{"id":347055,"date":"2023-03-21T15:01:57","date_gmt":"2023-03-21T15:01:57","guid":{"rendered":"http:\/\/savepearlharbor.com\/?p=347055"},"modified":"-0001-11-30T00:00:00","modified_gmt":"-0001-11-29T21:00:00","slug":"","status":"publish","type":"post","link":"https:\/\/savepearlharbor.com\/?p=347055","title":{"rendered":"Cisco ACI Preferred group, \u043d\u0435\u043c\u043d\u043e\u0436\u043a\u043e inter-VRF leaking \u0438 L3Out<\/span>"},"content":{"rendered":"
<\/div>\n
\n
\n
\n
\n

\u0412 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0439 \u0441\u0442\u0430\u0442\u044c\u0435<\/a> \u043c\u044b \u043e\u0431\u0441\u0443\u0434\u0438\u043b\u0438 \u0434\u0435\u0442\u0430\u043b\u0438 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 inter-VRF leaking \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u0434\u0432\u0443\u0445 \u0441\u0430\u043c\u044b\u0445 \u043e\u0431\u044b\u0447\u043d\u044b\u0445\u00a0 EPG. \u0411\u0435\u0437\u0443\u0441\u043b\u043e\u0432\u043d\u043e, L3Out \u0442\u043e\u0436\u0435 \u043c\u043e\u0436\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u043f\u043e\u0445\u043e\u0436\u0438\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0434\u043b\u044f \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043e\u0431\u0449\u0435\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u0432 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442. \u0412\u043f\u0440\u043e\u0447\u0435\u043c, \u0442\u0443\u0442 \u043d\u0435 \u043e\u0431\u043e\u0448\u043b\u043e\u0441\u044c \u0431\u0435\u0437 \u043b\u043e\u0436\u043a\u0438 \u0434\u0451\u0433\u0442\u044f: \u0435\u0441\u0442\u044c \u043e\u0434\u0438\u043d \u0440\u0430\u0437\u0434\u0435\u043b<\/a> \u0432 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0435, \u043e\u043f\u0438\u0441\u044b\u0432\u0430\u044e\u0449\u0435\u043c \u043a\u043e\u043d\u0442\u0440\u0430\u043a\u0442\u044b ACI, \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u043c\u0435\u043b\u043a\u0438\u043c \u0448\u0440\u0438\u0444\u0442\u043e\u043c<\/s> \u043d\u0430\u043f\u0438\u0441\u0430\u043d\u043e \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0435\u0435:<\/p>\n

\n

\u201cDue to CSCvm63145, an EPG in a preferred group can consume an inter-VRF contract but cannot be a provider for an inter-VRF contract with an L3Out EPG as the consumer.\u201d<\/em><\/p>\n

\u0412\u043e\u043b\u044c\u043d\u044b\u0439 \u043f\u0435\u0440\u0435\u0432\u043e\u0434:<\/em><\/p>\n

«\u0412\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u0435 CSCvm63145 EPG, \u0431\u0443\u0434\u0443\u0447\u0438 \u0447\u0430\u0441\u0442\u044c\u044e preferred group, \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0442\u0440\u0435\u0431\u043b\u044f\u0442\u044c inter-VRF \u043a\u043e\u043d\u0442\u0440\u0430\u043a\u0442, \u043e\u0434\u043d\u0430\u043a\u043e \u043d\u0435 \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0442\u044c \u0442\u0430\u043a\u043e\u0439 \u043a\u043e\u043d\u0442\u0440\u0430\u043a\u0442, \u0435\u0441\u043b\u0438 \u043f\u043e\u0442\u0440\u0435\u0431\u0438\u0442\u0435\u043b\u044c \u2013 L3Out.»<\/em><\/p>\n<\/blockquote>\n

\u0418 \u043d\u0438\u043a\u0430\u043a\u043e\u0433\u043e \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0433\u043e \u043a\u043e\u043c\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u044f, \u043f\u043e\u0447\u0435\u043c\u0443 \u0434\u0435\u043b\u0430 \u043e\u0431\u0441\u0442\u043e\u044f\u0442 \u0438\u043c\u0435\u043d\u043d\u043e \u0442\u0430\u043a. \u0415\u0441\u043b\u0438 \u043f\u043e\u0441\u043c\u043e\u0442\u0440\u0435\u0442\u044c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0431\u0430\u0433\u0430<\/a>, \u0442\u043e \u043c\u043e\u0436\u043d\u043e \u043d\u0430\u0439\u0442\u0438 \u0447\u0443\u0442\u044c \u0431\u043e\u043b\u044c\u0448\u0435 \u0434\u0435\u0442\u0430\u043b\u0435\u0439: \u0435\u0441\u043b\u0438 EPG \u2013 provider \u0434\u043b\u044f inter-VRF \u043a\u043e\u043d\u0442\u0440\u0430\u043a\u0442\u0430, \u0442\u043e \u043e\u043d \u043d\u0435 \u043c\u043e\u0436\u0435\u0442 \u043e\u0431\u0449\u0430\u0442\u044c\u0441\u044f \u0432\u043d\u0443\u0442\u0440\u0438 Preferred Group \u0438\u0437-\u0437\u0430 \u043d\u0435\u043a\u043e\u0435\u0433\u043e \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0438\u0432\u0430\u044e\u0449\u0435\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430. \u041e\u0434\u043d\u0430\u043a\u043e \u0432\u0435\u0434\u044c \u043f\u043e\u0434\u043e\u0431\u043d\u044b\u0435 \u0444\u0438\u043b\u044c\u0442\u0440\u044b \u0432\u043e\u0437\u043d\u0438\u043a\u0430\u044e\u0442 \u043f\u0440\u0438 \u044f\u0432\u043d\u043e\u043c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0438 \u043a\u043e\u043d\u0442\u0440\u0430\u043a\u0442\u0430, \u043d\u0435 \u0442\u0430\u043a \u043b\u0438? \u0421\u043f\u0440\u043e\u0432\u043e\u0446\u0438\u0440\u0443\u0435\u043c \u0431\u0430\u0433 \u0438 \u043f\u043e\u0441\u043c\u043e\u0442\u0440\u0438\u043c, \u0447\u0442\u043e \u0436\u0435 \u043f\u0440\u043e\u0438\u0441\u0445\u043e\u0434\u0438\u0442 \u043d\u0430 \u0441\u0430\u043c\u043e\u043c \u0434\u0435\u043b\u0435.<\/p>\n

<\/figure>\n

Host \u043f\u0440\u0438\u0442\u0432\u043e\u0440\u044f\u0435\u0442\u0441\u044f \u0441\u0440\u0430\u0437\u0443 \u0442\u0440\u0435\u043c\u044f \u0441\u0443\u0449\u043d\u043e\u0441\u0442\u044f\u043c\u0438: \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u0435\u0440\u0432\u0438\u0441 (Provider), \u043f\u043e\u0442\u0440\u0435\u0431\u043b\u044f\u0435\u0442 \u0441\u0435\u0440\u0432\u0438\u0441 (L3Out) \u0438 \u0442\u0438\u0445\u043e-\u043c\u0438\u0440\u043d\u043e \u043a\u043e\u0432\u044b\u0440\u044f\u0435\u0442\u0441\u044f \u0432 \u043d\u043e\u0441\u0443<\/s> \u0432 Preferred Group \u0432\u043d\u0443\u0442\u0440\u0438 TestVrf1 (TestEPG). \u041e\u0431\u043c\u0435\u043d \u043f\u0440\u0435\u0444\u0438\u043a\u0441\u0430\u043c\u0438 \u043c\u0435\u0436\u0434\u0443 L3Out \u0438 Host \u043f\u0440\u043e\u0438\u0441\u0445\u043e\u0434\u0438\u0442 \u043f\u043e OSPF. \u041f\u043e \u0437\u0430\u0434\u0443\u043c\u043a\u0435 2.2.2.2\/32 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0441\u0435\u0440\u0432\u0438\u0441, \u0440\u0430\u0441\u043f\u043e\u043b\u043e\u0436\u0435\u043d\u043d\u044b\u0439 \u043f\u043e \u0430\u0434\u0440\u0435\u0441\u0443 192.168.1.1. Provider \u0438 TestEPG \u043d\u0430\u0445\u043e\u0434\u044f\u0442\u0441\u044f \u0432 \u043e\u0434\u043d\u043e\u0439 \u043f\u043e\u0434\u0441\u0435\u0442\u0438 \u0438, \u043a\u0430\u043a \u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u0435, \u0432 \u043e\u0434\u043d\u043e\u043c BD.<\/p>\n

\u041e\u043f\u0440\u0435\u0434\u0435\u043b\u0438\u043c Access Policy, \u0447\u0442\u043e\u0431\u044b \u0440\u0430\u0437\u0440\u0435\u0448\u0438\u0442\u044c \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u043d\u0430 \u0444\u0438\u0437\u0438\u0447\u0435\u0441\u043a\u043e\u043c \u0443\u0440\u043e\u0432\u043d\u0435 \u0444\u0430\u0431\u0440\u0438\u043a\u0438:<\/p>\n

resource \"aci_vlan_pool\" \"TestPool\" {   name  = \"TestPool\"   alloc_mode  = \"static\" } resource \"aci_ranges\" \"TestRange\" {   vlan_pool_dn  = aci_vlan_pool.TestPool.id   from = \"vlan-1\"   to = \"vlan-1000\"   alloc_mode = \"static\" } resource \"aci_physical_domain\" \"PhysicalDomain\" {   name = \"PhysicalDomain\"   relation_infra_rs_vlan_ns = aci_vlan_pool.TestPool.id } resource \"aci_l3_domain_profile\" \"L3Domain\" {   name = \"L3Domain\"   relation_infra_rs_vlan_ns = aci_vlan_pool.TestPool.id } resource \"aci_attachable_access_entity_profile\" \"TestAAEP\" {     name = \"TestAAEP\" } resource \"aci_aaep_to_domain\" \"PhysicalDomain-to-TestAAEP\" {   attachable_access_entity_profile_dn = aci_attachable_access_entity_profile.TestAAEP.id   domain_dn = aci_physical_domain.PhysicalDomain.id } resource \"aci_aaep_to_domain\" \"L3Domain-to-TestAAEP\" {   attachable_access_entity_profile_dn = aci_attachable_access_entity_profile.TestAAEP.id   domain_dn = aci_l3_domain_profile.L3Domain.id } resource \"aci_leaf_interface_profile\" \"TestInterfaceProfile\" {     name = \"TestInterfaceProfile\" } resource \"aci_access_port_block\" \"TestAccessBlockSelector\" {   access_port_selector_dn = aci_access_port_selector.TestAccessPortSelector.id   name = \"TestAccessBlockSelector\"   from_card = \"1\"   from_port = \"2\"   to_card = \"1\"   to_port = \"4\" } resource \"aci_access_port_selector\" \"TestAccessPortSelector\" {     leaf_interface_profile_dn = aci_leaf_interface_profile.TestInterfaceProfile.id     name = \"TestAccessPortSelector\"     access_port_selector_type = \"range\"     relation_infra_rs_acc_base_grp = aci_leaf_access_port_policy_group.TestAccessInterfacePolicy.id } resource \"aci_leaf_access_port_policy_group\" \"TestAccessInterfacePolicy\" {     name = \"TestAccessInterfaceProfile\"     relation_infra_rs_att_ent_p = aci_attachable_access_entity_profile.TestAAEP.id } resource \"aci_leaf_profile\" \"TestSwitchProfile\" {   name = \"TestSwitchProfile\"   leaf_selector {     name = \"LeafSelector\"     switch_association_type = \"range\"     node_block {       name  = \"Block1\"       from_ = \"101\"       to_   = \"104\"     }   }   relation_infra_rs_acc_port_p = [aci_leaf_interface_profile.TestInterfaceProfile.id] } <\/code><\/pre>\n
\u0417\u0430\u0442\u0435\u043c \u043c\u043e\u0436\u043d\u043e \u043d\u0430\u0441\u0442\u0440\u043e\u0438\u0442\u044c tenant \u0441 \u043d\u0443\u0436\u043d\u044b\u043c\u0438 EPG \u0438 \u043a\u043e\u043d\u0441\u0442\u0440\u0443\u043a\u0446\u0438\u044f\u043c\u0438 \u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u0443\u0440\u043e\u0432\u043d\u044f:<\/p>\n
resource \"aci_tenant\" \"TestTenant\" {     name = \"TestTenant\" } resource \"aci_vrf\" \"TestVrf1\" {     tenant_dn = aci_tenant.TestTenant.id     name = \"TestVrf1\" } resource \"aci_vrf\" \"TestVrf2\" {     tenant_dn = aci_tenant.TestTenant.id     name = \"TestVrf2\" } resource \"aci_bridge_domain\" \"TestBD1\" {     tenant_dn = aci_tenant.TestTenant.id     name  = \"TestBD1\"     relation_fv_rs_ctx = aci_vrf.TestVrf1.id } resource \"aci_subnet\" \"ProviderSubnet\" {     parent_dn = aci_application_epg.Provider.id     ip = \"192.168.1.1\/32\"     scope = [\"public\", \"shared\"]     ctrl = [\"no-default-gateway\"] } resource \"aci_subnet\" \"TestEPGSubnet\" {     parent_dn = aci_bridge_domain.TestBD1.id     ip = \"192.168.1.254\/24\"     scope = [\"public\", \"shared\"] } resource \"aci_application_profile\" \"TestAP\" {     tenant_dn = aci_tenant.TestTenant.id     name = \"TestAP\" } resource \"aci_application_epg\" \"Provider\" {     application_profile_dn = aci_application_profile.TestAP.id     name = \"Provider\"     relation_fv_rs_bd = aci_bridge_domain.TestBD1.id     pref_gr_memb = \"include\" } resource \"aci_application_epg\" \"TestEPG\" {     application_profile_dn = aci_application_profile.TestAP.id     name = \"TestEPG\"     relation_fv_rs_bd = aci_bridge_domain.TestBD1.id     pref_gr_memb = \"include\" } resource \"aci_epg_to_domain\" \"ProviderDomain\" {     application_epg_dn = aci_application_epg.Provider.id     tdn = aci_physical_domain.PhysicalDomain.id } resource \"aci_epg_to_domain\" \"TestEPGDomain\" {     application_epg_dn = aci_application_epg.TestEPG.id     tdn = aci_physical_domain.PhysicalDomain.id } resource \"aci_bulk_epg_to_static_path\" \"ProviderStaticPath\" {   application_epg_dn = aci_application_epg.Provider.id   static_path {     interface_dn = \"topology\/pod-1\/paths-101\/pathep-[eth1\/2]\"     encap = \"vlan-100\"   } } resource \"aci_bulk_epg_to_static_path\" \"TestEPGStaticPath\" {   application_epg_dn = aci_application_epg.TestEPG.id   static_path {     interface_dn = \"topology\/pod-1\/paths-101\/pathep-[eth1\/2]\"     encap = \"vlan-101\"   } }<\/code><\/pre>\n
\u0417\u0430\u0434\u0430\u0434\u0438\u043c \u043a\u043e\u043d\u0442\u0440\u0430\u043a\u0442, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0440\u0430\u0437\u0440\u0435\u0448\u0430\u0435\u0442 \u043b\u044e\u0431\u043e\u0439 \u0442\u0438\u043f \u0442\u0440\u0430\u0444\u0438\u043a\u0430, \u0438 \u043d\u0430\u0437\u043d\u0430\u0447\u0438\u043c \u0435\u0433\u043e Provider:<\/p>\n
resource \"aci_contract\" \"TestContract\" {     tenant_dn = aci_tenant.TestTenant.id     name = \"TestContract\"     scope = \"tenant\" } resource \"aci_contract_subject\" \"TestSubject\" {     contract_dn = aci_contract.TestContract.id     name = \"TestSubject\" } resource \"aci_contract_subject_filter\" \"PermitIPSubj\" {   contract_subject_dn = aci_contract_subject.TestSubject.id   filter_dn = aci_filter.PermitIPFilter.id } resource \"aci_filter\" \"PermitIPFilter\" {     tenant_dn = aci_tenant.TestTenant.id     name = \"PermitIPFilter\" } resource \"aci_filter_entry\" \"PermitIPFilterEntry\" {     filter_dn = aci_filter.PermitIPFilter.id     name = \"demo_entry\"     d_to_port = \"unspecified\"     ether_t = \"ip\" } resource \"aci_application_epg\" \"Provider\" {     application_profile_dn = aci_application_profile.TestAP.id     name = \"Provider\"     relation_fv_rs_bd = aci_bridge_domain.TestBD1.id     relation_fv_rs_prov = [aci_contract.TestContract.id]     pref_gr_memb = \"include\" }<\/code><\/pre>\n
\u0422\u0435\u043f\u0435\u0440\u044c \u043c\u044b \u043c\u043e\u0436\u0435\u043c \u043d\u0430\u0441\u0442\u0440\u043e\u0438\u0442\u044c Host \u0438 \u043f\u0440\u043e\u0432\u0435\u0440\u0438\u0442\u044c \u0441\u0432\u044f\u0437\u043d\u043e\u0441\u0442\u044c \u0441 \u0444\u0430\u0431\u0440\u0438\u043a\u043e\u0439. \u042d\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442 \u043d\u0430\u043c \u0443\u0431\u0435\u0434\u0438\u0442\u044c\u0441\u044f \u0432 \u0442\u043e\u043c, \u0447\u0442\u043e \u043f\u0440\u0435\u0434\u044b\u0434\u0443\u0449\u0438\u0435 \u0448\u0430\u0433\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u044b \u0443\u0441\u043f\u0435\u0448\u043d\u043e, \u0430 \u0432\u0441\u0435 \u043e\u0431\u044f\u0437\u0430\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u044b \u0443\u0436\u0435 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u044b.<\/p>\n
Host# show run vrf Provider interface Ethernet1\/1.100   vrf member Provider vrf context Provider   ip route 0.0.0.0\/0 192.168.1.254   address-family ipv4 unicast Host# Host# show vrf Provider interface  Interface                 VRF-Name                        VRF-ID  Site-of-Origin Ethernet1\/1.100           Provider                             3  -- Host# Host# show run interface e1\/1.100 interface Ethernet1\/1.100   encapsulation dot1q 100   mac-address 0000.0000.0001   vrf member Provider   ip address 192.168.1.1\/24 Host# Host# show run vrf TestEPG interface Ethernet1\/1.101   vrf member TestEPG vrf context TestEPG   ip route 0.0.0.0\/0 192.168.1.254   address-family ipv4 unicast Host# Host# show vrf TestEPG interface Interface                 VRF-Name                        VRF-ID  Site-of-Origin Ethernet1\/1.101           TestEPG                              5  -- Host# Host# show run interface e1\/1.101 interface Ethernet1\/1.101   encapsulation dot1q 101   mac-address 0000.0000.0002   vrf member TestEPG   ip address 192.168.1.2\/24<\/code><\/pre>\n
Subinterface \u043d\u0430\u0441\u043b\u0435\u0434\u0443\u044e\u0442 MAC \u0430\u0434\u0440\u0435\u0441 \u0440\u043e\u0434\u0438\u0442\u0435\u043b\u044c\u0441\u043a\u043e\u0433\u043e \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u0430 \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e. \u041f\u043e\u0441\u043a\u043e\u043b\u044c\u043a\u0443 \u0444\u0438\u0437\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441 \u043e\u0434\u0438\u043d \u0438 \u0442\u043e\u0442 \u0436\u0435, ACI \u0431\u0443\u0434\u0435\u0442 \u043d\u0435\u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u043e \u0441\u0447\u0438\u0442\u0430\u0442\u044c, \u0447\u0442\u043e \u043e\u0431\u0430 IP \u043f\u0440\u0438\u043d\u0430\u0434\u043b\u0435\u0436\u0430\u0442 \u043e\u0434\u043d\u043e\u043c\u0443 MAC \u0438, \u043a\u0430\u043a \u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u0435, \u043e\u0434\u043d\u043e\u043c\u0443 EPG. \u041f\u0440\u043e\u0441\u0442\u043e\u0435 \u0440\u0435\u0448\u0435\u043d\u0438\u0435 \u2013 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0440\u0430\u0437\u043d\u044b\u0435 MAC \u0430\u0434\u0440\u0435\u0441\u0430, \u043f\u043e\u044d\u0442\u043e\u043c\u0443 \u043c\u044b \u0438 \u0437\u0430\u0434\u0430\u043b\u0438 \u0438\u0445 \u0432\u0440\u0443\u0447\u043d\u0443\u044e.<\/p>\n
Host# ping 192.168.1.254 vrf Provider PING 192.168.1.254 (192.168.1.254): 56 data bytes 64 bytes from 192.168.1.254: icmp_seq=0 ttl=63 time=1.145 ms 64 bytes from 192.168.1.254: icmp_seq=1 ttl=63 time=0.898 ms 64 bytes from 192.168.1.254: icmp_seq=2 ttl=63 time=1.008 ms 64 bytes from 192.168.1.254: icmp_seq=3 ttl=63 time=0.97 ms 64 bytes from 192.168.1.254: icmp_seq=4 ttl=63 time=1.023 ms  --- 192.168.1.254 ping statistics --- 5 packets transmitted, 5 packets received, 0.00% packet loss round-trip min\/avg\/max = 0.898\/1.008\/1.145 ms Host# Host# ping 192.168.1.254 vrf TestEPG PING 192.168.1.254 (192.168.1.254): 56 data bytes 64 bytes from 192.168.1.254: icmp_seq=0 ttl=63 time=1.24 ms 64 bytes from 192.168.1.254: icmp_seq=1 ttl=63 time=0.961 ms 64 bytes from 192.168.1.254: icmp_seq=2 ttl=63 time=1.021 ms 64 bytes from 192.168.1.254: icmp_seq=3 ttl=63 time=0.744 ms 64 bytes from 192.168.1.254: icmp_seq=4 ttl=63 time=0.785 ms  --- 192.168.1.254 ping statistics --- 5 packets transmitted, 5 packets received, 0.00% packet loss round-trip min\/avg\/max = 0.744\/0.95\/1.24 ms<\/code><\/pre>\n
\u041d\u0430\u043a\u043e\u043d\u0435\u0446, \u0441\u043e\u0437\u0434\u0430\u0434\u0438\u043c L3Out \u0438 \u043d\u0430\u0437\u043d\u0430\u0447\u0438\u043c \u0435\u043c\u0443 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0451\u043d\u043d\u044b\u0439 \u0440\u0430\u043d\u0435\u0435 \u043a\u043e\u043d\u0442\u0440\u0430\u043a\u0442:<\/p>\n
resource \"aci_l3_outside\" \"L3Out\" {     tenant_dn = aci_tenant.TestTenant.id     name = \"L3Out\"     enforce_rtctrl = [\"export\", \"import\"]     relation_l3ext_rs_ectx = aci_vrf.TestVrf2.id     relation_l3ext_rs_l3_dom_att = aci_l3_domain_profile.L3Domain.id } resource \"aci_logical_node_profile\" \"L3OutNodeProfile\" {     l3_outside_dn = aci_l3_outside.L3Out.id     name = \"L3OutNodeProfile\" } resource \"aci_logical_interface_profile\" \"L3OutLogicalInterfaceProfile\" {     logical_node_profile_dn = aci_logical_node_profile.L3OutNodeProfile.id     name = \"L3OutLogicalInterfaceProfile\" } resource \"aci_logical_node_to_fabric_node\" \"NodetoFabric\" {   logical_node_profile_dn = aci_logical_node_profile.L3OutNodeProfile.id   tdn = \"topology\/pod-1\/node-103\"   rtr_id = \"1.1.1.1\" } resource \"aci_l3out_path_attachment\" \"InterfaceMapping\" {   logical_interface_profile_dn = aci_logical_interface_profile.L3OutLogicalInterfaceProfile.id   target_dn = \"topology\/pod-1\/paths-103\/pathep-[eth1\/3]\"   if_inst_t = \"l3-port\"   encap = \"unknown\"   addr = \"192.168.2.254\/24\" } resource \"aci_l3out_ospf_external_policy\" \"L3OutOSPF\" {   l3_outside_dn = aci_l3_outside.L3Out.id   area_id = \"0.0.0.0\"   area_type = \"regular\" } resource \"aci_ospf_interface_policy\" \"L3OutOSPFPolicy\" {     tenant_dn = aci_tenant.TestTenant.id     name = \"L3OutOSPFPolicy\"     ctrl = [\"mtu-ignore\"]     dead_intvl = \"40\"     hello_intvl = \"10\" } resource \"aci_l3out_ospf_interface_profile\" \"L3OutOSPFInterface\" {   logical_interface_profile_dn = aci_logical_interface_profile.L3OutLogicalInterfaceProfile.id   relation_ospf_rs_if_pol = aci_ospf_interface_policy.L3OutOSPFPolicy.id   auth_key = \"key\" } resource \"aci_external_network_instance_profile\" \"Consumer\" {     l3_outside_dn = aci_l3_outside.L3Out.id     name = \"Consumer\"     relation_fv_rs_cons = [aci_contract.TestContract.id] } resource \"aci_l3_ext_subnet\" \"ConsumerSubnet\" {   external_network_instance_profile_dn = aci_external_network_instance_profile.Consumer.id   ip = \"2.2.2.2\/32\"   scope = [\"import-rtctrl\", \"import-security\", \"shared-security\", \"shared-rtctrl\"] }<\/code><\/pre>\n
\u041f\u043e\u0434\u043d\u0438\u043c\u0435\u043c OSPF \u043d\u0430 Host, \u0447\u0442\u043e\u0431\u044b \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u044b \u043e\u0442 ACI:<\/p>\n
Host# show run vrf Consumer interface loopback0   vrf member Consumer interface Ethernet1\/2   vrf member Consumer vrf context Consumer   address-family ipv4 unicast router ospf 1   vrf Consumer Host# Host# show vrf B interface  Interface                 VRF-Name                        VRF-ID  Site-of-Origin loopback0                 Consumer                             4  -- Ethernet1\/2               Consumer                             4  -- Host# Host# show run interface lo0 interface loopback0   vrf member Consumer   ip address 2.2.2.2\/32   ip router ospf 1 area 0.0.0.0 Host# Host# show run interface e1\/2 interface Ethernet1\/2   no switchport   vrf member Consumer   ip address 192.168.2.1\/24   ip ospf mtu-ignore   ip router ospf 1 area 0.0.0.0<\/code><\/pre>\n
\u041d\u0430 \u044d\u0442\u043e\u043c \u044d\u0442\u0430\u043f\u0435 \u043a\u043e\u043d\u0442\u0440\u0430\u043a\u0442 \u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d \u0442\u043e\u043b\u044c\u043a\u043e Provider \u0438 L3Out, \u043f\u043e\u044d\u0442\u043e\u043c\u0443 \u043c\u0435\u0436\u0434\u0443 \u043d\u0438\u043c\u0438 \u0434\u043e\u043b\u0436\u043d\u0430 \u0431\u044b\u0442\u044c \u0441\u0432\u044f\u0437\u043d\u043e\u0441\u0442\u044c. TestEPG \u0432\u0441\u0451 \u0442\u0430\u043a \u0436\u0435 \u043e\u0441\u0442\u0430\u0451\u0442\u0441\u044f \u043e\u0434\u0438\u043d \u0432 \u0441\u0432\u043e\u0435\u0439 \u043f\u0435\u0441\u043e\u0447\u043d\u0438\u0446\u0435:<\/p>\n
Host# ping 192.168.1.2 vrf Provider PING 192.168.1.2 (192.168.1.2): 56 data bytes 36 bytes from 192.168.1.1: Destination Host Unreachable Request 0 timed out Request 1 timed out Request 2 timed out Request 3 timed out Request 4 timed out --- 192.168.1.2 ping statistics --- 5 packets transmitted, 0 packets received, 100.00% packet loss Host# Host# ping 192.168.1.1 vrf Consumer source 2.2.2.2 PING 192.168.1.1 (192.168.1.1) from 2.2.2.2: 56 data bytes 64 bytes from 192.168.1.1: icmp_seq=0 ttl=252 time=1.691 ms 64 bytes from 192.168.1.1: icmp_seq=1 ttl=252 time=1.489 ms 64 bytes from 192.168.1.1: icmp_seq=2 ttl=252 time=1.529 ms 64 bytes from 192.168.1.1: icmp_seq=3 ttl=252 time=1.525 ms 64 bytes from 192.168.1.1: icmp_seq=4 ttl=252 time=1.533 ms<\/code><\/pre>\n
\u0427\u0442\u043e\u0431\u044b \u0442\u0440\u0430\u0444\u0438\u043a \u043c\u043e\u0433 \u043f\u043e\u043f\u0430\u0441\u0442\u044c \u0441 border leaf \u043d\u0430 Provider, \u043d\u0430 Leaf-103 \u0434\u043e\u043b\u0436\u0435\u043d \u0431\u044b\u0442\u044c \u0441\u0442\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u043c\u0430\u0440\u0448\u0440\u0443\u0442 \u0434\u043e EPG, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u044f\u0435\u0442 ClassID \u0442\u043e\u0447\u043a\u0438 \u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f, \u0430 \u0442\u0430\u043a \u0436\u0435 \u0446\u0435\u043b\u0435\u0432\u043e\u0439 VNID. <\/p>\n
Leaf-103# show ip route vrf TestTenant:TestVrf2 <output omitted> 1.1.1.1\/32, ubest\/mbest: 2\/0, attached, direct     *via 1.1.1.1, Lo6, [0\/0], 00:08:30, direct     *via 1.1.1.1, Lo6, [0\/0], 00:08:30, local, local 2.2.2.2\/32, ubest\/mbest: 1\/0     *via 192.168.2.1, Eth1\/3, [110\/5], 00:07:41, ospf-default, intra 192.168.1.1\/32, ubest\/mbest: 1\/0, attached, direct, pervasive     *via 10.0.96.64%overlay-1, [1\/0], 00:03:54, static, tag 4294967292 192.168.2.0\/24, ubest\/mbest: 1\/0, attached, direct     *via 192.168.2.254, Eth1\/3, [0\/0], 00:08:27, direct 192.168.2.254\/32, ubest\/mbest: 1\/0, attached     *via 192.168.2.254, Eth1\/3, [0\/0], 00:08:27, local, local Leaf-103# Leaf-103# show ip route vrf TestTenant:TestVrf2 192.168.1.1\/32 det <output omitted> 192.168.1.1\/32, ubest\/mbest: 1\/0, attached, direct, pervasive     *via 10.0.96.64%overlay-1, [1\/0], 00:15:41, static, tag 4294967292          recursive next hop: 10.0.96.64\/32%overlay-1          vrf crossing information:  VNID:0x288000 ClassId:0x1562 Flush#:0x3<\/code><\/pre>\n
\u041d\u0435\u0441\u043b\u043e\u0436\u043d\u043e \u0434\u043e\u0433\u0430\u0434\u0430\u0442\u044c\u0441\u044f, \u0447\u0442\u043e 0x288000 (2654208) \u2013 \u044d\u0442\u043e VNID, \u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u043d\u044b\u0439 TestVrf1:<\/p>\n
<\/figure>\n
ClassID 0x1562 (5474) \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u0435\u0442 Provider EPG:<\/p>\n
<\/figure>\n
\u0413\u043b\u043e\u0431\u0430\u043b\u044c\u043d\u044b\u0439 pcTag (5475) \u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d External EPG \u043d\u0430 L3Out. \u0412\u044b \u0436\u0435 \u043f\u043e\u043c\u043d\u0438\u0442\u0435, \u0447\u0442\u043e \u043a\u043e\u043d\u0442\u0440\u0430\u043a\u0442 \u0432\u0441\u0435\u0433\u0434\u0430 \u0440\u0435\u0430\u043b\u0438\u0437\u0443\u0435\u0442 consumer leaf? \u0422\u0430\u043a \u0432\u043e\u0442, ingress enforcement \u043a\u043e\u043d\u0442\u0440\u0430\u043a\u0442\u0430 (\u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430 VRF) \u0442\u0440\u0435\u0431\u0443\u0435\u0442 \u043e\u0431\u0440\u0430\u0442\u043d\u043e\u0433\u043e \u2013 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043a\u043e\u043d\u0442\u0440\u0430\u043a\u0442 \u043d\u0430 compute leaf \u0432\u043c\u0435\u0441\u0442\u043e border leaf. \u0412 \u043d\u0430\u0448\u0435\u043c \u0441\u043b\u0443\u0447\u0430\u0435 compute leaf \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f provider leaf; \u0447\u0442\u043e\u0431\u044b \u043f\u0440\u0438\u043c\u0435\u043d\u0438\u0442\u044c \u043a\u043e\u043d\u0442\u0440\u0430\u043a\u0442, \u043e\u043d \u0434\u043e\u043b\u0436\u0435\u043d \u0437\u043d\u0430\u0442\u044c pcTag \u043d\u0430 L3Out, \u0430 \u044d\u0442\u043e \u0437\u043d\u0430\u0447\u0438\u0442, \u0447\u0442\u043e L3Out EPG \u0434\u043e\u043b\u0436\u0435\u043d \u0438\u043c\u0435\u0442\u044c \u0433\u043b\u043e\u0431\u0430\u043b\u044c\u043d\u044b\u0439 pcTag.<\/p>\n
<\/figure>\n
\u0417\u0430\u043f\u0443\u0442\u0430\u043b\u0438\u0441\u044c? \u0412\u043e\u043e\u0431\u0449\u0435 \u043d\u0435\u043f\u043e\u043d\u044f\u0442\u043d\u043e, \u0433\u0434\u0435 \u0436\u0435 \u0432 \u043a\u043e\u043d\u0435\u0447\u043d\u043e\u043c \u0441\u0447\u0451\u0442\u0435 \u043f\u0440\u043e\u0438\u0441\u0445\u043e\u0434\u0438\u0442 \u043f\u0440\u0438\u043c\u0435\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u043d\u0442\u0440\u0430\u043a\u0442\u0430? \u0414\u0430\u0432\u0430\u0439\u0442\u0435 \u0440\u0430\u0437\u0431\u0438\u0440\u0430\u0442\u044c\u0441\u044f. \u0417\u0430\u0433\u043b\u044f\u043d\u0435\u043c \u0432 \u0434\u0443\u0448\u0443 border leaf, \u0447\u0442\u043e\u0431\u044b \u043f\u043e\u043d\u044f\u0442\u044c, \u043a\u0430\u043a\u0438\u0435 \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0438 \u043e\u043d \u0440\u0435\u0430\u043b\u0438\u0437\u0443\u0435\u0442 \u0441\u043e \u0441\u0432\u043e\u0435\u0439 \u0441\u0442\u043e\u0440\u043e\u043d\u044b:<\/p>\n
Leaf-103# show zoning-rule scope 2818048 +---------+--------+--------+----------+----------------+---------+---------+-------------------------+----------+------------------------+ | Rule ID | SrcEPG | DstEPG | FilterID |      Dir       |  operSt |  Scope  |           Name          |  Action  |        Priority        | +---------+--------+--------+----------+----------------+---------+---------+-------------------------+----------+------------------------+ |   4102  |   0    |   0    | implarp  |    uni-dir     | enabled | 2818048 |                         |  permit  |   any_any_filter(17)   | |   4099  |   0    |   0    | implicit |    uni-dir     | enabled | 2818048 |                         | deny,log |    any_any_any(21)     | |   4098  |   0    |   15   | implicit |    uni-dir     | enabled | 2818048 |                         | deny,log |  any_vrf_any_deny(22)  | |   4108  |  5474  |   0    | implicit |    uni-dir     | enabled | 2818048 |                         | deny,log | shsrc_any_any_deny(12) | |   4111  |  5474  |  5475  |    4     | uni-dir-ignore | enabled | 2818048 | TestTenant:TestContract |  permit  |     fully_qual(7)      | |   4110  |  5475  |  5474  |    4     |     bi-dir     | enabled | 2818048 | TestTenant:TestContract |  permit  |     fully_qual(7)      | +---------+--------+--------+----------+----------------+---------+---------+-------------------------+----------+------------------------+ <\/code><\/pre>\n
\u041f\u0440\u043e\u0439\u0434\u0451\u043c\u0441\u044f \u043f\u043e \u043f\u0440\u0430\u0432\u0438\u043b\u0430\u043c \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0438 \u0434\u043b\u044f TestVrf2:<\/p>\n