Inqubomgomo ye-firewall ye-EVPN: isango elimaphakathi ngokuqhathanisa ne-IRB esatshalaliswa
Amasango amaphakathi adlulisa ithrafikhi yabaqashi nge-firewall, i-IRB esatshalaliswa ayikwenzi. Qhathanisa lapho ngakunye kuhlola khona nokuthi yini edinga ukwengezwa endleleni esheshayo.
Amadizayini amabili e-EVPN abeka isango lomqashi ezindaweni ezahlukene, futhi i-firewall ibona ithrafikhi ehlukile kulelo nalelo. Ngesango elimaphakathi, ithrafikhi phakathi kwama-subnet ifinyelela ku-firewall ngoba ukuhambisa imizila kwenzeka khona. Nge-IRB esatshalaliswa, ama-switch e-leaf ahambisa imizila endaweni, futhi i-firewall ayiboni lutho ngaphandle uma uyifaka khona ngamabomu. Akukho modeli eyiphutha. Okuyiphutha ukuxhuma i-firewall emngceleni bese ucabanga ukuthi i-fabric izoletha ithrafikhi kuyo.
Amamodeli amabili, izindawo ezimbili zokuhlola ezihlukene
Qala uqambe imigudu edinga ukuhlolwa, ngoba amamodeli amabili ayiphatha ngendlela ehlukile.
| Flow class | Centralized gateway | Distributed IRB |
|---|---|---|
| Same subnet | Bridged, not routed | Bridged, not routed |
| Inter-subnet | Routed at the firewall | Routed at the leaf |
| Inter-VRF | At the firewall | Needs leaking or service insertion |
| External | Border firewall | Border firewall |
Ithrafikhi engaphakathi kwe-subnet efanayo iwumugqa abantu abawukhohlwayo. Ama-host amabili ku-VLAN eyodwa akhuluma ngebhuloho, futhi akukho firewall ehambisa imizila kuleyo ndlela ngaphandle uma idizayini ehlukile yokuhlola yesigaba 2 iyivimbela. Lokhu kuyiqiniso kuwo womabili amamodeli, ngakho lesi yisikhala sedizayini hhayi ukuqhathanisa phakathi kwawo.
Eminye imigqa emithathu yilapho amamodeli ahlukana khona ngempela.
Isango elimaphakathi: ukuhlola okulula, izindleko zangempela zokudlulisa
Gcina ama-VLAN omqashi njengezinsizakalo zesigaba 2 bese ubeka amasango awo okuhambisa imizila ku-firewall. Ithrafikhi phakathi kwama-subnet ibe isiya kulelo sango futhi ibuya, mhlawumbe ngisho nalapho ama-host womabili ekwi-leaf eyodwa. Indawo yokuhlola icacile, futhi yikho konke ukucabanga kwale dizayini. Izindleko umthwalo wokudlulisa ku-firewall kanye nokuncika okuphakathi kwamandla nokutholakala okufanele ukuklama manje.
Khawulela ushintsho kumasango omqashi ohlose ukuwasebenzisa. Ukususa yonke ikheli le-VLAN kubanzi kakhulu lapho ukuphatha, i-underlay kanye nezixhumanisi zepulatifomu kunemisebenzi ehlukene. Hlola nesango lesibili elisebenzayo, ngoba lelo elisahambisa imizila lizungeza i-firewall licindezela idizayini ngokuthula.
Le modeli kulula ukuyichaza kumcwaningi wamabhuku. Ayibizi kakhulu ngokuzenzakalela ukuyiphatha.
I-IRB esatshalaliswa: indlela esheshayo, akukho ukuhlola ngokuzenzakalela
Ngamasango e-anycast asatshalaliswa, i-leaf ngayinye ihambisa imizila yethrafikhi yomqashi endaweni, futhi i-RFC 9135 ichaza ukuthi kungani lokhu kugwema ukubuyiselwa ngesango elimaphakathi. Inzuzo ingempela, futhi inomphumela oqondile: ukuhlola akukwazi ukucatshangwa kusukela lapho i-firewall ixhunywe khona. I-firewall exhunywe ku-leaf yomngcele ibona ithrafikhi yangaphandle kanye nakho konke okuqondisa kuyo ngokusobala.
Faka insizakalo ngendlela ipulatifomu eyisekela ngempela: ukuqondisa kabusha okusekelwe kunqubomgomo, i-node yensizakalo, noma ukuhambisa imizila okulawulwayo phakathi kwama-VRF nge-firewall. Fanisa ithrafikhi ehlosiwe endaweni yayo yangempela yokungena. Inqubomgomo ebhalwe kusixhumanisi esibheke kuma-host ayiyihlanganisi iphakethe elivela ku-overlay.
Funda imizila efakiwe hhayi okuzenzakalelayo okuhloswe. Isiqalo somqashi esicacile esingeniswe ngqo singadlula umzila ozenzakalelayo okhomba ku-firewall, futhi akukho lutho ekulungiselelweni oluzobonakala lungalungile.
Ukulingana kuyisici sokuhambisa imizila, akusona isiqinisekiso sokuhlola
I-IRB elinganayo ichaza ukuthi ama-node e-provider edge angenayo naphumayo aphatha kanjani ukuhambisa imizila kanye nebhuloho lomgudu. Ayisho lutho mayelana nokuthi izinhlangothi zombili zifinyelela kudivayisi efanayo enesimo. I-ECMP, i-anycast kanye nokutholakala okuphezulu kwe-firewall konke kuthinta ukuthi iyiphi i-node ebona ithrafikhi ebuyayo, futhi imodeli yesimo esekelwe iqoqo inquma ukuthi lokho kwamukeleka yini.
Landela indlela yokubuya ngokusobala kumgudu ngamunye okhathazayo. I-NAT ayisiyo into yokushintsha yonke yalowo msebenzi, futhi amadizayini ancike kuyo avame ukuthola isikhala ngesikhathi se-failover hhayi ngesikhathi sokwakha.
Dlula emgudwini owodwa odingekayo kanye nomgudu owodwa okhishwe ngamabomu, kuzinhlangothi zombili, ngaphambi kokugunyaza idizayini.
Indlela yokukhetha, nokuthi yini okufanele ihlolwe kunoma yisiphi isimo
Khetha isango elimaphakathi lapho ukumbozwa kokuhlola kubaluleke kakhulu kunamandla okudlulisa futhi ungakwazi ukukhokhela ukuncika okuphakathi. Khetha i-IRB esatshalaliswa lapho ukuhambisa imizila endaweni kuyiyona nto esemqoka, futhi wabele isabelomali sokufakwa kwensizakalo ngokusobala esikhundleni sokucabanga.
Bese uhlola ukuhambisa imizila okuyikho empeleni okufakile, ngoba yilapho amadizayini amabili ahluka khona kakhulu:
show ip route vrf TENANT 10.20.0.0/16
show bgp l2vpn evpn route-type prefixFaka ekuhlolweni ukwehluleka nokululama kwe-node yensizakalo. Umzila oyisipele odlula ukuhlola ngokuthula uyisinqumo esihlukile kunqubomgomo ye-fail-open ehleliwe, futhi ngokuvamile munye kuphela kubo ababili ohliwe. Idizayini eqediwe isho ukuthi isigaba ngasinye sethrafikhi sihamba ngamuphi umzila, sihlolwa kuphi, futhi kwenzekani lapho lowo mzila wokuhlola ungatholakali.