场景说明：Servers模拟虚拟机，在ServerLeaf上有两个租户分别为租户A、租户B，他们购买了各自的防火墙，在ServiceLeaf下联，Spine和Border融合部署，要求租户访问互联网流量先经过租户的防火墙，再经过边界防火墙然后访问互联网。租户防火墙采用vsys方式部署
流量路径：
关于租户防火墙内流量路径：防火墙分为根墙、租户虚墙A、租户虚墙B，流量需要先经过租户虚墙后，然后在经过根墙然后转发给Spine。
Spine/Border-Leaf配置：
sysname SpineAndBorder-Leaf # vlan batch 3 to 4 # evpn-overlay enable #两个VRF Internet和Inside_Internet用于隔离内部和外部路由，然后通过防火墙打通两个VRF ip vpn-instance Internet ipv4-family route-distinguisher 1:200 vpn-target 1:200 export-extcommunity vpn-target 1:200 import-extcommunity # ip vpn-instance Inside_Internet ipv4-family route-distinguisher 1:201 vpn-target 1:201 export-extcommunity vpn-target 1:201 import-extcommunity # bridge-domain 20000 //配置与外部互联的VXLAN vxlan vni 20000 evpn route-distinguisher 1:20000 vpn-target 1:20000 export-extcommunity vpn-target 1:20000 import-extcommunity # # interface Vbdif20000 //承接外部流量的vxlan网关 ip binding vpn-instance Inside_Internet ip address 10.0.255.254 255.255.255.0 # interface Vlanif3 //与防火墙Untrust互联的接口 ip binding vpn-instance Internet ip address 10.0.3.1 255.255.255.252 ospf network-type p2p # interface Vlanif4 //与防火墙Trust互联的接口 ip binding vpn-instance Inside_Internet ip address 10.0.4.1 255.255.255.252 ospf network-type p2p # interface GE1/0/0 undo portswitch undo shutdown ip address 10.0.1.1 255.255.255.252 ospf network-type p2p # interface GE1/0/1 undo portswitch undo shutdown ip address 10.0.1.5 255.255.255.252 ospf network-type p2p # interface GE1/0/2 undo shutdown # interface GE1/0/8 //与Internet互联的接口 undo portswitch undo shutdown ip binding vpn-instance Internet ip address 100.1.1.2 255.255.255.252 # interface GE1/0/9 //与旁路防火墙互联的接口 undo shutdown port link-type trunk undo port trunk allow-pass vlan 1 port trunk allow-pass vlan 3 to 4 # interface LoopBack0 ip address 1.1.1.1 255.255.255.255 # interface Nve1 //配置vtep与头端复制方式 source 1.1.1.1 vni 20000 head-end peer-list protocol bgp # interface NULL0 # bgp 100 instance EVPN //配置BGP EVPN，这里模拟器有BUG，采用peer group方式配置的话，会出现邻居关系无法正常建立的情况。 peer 1.1.1.2 as-number 100 peer 1.1.1.2 connect-interface LoopBack0 peer 1.1.1.3 as-number 100 peer 1.1.1.3 connect-interface LoopBack0 # l2vpn-family evpn undo policy vpn-target peer 1.1.1.2 enable peer 1.1.1.2 advertise irb //通告irb路由，如果不配置该命令，则无法正常传递主机路由 peer 1.1.1.2 reflect-client peer 1.1.1.3 enable peer 1.1.1.3 advertise irb //通告irb路由，如果不配置该命令，则无法正常传递主机路由 peer 1.1.1.3 reflect-client # ospf 1 //Underlay层通讯使用OSPF打通 area 0.0.0.0 network 1.1.1.1 0.0.0.0 network 10.0.1.0 0.0.0.3 network 10.0.1.4 0.0.0.3 # ospf 100 vpn-instance Inside_Internet //与防火墙Trust互联的OSPF import-route static vpn-instance-capability simple area 0.0.0.0 network 10.0.4.0 0.0.0.3 network 100.1.0.0 0.0.0.255 network 100.2.0.0 0.0.0.255 # ospf 101 vpn-instance Internet //与防火墙Untrust互联的OSPF default-route-advertise area 0.0.0.0 network 10.0.3.0 0.0.0.3 # ip route-static vpn-instance Internet 0.0.0.0 0.0.0.0 100.1.1.1 ip route-static vpn-instance Inside_Internet 100.1.0.0 255.255.255.0 10.0.255.1 //回程路由到租户防火墙 ip route-static vpn-instance Inside_Internet 100.2.0.0 255.255.255.0 10.0.255.1 //回程路由到租户防火墙
Server-Leaf配置：
sysname Server-Leaf # vlan batch 10 20 # evpn-overlay enable # evpn # ip vpn-instance A //配置租户A的VRF ipv4-family route-distinguisher 1:1000 vpn-target 1:1000 export-extcommunity vpn-target 1:1000 export-extcommunity evpn //这里一定要配置带EVPN的RT值，如果不配置，那么5类路由不会加入路由表 vpn-target 1:1000 import-extcommunity vpn-target 1:1000 import-extcommunity evpn vxlan vni 1000 //L3 VNI # ip vpn-instance B //配置租户B的VRF ipv4-family route-distinguisher 1:2000 vpn-target 1:2000 export-extcommunity vpn-target 1:2000 export-extcommunity evpn //这里一定要配置带EVPN的RT值，如果不配置，那么5类路由不会加入路由表 vpn-target 1:2000 import-extcommunity vpn-target 1:2000 import-extcommunity evpn vxlan vni 2000 //L3 VNI # bridge-domain 10010 vxlan vni 10010 evpn route-distinguisher 1:10010 vpn-target 1:10010 export-extcommunity vpn-target 1:1000 export-extcommunity //配置租户A的RT交叉 vpn-target 1:10010 import-extcommunity # bridge-domain 10020 vxlan vni 10020 evpn route-distinguisher 1:10020 vpn-target 1:10020 export-extcommunity vpn-target 1:2000 export-extcommunity vpn-target 1:10020 import-extcommunity # interface Vbdif10010 ip binding vpn-instance A ip address 192.168.10.254 255.255.255.0 arp collect host enable //配置通过ARP表项来生成32位主机路由 # interface Vbdif10020 ip binding vpn-instance B ip address 192.168.20.254 255.255.255.0 arp collect host enable //配置通过ARP表项来生成32位主机路由 # interface GE1/0/1 undo portswitch undo shutdown ip address 10.0.1.2 255.255.255.252 ospf network-type p2p # interface GE1/0/9 undo shutdown port link-type trunk # interface GE1/0/9.10 mode l2 encapsulation dot1q vid 10 bridge-domain 10010 # interface GE1/0/9.20 mode l2 encapsulation dot1q vid 20 bridge-domain 10020 # interface LoopBack0 ip address 1.1.1.2 255.255.255.255 # interface Nve1 source 1.1.1.2 vni 10010 head-end peer-list protocol bgp vni 10020 head-end peer-list protocol bgp # interface NULL0 # bgp 100 undo default ipv4-unicast peer 1.1.1.1 as-number 100 peer 1.1.1.1 connect-interface LoopBack0 # ipv4-family unicast undo peer 1.1.1.1 enable # l2vpn-family evpn policy vpn-target peer 1.1.1.1 enable peer 1.1.1.1 advertise irb # ospf 1 area 0.0.0.0 network 1.1.1.2 0.0.0.0 network 10.0.1.0 0.0.0.3 #
Service-Leaf配置：
sysname Service-Leaf # evpn-overlay enable # ip vpn-instance A ipv4-family route-distinguisher 1:1000 vpn-target 1:1000 export-extcommunity vpn-target 1:1000 export-extcommunity evpn vpn-target 1:1000 import-extcommunity vpn-target 1:1000 import-extcommunity evpn vxlan vni 1000 # ip vpn-instance B ipv4-family route-distinguisher 1:2000 vpn-target 1:2000 export-extcommunity vpn-target 1:2000 export-extcommunity evpn vpn-target 1:2000 import-extcommunity vpn-target 1:2000 import-extcommunity evpn vxlan vni 2000 # bridge-domain 10100 vxlan vni 10100 evpn route-distinguisher 1:10100 vpn-target 1:10100 export-extcommunity vpn-target 1:1000 export-extcommunity //配置租户的交叉ERT vpn-target 1:10100 import-extcommunity # bridge-domain 10200 vxlan vni 10200 evpn route-distinguisher 1:10200 vpn-target 1:10200 export-extcommunity vpn-target 1:2000 export-extcommunity //配置租户的交叉ERT vpn-target 1:10200 import-extcommunity # bridge-domain 20000 //与外部通讯的vxlan20000 vxlan vni 20000 evpn route-distinguisher 1:20000 vpn-target 1:20000 export-extcommunity vpn-target 1:20000 import-extcommunity # interface Vbdif10100 ip binding vpn-instance A ip address 10.0.100.254 255.255.255.0 arp collect host enable # interface Vbdif10200 ip binding vpn-instance B ip address 10.0.200.254 255.255.255.0 # interface MEth0/0/0 undo shutdown # interface GE1/0/0 undo portswitch undo shutdown ip address 10.0.1.6 255.255.255.252 ospf network-type p2p # interface GE1/0/9 undo shutdown port link-type trunk # interface GE1/0/9.100 mode l2 encapsulation dot1q vid 100 bridge-domain 10100 # interface GE1/0/9.200 mode l2 encapsulation dot1q vid 200 bridge-domain 10200 # interface GE1/0/9.255 mode l2 encapsulation dot1q vid 255 bridge-domain 20000 # interface LoopBack0 ip address 1.1.1.3 255.255.255.255 # interface Nve1 source 1.1.1.3 vni 20000 head-end peer-list protocol bgp # bgp 100 undo default ipv4-unicast peer 1.1.1.1 as-number 100 peer 1.1.1.1 connect-interface LoopBack0 # ipv4-family unicast undo peer 1.1.1.1 enable # ipv4-family vpn-instance A //配置租户的路由，且允许引入默认路由，并且允许将租户路由通过EVPN方式通告 default-route imported import-route static advertise l2vpn evpn # ipv4-family vpn-instance B //配置租户的路由，且允许引入默认路由，并且允许将租户路由通过EVPN方式通告 default-route imported import-route static advertise l2vpn evpn # l2vpn-family evpn policy vpn-target peer 1.1.1.1 enable peer 1.1.1.1 advertise irb # ospf 1 area 0.0.0.0 network 1.1.1.3 0.0.0.0 network 10.0.1.4 0.0.0.3 # ip route-static vpn-instance A 0.0.0.0 0.0.0.0 10.0.100.1 //将流量引流到租户防火墙 ip route-static vpn-instance B 0.0.0.0 0.0.0.0 10.0.200.1 //将流量引流到租户防火墙 # return
租户防火墙配置：
!Software Version V500R005C00SPC100 # sysname Tenant_FW # vsys enable # vsys name A 1 //创建虚墙A并分配相应端口和公网IP assign interface GigabitEthernet1/0/0.100 assign global-ip 100.1.0.100 100.1.0.200 exclusive # vsys name B 2 //创建虚墙B并分配相应端口和公网IP assign interface GigabitEthernet1/0/0.200 assign global-ip 100.2.0.100 100.2.0.200 exclusive # ip vpn-instance A ipv4-family # ip vpn-instance B ipv4-family # ip vpn-instance default ipv4-family #配置根墙、虚墙所归属的子接口 interface GigabitEthernet1/0/0.100 vlan-type dot1q 100 ip binding vpn-instance A ip address 10.0.100.1 255.255.255.0 service-manage ping permit # interface GigabitEthernet1/0/0.200 vlan-type dot1q 200 ip binding vpn-instance B ip address 10.0.200.1 255.255.255.0 service-manage ping permit # interface GigabitEthernet1/0/0.255 vlan-type dot1q 255 ip address 10.0.255.1 255.255.255.0 service-manage ping permit # interface GigabitEthernet1/0/1 undo shutdown # interface GigabitEthernet1/0/2 undo shutdown # interface GigabitEthernet1/0/3 undo shutdown # interface GigabitEthernet1/0/4 undo shutdown # interface Virtual-if0 //这里防火墙虚拟内联口需要配置地址才会生成路由，可以是根墙和虚墙可以同子网地址也可以是不同子网地址。 ip address 1.1.1.1 255.255.255.0 # interface Virtual-if1 ip address 1.1.1.2 255.255.255.0 # interface Virtual-if2 ip address 1.1.3.1 255.255.255.0 # interface NULL0 # firewall zone local set priority 100 # firewall zone trust set priority 85 add interface GigabitEthernet0/0/0 add interface Virtual-if0 # firewall zone untrust set priority 5 add interface GigabitEthernet1/0/0.255 # firewall zone dmz set priority 50 # api # ip route-static 0.0.0.0 0.0.0.0 10.0.255.254 ip route-static 100.1.0.0 255.255.255.0 vpn-instance A //配置虚墙A的回程路由 ip route-static 100.2.0.0 255.255.255.0 vpn-instance B //配置虚墙B的回程路由 # security-policy rule name Trust_Untrust_Permit source-zone trust destination-zone untrust source-address 100.1.0.0 mask 255.255.255.0 source-address 100.2.0.0 mask 255.255.255.0 action permit #############################################虚墙A的配置################################################## switch vsys A # interface GigabitEthernet1/0/0.100 vlan-type dot1q 100 ip binding vpn-instance A ip address 10.0.100.1 255.255.255.0 service-manage ping permit # interface Virtual-if1 ip address 1.1.1.2 255.255.255.0 # sa # firewall zone local set priority 100 # firewall zone trust set priority 85 add interface GigabitEthernet1/0/0.100 # firewall zone untrust set priority 5 add interface Virtual-if1 # firewall zone dmz set priority 50 # location # nat address-group SNAT 1 mode pat route enable section 0 100.1.0.100 100.1.0.100 # multi-linkif mode proportion-of-weight # security-policy rule name Trust_Untrust_Permit source-zone trust destination-zone untrust source-address 192.168.10.0 mask 255.255.255.0 action permit rule name Local_Trust_Permit source-zone local destination-zone trust action permit # nat-policy //将租户VPC内地址转换为公网地址SNAT方式 rule name Trust_Untrust_SNAT source-zone trust destination-zone untrust source-address 192.168.10.0 mask 255.255.255.0 action source-nat address-group SNAT # ip route-static 0.0.0.0 0.0.0.0 public //配置去往根墙的路由 ip route-static 192.168.10.0 255.255.255.0 10.0.100.254 //回程路由 # return # #############################################虚墙B的配置################################################## switch vsys B # interface GigabitEthernet1/0/0.200 vlan-type dot1q 200 ip binding vpn-instance B ip address 10.0.200.1 255.255.255.0 service-manage ping permit # interface Virtual-if2 ip address 1.1.3.1 255.255.255.0 # sa # firewall zone local set priority 100 # firewall zone trust set priority 85 add interface GigabitEthernet1/0/0.200 # firewall zone untrust set priority 5 add interface Virtual-if2 # firewall zone dmz set priority 50 # location # nat address-group SNAT 0 mode pat route enable section 0 100.2.0.100 100.2.0.100 # multi-linkif mode proportion-of-weight # security-policy rule name Trust_Untrust_Permit source-zone trust destination-zone untrust source-address 192.168.20.0 mask 255.255.255.0 action permit rule name Local_Trust_Permit source-zone local destination-zone trust action permit # auth-policy # traffic-policy # policy-based-route # nat-policy //将租户VPC内地址转换为公网地址SNAT方式 rule name Trust_Untrust_SNAT source-zone trust destination-zone untrust source-address 192.168.20.0 mask 255.255.255.0 action source-nat address-group SNAT # proxy-policy # pcp-policy # ip route-static 0.0.0.0 0.0.0.0 public //配置去往根墙的路由 ip route-static 192.168.20.0 255.255.255.0 10.0.200.254 //回程路由 # return
实验结果：
配置要点：主要的要点是在租户防火墙和Service-Leaf，一个是Service-Leaf需要引导租户流量进入防火墙的配置，另外一个就是租户防火墙内虚墙和根墙的流量处理，这里比较简单。另外一个就是模拟器虚墙有BUG，虚墙接口不主动相应ARP，需要先通过虚墙ping一下对应的vxlan网关才可以正常通讯。