{"id":346438,"date":"2023-03-07T15:04:02","date_gmt":"2023-03-07T15:04:02","guid":{"rendered":"http:\/\/savepearlharbor.com\/?p=346438"},"modified":"-0001-11-30T00:00:00","modified_gmt":"-0001-11-29T21:00:00","slug":"","status":"publish","type":"post","link":"https:\/\/savepearlharbor.com\/?p=346438","title":{"rendered":"ACI VRF leaking<\/span>"},"content":{"rendered":"
<\/div>\n
\n
\n
\n
\n

\u041d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043b\u044e\u0434\u0438 \u0433\u043e\u0432\u043e\u0440\u044f\u0442, \u0447\u0442\u043e\u00a0BGP\u00a0\u2014 \u0441\u043b\u043e\u0436\u043d\u044b\u0439 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b (\u044f\u00a0\u0431\u044b \u043f\u043e\u0441\u043f\u043e\u0440\u0438\u043b, \u043e\u0441\u043e\u0431\u0435\u043d\u043d\u043e \u0432\u00a0\u0441\u0440\u0430\u0432\u043d\u0435\u043d\u0438\u0438 \u0441\u00a0OSPF). \u041e\u0434\u043d\u0430\u043a\u043e \u044f \u043d\u0438 \u0440\u0430\u0437\u0443 \u043d\u0435\u00a0\u0432\u0441\u0442\u0440\u0435\u0447\u0430\u043b \u043d\u0438\u043a\u043e\u0433\u043e, \u043a\u0442\u043e \u0441\u0447\u0438\u0442\u0430\u043b\u00a0\u0431\u044b \u043f\u0440\u043e\u0441\u0442\u044b\u043c ACI, \u0435\u0441\u043b\u0438, \u043a\u043e\u043d\u0435\u0447\u043d\u043e, \u043d\u0435\u00a0\u0431\u0440\u0430\u0442\u044c \u0432\u00a0\u0440\u0430\u0441\u0447\u0451\u0442 \u043c\u0430\u0440\u043a\u0435\u0442\u0438\u043d\u0433. ACL \u0438 prefix\u2011lists \u044f\u0432\u043b\u044f\u044e\u0442\u0441\u044f \u0447\u0430\u0441\u0442\u044c\u044e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u044b CCNA; \u0430\u00a0\u0432\u043e\u0442 \u043a\u043e\u043d\u0442\u0440\u0430\u043a\u0442\u0430\u043c ACI \u043f\u043e\u0441\u0432\u044f\u0449\u0451\u043d \u0430\u0436 \u0446\u0435\u043b\u044b\u0439 white paper<\/a>. \u0414\u043e\u043b\u0433\u043e\u0435 \u0432\u0440\u0435\u043c\u044f \u0434\u043b\u044f\u00a0\u043c\u0435\u043d\u044f \u043e\u0441\u0442\u0430\u0432\u0430\u043b\u0438\u0441\u044c \u0437\u0430\u0433\u0430\u0434\u043a\u043e\u0439 \u0434\u0435\u0442\u0430\u043b\u0438 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 inter\u2011VRF \u043a\u043e\u043d\u0442\u0440\u0430\u043a\u0442\u043e\u0432. \u041d\u0435\u00a0\u043f\u043e\u0439\u043c\u0438\u0442\u0435 \u043c\u0435\u043d\u044f \u043d\u0435\u043f\u0440\u0430\u0432\u0438\u043b\u044c\u043d\u043e\u00a0\u2014 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u0430\u044f \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e \u043e\u043f\u0438\u0441\u0430\u043d\u0430 \u0432\u00a0\u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u0446\u0438\u0438, \u043e\u0434\u043d\u0430\u043a\u043e \u043c\u043d\u0435\u00a0\u0431\u044b\u043b\u043e \u043f\u043e\u0434\u0447\u0430\u0441 \u043d\u0435\u043f\u043e\u043d\u044f\u0442\u043d\u043e, \u043f\u043e\u0447\u0435\u043c\u0443 \u043d\u0443\u0436\u043d\u044b \u0442\u0435 \u0438\u043b\u0438\u00a0\u0438\u043d\u044b\u0435 \u0448\u0430\u0433\u0438. \u0421\u0435\u0433\u043e\u0434\u043d\u044f \u044f\u00a0\u0431\u044b \u0445\u043e\u0442\u0435\u043b \u043f\u043e\u0434\u0435\u043b\u0438\u0442\u044c\u0441\u044f \u043f\u0430\u0440\u043e\u0439\u2011\u0442\u0440\u043e\u0439\u043a\u043e\u0439 \u0441\u0432\u043e\u0438\u0445 \u043d\u0430\u0445\u043e\u0434\u043e\u043a \u043f\u043e\u00a0\u044d\u0442\u043e\u0439 \u0442\u0435\u043c\u0435.<\/p>\n

\u0422\u043e\u043f\u043e\u043b\u043e\u0433\u0438\u044f \u0432\u0435\u0441\u044c\u043c\u0430 \u043f\u0440\u043e\u0441\u0442\u0430:<\/p>\n

<\/figure>\n

Host\u00a0\u2014 \u044d\u0442\u043e L3\u00a0\u043a\u043e\u043c\u043c\u0443\u0442\u0430\u0442\u043e\u0440, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u0442 \u0440\u043e\u043b\u044c provider (VRF Provider) \u0438 consumer (VRF Consumer). \u0412\u00a0\u043f\u043b\u0430\u043d\u0435 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0446\u0438\u0438 ACI \u0432\u044b\u0441\u0442\u0443\u043f\u0430\u0435\u0442 \u0448\u043b\u044e\u0437\u043e\u043c \u043f\u043e\u00a0\u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e:<\/p>\n

Host# show run vrf Provider interface Ethernet1\/1.100   vrf member Provider vrf context Provider   ip route 0.0.0.0\/0 192.168.1.254   address-family ipv4 unicast ip route 0.0.0.0\/0 192.168.1.254 vrf Provider  Host# show ip interface brief vrf Provider IP Interface Status for VRF \" Provider \"(47) Interface            IP Address      Interface Status Eth1\/1.100           192.168.1.1     protocol-up\/link-up\/admin-up         Host# show run vrf Consumer interface Ethernet1\/2.100   vrf member Consumer vrf context Consumer   ip route 0.0.0.0\/0 192.168.2.254   address-family ipv4 unicast ip route 0.0.0.0\/0 192.168.2.254 vrf Consumer  Host# show ip interface brief vrf Consumer IP Interface Status for VRF \" Consumer \"(48) Interface            IP Address      Interface Status Eth1\/2.100           192.168.2.1     protocol-up\/link-up\/admin-up<\/code><\/pre>\n
\u0427\u0442\u043e\u00a0\u043a\u0430\u0441\u0430\u0435\u0442\u0441\u044f ACI, \u043d\u0430\u043c \u043d\u0443\u0436\u043d\u044b \u0442\u043e\u043b\u044c\u043a\u043e \u043f\u0430\u0440\u0430 EPG, BD \u0438 VRF \u0432\u00a0\u0440\u0430\u043c\u043a\u0430\u0445 \u043e\u0434\u043d\u043e\u0433\u043e tenant, \u0430\u00a0\u0442\u0430\u043a\u0436\u0435 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430 Access Policies.<\/p>\n
 <\/em>\u041c\u043e\u0434\u0443\u043b\u044c Tenant:<\/p>\n
resource \"aci_tenant\" \"TestTenant\" {     name                = \"TestTenant\" } resource \"aci_vrf\" \"TestVrf1\" {     tenant_dn           = aci_tenant.TestTenant.id     name                = \"TestVrf1\" } resource \"aci_vrf\" \"TestVrf2\" {     tenant_dn           = aci_tenant.TestTenant.id     name                = \"TestVrf2\" } resource \"aci_bridge_domain\" \"TestBD1\" {     tenant_dn           = aci_tenant.TestTenant.id     name                = \"TestBD1\"     relation_fv_rs_ctx  = aci_vrf.TestVrf1.id } resource \"aci_subnet\" \"Subnet1\" {     parent_dn        = aci_application_epg.Provider.id     ip               = \"192.168.1.254\/24\"     scope            = [\"private\", \"shared\"] } resource \"aci_bridge_domain\" \"TestBD2\" {     tenant_dn           = aci_tenant.TestTenant.id     name                = \"TestBD2\"     relation_fv_rs_ctx  = aci_vrf.TestVrf2.id } resource \"aci_subnet\" \"Subnet2\" {     parent_dn        = aci_bridge_domain.TestBD2.id     ip               = \"192.168.2.254\/24\"     scope            = [\"private\", \"shared\"] } resource \"aci_application_profile\" \"TestAP\" {     tenant_dn           = aci_tenant.TestTenant.id     name                = \"TestAP\" } resource \"aci_application_epg\" \"Provider\" {     application_profile_dn  = aci_application_profile.TestAP.id     name                    = \"Provider\"     relation_fv_rs_bd       = aci_bridge_domain.TestBD1.id } resource \"aci_application_epg\" \"Consumer\" {     application_profile_dn  = aci_application_profile.TestAP.id     name                    = \"Consumer\"     relation_fv_rs_bd       = aci_bridge_domain.TestBD2.id } resource \"aci_epg_to_domain\" \"ProviderDomain\" {     application_epg_dn  = aci_application_epg.Provider.id     tdn                 = aci_physical_domain.PhysicalDomain.id } resource \"aci_epg_to_domain\" \"ConsumerDomain\" {     application_epg_dn  = aci_application_epg.Consumer.id     tdn                 = aci_physical_domain.PhysicalDomain.id }<\/code><\/pre>\n
\u041c\u043e\u0434\u0443\u043b\u044c Access Policies:<\/p>\n
resource \"aci_vlan_pool\" \"TestPool\" {   name  = \"TestPool\"   alloc_mode  = \"static\" } resource \"aci_ranges\" \"range_1\" {   vlan_pool_dn  = aci_vlan_pool.TestPool.id   from          = \"vlan-1\"   to            = \"vlan-1000\"   alloc_mode    = \"static\" } resource \"aci_physical_domain\" \"PhysicalDomain\" {   name                      = \"PhysicalDomain\"   relation_infra_rs_vlan_ns = aci_vlan_pool.TestPool.id } resource \"aci_attachable_access_entity_profile\" \"TestAAEP\" {     name                    = \"TestAAEP\" } resource \"aci_aaep_to_domain\" \"PhysicalDomain-to-TestAAEP\" {   attachable_access_entity_profile_dn = aci_attachable_access_entity_profile.TestAAEP.id   domain_dn                           = aci_physical_domain.PhysicalDomain.id } resource \"aci_leaf_interface_profile\" \"TestInterfaceProfile\" {     name        = \"TestInterfaceProfile\" } resource \"aci_access_port_block\" \"TestAccessBlockSelector\" {   access_port_selector_dn = aci_access_port_selector.TestAccessPortSelector.id   name                    = \"TestAccessBlockSelector\"   from_card               = \"1\"   from_port               = \"2\"   to_card                 = \"1\"   to_port                 = \u201c2\" } resource \"aci_access_port_selector\" \"TestAccessPortSelector\" {     leaf_interface_profile_dn       = aci_leaf_interface_profile.TestInterfaceProfile.id     name                            = \"TestAccessPortSelector\"     access_port_selector_type       = \"range\"     relation_infra_rs_acc_base_grp  = aci_leaf_access_port_policy_group.TestAccessInterfacePolicy.id } resource \"aci_leaf_access_port_policy_group\" \"TestAccessInterfacePolicy\" {     name                        = \"TestAccessInterfaceProfile\"     relation_infra_rs_att_ent_p = aci_attachable_access_entity_profile.TestAAEP.id } resource \"aci_leaf_profile\" \"TestSwitchProfile\" {   name        = \"TestSwitchProfile\"   leaf_selector {     name                    = \"LeafSelector\"     switch_association_type = \"range\"     node_block {       name  = \"Block1\"       from_ = \"101\"       to_   = \"102\"     }   }   relation_infra_rs_acc_port_p = [aci_leaf_interface_profile.TestInterfaceProfile.id] }<\/code><\/pre>\n
\u041f\u043e\u0434\u0441\u0435\u0442\u044c, \u0432\u00a0\u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u043d\u0430\u0445\u043e\u0434\u0438\u0442\u0441\u044f provider, \u0434\u043e\u043b\u0436\u043d\u0430\u00a0\u0431\u044b\u0442\u044c \u0437\u0430\u0434\u0430\u043d\u0430 \u0432\u00a0EPG \u0432\u043c\u0435\u0441\u0442\u043e BD. \u041f\u043e\u0441\u043a\u043e\u043b\u044c\u043a\u0443 \u043c\u044b \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c \u0440\u0430\u0437\u043d\u044b\u0435 EPG, \u043d\u0443\u0436\u043d\u043e \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0438\u0442\u044c \u043a\u043e\u043d\u0442\u0440\u0430\u043a\u0442, \u0447\u0442\u043e\u0431\u044b \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c \u043c\u0435\u0436\u0434\u0443 \u043d\u0438\u043c\u0438 \u0441\u0432\u044f\u0437\u043d\u043e\u0441\u0442\u044c.<\/p>\n
\u041c\u043e\u0434\u0443\u043b\u044c Contract:<\/p>\n
resource \"aci_application_epg\" \"Provider\" {     application_profile_dn  = aci_application_profile.TestAP.id     name                    = \" Provider\"     relation_fv_rs_bd       = aci_bridge_domain.TestBD1.id     relation_fv_rs_prov     = [aci_contract.TestContract.id] } resource \"aci_application_epg\" \"Consumer\" {     application_profile_dn  = aci_application_profile.TestAP.id     name                    = \" Consumer\"     relation_fv_rs_bd       = aci_bridge_domain.TestBD2.id     relation_fv_rs_cons     = [aci_contract.TestContract.id] } resource \"aci_contract\" \"TestContract\" {     tenant_dn   =  aci_tenant.TestTenant.id     name        = \"TestContract\"     scope       = \"tenant\" } resource \"aci_contract_subject\" \"TestSubject\" {     contract_dn   = aci_contract.TestContract.id     name          = \"TestSubject\" } resource \"aci_contract_subject_filter\" \"PermitIPSubj\" {   contract_subject_dn  = aci_contract_subject.TestSubject.id   filter_dn  = aci_filter.PermitIPFilter.id } resource \"aci_filter\" \"PermitIPFilter\" {     tenant_dn   = aci_tenant.TestTenant.id     name        = \"PermitIPFilter\" } resource \"aci_filter_entry\" \"PermitIPFilterEntry\" {     filter_dn     = aci_filter.PermitIPFilter.id     name          = \"permit_ip \"     ether_t       = \"ip\" }<\/code><\/pre>\n
\u041a\u0430\u043a \u0442\u043e\u043b\u044c\u043a\u043e \u043c\u044b \u043f\u0440\u0438\u043c\u0435\u043d\u0438\u043c \u044d\u0442\u043e\u0442 \u043a\u043e\u043d\u0442\u0440\u0430\u043a\u0442, Consumer \u0441\u043c\u043e\u0436\u0435\u0442 \u043e\u0431\u0449\u0430\u0442\u044c\u0441\u044f \u0441 Provider:<\/p>\n
Host# traceroute 192.168.1.1 vrf Consumer traceroute to 192.168.1.1 (192.168.1.1), 30 hops max, 40 byte packets  1  192.168.2.254 (192.168.2.254)  1.946 ms  0.758 ms  0.691 ms  2  192.168.1.254 (192.168.1.254)  2.231 ms  0.708 ms  0.705 ms  3  192.168.1.1 (192.168.1.1)  0.708 ms  0.577 ms  0.578 ms<\/code><\/pre>\n
\u041d\u0430\u00a0\u0434\u0430\u043d\u043d\u043e\u043c \u044d\u0442\u0430\u043f\u0435 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0438 \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u044b, \u043f\u043e\u044d\u0442\u043e\u043c\u0443 \u043c\u044b \u043c\u043e\u0436\u0435\u043c \u043f\u0435\u0440\u0435\u0439\u0442\u0438 \u043a\u00a0\u043d\u0430\u0431\u043b\u044e\u0434\u0435\u043d\u0438\u044f\u043c. \u041f\u043e\u0447\u0435\u043c\u0443 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u044f\u0442\u044c \u043f\u043e\u0434\u0441\u0435\u0442\u044c provider \u0432\u00a0\u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430\u0445 EPG, \u0430\u00a0\u043d\u0435\u00a0BD? \u0412\u00a0\u043a\u043b\u0430\u0441\u0441\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0435 L3VPN \u043d\u0435\u0442 \u043f\u043e\u0434\u043e\u0431\u043d\u043e\u0433\u043e \u0442\u0440\u0435\u0431\u043e\u0432\u0430\u043d\u0438\u044f, \u043f\u043e\u044d\u0442\u043e\u043c\u0443, \u0434\u043e\u043b\u0436\u043d\u043e\u00a0\u0431\u044b\u0442\u044c, \u043e\u043d\u043e \u043e\u0442\u043d\u043e\u0441\u0438\u0442\u0441\u044f \u0441\u0443\u0433\u0443\u0431\u043e \u043a\u00a0ACI. \u0420\u0430\u0441\u0441\u043c\u043e\u0442\u0440\u0438\u043c, \u043a\u0430\u043a\u00a0\u0438\u043c\u0435\u043d\u043d\u043e \u043f\u0440\u043e\u0438\u0441\u0445\u043e\u0434\u0438\u0442 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0446\u0438\u044f \u0442\u0440\u0430\u0444\u0438\u043a\u0430:<\/p>\n
leaf-102# show ip route vrf TestTenant:TestVrf2 <output omitted> 192.168.1.0\/24, ubest\/mbest: 1\/0, attached, direct, pervasive     *via 10.0.88.66%overlay-1, [1\/0], 00:07:29, static, tag 4294967294 192.168.2.0\/24, ubest\/mbest: 1\/0, attached, direct, pervasive, dcs     *via 10.0.88.66%overlay-1, [1\/0], 00:11:01, static, tag 4294967294 192.168.2.254\/32, ubest\/mbest: 1\/0, attached, pervasive     *via 192.168.2.254, Vlan11, [0\/0], 00:11:01, local, local leaf-102# leaf-102# show ip route vrf TestTenant:TestVrf2 192.168.1.0\/24 det <output omitted> 192.168.1.0\/24, ubest\/mbest: 1\/0, attached, direct, pervasive     *via 10.0.88.66%overlay-1, [1\/0], 00:07:38, static, tag 4294967294          recursive next hop: 10.0.88.66\/32%overlay-1          vrf crossing information:  VNID:0x238000 ClassId:0x2ab4 Flush#:0x1<\/code><\/pre>\n
\u041e\u0431\u0440\u0430\u0442\u0438\u0442\u0435 \u0432\u043d\u0438\u043c\u0430\u043d\u0438\u0435, \u0447\u0442\u043e \u043f\u043e\u0434\u0441\u0435\u0442\u044c Provider \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u0430 \u0447\u0435\u0440\u0435\u0437 \u0441\u0442\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u043c\u0430\u0440\u0448\u0440\u0443\u0442 \u0441 \u043f\u0430\u0440\u043e\u0439 \u043d\u0435\u043e\u0431\u044b\u0447\u043d\u044b\u0445 \u0430\u0442\u0440\u0438\u0431\u0443\u0442\u043e\u0432. \u0412\u043e-\u043f\u0435\u0440\u0432\u044b\u0445, next-hop \u2013 \u044d\u0442\u043e \u0430\u0434\u0440\u0435\u0441 anycast IP for IPv4 hardware proxy:<\/p>\n
spine-201# show ip interface lo9 IP Interface Status for VRF \"overlay-1\" lo9, Interface status: protocol-up\/link-up\/admin-up, iod: 81, mode: anycast-v4   IP address: 10.0.88.66, IP subnet: 10.0.88.66\/32     IP broadcast address: 255.255.255.255   IP primary address route-preference: 0, tag: 0<\/code><\/pre>\n
\u0427\u0442\u043e\u0431\u044b proxy \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0430\u043b \u043f\u0430\u043a\u0435\u0442 \u0432 \u043f\u0440\u0430\u0432\u0438\u043b\u044c\u043d\u043e\u043c VRF, consumer leaf \u043f\u0435\u0440\u0435\u043f\u0438\u0441\u044b\u0432\u0430\u0435\u0442 VNID \u0442\u0430\u043a, \u0447\u0442\u043e\u0431\u044b \u0442\u043e\u0442 \u043f\u043e\u043f\u0430\u043b \u0432 provider VRF (0x238000 = 2326528):<\/p>\n
<\/figure>\n
\u041e\u0444\u0444\u0442\u043e\u043f: \u0434\u043b\u044f\u00a0NX\u2011OS VXLAN \u0445\u0430\u0440\u0430\u043a\u0442\u0435\u0440\u043d\u043e \u0440\u043e\u0432\u043d\u043e \u043f\u0440\u043e\u0442\u0438\u0432\u043e\u043f\u043e\u043b\u043e\u0436\u043d\u043e\u0435 \u043f\u043e\u0432\u0435\u0434\u0435\u043d\u0438\u0435, \u0435\u0441\u043b\u0438 \u043d\u0435\u00a0\u0431\u0440\u0430\u0442\u044c \u0432\u00a0\u0440\u0430\u0441\u0447\u0451\u0442 downstream VNI.<\/p>\n
Inter\u2011VRF \u043a\u043e\u043d\u0442\u0440\u0430\u043a\u0442 \u0412\u0421\u0415\u0413\u0414\u0410 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u0442 \u0438\u043c\u0435\u043d\u043d\u043e consumer leaf. \u041e\u0434\u043d\u0430\u043a\u043e \u0442\u0430\u043a\u043e\u0439 \u043f\u043e\u0434\u0445\u043e\u0434 \u0434\u043e\u043b\u0436\u0435\u043d\u00a0\u0431\u044b \u0441\u043b\u043e\u043c\u0430\u0442\u044c conversation\u2011based forwarding: consumer \u043d\u0430\u0447\u0438\u043d\u0430\u0435\u0442 \u0442\u0440\u0430\u043d\u0437\u0430\u043a\u0446\u0438\u044e, \u043f\u043e\u044d\u0442\u043e\u043c\u0443 \u043e\u043d \u043d\u0435\u00a0\u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0435\u0434\u0432\u0430\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u0430\u043a\u0435\u0442 \u043e\u0442\u00a0provider, \u0447\u0442\u043e\u0431\u044b \u0437\u0430\u043f\u043e\u043c\u043d\u0438\u0442\u044c \u0435\u0433\u043e pcTag. \u0420\u0435\u0448\u0435\u043d\u0438\u0435 \u043e\u0447\u0435\u0432\u0438\u0434\u043d\u043e: consumer \u0434\u043e\u043b\u0436\u0435\u043d \u0437\u0430\u0440\u0430\u043d\u0435\u0435 \u0437\u043d\u0430\u0442\u044c pcTag, \u043e\u0442\u043d\u043e\u0441\u044f\u0449\u0438\u0439\u0441\u044f \u043a\u00a0provider. \u0418\u043c\u0435\u043d\u043d\u043e \u044d\u0442\u043e\u0442 \u0444\u0430\u043a\u0442 \u043e\u0442\u0440\u0430\u0436\u0430\u0435\u0442\u0441\u044f \u0432\u00a0\u0432\u0438\u0434\u0435 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u0438 \u043d\u0430\u0441\u0442\u0440\u0430\u0438\u0432\u0430\u0442\u044c \u043f\u043e\u0434\u0441\u0435\u0442\u044c provider \u0432\u00a0EPG: \u043a\u0430\u043a\u00a0\u0442\u043e\u043b\u044c\u043a\u043e \u043a\u043e\u043d\u0442\u0440\u0430\u043a\u0442 \u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u0441\u044f \u0430\u043a\u0442\u0438\u0432\u0435\u043d, APIC \u043d\u0430\u0441\u0442\u0440\u0430\u0438\u0432\u0430\u0435\u0442 \u043d\u0430\u00a0consumer leaf \u0441\u0442\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u043c\u0430\u0440\u0448\u0440\u0443\u0442 \u0441\u00a0\u043f\u0435\u0440\u0435\u0437\u0430\u043f\u0438\u0441\u044c\u044e VNID \u0438 provider pcTag, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0432\u00a0RIB \u043d\u0430\u0437\u044b\u0432\u0430\u0435\u0442\u0441\u044f ClassID (0\u00d72ab4\u00a0= 10\u00a0932):<\/p>\n
<\/figure>\n
\u0412 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 consumer leaf \u043e\u0431\u043b\u0430\u0434\u0430\u0435\u0442 \u0432\u0441\u0435\u0439 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0435\u0439, \u0447\u0442\u043e\u0431\u044b \u043f\u0435\u0440\u0435\u0434\u0430\u0442\u044c \u043f\u0430\u043a\u0435\u0442 \u0432 provider VRF \u0438 \u043f\u0440\u0438\u043c\u0435\u043d\u0438\u0442\u044c \u043f\u0440\u0430\u0432\u0438\u043b\u044c\u043d\u044b\u0435 \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0438:<\/p>\n
leaf-102# show zoning-rule scope 2719744 +---------+--------+--------+----------+----------------+---------+---------+-------------------------+----------+------------------------+ | Rule ID | SrcEPG | DstEPG | FilterID |      Dir       |  operSt |  Scope  |           Name          |  Action  |        Priority        | +---------+--------+--------+----------+----------------+---------+---------+-------------------------+----------+------------------------+ |   4101  |   0    |   15   | implicit |    uni-dir     | enabled | 2719744 |                         | deny,log |  any_vrf_any_deny(22)  | |   4100  |   0    |   0    | implarp  |    uni-dir     | enabled | 2719744 |                         |  permit  |   any_any_filter(17)   | |   4099  |   0    |   0    | implicit |    uni-dir     | enabled | 2719744 |                         | deny,log |    any_any_any(21)     | |   4098  |   0    | 49153  | implicit |    uni-dir     | enabled | 2719744 |                         |  permit  |    any_dest_any(16)    | |   4102  | 10932  | 49154  |    4     | uni-dir-ignore | enabled | 2719744 | TestTenant:TestContract |  permit  |     fully_qual(7)      | |   4103  | 49154  | 10932  |    4     |     bi-dir     | enabled | 2719744 | TestTenant:TestContract |  permit  |     fully_qual(7)      | |   4104  | 10932  |   0    | implicit |    uni-dir     | enabled | 2719744 |                         | deny,log | shsrc_any_any_deny(12) | +---------+--------+--------+----------+----------------+---------+---------+-------------------------+----------+------------------------+<\/code><\/pre>\n
\u0427\u0442\u043e \u043d\u0430\u0441\u0447\u0451\u0442 \u043e\u0431\u0440\u0430\u0442\u043d\u043e\u0433\u043e \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u043e\u0442 provider EPG?<\/p>\n
leaf-101# show ip route vrf TestTenant:TestVrf1 192.168.2.0\/24 det <output omitted> 192.168.2.0\/24, ubest\/mbest: 1\/0, attached, direct, pervasive     *via 10.0.88.66%overlay-1, [1\/0], 00:01:13, static, tag 4294967294          recursive next hop: 10.0.88.66\/32%overlay-1          vrf crossing information:  VNID:0x298000 ClassId:0 Flush#:0<\/code><\/pre>\n
\u041c\u043e\u0436\u043d\u043e \u0434\u043e\u0433\u0430\u0434\u0430\u0442\u044c\u0441\u044f, \u0447\u0442\u043e \u043c\u044b \u043d\u0430\u0439\u0434\u0451\u043c \u043f\u043e\u0445\u043e\u0436\u0438\u0439 \u043c\u0430\u0440\u0448\u0440\u0443\u0442 \u0434\u043b\u044f consumer EPG:<\/p>\n
    \n
  1. \n
    \u041e\u043d \u0443\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u0442 \u043d\u0430 Anycast IPv4 hardware proxy address.<\/p>\n<\/li>\n
  2. \n
    \u041e\u043d \u0437\u0430\u0434\u0430\u0451\u0442 \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u043e\u0439 \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0435 \u0434\u043b\u044f \u043f\u0435\u0440\u0435\u0437\u0430\u043f\u0438\u0441\u0438 VNID.<\/p>\n<\/li>\n<\/ol>\n
    \u041e\u0434\u043d\u0430\u043a\u043e ClassID \u0440\u0430\u0432\u0435\u043d \u043d\u0443\u043b\u044e. \u041e\u0437\u043d\u0430\u0447\u0430\u0435\u0442 \u043b\u0438 \u044d\u0442\u043e, \u0447\u0442\u043e provider leaf \u043d\u0435 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u0442 \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0443? \u0414\u0435\u0439\u0441\u0442\u0432\u0438\u0442\u0435\u043b\u044c\u043d\u043e:<\/p>\n
    leaf-101# show zoning-rule scope 2326528 +---------+--------+--------+----------+---------+---------+---------+------+----------+----------------------+ | Rule ID | SrcEPG | DstEPG | FilterID |   Dir   |  operSt |  Scope  | Name |  Action  |       Priority       | +---------+--------+--------+----------+---------+---------+---------+------+----------+----------------------+ |   4101  |   0    | 16387  | implicit | uni-dir | enabled | 2326528 |      |  permit  |   any_dest_any(16)   | |   4098  |   0    |   0    | implicit | uni-dir | enabled | 2326528 |      | deny,log |   any_any_any(21)    | |   4099  |   0    |   0    | implarp  | uni-dir | enabled | 2326528 |      |  permit  |  any_any_filter(17)  | |   4100  |   0    |   15   | implicit | uni-dir | enabled | 2326528 |      | deny,log | any_vrf_any_deny(22) | |   4102  | 10932  |   14   | implicit | uni-dir | enabled | 2326528 |      | permit_override |    src_dst_any(9)    | +---------+--------+--------+----------+---------+---------+---------+------+----------+----------------------+<\/code><\/pre>\n
    \u041d\u0435\u043d\u0443\u043b\u0435\u0432\u044b\u0435 \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f pcTag \u0432 zoning table \u043b\u0438\u0431\u043e \u044f\u0432\u043b\u044f\u044e\u0442\u0441\u044f \u0437\u0430\u0440\u0435\u0437\u0435\u0440\u0432\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u043c\u0438, \u043b\u0438\u0431\u043e \u043e\u0442\u043d\u043e\u0441\u044f\u0442\u0441\u044f \u043a BD:<\/p>\n
    <\/figure>\n
    \u0414\u0435\u043a\u043e\u0434\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u043e\u0441\u0442\u0430\u043b\u044c\u043d\u044b\u0445 \u0437\u0430\u043f\u0438\u0441\u0435\u0439 \u0432\u00a0zoning table \u044f \u043e\u0441\u0442\u0430\u0432\u043b\u044e \u0432\u00a0\u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u0443\u043f\u0440\u0430\u0436\u043d\u0435\u043d\u0438\u044f (\u0432\u043d\u0430\u0447\u0430\u043b\u0435 \u043c\u043e\u0436\u043d\u043e \u0438\u0437\u0443\u0447\u0438\u0442\u044c \u044d\u0442\u043e\u0442 \u0440\u0430\u0437\u0434\u0435\u043b<\/a>).<\/p>\n
    \u0421\u0442\u043e\u0438\u0442 \u043f\u043e\u0434\u0447\u0435\u0440\u043a\u043d\u0443\u0442\u044c, \u0447\u0442\u043e\u00a0inter\u2011VRF \u0442\u0440\u0430\u0444\u0438\u043a \u043d\u0435\u00a0\u043f\u043e\u043f\u0430\u0434\u0430\u0435\u0442 \u043f\u043e\u0434\u00a0endpoint learning \u043d\u0438 \u0434\u043b\u044f\u00a0\u043e\u0434\u043d\u043e\u0433\u043e \u0438\u0437\u00a0\u043d\u0430\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0439 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0438. \u0422\u0430\u043a\u043e\u0439 \u043f\u043e\u0434\u0445\u043e\u0434 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u0430\u0441\u0442\u0430\u0432\u0438\u0442\u044c leaf\u2011\u043a\u043e\u043c\u043c\u0443\u0442\u0430\u0442\u043e\u0440\u044b \u0432\u0441\u0435\u0433\u0434\u0430 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0441\u0442\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u043c\u0430\u0440\u0448\u0440\u0443\u0442, \u0430\u00a0\u0437\u043d\u0430\u0447\u0438\u0442, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0442\u044c \u043f\u0440\u0430\u0432\u0438\u043b\u044c\u043d\u044b\u0435 \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0438 \u0438 \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u043e \u043f\u0435\u0440\u0435\u043f\u0438\u0441\u044b\u0432\u0430\u0442\u044c VNID. \u0422\u0443\u0442 \u0435\u0441\u0442\u044c \u043d\u0435\u043e\u0447\u0435\u0432\u0438\u0434\u043d\u043e\u0435 \u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u0435: inter\u2011VRF \u0442\u0440\u0430\u0444\u0438\u043a \u0432\u0441\u0435\u0433\u0434\u0430 \u043f\u0440\u043e\u0445\u043e\u0434\u0438\u0442 \u0447\u0435\u0440\u0435\u0437 spine, \u0434\u0430\u0436\u0435 \u0435\u0441\u043b\u0438 provider \u0438 consumer \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u044b \u043a\u00a0\u043e\u0434\u043d\u043e\u043c\u0443 \u0438 \u0442\u043e\u043c\u0443\u00a0\u0436\u0435 leaf. <\/p>\n
    \u042f \u043d\u0430\u0434\u0435\u044e\u0441\u044c, \u0442\u0435\u043f\u0435\u0440\u044c \u043e\u0447\u0435\u0432\u0438\u0434\u043d\u043e, \u0447\u0442\u043e\u00a0ACI\u00a0\u2014 \u044d\u0442\u043e \u043e\u0447\u0435\u043d\u044c \u0441\u043b\u043e\u0436\u043d\u0430\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u0430 \u0441\u00a0\u043c\u043d\u043e\u0436\u0435\u0441\u0442\u0432\u043e\u043c \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0438\u0445 \u043d\u044e\u0430\u043d\u0441\u043e\u0432. \u0412\u043f\u0440\u043e\u0447\u0435\u043c, \u044d\u0442\u043e \u043d\u0435\u00a0\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043d\u0435\u0433\u0430\u0442\u0438\u0432\u043d\u043e\u0439 \u0445\u0430\u0440\u0430\u043a\u0442\u0435\u0440\u0438\u0441\u0442\u0438\u043a\u043e\u0439; \u0432\u00a0\u043a\u043e\u043d\u0446\u0435 \u043a\u043e\u043d\u0446\u043e\u0432, \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u044b \u0432\u043a\u043b\u044e\u0447\u0430\u044e\u0442 \u0432\u00a0\u0441\u0435\u0431\u044f \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0435\u043d\u043d\u043e \u0431\u043e\u043b\u044c\u0448\u0435 \u044d\u043b\u0435\u043c\u0435\u043d\u0442\u043e\u0432, \u0447\u0435\u043c \u0441\u0442\u0440\u0435\u043b\u044b \u0438\u0437\u00a0\u041a\u0430\u043c\u0435\u043d\u043d\u043e\u0433\u043e \u0432\u0435\u043a\u0430. \u041e\u0434\u043d\u0430\u043a\u043e \u0434\u043b\u044f\u00a0\u043e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u043e\u0432 ACI \u044d\u0442\u043e \u043d\u0435\u043f\u043b\u043e\u0445\u043e\u0439 \u043f\u043e\u0432\u043e\u0434 \u043f\u043e\u043c\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u00a0\u0441\u043b\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0432\u00a0\u0446\u0435\u043b\u043e\u043c, \u0430\u00a0\u0442\u0430\u043a\u0436\u0435 \u043f\u0440\u0438\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0442\u044c\u0441\u044f \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439, \u043f\u0440\u0435\u0434\u0432\u0430\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u043f\u0440\u043e\u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u0432 \u0432\u0441\u0451 \u043d\u0430\u00a0\u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0438\u0435 \u0442\u0440\u0435\u0431\u043e\u0432\u0430\u043d\u0438\u044f\u043c \u0444\u0443\u043d\u043a\u0446\u0438\u043e\u043d\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u0438 \u0438 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u0438. \u0412\u00a0\u043f\u0440\u043e\u0442\u0438\u0432\u043d\u043e\u043c \u0441\u043b\u0443\u0447\u0430\u0435 \u043c\u043e\u0436\u043d\u043e \u043e\u043a\u0430\u0437\u0430\u0442\u044c\u0441\u044f \u0432\u00a0\u0441\u0435\u0440\u043e\u0439 \u0437\u043e\u043d\u0435, \u0447\u0442\u043e\u00a0\u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043f\u0440\u0438\u0432\u0435\u0434\u0451\u0442 \u043a\u00a0\u043c\u0430\u043b\u043e\u043f\u0440\u0438\u044f\u0442\u043d\u043e\u0439 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u0435\u0440\u0435\u0434\u0435\u043b\u044b\u0432\u0430\u0442\u044c \u0434\u0438\u0437\u0430\u0439\u043d \u0432\u0441\u0435\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0441\u00a0\u043d\u0443\u043b\u044f.<\/p>\n
    \u0421\u043f\u0430\u0441\u0438\u0431\u043e \u0437\u0430 \u0440\u0435\u0446\u0435\u043d\u0437\u0438\u044e: \u0410\u043d\u0430\u0441\u0442\u0430\u0441\u0438\u0438 \u041a\u0443\u0440\u0430\u043b\u0451\u0432\u043e\u0439<\/strong><\/p>\n
    \u041a\u0430\u043d\u0430\u043b \u0432 \u0422\u0435\u043b\u0435\u0433\u0440\u0430\u043c\u0435: https:\/\/t.me\/networking_it_ru<\/a><\/p>\n<\/p>\n<\/div>\n<\/div>\n<\/div>\n
      <\/div>\n
      
     \u0441\u0441\u044b\u043b\u043a\u0430 \u043d\u0430 \u043e\u0440\u0438\u0433\u0438\u043d\u0430\u043b \u0441\u0442\u0430\u0442\u044c\u0438      https:\/\/habr.com\/ru\/post\/712014\/<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"
    <\/div>\n
    \n
    \n
    \n
    \n
    \u041d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043b\u044e\u0434\u0438 \u0433\u043e\u0432\u043e\u0440\u044f\u0442, \u0447\u0442\u043e\u00a0BGP\u00a0\u2014 \u0441\u043b\u043e\u0436\u043d\u044b\u0439 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b (\u044f\u00a0\u0431\u044b \u043f\u043e\u0441\u043f\u043e\u0440\u0438\u043b, \u043e\u0441\u043e\u0431\u0435\u043d\u043d\u043e \u0432\u00a0\u0441\u0440\u0430\u0432\u043d\u0435\u043d\u0438\u0438 \u0441\u00a0OSPF). \u041e\u0434\u043d\u0430\u043a\u043e \u044f \u043d\u0438 \u0440\u0430\u0437\u0443 \u043d\u0435\u00a0\u0432\u0441\u0442\u0440\u0435\u0447\u0430\u043b \u043d\u0438\u043a\u043e\u0433\u043e, \u043a\u0442\u043e \u0441\u0447\u0438\u0442\u0430\u043b\u00a0\u0431\u044b \u043f\u0440\u043e\u0441\u0442\u044b\u043c ACI, \u0435\u0441\u043b\u0438, \u043a\u043e\u043d\u0435\u0447\u043d\u043e, \u043d\u0435\u00a0\u0431\u0440\u0430\u0442\u044c \u0432\u00a0\u0440\u0430\u0441\u0447\u0451\u0442 \u043c\u0430\u0440\u043a\u0435\u0442\u0438\u043d\u0433. ACL \u0438 prefix\u2011lists \u044f\u0432\u043b\u044f\u044e\u0442\u0441\u044f \u0447\u0430\u0441\u0442\u044c\u044e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u044b CCNA; \u0430\u00a0\u0432\u043e\u0442 \u043a\u043e\u043d\u0442\u0440\u0430\u043a\u0442\u0430\u043c ACI \u043f\u043e\u0441\u0432\u044f\u0449\u0451\u043d \u0430\u0436 \u0446\u0435\u043b\u044b\u0439 white paper<\/a>. \u0414\u043e\u043b\u0433\u043e\u0435 \u0432\u0440\u0435\u043c\u044f \u0434\u043b\u044f\u00a0\u043c\u0435\u043d\u044f \u043e\u0441\u0442\u0430\u0432\u0430\u043b\u0438\u0441\u044c \u0437\u0430\u0433\u0430\u0434\u043a\u043e\u0439 \u0434\u0435\u0442\u0430\u043b\u0438 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 inter\u2011VRF \u043a\u043e\u043d\u0442\u0440\u0430\u043a\u0442\u043e\u0432. \u041d\u0435\u00a0\u043f\u043e\u0439\u043c\u0438\u0442\u0435 \u043c\u0435\u043d\u044f \u043d\u0435\u043f\u0440\u0430\u0432\u0438\u043b\u044c\u043d\u043e\u00a0\u2014 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u0430\u044f \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e \u043e\u043f\u0438\u0441\u0430\u043d\u0430 \u0432\u00a0\u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u0446\u0438\u0438, \u043e\u0434\u043d\u0430\u043a\u043e \u043c\u043d\u0435\u00a0\u0431\u044b\u043b\u043e \u043f\u043e\u0434\u0447\u0430\u0441 \u043d\u0435\u043f\u043e\u043d\u044f\u0442\u043d\u043e, \u043f\u043e\u0447\u0435\u043c\u0443 \u043d\u0443\u0436\u043d\u044b \u0442\u0435 \u0438\u043b\u0438\u00a0\u0438\u043d\u044b\u0435 \u0448\u0430\u0433\u0438. \u0421\u0435\u0433\u043e\u0434\u043d\u044f \u044f\u00a0\u0431\u044b \u0445\u043e\u0442\u0435\u043b \u043f\u043e\u0434\u0435\u043b\u0438\u0442\u044c\u0441\u044f \u043f\u0430\u0440\u043e\u0439\u2011\u0442\u0440\u043e\u0439\u043a\u043e\u0439 \u0441\u0432\u043e\u0438\u0445 \u043d\u0430\u0445\u043e\u0434\u043e\u043a \u043f\u043e\u00a0\u044d\u0442\u043e\u0439 \u0442\u0435\u043c\u0435.<\/p>\n
    \u0422\u043e\u043f\u043e\u043b\u043e\u0433\u0438\u044f \u0432\u0435\u0441\u044c\u043c\u0430 \u043f\u0440\u043e\u0441\u0442\u0430:<\/p>\n
    <\/figure>\n
    Host\u00a0\u2014 \u044d\u0442\u043e L3\u00a0\u043a\u043e\u043c\u043c\u0443\u0442\u0430\u0442\u043e\u0440, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u0442 \u0440\u043e\u043b\u044c provider (VRF Provider) \u0438 consumer (VRF Consumer). \u0412\u00a0\u043f\u043b\u0430\u043d\u0435 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0446\u0438\u0438 ACI \u0432\u044b\u0441\u0442\u0443\u043f\u0430\u0435\u0442 \u0448\u043b\u044e\u0437\u043e\u043c \u043f\u043e\u00a0\u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e:<\/p>\n
    Host# show run vrf Provider interface Ethernet1\/1.100   vrf member Provider vrf context Provider   ip route 0.0.0.0\/0 192.168.1.254   address-family ipv4 unicast ip route 0.0.0.0\/0 192.168.1.254 vrf Provider  Host# show ip interface brief vrf Provider IP Interface Status for VRF \" Provider \"(47) Interface            IP Address      Interface Status Eth1\/1.100           192.168.1.1     protocol-up\/link-up\/admin-up         Host# show run vrf Consumer interface Ethernet1\/2.100   vrf member Consumer vrf context Consumer   ip route 0.0.0.0\/0 192.168.2.254   address-family ipv4 unicast ip route 0.0.0.0\/0 192.168.2.254 vrf Consumer  Host# show ip interface brief vrf Consumer IP Interface Status for VRF \" Consumer \"(48) Interface            IP Address      Interface Status Eth1\/2.100           192.168.2.1     protocol-up\/link-up\/admin-up<\/code><\/pre>\n
    \u0427\u0442\u043e\u00a0\u043a\u0430\u0441\u0430\u0435\u0442\u0441\u044f ACI, \u043d\u0430\u043c \u043d\u0443\u0436\u043d\u044b \u0442\u043e\u043b\u044c\u043a\u043e \u043f\u0430\u0440\u0430 EPG, BD \u0438 VRF \u0432\u00a0\u0440\u0430\u043c\u043a\u0430\u0445 \u043e\u0434\u043d\u043e\u0433\u043e tenant, \u0430\u00a0\u0442\u0430\u043a\u0436\u0435 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430 Access Policies.<\/p>\n
     <\/em>\u041c\u043e\u0434\u0443\u043b\u044c Tenant:<\/p>\n
    resource \"aci_tenant\" \"TestTenant\" {     name                = \"TestTenant\" } resource \"aci_vrf\" \"TestVrf1\" {     tenant_dn           = aci_tenant.TestTenant.id     name                = \"TestVrf1\" } resource \"aci_vrf\" \"TestVrf2\" {     tenant_dn           = aci_tenant.TestTenant.id     name                = \"TestVrf2\" } resource \"aci_bridge_domain\" \"TestBD1\" {     tenant_dn           = aci_tenant.TestTenant.id     name                = \"TestBD1\"     relation_fv_rs_ctx  = aci_vrf.TestVrf1.id } resource \"aci_subnet\" \"Subnet1\" {     parent_dn        = aci_application_epg.Provider.id     ip               = \"192.168.1.254\/24\"     scope            = [\"private\", \"shared\"] } resource \"aci_bridge_domain\" \"TestBD2\" {     tenant_dn           = aci_tenant.TestTenant.id     name                = \"TestBD2\"     relation_fv_rs_ctx  = aci_vrf.TestVrf2.id } resource \"aci_subnet\" \"Subnet2\" {     parent_dn        = aci_bridge_domain.TestBD2.id     ip               = \"192.168.2.254\/24\"     scope            = [\"private\", \"shared\"] } resource \"aci_application_profile\" \"TestAP\" {     tenant_dn           = aci_tenant.TestTenant.id     name                = \"TestAP\" } resource \"aci_application_epg\" \"Provider\" {     application_profile_dn  = aci_application_profile.TestAP.id     name                    = \"Provider\"     relation_fv_rs_bd       = aci_bridge_domain.TestBD1.id } resource \"aci_application_epg\" \"Consumer\" {     application_profile_dn  = aci_application_profile.TestAP.id     name                    = \"Consumer\"     relation_fv_rs_bd       = aci_bridge_domain.TestBD2.id } resource \"aci_epg_to_domain\" \"ProviderDomain\" {     application_epg_dn  = aci_application_epg.Provider.id     tdn                 = aci_physical_domain.PhysicalDomain.id } resource \"aci_epg_to_domain\" \"ConsumerDomain\" {     application_epg_dn  = aci_application_epg.Consumer.id     tdn                 = aci_physical_domain.PhysicalDomain.id }<\/code><\/pre>\n
    \u041c\u043e\u0434\u0443\u043b\u044c Access Policies:<\/p>\n
    resource \"aci_vlan_pool\" \"TestPool\" {   name  = \"TestPool\"   alloc_mode  = \"static\" } resource \"aci_ranges\" \"range_1\" {   vlan_pool_dn  = aci_vlan_pool.TestPool.id   from          = \"vlan-1\"   to            = \"vlan-1000\"   alloc_mode    = \"static\" } resource \"aci_physical_domain\" \"PhysicalDomain\" {   name                      = \"PhysicalDomain\"   relation_infra_rs_vlan_ns = aci_vlan_pool.TestPool.id } resource \"aci_attachable_access_entity_profile\" \"TestAAEP\" {     name                    = \"TestAAEP\" } resource \"aci_aaep_to_domain\" \"PhysicalDomain-to-TestAAEP\" {   attachable_access_entity_profile_dn = aci_attachable_access_entity_profile.TestAAEP.id   domain_dn                           = aci_physical_domain.PhysicalDomain.id } resource \"aci_leaf_interface_profile\" \"TestInterfaceProfile\" {     name        = \"TestInterfaceProfile\" } resource \"aci_access_port_block\" \"TestAccessBlockSelector\" {   access_port_selector_dn = aci_access_port_selector.TestAccessPortSelector.id   name                    = \"TestAccessBlockSelector\"   from_card               = \"1\"   from_port               = \"2\"   to_card                 = \"1\"   to_port                 = \u201c2\" } resource \"aci_access_port_selector\" \"TestAccessPortSelector\" {     leaf_interface_profile_dn       = aci_leaf_interface_profile.TestInterfaceProfile.id     name                            = \"TestAccessPortSelector\"     access_port_selector_type       = \"range\"     relation_infra_rs_acc_base_grp  = aci_leaf_access_port_policy_group.TestAccessInterfacePolicy.id } resource \"aci_leaf_access_port_policy_group\" \"TestAccessInterfacePolicy\" {     name                        = \"TestAccessInterfaceProfile\"     relation_infra_rs_att_ent_p = aci_attachable_access_entity_profile.TestAAEP.id } resource \"aci_leaf_profile\" \"TestSwitchProfile\" {   name        = \"TestSwitchProfile\"   leaf_selector {     name                    = \"LeafSelector\"     switch_association_type = \"range\"     node_block {       name  = \"Block1\"       from_ = \"101\"       to_   = \"102\"     }   }   relation_infra_rs_acc_port_p = [aci_leaf_interface_profile.TestInterfaceProfile.id] }<\/code><\/pre>\n
    \u041f\u043e\u0434\u0441\u0435\u0442\u044c, \u0432\u00a0\u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u043d\u0430\u0445\u043e\u0434\u0438\u0442\u0441\u044f provider, \u0434\u043e\u043b\u0436\u043d\u0430\u00a0\u0431\u044b\u0442\u044c \u0437\u0430\u0434\u0430\u043d\u0430 \u0432\u00a0EPG \u0432\u043c\u0435\u0441\u0442\u043e BD. \u041f\u043e\u0441\u043a\u043e\u043b\u044c\u043a\u0443 \u043c\u044b \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c \u0440\u0430\u0437\u043d\u044b\u0435 EPG, \u043d\u0443\u0436\u043d\u043e \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0438\u0442\u044c \u043a\u043e\u043d\u0442\u0440\u0430\u043a\u0442, \u0447\u0442\u043e\u0431\u044b \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c \u043c\u0435\u0436\u0434\u0443 \u043d\u0438\u043c\u0438 \u0441\u0432\u044f\u0437\u043d\u043e\u0441\u0442\u044c.<\/p>\n
    \u041c\u043e\u0434\u0443\u043b\u044c Contract:<\/p>\n
    resource \"aci_application_epg\" \"Provider\" {     application_profile_dn  = aci_application_profile.TestAP.id     name                    = \" Provider\"     relation_fv_rs_bd       = aci_bridge_domain.TestBD1.id     relation_fv_rs_prov     = [aci_contract.TestContract.id] } resource \"aci_application_epg\" \"Consumer\" {     application_profile_dn  = aci_application_profile.TestAP.id     name                    = \" Consumer\"     relation_fv_rs_bd       = aci_bridge_domain.TestBD2.id     relation_fv_rs_cons     = [aci_contract.TestContract.id] } resource \"aci_contract\" \"TestContract\" {     tenant_dn   =  aci_tenant.TestTenant.id     name        = \"TestContract\"     scope       = \"tenant\" } resource \"aci_contract_subject\" \"TestSubject\" {     contract_dn   = aci_contract.TestContract.id     name          = \"TestSubject\" } resource \"aci_contract_subject_filter\" \"PermitIPSubj\" {   contract_subject_dn  = aci_contract_subject.TestSubject.id   filter_dn  = aci_filter.PermitIPFilter.id } resource \"aci_filter\" \"PermitIPFilter\" {     tenant_dn   = aci_tenant.TestTenant.id     name        = \"PermitIPFilter\" } resource \"aci_filter_entry\" \"PermitIPFilterEntry\" {     filter_dn     = aci_filter.PermitIPFilter.id     name          = \"permit_ip \"     ether_t       = \"ip\" }<\/code><\/pre>\n
    \u041a\u0430\u043a \u0442\u043e\u043b\u044c\u043a\u043e \u043c\u044b \u043f\u0440\u0438\u043c\u0435\u043d\u0438\u043c \u044d\u0442\u043e\u0442 \u043a\u043e\u043d\u0442\u0440\u0430\u043a\u0442, Consumer \u0441\u043c\u043e\u0436\u0435\u0442 \u043e\u0431\u0449\u0430\u0442\u044c\u0441\u044f \u0441 Provider:<\/p>\n
    Host# traceroute 192.168.1.1 vrf Consumer traceroute to 192.168.1.1 (192.168.1.1), 30 hops max, 40 byte packets  1  192.168.2.254 (192.168.2.254)  1.946 ms  0.758 ms  0.691 ms  2  192.168.1.254 (192.168.1.254)  2.231 ms  0.708 ms  0.705 ms  3  192.168.1.1 (192.168.1.1)  0.708 ms  0.577 ms  0.578 ms<\/code><\/pre>\n
    \u041d\u0430\u00a0\u0434\u0430\u043d\u043d\u043e\u043c \u044d\u0442\u0430\u043f\u0435 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0438 \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u044b, \u043f\u043e\u044d\u0442\u043e\u043c\u0443 \u043c\u044b \u043c\u043e\u0436\u0435\u043c \u043f\u0435\u0440\u0435\u0439\u0442\u0438 \u043a\u00a0\u043d\u0430\u0431\u043b\u044e\u0434\u0435\u043d\u0438\u044f\u043c. \u041f\u043e\u0447\u0435\u043c\u0443 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u044f\u0442\u044c \u043f\u043e\u0434\u0441\u0435\u0442\u044c provider \u0432\u00a0\u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430\u0445 EPG, \u0430\u00a0\u043d\u0435\u00a0BD? \u0412\u00a0\u043a\u043b\u0430\u0441\u0441\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0435 L3VPN \u043d\u0435\u0442 \u043f\u043e\u0434\u043e\u0431\u043d\u043e\u0433\u043e \u0442\u0440\u0435\u0431\u043e\u0432\u0430\u043d\u0438\u044f, \u043f\u043e\u044d\u0442\u043e\u043c\u0443, \u0434\u043e\u043b\u0436\u043d\u043e\u00a0\u0431\u044b\u0442\u044c, \u043e\u043d\u043e \u043e\u0442\u043d\u043e\u0441\u0438\u0442\u0441\u044f \u0441\u0443\u0433\u0443\u0431\u043e \u043a\u00a0ACI. \u0420\u0430\u0441\u0441\u043c\u043e\u0442\u0440\u0438\u043c, \u043a\u0430\u043a\u00a0\u0438\u043c\u0435\u043d\u043d\u043e \u043f\u0440\u043e\u0438\u0441\u0445\u043e\u0434\u0438\u0442 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0446\u0438\u044f \u0442\u0440\u0430\u0444\u0438\u043a\u0430:<\/p>\n
    leaf-102# show ip route vrf TestTenant:TestVrf2 <output omitted> 192.168.1.0\/24, ubest\/mbest: 1\/0, attached, direct, pervasive     *via 10.0.88.66%overlay-1, [1\/0], 00:07:29, static, tag 4294967294 192.168.2.0\/24, ubest\/mbest: 1\/0, attached, direct, pervasive, dcs     *via 10.0.88.66%overlay-1, [1\/0], 00:11:01, static, tag 4294967294 192.168.2.254\/32, ubest\/mbest: 1\/0, attached, pervasive     *via 192.168.2.254, Vlan11, [0\/0], 00:11:01, local, local leaf-102# leaf-102# show ip route vrf TestTenant:TestVrf2 192.168.1.0\/24 det <output omitted> 192.168.1.0\/24, ubest\/mbest: 1\/0, attached, direct, pervasive     *via 10.0.88.66%overlay-1, [1\/0], 00:07:38, static, tag 4294967294          recursive next hop: 10.0.88.66\/32%overlay-1          vrf crossing information:  VNID:0x238000 ClassId:0x2ab4 Flush#:0x1<\/code><\/pre>\n
    \u041e\u0431\u0440\u0430\u0442\u0438\u0442\u0435 \u0432\u043d\u0438\u043c\u0430\u043d\u0438\u0435, \u0447\u0442\u043e \u043f\u043e\u0434\u0441\u0435\u0442\u044c Provider \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u0430 \u0447\u0435\u0440\u0435\u0437 \u0441\u0442\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u043c\u0430\u0440\u0448\u0440\u0443\u0442 \u0441 \u043f\u0430\u0440\u043e\u0439 \u043d\u0435\u043e\u0431\u044b\u0447\u043d\u044b\u0445 \u0430\u0442\u0440\u0438\u0431\u0443\u0442\u043e\u0432. \u0412\u043e-\u043f\u0435\u0440\u0432\u044b\u0445, next-hop \u2013 \u044d\u0442\u043e \u0430\u0434\u0440\u0435\u0441 anycast IP for IPv4 hardware proxy:<\/p>\n
    spine-201# show ip interface lo9 IP Interface Status for VRF \"overlay-1\" lo9, Interface status: protocol-up\/link-up\/admin-up, iod: 81, mode: anycast-v4   IP address: 10.0.88.66, IP subnet: 10.0.88.66\/32     IP broadcast address: 255.255.255.255   IP primary address route-preference: 0, tag: 0<\/code><\/pre>\n
    \u0427\u0442\u043e\u0431\u044b proxy \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0430\u043b \u043f\u0430\u043a\u0435\u0442 \u0432 \u043f\u0440\u0430\u0432\u0438\u043b\u044c\u043d\u043e\u043c VRF, consumer leaf \u043f\u0435\u0440\u0435\u043f\u0438\u0441\u044b\u0432\u0430\u0435\u0442 VNID \u0442\u0430\u043a, \u0447\u0442\u043e\u0431\u044b \u0442\u043e\u0442 \u043f\u043e\u043f\u0430\u043b \u0432 provider VRF (0x238000 = 2326528):<\/p>\n
    <\/figure>\n
    \u041e\u0444\u0444\u0442\u043e\u043f: \u0434\u043b\u044f\u00a0NX\u2011OS VXLAN \u0445\u0430\u0440\u0430\u043a\u0442\u0435\u0440\u043d\u043e \u0440\u043e\u0432\u043d\u043e \u043f\u0440\u043e\u0442\u0438\u0432\u043e\u043f\u043e\u043b\u043e\u0436\u043d\u043e\u0435 \u043f\u043e\u0432\u0435\u0434\u0435\u043d\u0438\u0435, \u0435\u0441\u043b\u0438 \u043d\u0435\u00a0\u0431\u0440\u0430\u0442\u044c \u0432\u00a0\u0440\u0430\u0441\u0447\u0451\u0442 downstream VNI.<\/p>\n
    Inter\u2011VRF \u043a\u043e\u043d\u0442\u0440\u0430\u043a\u0442 \u0412\u0421\u0415\u0413\u0414\u0410 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u0442 \u0438\u043c\u0435\u043d\u043d\u043e consumer leaf. \u041e\u0434\u043d\u0430\u043a\u043e \u0442\u0430\u043a\u043e\u0439 \u043f\u043e\u0434\u0445\u043e\u0434 \u0434\u043e\u043b\u0436\u0435\u043d\u00a0\u0431\u044b \u0441\u043b\u043e\u043c\u0430\u0442\u044c conversation\u2011based forwarding: consumer \u043d\u0430\u0447\u0438\u043d\u0430\u0435\u0442 \u0442\u0440\u0430\u043d\u0437\u0430\u043a\u0446\u0438\u044e, \u043f\u043e\u044d\u0442\u043e\u043c\u0443 \u043e\u043d \u043d\u0435\u00a0\u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0435\u0434\u0432\u0430\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u0430\u043a\u0435\u0442 \u043e\u0442\u00a0provider, \u0447\u0442\u043e\u0431\u044b \u0437\u0430\u043f\u043e\u043c\u043d\u0438\u0442\u044c \u0435\u0433\u043e pcTag. \u0420\u0435\u0448\u0435\u043d\u0438\u0435 \u043e\u0447\u0435\u0432\u0438\u0434\u043d\u043e: consumer \u0434\u043e\u043b\u0436\u0435\u043d \u0437\u0430\u0440\u0430\u043d\u0435\u0435 \u0437\u043d\u0430\u0442\u044c pcTag,<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[],"tags":[],"class_list":["post-346438","post","type-post","status-publish","format-standard","hentry"],"_links":{"self":[{"href":"https:\/\/savepearlharbor.com\/index.php?rest_route=\/wp\/v2\/posts\/346438","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/savepearlharbor.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/savepearlharbor.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/savepearlharbor.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/savepearlharbor.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=346438"}],"version-history":[{"count":0,"href":"https:\/\/savepearlharbor.com\/index.php?rest_route=\/wp\/v2\/posts\/346438\/revisions"}],"wp:attachment":[{"href":"https:\/\/savepearlharbor.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=346438"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/savepearlharbor.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=346438"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/savepearlharbor.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=346438"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}