1、网络拓扑
标准的Spine-Leaf架构，防火墙使用ASA，采用HSRP实现双机冗余
2、设备配置，注标红命令，表示需要重启才能生效。
（1）Cisco-PE01
!
hostname PE01
!
interface Loopback0
ip address 88.1.1.1 255.255.255.255
!
interface Ethernet1/0
ip address 172.16.1.1 255.255.255.252
ip ospf network point-to-point
duplex full
!
interface Ethernet1/1
ip address 172.16.2.1 255.255.255.252
ip ospf network point-to-point
duplex full
!
router ospf 101
router-id 88.1.1.1
redistribute connected subnets
network 172.16.1.1 0.0.0.0 area 0
network 172.16.2.1 0.0.0.0 area 0
（2）Cisco-BL01
!
hostname Cisco-BL01
!
cfs eth distribute
nv overlay evpn
feature ospf
feature bgp
feature pim
feature fabric forwarding
feature interface-vlan
feature vn-segment-vlan-based
feature lacp
feature vpc
feature lldp
feature bfd
feature nv overlay
!
fabric forwarding anycast-gateway-mac 0001.0001.0001
ip pim rp-address 8.8.8.8 group-list 239.0.0.0/24
ip pim ssm range 232.0.0.0/8
vlan 1,10,20,101-102
vlan 10
vn-segment 10
vlan 20
vn-segment 20
vlan 101
vn-segment 101
!
evpn
vni 10 l2
rd auto
route-target import auto
route-target export auto
vni 20 l2
rd auto
route-target import auto
route-target export auto
!
ip prefix-list PC01 seq 5 permit 10.18.1.0/24
ip prefix-list PC02 seq 5 permit 10.18.2.0/24
ip prefix-list default seq 5 permit 0.0.0.0/0
route-map PC permit 10
match ip address prefix-list PC01 PC02
route-map default permit 10
match ip address prefix-list default
!
vrf context gw_vpna
ip route 10.18.1.0/24 172.17.12.2
ip route 10.18.2.0/24 172.17.12.2
rd auto
vrf context heart
vrf context management
vrf context vpna
vni 101
ip route 0.0.0.0/0 172.17.11.2
rd auto
address-family ipv4 unicast
route-target both auto
route-target both auto evpn
!
hardware access-list tcam region racl 512
hardware access-list tcam region arp-ether 256 double-wide
!
vpc domain 100
peer-switch
role priority 150
system-priority 100
peer-keepalive destination 192.168.1.2 source 192.168.1.1 vrf heart
peer-gateway
!
interface Vlan10
no shutdown
vrf member vpna
ip address 172.17.11.1/30
fabric forwarding mode anycast-gateway
!
interface Vlan101
no shutdown
vrf member vpna
ip forward
!
interface Vlan102
no shutdown
vrf member gw_vpna
ip address 172.17.12.1/30
fabric forwarding mode anycast-gateway
!
interface port-channel1
switchport mode trunk
switchport trunk allowed vlan 10,102
vpc 1
!
interface port-channel2
switchport mode trunk
switchport trunk allowed vlan 10,102
vpc 2
!
interface port-channel100
description peer-link
switchport mode trunk
spanning-tree port type network
vpc peer-link
!
router ospf 100
router-id 21.1.1.1
router ospf 101
vrf gw_vpna
router-id 21.1.1.1
redistribute static route-map PC
!
interface Ethernet1/1
no switchport
vrf member gw_vpna
ip address 172.16.1.2/30
ip ospf network point-to-point
ip router ospf 101 area 0.0.0.0
no shutdown
!
interface Ethernet1/2
no switchport
ip address 172.17.1.1/30
ip ospf network point-to-point
ip router ospf 100 area 0.0.0.0
ip pim sparse-mode
no shutdown
!
interface Ethernet1/3
no switchport
ip address 172.17.2.1/30
ip ospf network point-to-point
ip router ospf 100 area 0.0.0.0
ip pim sparse-mode
no shutdown
!
interface Ethernet1/4
switchport mode trunk
switchport trunk allowed vlan 10,102
channel-group 1 mode active
!
interface Ethernet1/5
switchport mode trunk
switchport trunk allowed vlan 10,102
channel-group 2 mode active
!
interface Ethernet1/6
switchport mode trunk
channel-group 100 mode active
!
interface Ethernet1/7
no switchport
no shutdown
!
interface Ethernet1/7.10
description for heart
encapsulation dot1q 10
vrf member heart
ip address 192.168.1.1/30
no shutdown
!
interface Ethernet1/7.20
description for escape
encapsulation dot1q 20
vrf member gw_vpna
ip address 172.16.3.1/30
ip ospf cost 1000
ip ospf network point-to-point
ip router ospf 101 area 0.0.0.0
no shutdown
!
interface loopback0
ip address 21.1.1.1/32
ip router ospf 100 area 0.0.0.0
ip pim sparse-mode
!
interface loopback1
ip address 21.1.2.1/32
ip address 20.1.1.1/32 secondary
ip router ospf 100 area 0.0.0.0
ip pim sparse-mode
!
interface nve1
no shutdown
host-reachability protocol bgp
source-interface loopback1
member vni 10
suppress-arp
mcast-group 239.0.0.1
member vni 20
suppress-arp
mcast-group 239.0.0.1
member vni 101 associate-vrf
!
router bgp 100
log-neighbor-changes
template peer spine
remote-as 100
update-source loopback0
address-family l2vpn evpn
send-community extended
neighbor 22.1.1.1
inherit peer spine
neighbor 22.1.1.2
inherit peer spine
vrf vpna
address-family ipv4 unicast
advertise l2vpn evpn
redistribute static route-map default
default-information originate
（3）Cisco-BL02
!
hostname Cisco-BL02
!
cfs eth distribute
nv overlay evpn
feature ospf
feature bgp
feature pim
feature fabric forwarding
feature interface-vlan
feature vn-segment-vlan-based
feature lacp
feature vpc
feature lldp
feature bfd
feature nv overlay
!
fabric forwarding anycast-gateway-mac 0001.0001.0001
ip pim rp-address 8.8.8.8 group-list 239.0.0.0/24
ip pim ssm range 232.0.0.0/8
!
vlan 1,10,20,101-102
vlan 10
vn-segment 10
vlan 20
vn-segment 20
vlan 101
vn-segment 101
!
evpn
vni 10 l2
rd auto
route-target import auto
route-target export auto
vni 20 l2
rd auto
route-target import auto
route-target export auto
!
ip prefix-list PC01 seq 5 permit 10.18.1.0/24
ip prefix-list PC02 seq 5 permit 10.18.2.0/24
ip prefix-list default seq 5 permit 0.0.0.0/0
route-map PC permit 10
match ip address prefix-list PC01 PC02
route-map default permit 10
match ip address prefix-list default
!
vrf context gw_vpna
ip route 10.18.1.0/24 172.17.12.2
ip route 10.18.2.0/24 172.17.12.2
rd auto
vrf context heart
vrf context vpna
vni 101
ip route 0.0.0.0/0 172.17.11.2
rd auto
address-family ipv4 unicast
route-target both auto
route-target both auto evpn
!
hardware access-list tcam region racl 512
hardware access-list tcam region arp-ether 256 double-wide
!
vpc domain 100
peer-switch
role priority 150
system-priority 100
peer-keepalive destination 192.168.1.1 source 192.168.1.2 vrf heart
peer-gateway
interface Vlan10
no shutdown
vrf member vpna
no ip redirects
ip address 172.17.11.1/30
no ipv6 redirects
fabric forwarding mode anycast-gateway
!
interface Vlan101
no shutdown
vrf member vpna
no ip redirects
ip forward
no ipv6 redirects
!
interface Vlan102
no shutdown
vrf member gw_vpna
no ip redirects
ip address 172.17.12.1/30
no ipv6 redirects
fabric forwarding mode anycast-gateway
!
interface port-channel1
switchport mode trunk
switchport trunk allowed vlan 10,102
vpc 1
!
interface port-channel2
switchport mode trunk
switchport trunk allowed vlan 10,102
vpc 2
!
interface port-channel100
description peer-link
switchport mode trunk
spanning-tree port type network
vpc peer-link
!
router ospf 100
router-id 21.1.1.2
router ospf 101
vrf gw_vpna
router-id 21.1.1.2
redistribute static route-map PC
!
interface Ethernet1/1
no switchport
vrf member gw_vpna
ip address 172.16.2.2/30
ip ospf network point-to-point
ip router ospf 101 area 0.0.0.0
no shutdown
!
interface Ethernet1/2
no switchport
ip address 172.17.3.1/30
ip ospf network point-to-point
ip router ospf 100 area 0.0.0.0
ip pim sparse-mode
no shutdown
!
interface Ethernet1/3
no switchport
ip address 172.17.4.1/30
ip ospf network point-to-point
ip router ospf 100 area 0.0.0.0
ip pim sparse-mode
no shutdown
!
interface Ethernet1/4
switchport mode trunk
switchport trunk allowed vlan 10,102
channel-group 1 mode active
!
interface Ethernet1/5
switchport mode trunk
switchport trunk allowed vlan 10,102
channel-group 2 mode active
!
interface Ethernet1/6
switchport mode trunk
channel-group 100 mode active
!
interface Ethernet1/7
no switchport
no shutdown
!
interface Ethernet1/7.10
description for heart
encapsulation dot1q 10
vrf member heart
ip address 192.168.1.2/30
no shutdown
!
interface Ethernet1/7.20
description for escape
encapsulation dot1q 20
vrf member gw_vpna
ip address 172.16.3.2/30
ip ospf cost 1000
ip ospf network point-to-point
ip router ospf 101 area 0.0.0.0
no shutdown
!
interface loopback0
ip address 21.1.1.2/32
ip router ospf 100 area 0.0.0.0
ip pim sparse-mode
!
interface loopback1
ip address 21.1.2.2/32
ip address 20.1.1.1/32 secondary
ip router ospf 100 area 0.0.0.0
ip pim sparse-mode
!
interface nve1
no shutdown
host-reachability protocol bgp
source-interface loopback1
member vni 10
suppress-arp
mcast-group 239.0.0.1
member vni 20
suppress-arp
mcast-group 239.0.0.1
member vni 101 associate-vrf
!
router bgp 100
log-neighbor-changes
template peer spine
remote-as 100
update-source loopback0
address-family l2vpn evpn
send-community extended
neighbor 22.1.1.1
inherit peer spine
neighbor 22.1.1.2
inherit peer spine
vrf vpna
address-family ipv4 unicast
advertise l2vpn evpn
redistribute static route-map default
default-information originate
（4）Cisco-FW01
!
hostname Ciso-FW01
!
interface Ethernet0
channel-group 1 mode passive
no shutdown
!
interface Ethernet1
channel-group 1 mode passive
no shutdown
!
interface Ethernet2
no shutdown
!
interface Port-channel1
!
interface Port-channel1.10
vlan 10
nameif inside
ip address 172.17.11.2 255.255.255.248 standby 172.17.11.3
!
interface Port-channel1.102
vlan 102
nameif outside
ip address 172.17.12.2 255.255.255.248 standby 172.17.12.3
!
route outside 0.0.0.0 0.0.0.0 172.17.12.1 1
route inside 10.18.1.0 255.255.255.0 172.17.11.1 1
route inside 10.18.2.0 255.255.255.0 172.17.11.1 1
!
access-list ping extended permit icmp any any
access-group ping in interface outside
==================failover
！
failover
failover lan unit primary
failover lan interface flink Ethernet2
failover key nihao
failover replication http
failover link flink Ethernet2
failover interface ip flink 192.168.1.1 255.255.255.252 standby 192.168.1.2
（5）Csico-FW02
!
hostname Ciso-FW02
!
interface Ethernet2
no shutdown
!
failover
failover lan unit secondary
failover lan interface flink Ethernet2
failover key nihao
failover interface ip flink 192.168.1.1 255.255.255.252 standby 192.168.1.2
（6）Cisco-SP01
!
hostname Cisco-SP01
!
nv overlay evpn
feature ospf
feature bgp
feature pim
feature lldp
feature bfd
!
ip pim rp-address 8.8.8.8 group-list 239.0.0.0/24
ip pim ssm range 232.0.0.0/8
ip pim anycast-rp 8.8.8.8 22.1.1.1
ip pim anycast-rp 8.8.8.8 22.1.1.2
!
router ospf 100
router-id 22.1.1.1
!
interface Ethernet1/1
no switchport
ip address 172.17.1.2/30
ip ospf network point-to-point
ip router ospf 100 area 0.0.0.0
ip pim sparse-mode
no shutdown
!
interface Ethernet1/2
no switchport
ip address 172.17.3.2/30
ip ospf network point-to-point
ip router ospf 100 area 0.0.0.0
ip pim sparse-mode
no shutdown
!
interface Ethernet1/3
no switchport
ip address 172.17.5.1/30
ip ospf network point-to-point
ip router ospf 100 area 0.0.0.0
ip pim sparse-mode
no shutdown
!
interface Ethernet1/4
no switchport
ip address 172.17.7.1/30
ip ospf network point-to-point
ip router ospf 100 area 0.0.0.0
ip pim sparse-mode
no shutdown
interface loopback0
description R-ID
ip address 22.1.1.1/32
ip router ospf 100 area 0.0.0.0
ip pim sparse-mode
!
interface loopback1
description anycast-rp
ip address 8.8.8.8/32
ip router ospf 100 area 0.0.0.0
ip pim sparse-mode
!
router bgp 100
log-neighbor-changes
template peer leaf
remote-as 100
update-source loopback0
address-family l2vpn evpn
send-community extended
route-reflector-client
neighbor 11.1.1.1
inherit peer leaf
neighbor 11.1.1.2
inherit peer leaf
neighbor 21.1.1.1
inherit peer leaf
neighbor 21.1.1.2
inherit peer leaf
（7）Cisco-SP02
!
hostname Cisco-SP02
!
nv overlay evpn
feature ospf
feature bgp
feature pim
feature lldp
feature bfd
!
ip pim rp-address 8.8.8.8 group-list 239.0.0.0/24
ip pim ssm range 232.0.0.0/8
ip pim anycast-rp 8.8.8.8 22.1.1.1
ip pim anycast-rp 8.8.8.8 22.1.1.2
!
router ospf 100
router-id 22.1.1.2
!
interface Ethernet1/1
no switchport
ip address 172.17.2.2/30
ip ospf network point-to-point
ip router ospf 100 area 0.0.0.0
ip pim sparse-mode
no shutdown
!
interface Ethernet1/2
no switchport
ip address 172.17.4.2/30
ip ospf network point-to-point
ip router ospf 100 area 0.0.0.0
ip pim sparse-mode
no shutdown
!
interface Ethernet1/3
no switchport
ip address 172.17.6.1/30
ip ospf network point-to-point
ip router ospf 100 area 0.0.0.0
ip pim sparse-mode
no shutdown
!
interface Ethernet1/4
no switchport
ip address 172.17.8.1/30
ip ospf network point-to-point
ip router ospf 100 area 0.0.0.0
ip pim sparse-mode
no shutdown
!
interface loopback0
description R-ID
ip address 22.1.1.2/32
ip router ospf 100 area 0.0.0.0
ip pim sparse-mode
!
interface loopback1
description anycast-rp
ip address 8.8.8.8/32
ip router ospf 100 area 0.0.0.0
ip pim sparse-mode
!
router bgp 100
log-neighbor-changes
template peer leaf
remote-as 100
update-source loopback0
address-family l2vpn evpn
send-community extended
route-reflector-client
neighbor 11.1.1.1
inherit peer leaf
neighbor 11.1.1.2
inherit peer leaf
neighbor 21.1.1.1
inherit peer leaf
neighbor 21.1.1.2
inherit peer leaf
（8）Cisco-SL01
!
hostname Cisco-SL01
!
cfs eth distribute
nv overlay evpn
feature ospf
feature bgp
feature pim
feature fabric forwarding
feature interface-vlan
feature vn-segment-vlan-based
feature lacp
feature vpc
feature lldp
feature bfd
feature nv overlay
!
fabric forwarding anycast-gateway-mac 0001.0001.0001
ip pim rp-address 8.8.8.8 group-list 239.0.0.0/24
ip pim ssm range 232.0.0.0/8
!
vlan 1,10,20,101
vlan 10
vn-segment 10
vlan 20
vn-segment 20
vlan 101
vn-segment 101
!
evpn
vni 10 l2
rd auto
route-target import auto
route-target export auto
vni 20 l2
rd auto
route-target import auto
route-target export auto
!
vrf context heart
vrf context vpna
vni 101
rd auto
address-family ipv4 unicast
route-target both auto
route-target both auto evpn
!
hardware access-list tcam region racl 512
hardware access-list tcam region arp-ether 256 double-wide
!
vpc domain 100
peer-switch
role priority 100
system-priority 100
peer-keepalive destination 192.168.1.2 source 192.168.1.1 vrf heart
peer-gateway
!
interface Vlan10
no shutdown
vrf member vpna
no ip redirects
ip address 10.18.1.254/24
no ipv6 redirects
fabric forwarding mode anycast-gateway
!
interface Vlan20
no shutdown
vrf member vpna
ip address 10.18.2.254/24
fabric forwarding mode anycast-gateway
!
interface Vlan101
no shutdown
vrf member vpna
ip forward
!
interface port-channel1
switchport mode trunk
switchport trunk allowed vlan 10
vpc 1
!
interface port-channel2
switchport mode trunk
switchport trunk allowed vlan 20
vpc 2
!
interface port-channel100
description peer-link
switchport mode trunk
spanning-tree port type network
vpc peer-link
!
router ospf 100
router-id 11.1.1.1
!
interface Ethernet1/1
no switchport
ip address 172.17.5.2/30
ip ospf network point-to-point
ip router ospf 100 area 0.0.0.0
ip pim sparse-mode
no shutdown
!
interface Ethernet1/2
no switchport
ip address 172.17.6.2/30
ip ospf network point-to-point
ip router ospf 100 area 0.0.0.0
ip pim sparse-mode
no shutdown
!
interface Ethernet1/3
switchport mode trunk
switchport trunk allowed vlan 10
channel-group 1 mode active
!
interface Ethernet1/4
switchport mode trunk
switchport trunk allowed vlan 20
channel-group 2 mode active
!
interface Ethernet1/6
switchport mode trunk
channel-group 100 mode active
!
interface Ethernet1/7
description for heart
no switchport
vrf member heart
ip address 192.168.1.1/30
no shutdown
!
interface loopback0
ip address 11.1.1.1/32
ip router ospf 100 area 0.0.0.0
ip pim sparse-mode
!
interface loopback1
ip address 11.1.2.1/32
ip address 10.1.1.1/32 secondary
ip router ospf 100 area 0.0.0.0
ip pim sparse-mode
!
interface nve1
no shutdown
host-reachability protocol bgp
source-interface loopback1
member vni 10
suppress-arp
mcast-group 239.0.0.1
member vni 20
suppress-arp
mcast-group 239.0.0.1
member vni 101 associate-vrf
!
router bgp 100
log-neighbor-changes
template peer spine
bfd multihop interval 250 min_rx 250 multiplier 3
remote-as 100
update-source loopback0
address-family l2vpn evpn
send-community extended
neighbor 22.1.1.1
inherit peer spine
neighbor 22.1.1.2
inherit peer spine
vrf vpna
address-family ipv4 unicast
advertise l2vpn evpn
（9）Cisco-SL02
!
hostname Cisco-SL02
!
cfs eth distribute
nv overlay evpn
feature ospf
feature bgp
feature pim
feature fabric forwarding
feature interface-vlan
feature vn-segment-vlan-based
feature lacp
feature vpc
feature lldp
feature bfd
feature nv overlay
!
fabric forwarding anycast-gateway-mac 0001.0001.0001
ip pim rp-address 8.8.8.8 group-list 239.0.0.0/24
ip pim ssm range 232.0.0.0/8
!
vlan 1,10,20,101
vlan 10
vn-segment 10
vlan 20
vn-segment 20
vlan 101
vn-segment 101
!
evpn
vni 10 l2
rd auto
route-target import auto
route-target export auto
vni 20 l2
rd auto
route-target import auto
route-target export auto
!
vrf context heart
vrf context vpna
vni 101
rd auto
address-family ipv4 unicast
route-target both auto
route-target both auto evpn
!
hardware access-list tcam region racl 512
hardware access-list tcam region arp-ether 256 double-wide
!
vpc domain 100
peer-switch
role priority 100
system-priority 100
peer-keepalive destination 192.168.1.1 source 192.168.1.2 vrf heart
peer-gateway
!
interface Vlan10
no shutdown
vrf member vpna
no ip redirects
ip address 10.18.1.254/24
no ipv6 redirects
fabric forwarding mode anycast-gateway
!
interface Vlan20
no shutdown
vrf member vpna
ip address 10.18.2.254/24
fabric forwarding mode anycast-gateway
!
interface Vlan101
no shutdown
vrf member vpna
ip forward
!
interface port-channel1
switchport mode trunk
switchport trunk allowed vlan 10
vpc 1
!
interface port-channel2
switchport mode trunk
switchport trunk allowed vlan 20
vpc 2
!
interface port-channel100
description peer-link
switchport mode trunk
spanning-tree port type network
vpc peer-link
!
router ospf 100
router-id 11.1.1.2
!
interface Ethernet1/1
no switchport
ip address 172.17.7.2/30
ip ospf network point-to-point
ip router ospf 100 area 0.0.0.0
ip pim sparse-mode
no shutdown
!
interface Ethernet1/2
no switchport
ip address 172.17.8.2/30
ip ospf network point-to-point
ip router ospf 100 area 0.0.0.0
ip pim sparse-mode
no shutdown
!
interface Ethernet1/3
switchport mode trunk
switchport trunk allowed vlan 10
channel-group 1 mode active
!
interface Ethernet1/4
switchport mode trunk
switchport trunk allowed vlan 20
channel-group 2 mode active
!
interface Ethernet1/6
switchport mode trunk
channel-group 100 mode active
!
interface Ethernet1/7
description for heart
no switchport
vrf member heart
ip address 192.168.1.2/30
no shutdown
!
interface loopback0
ip address 11.1.1.2/32
ip router ospf 100 area 0.0.0.0
ip pim sparse-mode
!
interface loopback1
ip address 11.1.2.2/32
ip address 10.1.1.1/32 secondary
ip router ospf 100 area 0.0.0.0
ip pim sparse-mode
!
interface nve1
no shutdown
host-reachability protocol bgp
source-interface loopback1
member vni 10
suppress-arp
mcast-group 239.0.0.1
member vni 20
suppress-arp
mcast-group 239.0.0.1
member vni 101 associate-vrf
!
router bgp 100
log-neighbor-changes
template peer spine
bfd multihop interval 250 min_rx 250 multiplier 3
remote-as 100
update-source loopback0
address-family l2vpn evpn
send-community extended
neighbor 22.1.1.1
inherit peer spine
neighbor 22.1.1.2
inherit peer spine
vrf vpna
address-family ipv4 unicast
advertise l2vpn evpn
3、实验结果
（1）SP与leaf的ospf、pim、bgp evpn邻居正常建立
（2）server leaf、border leaf的vpc状态正常，其中BL对接的2台FW采用镜像模式，所以有一个聚合组会处于down状态
（3）Server leaf和Border leaf的nve隧道正常建立
（4）Server leaf可以学习到Border leaf引入的静态路由
（4）Border leaf可以学习到server leaf发布的主机路由10.18.1.10/32、10.18.2.10/32，并通过ospf传递给PE
（5）PC1和PC2均可以ping通PE01的环回口，并且tracert路径符合预期
