Charles Chan | 9e5c617 | 2019-09-07 11:24:54 -0700 | [diff] [blame] | 1 | Bridging and Unicast Routing |
| 2 | ============================ |
| 3 | |
| 4 | Access Ports |
| 5 | ------------ |
| 6 | The necessary but minimum configuration for an access port is simply a VLAN. |
| 7 | |
| 8 | .. code-block:: json |
| 9 | :linenos: |
| 10 | |
| 11 | { |
| 12 | "ports" : { |
| 13 | "of:0000000000000204/12" : { |
| 14 | "interfaces" : [{ |
| 15 | "name" : "serverA-intf", |
| 16 | "vlan-untagged": 10 |
| 17 | }] |
| 18 | }, |
| 19 | "of:0000000000000204/16" : { |
| 20 | "interfaces" : [{ |
| 21 | "name" : "serverB-intf", |
| 22 | "vlan-untagged": 10 |
| 23 | }] |
| 24 | } |
| 25 | } |
| 26 | } |
| 27 | |
| 28 | The example above shows two ports (12 and 16) on switch of:204 that have been assigned to VLAN 10 using the ``vlan-untagged`` keyword. |
| 29 | It simply means that packets come in and leave out of these switches untagged, |
| 30 | but internally they are assigned VLAN 10 and they belong to the bridging domain defined for VLAN 10. |
| 31 | |
| 32 | ``name`` is used to associate the interface with a globally unique, user friendly name. It can be omitted. |
| 33 | |
| 34 | With the configuration shown above, the packets will always be bridged, but they cannot be routed out of the VLAN (e.g. to other subnets). |
| 35 | To add the capability to route out of VLAN 10, we need to add a subnet/gateway IP (similar to `interface-vlans or SVIs in traditional networks <https://www.youtube.com/watch?v=bUXpmiJpGb0>`_). |
| 36 | |
| 37 | .. code-block:: json |
| 38 | :linenos: |
| 39 | |
| 40 | { |
| 41 | "ports" : { |
| 42 | "of:0000000000000204/12" : { |
| 43 | "interfaces" : [{ |
| 44 | "name" : "serverA-intf", |
| 45 | "ips" : [ "10.0.1.254/24"], |
| 46 | "vlan-untagged": 10 |
| 47 | }] |
| 48 | }, |
| 49 | "of:0000000000000204/16" : { |
| 50 | "interfaces" : [{ |
| 51 | "name" : "serverB-intf", |
| 52 | "ips" : [ "10.0.1.254/24"], |
| 53 | "vlan-untagged": 10 |
| 54 | }] |
| 55 | } |
| 56 | } |
| 57 | } |
| 58 | |
| 59 | In this example, VLAN 10 is associated with subnet ``10.0.1.0/24``, and the gateway IP for hosts in this subnet is ``10.0.1.254/32``. |
| 60 | When the desire is to route out of a VLAN, this assignment is currently necessary on all ports configured in the same VLAN. |
| 61 | |
| 62 | .. note:: |
| 63 | |
| 64 | Typically we only expect a single subnet for a VLAN. Similar to traditional networks, for us, a subnet == VLAN. Different VLANs should be configured in different subnets. |
| 65 | In certain use-cases, it may be necessary to configure multiple subnets in the same VLAN. This is possible by adding more subnet/gateway IPs in the ``ips`` array. |
| 66 | |
| 67 | |
| 68 | Tagged Ports |
| 69 | ------------ |
| 70 | Tagged port configuration is similar. |
| 71 | |
| 72 | .. code-block:: json |
| 73 | :linenos: |
| 74 | |
| 75 | { |
| 76 | "ports" : { |
| 77 | "of:0000000000000204/24" : { |
| 78 | "interfaces" : [{ |
| 79 | "name" : "serverA-intf", |
| 80 | "ips" : [ "10.0.2.254/24", "10.0.4.254/24" ], |
| 81 | "vlan-tagged" : [ 20, 40 ] |
| 82 | }] |
| 83 | } |
| 84 | } |
| 85 | } |
| 86 | |
| 87 | The configuration above for port 24 on switch of:204 shows two VLANs 20 and 40 configured on that port, with corresponding subnets and gateway IPs. |
| 88 | Note that there is no specific ordering required in the ``ips`` or ``vlan-tagged`` arrays to correlate the VLANs to their corresponding subnets. |
| 89 | In a future release, we will correlate VLAN and subnets configuration in a more readable way. |
| 90 | |
| 91 | |
| 92 | Native VLAN on Tagged Ports |
| 93 | --------------------------- |
| 94 | An additional configuration ``vlan-native`` possible on tagged ports includes the ability to specify a VLAN (and thus a bridging domain) for incoming untagged packets. |
| 95 | Typically, such configuration in trunk ports in traditional networks is referred to a native VLAN. |
| 96 | |
| 97 | .. code-block:: json |
| 98 | :linenos: |
| 99 | |
| 100 | { |
| 101 | "ports" : { |
| 102 | "of:0000000000000204/24" : { |
| 103 | "interfaces" : [ { |
| 104 | "name" : "serverA-intf", |
| 105 | "ips" : [ "10.0.2.254/24", "10.0.4.254/24", "10.0.1.254/24" ], |
| 106 | "vlan-tagged" : [ 20, 40 ], |
| 107 | "vlan-native" : 10 |
| 108 | }] |
| 109 | } |
| 110 | } |
| 111 | } |
| 112 | |
| 113 | Note that it is also necessary to configure the subnet/gateway IP corresponding to the native VLAN if you wish to route out of that VLAN. |
| 114 | |
| 115 | |
| 116 | Configuring interface for IPv6 |
| 117 | ------------------------------ |
| 118 | It is similar to configure IPv6 routing. Simply replace the addresses in ``ips`` with IPv6 addresses. For example, |
| 119 | |
| 120 | .. code-block:: json |
| 121 | :linenos: |
| 122 | |
| 123 | { |
| 124 | "ports" : { |
| 125 | "of:0000000000000204/24" : { |
| 126 | "interfaces" : [ { |
| 127 | "name" : "serverA-intf", |
| 128 | "ips" : [ "10.0.2.254/24", "2000::1ff/120" ], |
| 129 | "vlan-tagged" : [ 20, 40 ] |
| 130 | }] |
| 131 | } |
| 132 | } |
| 133 | } |
| 134 | |
| 135 | |
| 136 | Notes |
| 137 | ----- |
| 138 | There is no need to configure ports on switches that are meant to connect to other switches. |
| 139 | The VLAN (untagged or tagged) configuration is only meant for ports that are connected to hosts (edge ports). |
| 140 | |
Charles Chan | 20fabfb | 2019-09-07 11:24:54 -0700 | [diff] [blame^] | 141 | .. image:: ../images/config-vlan.png |
Charles Chan | 9e5c617 | 2019-09-07 11:24:54 -0700 | [diff] [blame] | 142 | |
| 143 | Furthermore, note that the same VLAN can be configured on multiple ToRs - e.g. vlan 20 in the figure above. |
| 144 | However this does not mean that the ports are in the same bridging domain, because in the fabric, the communication between ToRs is through a routed network. ' |
| 145 | In other words, a host on VLAN 20 (untagged or tagged) connected to one ToR can communicate with another host on VLAN 20 (untagged or tagged) connected to a different ToR, |
| 146 | but the MAC addresses will change as the traffic goes through a routed network. |
| 147 | |
| 148 | Please do not use this feature to connect switches in unsupported topologies as shown in the example below. |
| 149 | The fabric is not designed to be one big Ethernet fabric. The bridging domain is restricted to within one ToR. |
| 150 | If the bridging domain is extended across two ToRs directly linked to each other, there is a chance of loops. |
| 151 | In other words, the ToRs/Leafs are not standalone 802.1Q bridges, and should not be used as such. |
| 152 | |
Charles Chan | 20fabfb | 2019-09-07 11:24:54 -0700 | [diff] [blame^] | 153 | .. image:: ../images/config-vlan-invalid.png |