:32:57
...（其余 9 行同理）
</code></pre>
<blockquote>
<p><code>UP time</code> 和 <code>RMAC/Num_RTs</code> 的具体数值以实际为准；关键是每个 VNI 都有 3 个 peer，<br />
<code>state</code> 为 <code>UP</code>。</p>
</blockquote>
<p><strong>EVPN MAC-IP 表（8 台主机全学到）：</strong></p>
<pre><code class="language-text">LEAF1> show l2vpn evpn mac ip
IP Address                            EVI VLANMAC Address Next Hop(s)
--------------------------------------- ----- ----- -------------- -----------
10.10.10.11                         10 10 0050.7966.6807 Et0/2:10
10.10.10.12                         10 10 0050.7966.6809 10.255.0.12
10.10.20.11                         20 20 0050.7966.6808 Et0/3:20
10.10.20.12                         20 20 0050.7966.680a 10.255.0.12
10.10.30.11                         30 30 0050.7966.680b 10.255.0.13
10.10.30.12                         30 30 0050.7966.680d 10.255.0.14
10.10.40.11                         40 40 0050.7966.680c 10.255.0.13
10.10.40.12                         40 40 0050.7966.680e 10.255.0.14
</code></pre>
<ul>
<li><strong>本地主机</strong>的 <code>Next Hop</code> 是 <code>Et0/2:10</code> / <code>Et0/3:20</code>（接口:VLAN）；</li>
<li><strong>远端主机</strong>的 <code>Next Hop</code> 是对端 VTEP 的 Loopback（10.255.0.12/13/14）；</li>
<li>8 条记录齐全，说明 type-2 路由已跨 leaf 交换完成。</li>
</ul>
<h3>5.3 预配检查表</h3>
<p>开机后应同时满足：</p>
<table>
<thead>
<tr>
<th>检查</th>
<th>期望</th>
</tr>
</thead>
<tbody>
<tr>
<td><code>show ip interface brief</code></td>
<td>4 个 SVI 全部 <code>up/up</code></td>
</tr>
<tr>
<td><code>show vlan brief</code></td>
<td>4 个 VLAN 都在；缺失 VLAN 通过 voice VLAN 关联到 access 口</td>
</tr>
<tr>
<td><code>show ip ospf neighbor</code></td>
<td>每台 leaf 两个 <code>FULL</code></td>
</tr>
<tr>
<td><code>show bgp l2vpn evpn summary</code></td>
<td>两个邻居 <code>Established</code>、<code>PfxRcd > 0</code></td>
</tr>
<tr>
<td><code>show nve vni</code></td>
<td>4 个 VNI 全 <code>Up</code></td>
</tr>
<tr>
<td><code>show nve peers</code></td>
<td>3 个远端 VTEP × 4 VNI = 12 个 <code>Up</code></td>
</tr>
<tr>
<td><code>show l2vpn evpn mac ip</code></td>
<td>8 条主机记录</td>
</tr>
</tbody>
</table>
<blockquote>
<p><code>show vlan brief</code> 会看到“反直觉”的一幕：<br />
LEAF1 的 <code>Ethernet0/2</code> 是 access VLAN 10，但它同时关联 VLAN 30（voice VLAN）。<br />
这是故意的，VLAN 30/40 在 LEAF1 本地没有 access 口，靠 voice VLAN 保活（§6.5）。</p>
<p><code>show ip interface brief</code> 还会多出一个 <code>Tunnel0</code>，其 IP 与 Loopback0 相同<br />
（<code>10.255.0.11</code>），状态 <code>up/up</code>。这是 XE 为 VXLAN 生成的隧道接口，<br />
不是手工配置错误；检查 SVI 时忽略它即可。</p>
</blockquote>
<hr />
<h2>6. 踩坑与注意事项（重点）</h2>
<h3>6.1 镜像选错：15.2 镜像根本没有 VXLAN/EVPN ★最根本的一条</h3>
<p>同一台 EVE-NG 上的 15.2 adv 镜像<br />
（<code>l2-adventerprisek9-ms.SSA.high_iron_20190423.bin</code>）实测：</p>
<pre><code class="language-text">Switch(config)# interface nve1
% Invalid input detected at '^' marker.
Switch(config)# l2vpn evpn
% Invalid input detected at '^' marker.
</code></pre>
<p><strong>不是配置写错，是镜像根本没有这个功能。</strong><br />
本实验必须用 <code>l2-iol-xe-17-18-02.bin</code>（IOS-XE 17.18.2）。<br />
<code>l3-*</code> 是路由器镜像，<code>l2-*</code> 是三层交换机镜像；<br />
本实验选 <code>l2-*</code> 是因为 leaf 的角色更贴近三层交换机。</p>
<p><strong>判断方法</strong>：在全局配置下输入 <code>interface nve1</code> 和 <code>l2vpn evpn</code>，<br />
两条都能进，才说明镜像支持。不要只看版本号或文件名猜。</p>
<h3>6.2 L2 VNI 只配 <code>member vni</code> 不出路由：必须走 EVI ★</h3>
<p>只在 <code>interface nve1</code> 下写：</p>
<pre><code class="language-text">member vni 10010
ingress-replication
</code></pre>
<p>会出现：<strong>BGP 会话 Established，但 <code>show bgp l2vpn evpn</code> 全空、<code>PfxRcd = 0</code>。</strong><br />
必须补上 EVI：</p>
<pre><code class="language-text">l2vpn evpn instance 10 vlan-based
encapsulation vxlan
replication-type ingress
advertise mac enable
!
vlan configuration 10
member evpn-instance 10 vni 10010
</code></pre>
<p>改完立刻能看到 type-3（IMET）路由，之后主机上线还会出现 type-2（MAC-IP）。</p>
<p><strong>这是最容易“看起来配了其实没配”的一处</strong>：会话健康、underlay 健康，<br />
只有 overlay 是空的。</p>
<h3>6.3 必须 <code>vtp mode transparent</code>，否则 VLAN 块被静默吞掉 ★</h3>
<p>IOL 默认 VTP Server 模式。启动配置里的 <code>vlan 10 / name WEB</code> 整块<br />
可能被<strong>静默丢弃</strong>：VLAN 不存在，但接口下的 <code>switchport access vlan 10</code><br />
却还在。症状是 <code>show vlan brief</code> 里没有 VLAN 10，主机完全不通。</p>
<p><strong>每台 leaf 的启动配置第一段就要写：</strong></p>
<pre><code class="language-text">vtp mode transparent
</code></pre>
<p>验证：</p>
<pre><code class="language-text">LEAF1> show vtp status
VTP Operating Mode             : Transparent
</code></pre>
<h3>6.4 <code>vlan.dat</code> 跨 stop/start 保留，会毒化启动解析 ★</h3>
<p>IOL 的 <code>vlan.dat</code> <strong>不会</strong>随 stop + start 清除。同一份启动配置：</p>
<table>
<thead>
<tr>
<th>磁盘状态</th>
<th>结果</th>
</tr>
</thead>
<tbody>
<tr>
<td>旧 <code>vlan.dat</code> 上 stop → start</td>
<td><code>vlan</code> 块名字不更新（<code>VLAN0010</code> 而不是 <code>WEB</code>）；<code>switchport voice vlan</code> 行直接从 <code>running-config</code> 消失</td>
</tr>
<tr>
<td><strong>wipe 后 start</strong></td>
<td><strong>同一份配置 100% 正确</strong></td>
</tr>
</tbody>
</table>
<p>所以：</p>
<ul>
<li><strong>首次导入配置后，先 wipe 再 start</strong>；</li>
<li><strong>改 VLAN 结构后，必须 wipe 再 start</strong>；</li>
<li>不要用 stop + start 验证预配配置，会得到“配置没生效”的假象。</li>
</ul>
<h3>6.5 <code>no autostate</code> 救不了“开机时没有 up 端口”的 SVI ★</h3>
<p>每台 leaf 只有 4 个 VLAN 里的 2 个有 access 口。<br />
另外两个 VLAN 的 SVI 在<strong>创建瞬间</strong>本地没有 active 端口 → 初始 down；<br />
<code>no autostate</code> 是运行态属性，<strong>拉不起已经 down 的 SVI</strong>。</p>
<p><strong>可用解法：给 access 口加 <code>switchport voice vlan <缺失 VLAN></code>。</strong></p>
<pre><code class="language-text">interface Ethernet0/2
switchport mode access
switchport access vlan 10
switchport voice vlan 30
spanning-tree portfast
</code></pre>
<ul>
<li>VLAN 30 因此在本地保持 active，<code>Vlan30</code> 开机即 up；</li>
<li>主机的 untagged 流量仍走 access VLAN 10，完全不受影响。</li>
</ul>
<p>验证：<code>show vlan brief</code> 会看到同一个 access 口同时出现在两个 VLAN 下：</p>
<pre><code class="language-text">VLAN Name                         Status Ports
---- -------------------------------- --------- -------------------------------
10 WEB                            active Et0/2
30 DB                            active Et0/2
</code></pre>
<p>这是 voice VLAN 的正常现象，不是配置错误。</p>
<blockquote>
<p>反过来，在启动配置里写 <code>shutdown</code> + <code>no shutdown</code> 想“手动拉一把”，<br />
解析时会被合并，<strong>无效</strong>。必须靠 voice VLAN 在开机前就让 VLAN active。</p>
</blockquote>
<h3>6.6 IOL 的 trunk 口不接受 VPCS 的 untagged 流量 ★</h3>
<p>试过把主机口配成 <code>switchport mode trunk</code> + native VLAN +<br />
<code>spanning-tree portfast trunk</code>：SVI 全 up，但接在该口的 VPCS <strong>完全不通</strong>，<br />
接口输入计数为 0。改回 <code>switchport mode access</code> 立刻恢复。</p>
<p><strong>VPCS 不会打 VLAN 标签，IOL 的 trunk 口也不收 untagged 入向帧。</strong><br />
所以主机口只能 access。需要“一个口多个 VLAN”的场景，在 IOL + VPCS 上做不到。</p>
<h3>6.7 手工 anycast 网关：同 IP + 同 MAC + <code>no ip proxy-arp</code> ★</h3>
<p>本实验没有用 cEOS 那套 <code>ip address virtual</code>，而是手工实现 anycast 网关：</p>
<pre><code class="language-text">interface Vlan10
no autostate
no ip proxy-arp
mac-address 0000.5e00.0101
ip address 10.10.10.1 255.255.255.0
</code></pre>
<ul>
<li><strong>同一个 IP</strong>：所有 leaf 都是 <code>10.10.10.1</code>；</li>
<li><strong>同一个 MAC</strong>：<code>0000.5e00.0101</code>，否则主机 ARP 缓存会在换 leaf 后失效；</li>
<li><strong><code>no ip proxy-arp</code></strong>：不加的话，某台 leaf 可能会用自己的 anycast MAC<br />
代替远端主机回答 ARP，把“远端主机自己的 ARP 应答”变成“网关代理应答”，<br />
破坏 MAC-IP 学习的判据，也可能让流量绕路。</li>
</ul>
<p><strong>跨子网是怎么通的</strong>：主机把包发给本地 anycast 网关（比如 LEAF3 的 VLAN 30 SVI）；<br />
LEAF3 查表发现目的 <code>10.10.40.12</code> 在直连的 VLAN 40 里 → 在 VLAN 40 上 ARP；<br />
ARP 请求通过 <strong>VNI 10040</strong> 泛洪到 LEAF4；LEAF4 上的主机应答；<br />
LEAF3 把帧封进 VNI 10040 发给 LEAF4。<strong>全程没有 L3 VNI</strong>。</p>
<h3>6.8 IOL 的 NVE 计数器恒为 0，别拿它当判据 ★</h3>
<ul>
<li><code>show interfaces nve1</code> 的输入/输出计数器<strong>恒为 0</strong>；</li>
<li>隧道学到的 MAC 也不显示在普通 MAC 表里。</li>
</ul>
<p>这不是“隧道没通”，是 IOL 的实现限制。<br />
判据只看：</p>
<pre><code class="language-text">show nve vni
show nve peers
show l2vpn evpn mac ip
</code></pre>
<h3>6.9 权限级别：<code>show running-config</code> / <code>ping source</code> 要先 <code>enable</code></h3>
<ul>
<li><code>show running-config</code> 在 <code>LEAF1></code>（user exec）下报 <code>Invalid input</code>。<br />
这不是镜像坏了，只是权限不够。先 <code>enable</code>（无密码）。</li>
<li><code>ping</code> 带 <code>source</code> / <code>repeat</code> 也必须先进特权模式；<br />
用户模式只吃 <code>ping <目标></code>。</li>
<li><code>clear arp-cache</code> 同样只在特权模式可用。</li>
</ul>
<blockquote>
<p>在 user exec 下测出的“这命令不存在”结论全都不可信。</p>
</blockquote>
<h3>6.10 VPCS 的配置语法与控制台有损</h3>
<p>VPCS 不是 Cisco CLI：</p>
<pre><code class="language-text">set pcname HOST-B1
ip 10.10.30.11/24 10.10.30.1
</code></pre>
<ul>
<li><strong><code>set pcname NAME</code> 的 <code>set</code> 不能漏</strong>，漏了报 <code>unknown VPCS command</code>；</li>
<li><code>ip ADDR </code> 这条不用 <code>set</code>；</li>
<li>VPCS 只有一块网卡 <code>eth0</code>。</li>
</ul>
<p>另外，VPCS 控制台偶尔会出现：</p>
<ul>
<li>整条命令<strong>空读</strong>（<code>output: ""</code>，但 prompt 正常）；</li>
<li>只把最后一行吞进提示符；</li>
<li><code>Bad command: "pipe2 failed"</code>（VPCS 内部管道错误）。</li>
</ul>
<p>对策：<strong>以“读到的内容是否满足预期”作判据，不满足就退避重读</strong>；<br />
连续失败就对这台 VPCS 做一次 stop → start（不用 wipe）恢复控制台。</p>
<h3>6.11 <code>ip routing</code> / <code>no switchport</code> / <code>point-to-point</code> 三个容易漏</h3>
<table>
<thead>
<tr>
<th>漏了</th>
<th>症状</th>
</tr>
</thead>
<tbody>
<tr>
<td>leaf 上的 <code>ip routing</code></td>
<td>SVI 有地址但不转发，跨 VLAN 完全不通</td>
</tr>
<tr>
<td>uplink 上的 <code>no switchport</code></td>
<td>口仍然是二层口，IP 地址配不进去/不生效，OSPF 起不来</td>
</tr>
<tr>
<td>uplink 上的 <code>ip ospf network point-to-point</code></td>
<td>OSPF 选 DR/BDR，邻居状态和收敛行为与预期不符</td>
</tr>
</tbody>
</table>
<p>这三项都在 §3 的配置里，复制时不要删。</p>
<h3>6.12 BGP EVPN 的三个必配项</h3>
<ol>
<li><strong><code>address-family l2vpn evpn</code> + <code>activate</code></strong>：否则邻居不交换 EVPN 路由；</li>
<li><strong><code>send-community extended</code></strong>：EVPN 的扩展团体传不过去，MAC-IP 可能装不上；</li>
<li><strong>spine 上的 <code>route-reflector-client</code></strong>：leaf 只与 spine 建邻居，<br />
没有 RR 配置，leaf 之间收不到彼此的路由。</li>
</ol>
<p>另外：</p>
<ul>
<li><code>l2vpn evpn</code> 下的 <code>router-id</code> 要写<strong>接口名</strong> <code>Loopback0</code>，不是 IP 地址；</li>
<li><code>nve1</code> 下的 <code>source-interface</code> 只接受 Loopback 接口；</li>
<li><code>host-reachability protocol bgp</code> 不能漏，否则 VTEP 对端发现不了。</li>
</ul>
<h3>6.13 故障排查顺序</h3>
<p>按从下到上的顺序查，不要一上来就怀疑 VXLAN：</p>
<ol>
<li><strong>镜像</strong>：<code>interface nve1</code> / <code>l2vpn evpn</code> 能不能进？（§6.1）</li>
<li><strong>接口</strong>：<code>show ip interface brief</code>，uplink 和 SVI 是否 up/up？</li>
<li><strong>Underlay</strong>：<code>show ip ospf neighbor</code>，是否 FULL？<code>show ip route</code> 有没有对端 Loopback？</li>
<li><strong>Overlay 会话</strong>：<code>show bgp l2vpn evpn summary</code>，是否 Established、PfxRcd > 0？</li>
<li><strong>EVI/NVE</strong>：<code>show nve vni</code> 是否 4 个 Up？<code>show nve peers</code> 是否 12 个 Up？</li>
<li><strong>MAC-IP</strong>：<code>show l2vpn evpn mac ip</code> 是否 8 条？</li>
<li><strong>数据面</strong>：最后才在 VPCS 上 ping，看 TTL 是 64 还是 63。</li>
</ol>
<hr />
<h2>7. 已知限制</h2>
<table>
<thead>
<tr>
<th>项</th>
<th>状态</th>
<th>说明</th>
</tr>
</thead>
<tbody>
<tr>
<td><strong>没有 L3 VNI / 对称 IRB</strong></td>
<td>刻意</td>
<td>跨子网靠每台 leaf 的 anycast SVI 本地路由 + L2 VNI 泛洪 ARP；不覆盖 VRF-aware EVPN</td>
</tr>
<tr>
<td><strong>没有 EVPN 多宿主 / ESI</strong></td>
<td>刻意</td>
<td>每台主机只挂一台 leaf，练不了 all-active、别名 MAC</td>
</tr>
<tr>
<td><strong>双 spine 没做故障切换测试</strong></td>
<td>未做</td>
<td>拓扑有双 uplink 冗余，但没测过挂掉一台 spine 的收敛</td>
</tr>
<tr>
<td><strong>没验 VXLAN MTU / 分片</strong></td>
<td>未做</td>
<td>全是小包 ping，撞不到 underlay MTU 边界</td>
</tr>
<tr>
<td><strong>只有 2 个 VNI 配了专用过滤器</strong></td>
<td>刻意</td>
<td>10010/10030 作代表；10020/10040 可按附录 A 照抄</td>
</tr>
<tr>
<td><strong>IOL NVE 计数器不可用</strong></td>
<td>平台限制</td>
<td>恒为 0，只能用控制面表验证</td>
</tr>
</tbody>
</table>
<hr />
<h2>8. 复现检查清单</h2>
<p>搭建时按这个顺序打勾：</p>
<ul>
<li class="vditor-task"><input disabled="" type="checkbox" /> 镜像文件是 <code>l2-iol-xe-17-18-02.bin</code>，<code>show version</code> 是 IOS-XE 17.18.2；</li>
<li class="vditor-task"><input disabled="" type="checkbox" /> 6 台 IOL 的 Ethernet 数量 = 1（4 个口），8 台 VPCS 只有 <code>eth0</code>；</li>
<li class="vditor-task"><input disabled="" type="checkbox" /> 16 条链路按 §1.4 连好，uplink 用 <code>Ethernet0/0</code>/<code>0/1</code>，主机用 <code>0/2</code>/<code>0/3</code>；</li>
<li class="vditor-task"><input disabled="" type="checkbox" /> 每台 leaf 配了 <code>ip routing</code>、<code>vtp mode transparent</code>；</li>
<li class="vditor-task"><input disabled="" type="checkbox" /> 每台 leaf 的 4 个 SVI 都有 <code>no autostate</code>、<code>no ip proxy-arp</code>、同一个 MAC；</li>
<li class="vditor-task"><input disabled="" type="checkbox" /> 每台 leaf 的 4 个 VLAN 都有 EVI 和 <code>vlan configuration</code> 映射；</li>
<li class="vditor-task"><input disabled="" type="checkbox" /> 每台 leaf 的 <code>nve1</code> 有 4 个 <code>member vni</code> + <code>ingress-replication</code>；</li>
<li class="vditor-task"><input disabled="" type="checkbox" /> 两台 spine 有 BGP EVPN RR 配置，且<strong>没有</strong> <code>nve1</code>；</li>
<li class="vditor-task"><input disabled="" type="checkbox" /> 所有 uplink 都是 <code>no switchport</code> + <code>point-to-point</code>；</li>
<li class="vditor-task"><input disabled="" type="checkbox" /> 主机口都是 access，且缺失 VLAN 用 voice VLAN 保活；</li>
<li class="vditor-task"><input disabled="" type="checkbox" /> <strong>导入配置后执行过 Wipe，再 Start</strong>；</li>
<li class="vditor-task"><input disabled="" type="checkbox" /> <code>show ip interface brief</code> 4 个 SVI up/up；</li>
<li class="vditor-task"><input disabled="" type="checkbox" /> <code>show ip ospf neighbor</code> 每台 leaf 两个 FULL；</li>
<li class="vditor-task"><input disabled="" type="checkbox" /> <code>show bgp l2vpn evpn summary</code> 两个邻居 Established、PfxRcd > 0；</li>
<li class="vditor-task"><input disabled="" type="checkbox" /> <code>show nve vni</code> 4 个 Up、<code>show nve peers</code> 12 个 Up；</li>
<li class="vditor-task"><input disabled="" type="checkbox" /> <code>show l2vpn evpn mac ip</code> 8 条；</li>
<li class="vditor-task"><input disabled="" type="checkbox" /> VPCS 5 条 ping 全 5/5，同 VLAN <code>ttl=64</code>，跨 VLAN <code>ttl=63</code>。</li>
</ul>
<hr />
<h2>附录 A：流量过滤器（可选）</h2>
<p>本实验在 EVE-NG 里配了 10 条 lab-wide Traffic Filter，用于观察 ARP、ICMP、<br />
OSPF、BGP、VXLAN、指定 VNI 和内层 ARP。<strong>过滤器不是转发的前提</strong>，<br />
不配也能通；它们只是观测工具。</p>
<p>VNI 的十六进制：10010 = <code>0x00271A</code>，10020 = <code>0x002724</code>，<br />
10030 = <code>0x00272E</code>，10040 = <code>0x002738</code>。要给 10020/10040 加专用过滤器，<br />
把 <code>udp</code> 分别改成 <code>0x24</code> / <code>0x38</code> 即可。</p>
<table>
<thead>
<tr>
<th>标题</th>
<th>表达式</th>
</tr>
</thead>
<tbody>
<tr>
<td>ARP-Request</td>
<td><code>(arp and arp = 1) or (vlan and arp and arp = 1)</code></td>
</tr>
<tr>
<td>ARP-Reply</td>
<td><code>(arp and arp = 2) or (vlan and arp and arp = 2)</code></td>
</tr>
<tr>
<td>ICMP-Request</td>
<td><code>(icmp == 8) or (vlan and icmp == 8)</code></td>
</tr>
<tr>
<td>ICMP-Reply</td>
<td><code>(icmp == 0) or (vlan and icmp == 0)</code></td>
</tr>
<tr>
<td>OSPF-Hello</td>
<td><code>(ip proto 89 and ip = 1) or (vlan and ip proto 89 and ip = 1)</code></td>
</tr>
<tr>
<td>BGP-EVPN</td>
<td><code>(tcp port 179) or (vlan and tcp port 179)</code></td>
</tr>
<tr>
<td>VXLAN-All</td>
<td><code>(udp port 4789) or (vlan and udp port 4789)</code></td>
</tr>
<tr>
<td>VXLAN-VNI-10010</td>
<td><code>(udp port 4789 and udp = 0x0027 and udp = 0x1a) or (vlan and udp port 4789 and udp = 0x0027 and udp = 0x1a)</code></td>
</tr>
<tr>
<td>VXLAN-VNI-10030</td>
<td><code>(udp port 4789 and udp = 0x0027 and udp = 0x2e) or (vlan and udp port 4789 and udp = 0x0027 and udp = 0x2e)</code></td>
</tr>
<tr>
<td>VXLAN-Inner-ARP</td>
<td><code>(udp port 4789 and udp = 0x0806) or (vlan and udp port 4789 and udp = 0x0806)</code></td>
</tr>
</tbody>
</table>
<p><strong>BPF 写法注意</strong>：</p>
<ul>
<li>这些是 <strong>classic libpcap / tcpdump 语法</strong>，不是 Wireshark 显示过滤器；</li>
<li><code>proto</code> 的 size 只能是 <strong>1/2/4</strong>；<code>udp</code> 不合法，<br />
VNI 必须拆成 <code>udp</code> + <code>udp</code>；</li>
<li><strong>VLAN 变体必须加括号</strong>：<code>and</code> / <code>or</code> 同级左结合，<br />
<code>vlan and A or B</code> 只会让 <code>vlan</code> 约束 <code>A</code>；</li>
<li>VXLAN 内层以太帧的 EtherType 在 <code>udp</code>，ARP = <code>0x0806</code>；</li>
<li>OSPF Hello 的类型字节在 <code>ip</code>（IP 头 20 + OSPF 头第 2 字节），<br />
不是 <code>ip</code>；</li>
<li>语法编译通过不等于语义正确，偏移量要按协议头逐字节核对；</li>
<li>过滤器的 <code>timeout</code> 是高亮衰减时间（毫秒），<strong>不是抓包窗口</strong>；BGP keepalive<br />
间隔长，高亮只会一闪而过。不要因为“没看到持续高亮”就判断 BGP 没跑，<br />
应该看命中计数，或直接查 <code>show bgp l2vpn evpn summary</code>。</li>
</ul>
<hr />
<h2>附录 B：常用验证命令</h2>
<p>在 leaf 上（先 <code>enable</code>）：</p>
<pre><code class="language-text">show ip interface brief
show vlan brief
show vtp status
show ip ospf neighbor
show bgp l2vpn evpn summary
show nve vni
show nve peers
show l2vpn evpn mac ip
show running-config
</code></pre>
<p>在 VPCS 上：</p>
<pre><code class="language-text">ping 10.10.30.12 -c 5
ping 10.10.40.12 -c 5
ping 10.10.40.11 -c 5
ping 10.10.10.11 -c 5
</code></pre>
<pre><code>
</code></pre>

haiyanuser 发表于 2026-10-24 20:49:50

<p>非常详细啊，没人顶顶吗</p>

liuxin8668 发表于 2026-10-27 16:02:42

<p>感谢楼主分享，顶。</p>

hansent 发表于 2026-10-29 17:40:40

厉害

页: [1]

EmulatedLab's Archiver

实验案例-VXLAN-EVPN-IOL-XE