Charles Chan | 9e5c617 | 2019-09-07 11:24:54 -0700 | [diff] [blame] | 1 | Bridging and Unicast Routing |
| 2 | ============================ |
| 3 | |
Charles Chan | 33bac08 | 2019-09-12 01:07:51 -0700 | [diff] [blame] | 4 | .. attention:: |
Charles Chan | 4ade88d | 2019-09-16 16:30:31 -0700 | [diff] [blame] | 5 | - VLAN **4090** is reserved for :doc:`pseudowire <pseudowire>` transport |
Charles Chan | 33bac08 | 2019-09-12 01:07:51 -0700 | [diff] [blame] | 6 | - VLAN **4094** is reserved for unconfigured ports (e.g. spine facing ports) |
| 7 | |
Charles Chan | 9e5c617 | 2019-09-07 11:24:54 -0700 | [diff] [blame] | 8 | Access Ports |
| 9 | ------------ |
Zack Williams | 40dfc97 | 2020-06-23 14:12:46 -0700 | [diff] [blame^] | 10 | |
Charles Chan | 9e5c617 | 2019-09-07 11:24:54 -0700 | [diff] [blame] | 11 | The necessary but minimum configuration for an access port is simply a VLAN. |
| 12 | |
| 13 | .. code-block:: json |
Charles Chan | 9e5c617 | 2019-09-07 11:24:54 -0700 | [diff] [blame] | 14 | |
| 15 | { |
| 16 | "ports" : { |
| 17 | "of:0000000000000204/12" : { |
| 18 | "interfaces" : [{ |
| 19 | "name" : "serverA-intf", |
| 20 | "vlan-untagged": 10 |
| 21 | }] |
| 22 | }, |
| 23 | "of:0000000000000204/16" : { |
| 24 | "interfaces" : [{ |
| 25 | "name" : "serverB-intf", |
| 26 | "vlan-untagged": 10 |
| 27 | }] |
| 28 | } |
| 29 | } |
| 30 | } |
| 31 | |
Zack Williams | 40dfc97 | 2020-06-23 14:12:46 -0700 | [diff] [blame^] | 32 | The example above shows two ports (12 and 16) on switch ``of:204`` that have |
| 33 | been assigned to VLAN 10 using the ``vlan-untagged`` keyword. |
| 34 | |
Charles Chan | 9e5c617 | 2019-09-07 11:24:54 -0700 | [diff] [blame] | 35 | It simply means that packets come in and leave out of these switches untagged, |
Zack Williams | 40dfc97 | 2020-06-23 14:12:46 -0700 | [diff] [blame^] | 36 | but internally they are assigned VLAN 10 and they belong to the bridging domain |
| 37 | defined for VLAN 10. |
Charles Chan | 9e5c617 | 2019-09-07 11:24:54 -0700 | [diff] [blame] | 38 | |
Zack Williams | 40dfc97 | 2020-06-23 14:12:46 -0700 | [diff] [blame^] | 39 | ``name`` is used to associate the interface with a globally unique, user |
| 40 | friendly name. It can be omitted. |
Charles Chan | 9e5c617 | 2019-09-07 11:24:54 -0700 | [diff] [blame] | 41 | |
Zack Williams | 40dfc97 | 2020-06-23 14:12:46 -0700 | [diff] [blame^] | 42 | With the configuration shown above, the packets will always be bridged, but |
| 43 | they cannot be routed out of the VLAN (e.g. to other subnets). To add the |
| 44 | capability to route out of VLAN 10, we need to add a subnet/gateway IP (similar |
| 45 | to `interface-vlans or SVIs in traditional networks |
| 46 | <https://www.youtube.com/watch?v=bUXpmiJpGb0>`_). |
Charles Chan | 9e5c617 | 2019-09-07 11:24:54 -0700 | [diff] [blame] | 47 | |
| 48 | .. code-block:: json |
Charles Chan | 9e5c617 | 2019-09-07 11:24:54 -0700 | [diff] [blame] | 49 | |
| 50 | { |
| 51 | "ports" : { |
| 52 | "of:0000000000000204/12" : { |
| 53 | "interfaces" : [{ |
| 54 | "name" : "serverA-intf", |
| 55 | "ips" : [ "10.0.1.254/24"], |
| 56 | "vlan-untagged": 10 |
| 57 | }] |
| 58 | }, |
| 59 | "of:0000000000000204/16" : { |
| 60 | "interfaces" : [{ |
| 61 | "name" : "serverB-intf", |
| 62 | "ips" : [ "10.0.1.254/24"], |
| 63 | "vlan-untagged": 10 |
| 64 | }] |
| 65 | } |
| 66 | } |
| 67 | } |
| 68 | |
Zack Williams | 40dfc97 | 2020-06-23 14:12:46 -0700 | [diff] [blame^] | 69 | In this example, VLAN 10 is associated with subnet ``10.0.1.0/24``, and the |
| 70 | gateway IP for hosts in this subnet is ``10.0.1.254/32``. |
| 71 | |
| 72 | When the desire is to route out of a VLAN, this assignment is currently |
| 73 | necessary on all ports configured in the same VLAN. |
Charles Chan | 9e5c617 | 2019-09-07 11:24:54 -0700 | [diff] [blame] | 74 | |
| 75 | .. note:: |
Zack Williams | 40dfc97 | 2020-06-23 14:12:46 -0700 | [diff] [blame^] | 76 | Typically we only expect a single subnet for a VLAN. Similar to traditional |
| 77 | networks, for us, a subnet == VLAN. Different VLANs should be configured in |
| 78 | different subnets. |
| 79 | |
| 80 | In certain use-cases, it may be necessary to configure multiple subnets in |
| 81 | the same VLAN. This is possible by adding more subnet/gateway IPs in the |
| 82 | ``ips`` array. |
Charles Chan | 9e5c617 | 2019-09-07 11:24:54 -0700 | [diff] [blame] | 83 | |
Charles Chan | 33bac08 | 2019-09-12 01:07:51 -0700 | [diff] [blame] | 84 | .. tip:: |
| 85 | One subnet cannot be configured on multiple leaf switches. |
Zack Williams | 40dfc97 | 2020-06-23 14:12:46 -0700 | [diff] [blame^] | 86 | |
Charles Chan | 33bac08 | 2019-09-12 01:07:51 -0700 | [diff] [blame] | 87 | We usually configure one subnet for all the ports on the same leaf switch. |
Charles Chan | 9e5c617 | 2019-09-07 11:24:54 -0700 | [diff] [blame] | 88 | |
| 89 | Tagged Ports |
| 90 | ------------ |
| 91 | Tagged port configuration is similar. |
| 92 | |
| 93 | .. code-block:: json |
Charles Chan | 9e5c617 | 2019-09-07 11:24:54 -0700 | [diff] [blame] | 94 | |
| 95 | { |
| 96 | "ports" : { |
| 97 | "of:0000000000000204/24" : { |
| 98 | "interfaces" : [{ |
| 99 | "name" : "serverA-intf", |
| 100 | "ips" : [ "10.0.2.254/24", "10.0.4.254/24" ], |
| 101 | "vlan-tagged" : [ 20, 40 ] |
| 102 | }] |
| 103 | } |
| 104 | } |
| 105 | } |
| 106 | |
Zack Williams | 40dfc97 | 2020-06-23 14:12:46 -0700 | [diff] [blame^] | 107 | The configuration above for port 24 on switch of:204 shows two VLANs 20 and 40 |
| 108 | configured on that port, with corresponding subnets and gateway IPs. |
Charles Chan | 9e5c617 | 2019-09-07 11:24:54 -0700 | [diff] [blame] | 109 | |
Zack Williams | 40dfc97 | 2020-06-23 14:12:46 -0700 | [diff] [blame^] | 110 | Note that there is no specific ordering required in the ``ips`` or |
| 111 | ``vlan-tagged`` arrays to correlate the VLANs to their corresponding subnets. |
| 112 | |
| 113 | In a future release, we will correlate VLAN and subnets configuration in a more |
| 114 | readable way. |
Charles Chan | 9e5c617 | 2019-09-07 11:24:54 -0700 | [diff] [blame] | 115 | |
| 116 | Native VLAN on Tagged Ports |
| 117 | --------------------------- |
Zack Williams | 40dfc97 | 2020-06-23 14:12:46 -0700 | [diff] [blame^] | 118 | |
| 119 | An additional configuration ``vlan-native`` possible on tagged ports includes |
| 120 | the ability to specify a VLAN (and thus a bridging domain) for incoming |
| 121 | untagged packets. |
| 122 | |
| 123 | Typically, such configuration in trunk ports in traditional networks is |
| 124 | referred to a native VLAN. |
Charles Chan | 9e5c617 | 2019-09-07 11:24:54 -0700 | [diff] [blame] | 125 | |
| 126 | .. code-block:: json |
Charles Chan | 9e5c617 | 2019-09-07 11:24:54 -0700 | [diff] [blame] | 127 | |
| 128 | { |
| 129 | "ports" : { |
| 130 | "of:0000000000000204/24" : { |
| 131 | "interfaces" : [ { |
| 132 | "name" : "serverA-intf", |
| 133 | "ips" : [ "10.0.2.254/24", "10.0.4.254/24", "10.0.1.254/24" ], |
| 134 | "vlan-tagged" : [ 20, 40 ], |
| 135 | "vlan-native" : 10 |
| 136 | }] |
| 137 | } |
| 138 | } |
| 139 | } |
| 140 | |
Zack Williams | 40dfc97 | 2020-06-23 14:12:46 -0700 | [diff] [blame^] | 141 | Note that it is also necessary to configure the subnet/gateway IP corresponding |
| 142 | to the native VLAN if you wish to route out of that VLAN. |
Charles Chan | 9e5c617 | 2019-09-07 11:24:54 -0700 | [diff] [blame] | 143 | |
| 144 | Configuring interface for IPv6 |
| 145 | ------------------------------ |
Zack Williams | 40dfc97 | 2020-06-23 14:12:46 -0700 | [diff] [blame^] | 146 | |
| 147 | It is similar to configure IPv6 routing. Simply replace the addresses in |
| 148 | ``ips`` with IPv6 addresses. For example: |
Charles Chan | 9e5c617 | 2019-09-07 11:24:54 -0700 | [diff] [blame] | 149 | |
| 150 | .. code-block:: json |
Charles Chan | 9e5c617 | 2019-09-07 11:24:54 -0700 | [diff] [blame] | 151 | |
| 152 | { |
| 153 | "ports" : { |
| 154 | "of:0000000000000204/24" : { |
| 155 | "interfaces" : [ { |
| 156 | "name" : "serverA-intf", |
| 157 | "ips" : [ "10.0.2.254/24", "2000::1ff/120" ], |
| 158 | "vlan-tagged" : [ 20, 40 ] |
| 159 | }] |
| 160 | } |
| 161 | } |
| 162 | } |
| 163 | |
| 164 | |
Charles Chan | 8d3ae67 | 2019-09-07 22:07:22 -0700 | [diff] [blame] | 165 | IPv6 Router Advertisement |
| 166 | ------------------------- |
| 167 | |
| 168 | Router Advertisement overview |
| 169 | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ |
Zack Williams | 40dfc97 | 2020-06-23 14:12:46 -0700 | [diff] [blame^] | 170 | |
| 171 | Router advertisement application is for enabling **Router Advertisement** and |
| 172 | **Router Solicitation** functionalities supported by IPv6 routers. |
| 173 | |
Charles Chan | 8d3ae67 | 2019-09-07 22:07:22 -0700 | [diff] [blame] | 174 | More details are available in `RFC 4861 <https://tools.ietf.org/html/rfc4861>`_. |
| 175 | |
Zack Williams | 40dfc97 | 2020-06-23 14:12:46 -0700 | [diff] [blame^] | 176 | Application identifies which IPv6 interfaces are currently configured in the |
| 177 | system and it will try to send out **unsolicited Router Advertisement** (RA) |
| 178 | messages from these interfaces. |
Charles Chan | 8d3ae67 | 2019-09-07 22:07:22 -0700 | [diff] [blame] | 179 | |
Zack Williams | 40dfc97 | 2020-06-23 14:12:46 -0700 | [diff] [blame^] | 180 | Each such RA message will have two mandatory options named **Source link-layer |
| 181 | address** and **MTU**. |
| 182 | |
| 183 | Additional RA option **prefix** can be enabled using component configuration |
| 184 | **raGlobalPrefixConfStatus**. |
| 185 | |
| 186 | Application also processes **Router Solicitations** (RS) sent from hosts. Upon |
| 187 | receiving RS on a particular interface application stops RA transmission in |
| 188 | that interface and immediately sends RA targeted to the solicited host. After |
| 189 | that application continues unsolicited RA transmission on that interface. |
Charles Chan | 8d3ae67 | 2019-09-07 22:07:22 -0700 | [diff] [blame] | 190 | |
| 191 | Activate and configure RA |
| 192 | ^^^^^^^^^^^^^^^^^^^^^^^^^ |
Zack Williams | 40dfc97 | 2020-06-23 14:12:46 -0700 | [diff] [blame^] | 193 | |
Charles Chan | 8d3ae67 | 2019-09-07 22:07:22 -0700 | [diff] [blame] | 194 | RA application can be activated from CLI by running |
| 195 | |
| 196 | .. code-block:: console |
| 197 | |
| 198 | onos> app activate routeradvertisement |
| 199 | |
Zack Williams | 40dfc97 | 2020-06-23 14:12:46 -0700 | [diff] [blame^] | 200 | Behavior of RA application is controlled by ONOS component configuration |
| 201 | subsystem and following are possible configuration options. |
Charles Chan | 8d3ae67 | 2019-09-07 22:07:22 -0700 | [diff] [blame] | 202 | |
| 203 | - ``raThreadDelay``: Delay between consecutive RA transmissions |
Zack Williams | 40dfc97 | 2020-06-23 14:12:46 -0700 | [diff] [blame^] | 204 | |
Charles Chan | 8d3ae67 | 2019-09-07 22:07:22 -0700 | [diff] [blame] | 205 | - ``raPoolSize``: Capacity of thread pool to be used for RA transmissions |
Zack Williams | 40dfc97 | 2020-06-23 14:12:46 -0700 | [diff] [blame^] | 206 | |
| 207 | - ``raFlagMbitStatus``: RA flag “Managed address configuration” |
| 208 | enabled/disabled |
| 209 | |
Charles Chan | 8d3ae67 | 2019-09-07 22:07:22 -0700 | [diff] [blame] | 210 | - ``raFlagObitStatus``: RA flag “Other configuration” enabled/disabled |
Zack Williams | 40dfc97 | 2020-06-23 14:12:46 -0700 | [diff] [blame^] | 211 | |
| 212 | - ``raOptionPrefixStatus``: RA Option “prefix” is enabled/disabled. Router |
| 213 | prefixes will be available in RA only if this flag is “true” |
| 214 | |
| 215 | - ``raGlobalPrefixConfStatus``: Enable switch level global prefix |
| 216 | configuration. |
| 217 | |
| 218 | Once “raGlobalPrefixConfStatus” is enabled, RA prefix option is generated |
| 219 | from port configuration of device, see for more details. |
Charles Chan | 8d3ae67 | 2019-09-07 22:07:22 -0700 | [diff] [blame] | 220 | |
| 221 | Prefix details are picked up from network interface configuration. |
Zack Williams | 40dfc97 | 2020-06-23 14:12:46 -0700 | [diff] [blame^] | 222 | |
Charles Chan | 8d3ae67 | 2019-09-07 22:07:22 -0700 | [diff] [blame] | 223 | RA app will filter out link-local IPs while preparing prefixes. |
Zack Williams | 40dfc97 | 2020-06-23 14:12:46 -0700 | [diff] [blame^] | 224 | |
| 225 | For example, in following configuration, Prefix will include only |
| 226 | **2001:0558:FF10:04C9::2:1ff/120**. |
Charles Chan | 8d3ae67 | 2019-09-07 22:07:22 -0700 | [diff] [blame] | 227 | |
| 228 | .. code-block:: json |
| 229 | |
| 230 | { |
| 231 | "ports": { |
| 232 | "of:0000000000000018/16": { |
| 233 | "interfaces": [{ |
| 234 | "ips": [ "192.168.114.1/24", "2001:0558:FF10:04C9::2:1ff/120", "FE80::4EA8:2AFF:FE24:8E5F/120" ], |
| 235 | "vlan-untagged": "11", |
| 236 | "name": "18-15", |
| 237 | "mac": "8c:ea:1b:67:24:90" |
| 238 | }] |
| 239 | } |
| 240 | } |
| 241 | } |
| 242 | |
| 243 | Global prefix configuration |
| 244 | ^^^^^^^^^^^^^^^^^^^^^^^^^^^ |
Zack Williams | 40dfc97 | 2020-06-23 14:12:46 -0700 | [diff] [blame^] | 245 | |
| 246 | In some cases, users may want to have a set of global prefix **advertised on |
| 247 | all edge interfaces**. |
| 248 | |
| 249 | Such prefixes can be configured in **devices** section of network configuration |
| 250 | in the following way. |
Charles Chan | 8d3ae67 | 2019-09-07 22:07:22 -0700 | [diff] [blame] | 251 | |
| 252 | .. code-block:: json |
| 253 | |
| 254 | { |
| 255 | "devices": { |
| 256 | "of:0000000000000018": { |
| 257 | "routeradvertisement" : { |
| 258 | "prefixes": [ "2001:0558:FF10:04C9::3:1ff/120"] |
| 259 | } |
| 260 | } |
| 261 | } |
| 262 | } |
| 263 | |
| 264 | .. note:: |
Zack Williams | 40dfc97 | 2020-06-23 14:12:46 -0700 | [diff] [blame^] | 265 | When global prefix is configured, RA app will ignore any prefixes |
| 266 | configured on switch interfaces. |
Charles Chan | 8d3ae67 | 2019-09-07 22:07:22 -0700 | [diff] [blame] | 267 | |
| 268 | Notes about interface config |
| 269 | ---------------------------- |
Zack Williams | 40dfc97 | 2020-06-23 14:12:46 -0700 | [diff] [blame^] | 270 | |
| 271 | There is no need to configure ports on switches that are meant to connect to |
| 272 | other switches. |
| 273 | |
| 274 | The VLAN (untagged or tagged) configuration is only meant for ports that are |
| 275 | connected to hosts (edge ports). |
Charles Chan | 9e5c617 | 2019-09-07 11:24:54 -0700 | [diff] [blame] | 276 | |
Charles Chan | 20fabfb | 2019-09-07 11:24:54 -0700 | [diff] [blame] | 277 | .. image:: ../images/config-vlan.png |
Charles Chan | 9e5c617 | 2019-09-07 11:24:54 -0700 | [diff] [blame] | 278 | |
Zack Williams | 40dfc97 | 2020-06-23 14:12:46 -0700 | [diff] [blame^] | 279 | Furthermore, note that the same VLAN can be configured on multiple ToRs - e.g. |
| 280 | vlan 20 in the figure above. |
Charles Chan | 9e5c617 | 2019-09-07 11:24:54 -0700 | [diff] [blame] | 281 | |
Zack Williams | 40dfc97 | 2020-06-23 14:12:46 -0700 | [diff] [blame^] | 282 | However this does not mean that the ports are in the same bridging domain, |
| 283 | because in the fabric, the communication between ToRs is through a routed |
| 284 | network. |
| 285 | |
| 286 | In other words, a host on VLAN 20 (untagged or tagged) connected to one ToR can |
| 287 | communicate with another host on VLAN 20 (untagged or tagged) connected to a |
| 288 | different ToR, but the MAC addresses will change as the traffic goes through a |
| 289 | routed network. |
| 290 | |
| 291 | Please do not use this feature to connect switches in unsupported topologies as |
| 292 | shown in the example below. |
| 293 | |
| 294 | The fabric is not designed to be one big Ethernet fabric. The bridging domain |
| 295 | is restricted to within one ToR. |
| 296 | |
| 297 | If the bridging domain is extended across two ToRs directly linked to each |
| 298 | other, there is a chance of loops. |
| 299 | |
| 300 | In other words, the ToRs/Leafs are not standalone 802.1Q bridges, and should |
| 301 | not be used as such. |
Charles Chan | 9e5c617 | 2019-09-07 11:24:54 -0700 | [diff] [blame] | 302 | |
Charles Chan | 20fabfb | 2019-09-07 11:24:54 -0700 | [diff] [blame] | 303 | .. image:: ../images/config-vlan-invalid.png |