Configuring M-LAG, EVPN distributed gateway (OSPF on the underlay network), DHCP relay, microsegmentation, and service chain

Spine

S12500X-AF

F2809 and higher F28xx or R28xx versions

S12500G-AF

R7624P12

Border/Leaf

S6800, S6860

F2717 and higher F27xx or R27xx versions

Do not use F28xx or R28xx versions.

S6805, S6825, S6850, S9850

S6850 switches are used in this configuration example.

F6632 and higher F66xx or R66xx versions

S6890

F2809 and higher F28xx or R28xx versions

S6812, S6813

Under development. To obtain the latest images, contact Technical Support.

S9820-64H (EVPN gateway not supported)

S9820-8C (EVPN not supported)

Not supported

SDN controller

N/A

E3610P12H02, or contact Technical Support to obtain a higher version

router id 197.32.241.41

router id 197.32.241.42

Manual or controller-based

Configure a router ID.

ospf 65530

ospf 65530

Manual or controller-based

Run OSPF process 65530.

non-stop-routing

non-stop-routing

Manual or controller-based

Enable OSPF NSR.

stub-router include-stub on-startup 900

stub-router include-stub on-startup 900

Manual or controller-based

Specify the cost of the stub links (link type 3) in Router LSAs to the maximum value 65535 to accelerate network convergence.

area 0.0.0.0

area 0.0.0.0

Manual or controller-based

Create OSPF area 0.0.0.0.

interface LoopBack0

interface LoopBack0

Manual or controller-based

Enter the view of Loopback 0.

ospf 65530 area 0.0.0.0

ospf 65530 area 0.0.0.0

Manual or controller-based

Enable OSPF on Loopback 0.

quit

quit

Manual or controller-based

Return to system view.

interface LoopBack2

interface LoopBack2

Manual or controller-based

Enter the view of Loopback 2.

ospf 65530 area 0.0.0.0

ospf 65530 area 0.0.0.0

Manual or controller-based

Enable OSPF on Loopback 2.

interface LoopBack0

interface LoopBack0

Manual or controller-based

Configure Loopback 0.

ip address 197.32.241.41 255.255.255.255

ip address 197.32.241.42 255.255.255.255

Manual or controller-based

Assign an IP address to Loopback 0.

quit

quit

Manual or controller-based

Return to system view.

interface LoopBack2

interface LoopBack2

Manual or controller-based

Configure Loopback 2.

ip address 197.32.241.55 255.255.255.255

ip address 197.32.241.55 255.255.255.255

Manual or controller-based

Assign an IP address to Loopback 2.

ip vpn-instance auto-online-mlag

ip vpn-instance auto-online-mlag

Manual or controller-based

Configure the VPN instance where the keepalive link belongs.

quit

quit

Manual or controller-based

Return to system view.

ip vpn-instance mgmt

ip vpn-instance mgmt

Manual or controller-based

Configure the VPN instance where the management interface belongs.

quit

quit

Manual or controller-based

Return to system view.

ip vpn-instance ZHTESTCTVRF

ip vpn-instance ZHTESTCTVRF

Manual or controller-based

Configure the service VPN instance where the servers belong.

To ensure correct route learning, configure consistent route targets for the service VPN instance on different devices.

route-distinguisher 1:10000

route-distinguisher 2:10000

Manual or controller-based

Configure an RD for the VPN instance.

address-family ipv4

address-family ipv4

Manual or controller-based

Enter VPN instance IPv4 address family view.

vpn-target 0:10000 1:10000 0.39.18.0:10000 0.39.17.0:10000 import-extcommunity

vpn-target 0:10000 1:10000 0.39.18.0:10000 0.39.17.0:10000 import-extcommunity

Manual or controller-based

Configure import targets in VPN instance IPv4 address family view.

vpn-target 0:10000 1:10000 0.39.18.0:10000  0.39.17.0:10000 export-extcommunity

vpn-target  0:10000 1:10000 0.39.18.0:10000 0.39.17.0:10000 export-extcommunity

Manual or controller-based

Configure export targets in VPN instance IPv4 address family view.

quit

quit

Manual or controller-based

Return to VPN instance view.

address-family ipv6

address-family ipv6

Manual or controller-based

Enter VPN instance IPv6 address family view.

vpn-target 0:10000 1:10000 0.39.18.0:10000 0.39.17.0:10000 import-extcommunity

vpn-target 0:10000 1:10000 0.39.18.0:10000 0.39.17.0:10000 import-extcommunity

Manual or controller-based

Configure import targets in VPN instance IPv6 address family view.

vpn-target 0:10000 1:10000 0.39.18.0:10000 0.39.17.0:10000  export-extcommunity

vpn-target  0:10000 1:10000 0.39.18.0:10000 0.39.17.0:10000  export-extcommunity

Manual or controller-based

Configure export targets in VPN instance IPv6 address family view.

quit

quit

Manual or controller-based

Return to VPN instance view.

address-family evpn

address-family evpn

Manual or controller-based

Enter VPN instance EVPN address family view.

vpn-target 0:10000 1:10000 0.39.18.0:10000 0.39.17.0:10000 import-extcommunity

vpn-target 0:10000 1:10000 0.39.18.0:10000 0.39.17.0:10000 import-extcommunity

Manual or controller-based

Configure import targets in VPN instance EVPN address family view.

vpn-target 0:10000 1:10000 0.39.18.0:10000 0.39.17.0:10000 export-extcommunity

vpn-target 0:10000 1:10000 0.39.18.0:10000 0.39.17.0:10000 export-extcommunity

Manual or controller-based

Configure export targets in VPN instance EVPN address family view.

quit

quit

Manual or controller-based

Return to VPN instance view.

quit

quit

Manual or controller-based

Return to system view.

ip vpn-instance ZHTESTCTFWNS01VRF

ip vpn-instance ZHTESTCTFWNS01VRF

Manual or controller-based

Configure the VPN instance where firewall NS belongs.

To ensure correct route learning, configure consistent route targets for the NS firewall VPN instance on different devices.

route-distinguisher 1:10001

route-distinguisher 2:10001

Manual or controller-based

Configure an RD for the VPN instance.

address-family ipv4

address-family ipv4

Manual or controller-based

Enter VPN instance IPv4 address family view.

vpn-target 0:10001 1:10001 0.39.17.0:10000 import-extcommunity

vpn-target 0:10001 1:10001 0.39.17.0:10000 import-extcommunity

Manual or controller-based

Configure import targets in VPN instance IPv4 address family view.

vpn-target 0:10001 1:10001 0.39.17.0:10000 export-extcommunity

vpn-target 0:10001 1:10001 0.39.17.0:10000 export-extcommunity

Manual or controller-based

Configure export targets in VPN instance IPv4 address family view.

quit

quit

Manual or controller-based

Return to VPN instance view.

address-family ipv6

address-family ipv6

Manual or controller-based

Enter VPN instance IPv6 address family view.

route-replicate from vpn-instance ZHTESTCTVRF protocol vlink-direct

route-replicate from vpn-instance ZHTESTCTVRF protocol vlink-direct

Manual or controller-based

Redistribute the IPv6 VLINK direct routes of VPN instance ZHTESTCTVRF to the current VPN instance.

vpn-target 0:10001 1:10001 0.39.17.0:10000 import-extcommunity

vpn-target 0:10001 1:10001 0.39.17.0:10000 import-extcommunity

Manual or controller-based

Configure import targets in VPN instance IPv6 address family view.

vpn-target  0:10001 1:10001 0.39.17.0:10000 export-extcommunity

vpn-target  0:10001 1:10001 0.39.17.0:10000  export-extcommunity

Manual or controller-based

Configure export targets in VPN instance IPv6 address family view.

quit

quit

Manual or controller-based

Return to VPN instance view.

address-family evpn

address-family evpn

Manual or controller-based

Enter VPN instance EVPN address family view.

vpn-target 0:10001 1:10001 0.39.17.0:10000 import-extcommunity

vpn-target 0:10001 1:10001 0.39.17.0:10000 import-extcommunity

Manual or controller-based

Configure import targets in VPN instance EVPN address family view.

vpn-target 0:10001 1:10001 0.39.17.0:10000 export-extcommunity

vpn-target0:10001 1:10001 0.39.17.0:10000 export-extcommunity

Manual or controller-based

Configure export targets in VPN instance EVPN address family view.

quit

quit

Manual or controller-based

Return to VPN instance view.

quit

quit

Manual or controller-based

Return to system view.

ip vpn-instance ZHTESTCTFWEW01VRF

ip vpn-instance ZHTESTCTFWEW01VRF

Manual or controller-based

Configure the VPN instance where firewall EW belongs.

To ensure correct route learning, configure consistent route targets for firewall EW VPN instance on different devices.

route-distinguisher 1:10002

route-distinguisher 2:10002

Manual or controller-based

Configure an RD for the VPN instance.

address-family ipv4

address-family ipv4

Manual or controller-based

Enter VPN instance IPv4 address family view.

vpn-target 0:10002 1:10002 0.39.18.0:10000 import-extcommunity

vpn-target 0:10002 1:10002 0.39.18.0:10000 import-extcommunity

Manual or controller-based

Configure import targets in VPN instance IPv4 address family view.

vpn-target 0:10002 1:10002 0.39.18.0:10000 export-extcommunity

vpn-target 0:10002 1:10002 0.39.18.0:10000 export-extcommunity

Manual or controller-based

Configure export targets in VPN instance IPv4 address family view.

quit

quit

Manual or controller-based

Return to VPN instance view.

address-family ipv6

address-family ipv6

Manual or controller-based

Enter VPN instance IPv6 address family view.

route-replicate from vpn-instance ZHTESTCTVRF protocol vlink-direct

route-replicate from vpn-instance ZHTESTCTVRF protocol vlink-direct

Manual or controller-based

Redistribute the IPv6 VLINK direct routes of VPN instance ZHTESTCTVRF to the current VPN instance.

vpn-target 0:10002 1:10002 0.39.18.0:10000 import-extcommunity

vpn-target 0:10002 1:10002 0.39.18.0:10000 import-extcommunity

Manual or controller-based

Configure import targets in VPN instance IPv6 address family view.

vpn-target 0:10002 1:10002 0.39.18.0:10000 export-extcommunity

vpn-target  0:10002 1:10002 0.39.18.0:10000

export-extcommunity

Manual or controller-based

Configure export targets in VPN instance IPv6 address family view.

quit

quit

Manual or controller-based

Return to VPN instance view.

address-family evpn

address-family evpn

Manual or controller-based

Enter VPN instance EVPN address family view.

vpn-target 0:10002 1:10002 0.39.18.0:10000 import-extcommunity

vpn-target 0:10002 1:10002 0.39.18.0:10000 import-extcommunity

Manual or controller-based

Configure import targets in VPN instance EVPN address family view.

vpn-target 0:10002 1:10002 0.39.18.0:10000 export-extcommunity

vpn-target 0:10002 1:10002 0.39.18.0:10000 export-extcommunity

Manual or controller-based

Configure export targets in VPN instance EVPN address family view.

quit

quit

Manual or controller-based

Return to VPN instance view.

quit

quit

Manual or controller-based

Return to system view.

ip route-static vpn-instance ZHTESTCTFWNS01VRF 0.0.0.0 0 vpn-instance ZHTESTCTVRF 197.32.224.18 description SDN_ROUTE

ip route-static vpn-instance ZHTESTCTFWNS01VRF 0.0.0.0 0 vpn-instance ZHTESTCTVRF 197.32.224.18 description SDN_ROUTE

Manual or controller-based

Direct the traffic matching the IPv4 default route of the NS firewall VPN instance to the external network address configured on the border devices in the user VPN instance. This configuration ensures correct forwarding of south-to-north traffic returned from firewall NS.

ipv6 route-static vpn-instance ZHTESTCTFWNS01VRF :: 0 vpn-instance ZHTESTCTVRF FD00:0:97B0:2::F description SDN_ROUTE

ipv6 route-static vpn-instance ZHTESTCTFWNS01VRF :: 0 vpn-instance ZHTESTCTVRF FD00:0:97B0:2::F description SDN_ROUTE

Manual or controller-based

Direct the traffic matching the IPv6 default route of the NS firewall VPN instance to the external network address configured on the border devices in the user VPN instance. This configuration ensures correct forwarding of south-to-north traffic returned from firewall NS.

quit

quit

Manual or controller-based

Return to system view.

m-lag system-mac 0c3a-fa36-ef49

m-lag system-mac 0c3a-fa36-ef49

Manual or controller-based

Set the MAC address of the M-LAG system.

You must assign the same M-LAG system MAC address to the member devices in an M-LAG system.

m-lag system-number 1

m-lag system-number 2

Manual or controller-based

Set the M-LAG system number.

You must assign different M-LAG system numbers to the member devices in an M-LAG system.

m-lag system-priority 10

m-lag system-priority 10

Manual or controller-based

Set the M-LAG system priority.

You must set the same M-LAG system priority on the member devices in an M-LAG system.

m-lag keepalive ip destination 197.32.241.58 source 197.32.241.57 vpn-instance auto-online-mlag

m-lag keepalive ip destination 197.32.241.57 source 197.32.241.58 vpn-instance auto-online-mlag

Manual or controller-based

Configure the source and destination IP addresses of keepalive packets.

The source and destination IP addresses specified on one member device must be the destination and source IP addresses specified on the other, respectively.

m-lag restore-delay 300

m-lag restore-delay 300

Manual or controller-based

Set the data restoration interval.

To avoid packet loss and forwarding failure, increase the data restoration interval if the amount of data is large, for example, when the device has a large number of routes and interfaces.

m-lag mad default-action none

m-lag mad default-action none

Manual or controller-based

Set the M-LAG MAD action to none. When the M-LAG system splits, M-LAG MAD will not shut down any network interfaces, except the interfaces configured manually or by the system to be shut down by M-LAG MAD.

m-lag mad include interface HundredGigE1/0/25

m-lag mad include interface HundredGigE1/0/26

m-lag mad include interface HundredGigE1/0/51

m-lag mad include interface HundredGigE1/0/52

m-lag mad include interface HundredGigE1/0/25

m-lag mad include interface HundredGigE1/0/26

m-lag mad include interface HundredGigE1/0/51

m-lag mad include interface HundredGigE1/0/52

Manual or controller-based

Configure M-LAG MAD to shut down the uplink interfaces and firewall-attached physical interfaces.

interface

Twenty-FiveGigE 1/0/54

interface  Twenty-FiveGigE 1/0/54

Manual or controller-based

Enter the interface view for the keepalive link.

port link-mode route

port link-mode route

Manual or controller-based

Configure the interface for keepalive detection to operate in route mode as a Layer 3 interface.

ip binding vpn-instance auto-online-mlag

ip binding vpn-instance auto-online-mlag

Manual or controller-based

Associate the interface with VPN instance auto-online-mlag, the VPN instance for M-LAG keepalive detection.

ip address 197.32.241.57 255.255.255.252

ip address 197.32.241.58 255.255.255.252

Manual or controller-based

Assign an IP address to the interface as planned.

quit

quit

Manual or controller-based

Return to system view.

interface bridge-aggregation 256

interface bridge-aggregation 256

Manual or controller-based

Create the Layer 2 aggregate interface to be used as peer-link interface, and enter interface view.

link-aggregation mode dynamic

link-aggregation mode dynamic

Manual or controller-based

Configure the aggregate interface to operate in dynamic mode.

quit

quit

Manual or controller-based

Return to system view.

interface HundredGigE1/0/31

interface HundredGigE1/0/31

Manual or controller-based

Enter the view of the physical port for the peer link.

port link-aggregation group 256

port link-aggregation group 256

Manual or controller-based

Assign the physical port to the aggregation group for the peer link (aggregation group 256).

quit

quit

Manual or controller-based

Return to system view.

interface bridge-aggregation 256

interface bridge-aggregation 256

Manual or controller-based

Enter aggregate interface view.

port m-lag peer-link 1

port m-lag peer-link 1

Manual or controller-based

Specify Bridge-Aggregation 256 as the peer-link interface.

port trunk pvid vlan 4094

port trunk pvid vlan 4094

Manual or controller-based

Set the PVID of the physical port to 4094.

undo mac-address static source-check enable

undo mac-address static source-check enable

Manual or controller-based

Disable the static source check feature on Bridge-Aggregation 256.

quit

quit

Manual or controller-based

Return to system view.

interface Vlan-interface 4094

interface Vlan-interface 4094

Manual or controller-based

Create a VLAN interface on each of the M-LAG member devices to establish Layer 3 connectivity for forwarding packets from devices single-homed to only one M-LAG interface. This example uses VLAN-interface 4094.

ip address 197.32.241.141 255.255.255.0

ip address 197.32.241.142 255.255.255.0

Manual or controller-based

Assign an IP address to VLAN-interface 4094.

ospf 65530 area 0.0.0.0

ospf 65530 area 0.0.0.0

Manual or controller-based

Configure OSPF on VLAN-interface 4094.

interface bridge-aggregation 257

interface bridge-aggregation 257

Manual or controller-based

Create the Layer 2 aggregate interface to be used as the M-LAG interface connected to firewall EW.

link-aggregation mode dynamic

link-aggregation mode dynamic

Manual or controller-based

Configure the aggregate interface to operate in dynamic mode.

port m-lag group 1

port m-lag group 1

Manual or controller-based

Assign the aggregate interface (Bridge-Aggregation 257) to M-LAG group 1.

port link-type trunk

port link-type trunk

Manual or controller-based

Set the link type of M-LAG interface Bridge-Aggregation 257 to trunk.

port trunk permit vlan 1 997 to 1000

port trunk permit vlan 1 997 to 1000

Manual or controller-based

Assign M-LAG interface Bridge-Aggregation 257 to VLANs 997 through 1000.

quit

quit

Manual or controller-based

Return to system view.

interface HundredGigE1/0/51

interface HundredGigE1/0/51

Manual or controller-based

Enter the view of the physical port connected to firewall EW.

port link-type trunk

port link-type trunk

Manual or controller-based

Set the link type of the physical port to trunk.

port trunk permit vlan 1 997 to 1000

port trunk permit vlan 1 997 to 1000

Manual or controller-based

Assign the physical port to VLANs 997 through 1000.

port link-aggregation group 257

port link-aggregation group 257

Manual or controller-based

Assign the physical port to aggregation group 257. This is the aggregation group for the aggregate interface connected to firewall EW.

quit

quit

Manual or controller-based

Return to system view.

interface bridge-aggregation 258

interface bridge-aggregation 258

Manual or controller-based

Create the Layer 2 aggregate interface to be used as the M-LAG interface connected to firewall NS.

link-aggregation mode dynamic

link-aggregation mode dynamic

Manual or controller-based

Configure the aggregate interface to operate in dynamic mode.

port m-lag group 2

port m-lag group 2

Manual or controller-based

Assign the aggregate interface (Bridge-Aggregation 258) to M-LAG group 2.

port link-type trunk

port link-type trunk

Manual or controller-based

Set the link type of M-LAG interface Bridge-Aggregation 258 to trunk.

port trunk permit vlan 1 997 to 1000

port trunk permit vlan 1 997 to 1000

Manual or controller-based

Assign M-LAG interface Bridge-Aggregation 258 to VLANs 997 through 1000.

quit

quit

Manual or controller-based

Return to system view.

interface HundredGigE1/0/52

interface HundredGigE1/0/52

Manual or controller-based

Enter the view of the physical port connected to firewall NS.

port link-type trunk

port link-type trunk

Manual or controller-based

Set the link type of the physical port to trunk.

port trunk permit vlan 1 997 to 1000

port trunk permit vlan 1 997 to 1000

Manual or controller-based

Assign the physical port to VLANs 997 through 1000.

port link-aggregation group 258

port link-aggregation group 258

Manual or controller-based

Assign the physical port to aggregation group 258. This is the aggregation group for the aggregate interface connected to firewall NS.

interface HundredGigE1/0/25

interface HundredGigE1/0/25

Manual or controller-based

Enter the view of the physical interface connected to Spine A.

port link-mode route

port link-mode route

Manual or controller-based

Configure the interface to operate in route mode as a Layer 3 interface.

ip address unnumbered interface LoopBack0

ip address unnumbered interface LoopBack0

Manual or controller-based

Configure the interface to borrow the IP address of Loopback 0.

ospf network-type p2p

ospf network-type p2p

Manual or controller-based

Set the OSPF network type of the interface to P2P.

ospf 65530 area 0.0.0.0

ospf 65530 area 0.0.0.0

Manual or controller-based

Enable OSPF on the interface.

undo mac-address static source-check enable

undo mac-address static source-check enable

Manual or controller-based

Disable the static source check feature on the interface.

lldp compliance admin-status cdp txrx

lldp compliance admin-status cdp txrx

Manual or controller-based

Configure CDP-compatible LLDP to operate in TxRx mode. In this mode, LLDP both sends and receives CDP packets.

lldp management-address arp-learning

lldp management-address arp-learning

Manual or controller-based

Enable the device to generate an ARP entry after it receives an LLDP frame that contains a management address TLV on the interface.

lldp tlv-enable basic-tlv management-address-tlv interface LoopBack0

lldp tlv-enable basic-tlv management-address-tlv interface LoopBack0

Manual or controller-based

Specify advertisable TLVs on the interface.

quit

quit

Manual or controller-based

Return to system view.

interface HundredGigE1/0/26

interface HundredGigE1/0/26

Manual or controller-based

Enter the view of the physical interface connected to Spine B.

port link-mode route

port link-mode route

Manual or controller-based

Configure the interface to operate in route mode as a Layer 3 interface.

ip address unnumbered interface LoopBack0

ip address unnumbered interface LoopBack0

Manual or controller-based

Configure the interface to borrow the IP address of Loopback 0.

ospf network-type p2p

ospf network-type p2p

Manual or controller-based

Set the OSPF network type of the interface to P2P.

ospf 65530 area 0.0.0.0

ospf 65530 area 0.0.0.0

Manual or controller-based

Enable OSPF on the interface.

undo mac-address static source-check enable

undo mac-address static source-check enable

Manual or controller-based

Disable the static source check feature on the interface.

lldp compliance admin-status cdp txrx

lldp compliance admin-status cdp txrx

Manual or controller-based

Configure CDP-compatible LLDP to operate in TxRx mode. In this mode, LLDP both sends and receives CDP packets.

lldp management-address arp-learning

lldp management-address arp-learning

Manual or controller-based

Enable the device to generate an ARP entry after it receives an LLDP frame that contains a management address TLV on the interface.

lldp tlv-enable basic-tlv management-address-tlv interface LoopBack0

lldp tlv-enable basic-tlv management-address-tlv interface LoopBack0

Manual or controller-based

Specify advertisable TLVs on the interface.

l2vpn enable

l2vpn enable

Manual or controller-based

Enable L2VPN.

l2vpn m-lag peer-link ac-match-rule vxlan-mapping

l2vpn m-lag peer-link ac-match-rule vxlan-mapping

Manual or controller-based

Enable the device to create frame match criteria based on VXLAN IDs for the dynamic ACs on the peer link.

Perform this task when the M-LAG system uses a direct physical link as the peer link.

vxlan tunnel arp-learning disable

vxlan tunnel nd-learning disable

vxlan tunnel arp-learning disable

vxlan tunnel nd-learning disable

Manual or controller-based

Disable remote ARP learning. This setting avoids the conflict between automatically learned ARP entries and ARP entries advertised through BGP EVPN.

vxlan tunnel mac-learning disable

vxlan tunnel mac-learning disable

Manual or controller-based

Disable remote MAC address learning. This setting avoids the conflict between automatically learned MAC address entries and MAC address entries advertised through BGP EVPN.

vxlan default-decapsulation source interface LoopBack0

vxlan default-decapsulation source interface LoopBack0

Manual or controller-based

Enable the device to always decapsulate the VXLAN packets destined for the IP address of Loopback 0, whether or not it has a VXLAN tunnel for them.

vlan all

vlan all

Manual or controller-based

Create VLANs 1 through 4094.

evpn m-lag group 197.32.241.55

evpn m-lag group 197.32.241.55

Manual or controller-based

Enable EVPN M-LAG and set the virtual VTEP address.

evpn m-lag local 197.32.241.41 remote 197.32.241.42

evpn m-lag local 197.32.241.42 remote 197.32.241.41

Manual or controller-based

Specify the IP addresses of the local and peer VTEPs in the M-LAG system.

This step is required if the M-LAG system uses a direct physical link as the peer link and has ACs attached to only one of the member devices.

evpn global-mac 0c3a-fa38-4695

evpn global-mac 0c3a-fa38-4695

Manual or controller-based

Configure an EVPN global MAC address.

interface Vsi-interface10997

interface Vsi-interface10997

Manual or controller-based

Create the VSI interface to be used as a distributed EVPN gateway member for routing traffic to firewall NS.

ip binding vpn-instance ZHTESTCTFWNS01VRF

ip binding vpn-instance ZHTESTCTFWNS01VRF

Manual or controller-based

Associate the VSI interface with the VPN instance for firewall NS.

ip address 197.32.224.21 255.255.255.252 sub

ipv6 nd ra prefix FD00:0:97B0:100::/64 no-advertise

 ipv6 address FD00:0:97B0:100::1/64

ip address 197.32.224.21 255.255.255.252 sub

ipv6 nd ra prefix FD00:0:97B0:100::/64 no-advertise

 ipv6 address FD00:0:97B0:100::1/64

Manual or controller-based

Assign an IP address to the VSI interface.

You must assign the same IP address to all members of the distributed EVPN gateway for a VXLAN on different devices.

mac-address 6805-ca21-d6e5

mac-address 6805-ca21-d6e5

Manual or controller-based

Assign a MAC address to the distributed EVPN gateway.

You must assign the same MAC address to all members of the distributed EVPN gateway for a VXLAN on different devices.

arp route-direct advertise

arp route-direct advertise

Manual or controller-based

Enable ARP direct route advertisement.

distributed-gateway local

distributed-gateway local

Manual or controller-based

Enable distributed gateway service on the VSI interface.

quit

quit

Manual or controller-based

Return to system view.

interface Vsi-interface10998

interface Vsi-interface10998

Manual or controller-based

Create the VSI interface to be used as a distributed EVPN gateway member for receiving traffic returned from firewall NS.

ip binding vpn-instance ZHTESTCTFWNS01VRF

ip binding vpn-instance ZHTESTCTFWNS01VRF

Manual or controller-based

Associate the VSI interface with the VPN instance for firewall NS.

ip address 197.32.224.25 255.255.255.252 sub

ipv6 nd ra prefix FD00:0:97B0:101::/64 no-advertise

 ipv6 address FD00:0:97B0:101::1/64

ip address 197.32.224.25 255.255.255.252 sub

ipv6 nd ra prefix FD00:0:97B0:101::/64 no-advertise

 ipv6 address FD00:0:97B0:101::1/64

Manual or controller-based

Assign an IP address to the VSI interface.

You must assign the same IP address to all members of the distributed EVPN gateway for a VXLAN on different devices.

mac-address 6805-ca21-d6e5

mac-address 6805-ca21-d6e5

Manual or controller-based

Assign a MAC address to the distributed EVPN gateway.

You must assign the same MAC address to all members of the distributed EVPN gateway for a VXLAN on different devices.

arp route-direct advertise

arp route-direct advertise

Manual or controller-based

Enable ARP direct route advertisement.

distributed-gateway local

distributed-gateway local

Manual or controller-based

Enable distributed gateway service on the VSI interface.

quit

quit

Manual or controller-based

Return to system view.

interface Vsi-interface10999

interface Vsi-interface10999

Manual or controller-based

Create the VSI interface to be used as a distributed EVPN gateway member for routing traffic to firewall EW.

ip binding vpn-instance ZHTESTCTFWEW01VRF

ip binding vpn-instance ZHTESTCTFWEW01VRF

Manual or controller-based

Associate the VSI interface with the VPN instance for firewall EW.

ip address 197.32.224.29 255.255.255.252 sub

ipv6 nd ra prefix FD00:0:97B0:102::/64 no-advertise

 ipv6 address FD00:0:97B0:102::1/64

ip address 197.32.224.29 255.255.255.252 sub

ipv6 nd ra prefix FD00:0:97B0:102::/64 no-advertise

 ipv6 address FD00:0:97B0:102::1/64

Manual or controller-based

Assign an IP address to the VSI interface.

You must assign the same IP address to all members of the distributed EVPN gateway for a VXLAN on different devices.

mac-address 6805-ca21-d6e5

mac-address 6805-ca21-d6e5

Manual or controller-based

Assign a MAC address to the distributed EVPN gateway.

You must assign the same MAC address to all members of the distributed EVPN gateway for a VXLAN on different devices.

arp route-direct advertise

arp route-direct advertise

Manual or controller-based

Enable ARP direct route advertisement.

distributed-gateway local

distributed-gateway local

Manual or controller-based

Enable distributed gateway service on the VSI interface.

quit

quit

Manual or controller-based

Return to system view.

interface Vsi-interface11000

interface Vsi-interface11000

Manual or controller-based

Create the VSI interface to be used as a distributed EVPN gateway member for receiving  traffic returned from firewall EW.

ip binding vpn-instance ZHTESTCTFWEW01VRF

ip binding vpn-instance ZHTESTCTFWEW01VRF

Manual or controller-based

Associate the VSI interface with the VPN instance for firewall EW.

ip address 197.32.224.33 255.255.255.252 sub

ipv6 nd ra prefix FD00:0:97B0:103::/64 no-advertise

 ipv6 address FD00:0:97B0:103::1/64

ip address 197.32.224.33 255.255.255.252 sub

ipv6 nd ra prefix FD00:0:97B0:103::/64 no-advertise

 ipv6 address FD00:0:97B0:103::1/64

Manual or controller-based

Assign an IP address to the VSI interface.

You must assign the same IP address to all members of the distributed EVPN gateway for a VXLAN on different devices.

mac-address 6805-ca21-d6e5

mac-address 6805-ca21-d6e5

Manual or controller-based

Assign a MAC address to the distributed EVPN gateway.

You must assign the same MAC address to all members of the distributed EVPN gateway for a VXLAN on different devices.

arp route-direct advertise

arp route-direct advertise

Manual or controller-based

Enable ARP direct route advertisement.

distributed-gateway local

distributed-gateway local

Manual or controller-based

Enable distributed gateway service on the VSI interface.

quit

quit

Manual or controller-based

Return to system view.

vsi SDN_VSI_10997

vsi SDN_VSI_10997

Manual or controller-based

Create the VSI for sending traffic to firewall NS.

gateway vsi-interface 10997

gateway vsi-interface 10997

Manual or controller-based

Specify a gateway interface for the VSI.

arp suppression enable

ipv6 nd suppression enable

arp suppression enable

ipv6 nd suppression enable

Manual or controller-based

Enable ARP flood suppression and ND flood suppression.

vxlan 10997

vxlan 10997

Manual or controller-based

Create VXLAN 10997.

quit

quit

Manual or controller-based

Return to VSI view.

evpn encapsulation vxlan

evpn encapsulation vxlan

Manual or controller-based

Create a VXLAN EVPN instance on the VSI.

route-distinguisher auto

route-distinguisher auto

Manual or controller-based

Configure the device to automatically generate an RD for the EVPN instance.

vpn-target auto export-extcommunity

vpn-target auto export-extcommunity

Manual or controller-based

Configure the device to automatically generate an export RT for the EVPN instance.

vpn-target auto import-extcommunity

vpn-target auto import-extcommunity

Manual or controller-based

Configure the device to automatically generate an import RT for the EVPN instance.

quit

quit

quit

quit

Manual or controller-based

Return to system view.

vsi SDN_VSI_10998

vsi SDN_VSI_10998

Manual or controller-based

Create the VSI for receiving traffic from firewall NS.

gateway vsi-interface 10998

gateway vsi-interface 10998

Manual or controller-based

Specify a gateway interface for the VSI.

arp suppression enable

ipv6 nd suppression enable

arp suppression enable

ipv6 nd suppression enable

Manual or controller-based

Enable ARP flood suppression and ND flood suppression.

vxlan 10998

vxlan 10998

Manual or controller-based

Create VXLAN 10998.

quit

quit

Manual or controller-based

Return to VSI view.

evpn encapsulation vxlan

evpn encapsulation vxlan

Manual or controller-based

Create a VXLAN EVPN instance on the VSI.

route-distinguisher auto

route-distinguisher auto

Manual or controller-based

Configure the device to automatically generate an RD for the EVPN instance.

vpn-target auto export-extcommunity

vpn-target auto export-extcommunity

Manual or controller-based

Configure the device to automatically generate an export RT for the EVPN instance.

vpn-target auto import-extcommunity

vpn-target auto import-extcommunity

Manual or controller-based

Configure the device to automatically generate an import RT for the EVPN instance.

quit

quit

quit

quit

Manual or controller-based

Return to system view.

vsi SDN_VSI_10999

vsi SDN_VSI_10999

Manual or controller-based

Create the VSI for sending traffic to firewall EW.

gateway vsi-interface 10999

gateway vsi-interface 10999

Manual or controller-based

Specify a gateway interface for the VSI.

arp suppression enable

ipv6 nd suppression enable

arp suppression enable

ipv6 nd suppression enable

Manual or controller-based

Enable ARP flood suppression and ND flood suppression.

vxlan 10999

vxlan 10999

Manual or controller-based

Create VXLAN 10999.

quit

quit

Manual or controller-based

Return to VSI view.

evpn encapsulation vxlan

evpn encapsulation vxlan

Manual or controller-based

Create a VXLAN EVPN instance on the VSI.

route-distinguisher auto

route-distinguisher auto

Manual or controller-based

Configure the device to automatically generate an RD for the EVPN instance.

vpn-target auto export-extcommunity

vpn-target auto export-extcommunity

Manual or controller-based

Configure the device to automatically generate an export RT for the EVPN instance.

vpn-target auto import-extcommunity

vpn-target auto import-extcommunity

Manual or controller-based

Configure the device to automatically generate an import RT for the EVPN instance.

quit

quit

quit

quit

Manual or controller-based

Return to system view.

vsi SDN_VSI_11000

vsi SDN_VSI_11000

Manual or controller-based

Create the VSI for receiving traffic from firewall EW.

gateway vsi-interface 11000

gateway vsi-interface 11000

Manual or controller-based

Specify a gateway interface for the VSI.

arp suppression enable

ipv6 nd suppression enable

arp suppression enable

ipv6 nd suppression enable

Manual or controller-based

Enable ARP flood suppression and ND flood suppression.

vxlan 11000

vxlan 11000

Manual or controller-based

Create VXLAN 11000.

quit

quit

Manual or controller-based

Return to VSI view.

evpn encapsulation vxlan

evpn encapsulation vxlan

Manual or controller-based

Create a VXLAN EVPN instance on the VSI.

route-distinguisher auto

route-distinguisher auto

Manual or controller-based

Configure the device to automatically generate an RD for the EVPN instance.

vpn-target auto export-extcommunity

vpn-target auto export-extcommunity

Manual or controller-based

Configure the device to automatically generate an export RT for the EVPN instance.

vpn-target auto import-extcommunity

vpn-target auto import-extcommunity

Manual or controller-based

Configure the device to automatically generate an import RT for the EVPN instance.

quit

quit

quit

quit

Manual or controller-based

Return to system view.

interface Vsi-interface10001

interface Vsi-interface10001

Manual or controller-based

Create the VSI interface for L3 connectivity to firewall NS.

ip binding vpn-instance ZHTESTCTFWNS01VRF

ip binding vpn-instance ZHTESTCTFWNS01VRF

Manual or controller-based

Associate the VSI interface with the VPN instance for firewall NS.

ipv6 address auto link-local

ipv6 address auto link-local

Manual or controller-based

Automatically generate a link-local address for the VSI interface.

l3-vni 10001

l3-vni 10001

Manual or controller-based

Assign an L3VNI to the interface.

quit

quit

Manual or controller-based

Return to system view.

interface Vsi-interface10002

interface Vsi-interface10002

Manual or controller-based

Create the VSI interface for L3 connectivity to firewall EW.

ip binding vpn-instance ZHTESTCTFWEW01VRF

ip binding vpn-instance ZHTESTCTFWEW01VRF

Manual or controller-based

Associate the VSI interface with the VPN instance for firewall EW.

ipv6 address auto link-local

ipv6 address auto link-local

Manual or controller-based

Automatically generate a link-local address for the VSI interface.

l3-vni 10002

l3-vni 10002

Manual or controller-based

Assign an L3VNI to the interface.

quit

quit

Manual or controller-based

Return to system view.

interface Vsi-interface10000

interface Vsi-interface10000

Manual or controller-based

Create the VSI interface for L3 connectivity to servers.

ip binding vpn-instance ZHTESTCTVRF

ip binding vpn-instance ZHTESTCTVRF

Manual or controller-based

Associate the VSI interface with the VPN instance for servers.

ipv6 address auto link-local

ipv6 address auto link-local

Manual or controller-based

Automatically generate a link-local address for the VSI interface.

l3-vni 10000

l3-vni 10000

Manual or controller-based

Assign an L3VNI to the interface.

bgp 65530

bgp 65530

Manual or controller-based

Enable the specified BGP instance and enter its view.

non-stop-routing

non-stop-routing

Manual or controller-based

Enable BGP nonstop routing (NSR).

router-id 197.32.241.41

router-id 197.32.241.42

Manual or controller-based

Specify a unique router ID for the BGP instance on each BGP device.

group evpn internal

group evpn internal

Manual or controller-based

Create an IBGP peer group named evpn.

peer evpn connect-interface LoopBack0

peer evpn connect-interface LoopBack0

Manual or controller-based

Specify a source interface for establishing TCP connections to a peer or peer group.

peer 197.32.241.37 group evpn

peer 197.32.241.37 group evpn

Manual or controller-based

Add node Spine A to IBGP group evpn.

peer 197.32.241.38 group evpn

peer 197.32.241.38 group evpn

Manual or controller-based

Add node Spine B to IBGP group evpn.

address-family l2vpn evpn

address-family l2vpn evpn

Manual or controller-based

Create the BGP EVPN address family and enter its view.

peer evpn enable

peer evpn enable

Manual or controller-based

Enable BGP to exchange BGP EVPN routes with IBGP peer group evpn.

quit

quit

Manual or controller-based

Return to BGP instance view.

ip vpn-instance ZHTESTCTFWEW01VRF

ip vpn-instance ZHTESTCTFWEW01VRF

Manual or controller-based

Create a BGP-VPN instance for the VPN instance that contains firewall EW, and enter BGP-VPN instance view.

address-family ipv4 unicast

address-family ipv4 unicast

Manual or controller-based

Create the BGP-VPN IPv4 unicast address family and enter its view.

balance 4

balance 4

Manual or controller-based

Enable load balancing and set the maximum number of BGP ECMP routes for load balancing.

network 197.32.224.28 255.255.255.252

network 197.32.224.29 255.255.255.255

network 197.32.224.30 255.255.255.255

network 197.32.224.32 255.255.255.252

network 197.32.224.33 255.255.255.255

network 197.32.224.34 255.255.255.255

network 197.32.224.28 255.255.255.252

network 197.32.224.29 255.255.255.255

network 197.32.224.30 255.255.255.255

network 197.32.224.32 255.255.255.252

network 197.32.224.33 255.255.255.255

network 197.32.224.34 255.255.255.255

Manual or controller-based

Specify the local networks to be advertised by BGP.

quit

quit

quit

quit

Manual or controller-based

Return to BGP instance view.

address-family ipv6 unicast

address-family ipv6 unicast

Manual or controller-based

Create the BGP-VPN IPv6 unicast address family and enter its view.

balance 4

balance 4

Manual or controller-based

Enable load balancing and set the maximum number of BGP ECMP routes for load balancing.

network FD00:0:97B0:102:: 64

network FD00:0:97B0:102::1 128

network FD00:0:97B0:102::F 128

network FD00:0:97B0:103:: 64

network FD00:0:97B0:103::1 128

network FD00:0:97B0:103::F 128

network FD00:0:97B0:102:: 64

network FD00:0:97B0:102::1 128

network FD00:0:97B0:102::F 128

network FD00:0:97B0:103:: 64

network FD00:0:97B0:103::1 128

network FD00:0:97B0:103::F 128

Manual or controller-based

Specify the local networks to be advertised by BGP.

quit

quit

quit

quit

Manual or controller-based

Return to BGP instance view.

ip vpn-instance ZHTESTCTFWNS01VRF

ip vpn-instance ZHTESTCTFWNS01VRF

Manual or controller-based

Create a BGP-VPN instance for the VPN instance that contains firewall NS, and enter BGP-VPN instance view.

address-family ipv4 unicast

address-family ipv4 unicast

Manual or controller-based

Create the BGP-VPN IPv4 unicast address family and enter its view.

balance 4

balance 4

Manual or controller-based

Enable load balancing and set the maximum number of BGP ECMP routes for load balancing.

network 197.32.224.20 255.255.255.252

network 197.32.224.21 255.255.255.255

network 197.32.224.22 255.255.255.255

network 197.32.224.24 255.255.255.252

network 197.32.224.25 255.255.255.255

network 197.32.224.26 255.255.255.255

network 197.32.224.20 255.255.255.252

network 197.32.224.21 255.255.255.255

network 197.32.224.22 255.255.255.255

network 197.32.224.24 255.255.255.252

network 197.32.224.25 255.255.255.255

network 197.32.224.26 255.255.255.255

Manual or controller-based

Specify the local networks to be advertised by BGP.

quit

quit

quit

quit

Manual or controller-based

Return to BGP instance view.

address-family ipv6 unicast

address-family ipv6 unicast

Manual or controller-based

Create the BGP-VPN IPv6 unicast address family and enter its view.

balance 4

balance 4

Manual or controller-based

Enable load balancing and set the maximum number of BGP ECMP routes for load balancing.

network FD00:0:97B0:102:: 64

network FD00:0:97B0:102::1 128

network FD00:0:97B0:102::F 128

network FD00:0:97B0:103:: 64

network FD00:0:97B0:103::1 128

network FD00:0:97B0:103::F 128

network FD00:0:97B0:102:: 64

network FD00:0:97B0:102::1 128

network FD00:0:97B0:102::F 128

network FD00:0:97B0:103:: 64

network FD00:0:97B0:103::1 128

network FD00:0:97B0:103::F 128

Manual or controller-based

Specify the local networks to be advertised by BGP.

quit

quit

quit

quit

Manual or controller-based

Return to BGP instance view.

ip vpn-instance ZHTESTCTVRF

ip vpn-instance ZHTESTCTVRF

Manual or controller-based

Create a BGP-VPN instance for the VPN instance that contains servers, and enter BGP-VPN instance view.

address-family ipv4 unicast

address-family ipv4 unicast

Manual or controller-based

Create the BGP-VPN IPv4 unicast address family and enter its view.

balance 4

balance 4

Manual or controller-based

Enable load balancing and set the maximum number of BGP ECMP routes for load balancing.

network 197.32.13.0 255.255.255.0

network 197.32.13.254 255.255.255.255

network 197.32.42.0 255.255.255.0

network 197.32.42.254 255.255.255.255

network 197.32.13.0 255.255.255.0

network 197.32.13.254 255.255.255.255

network 197.32.42.0 255.255.255.0

network 197.32.42.254 255.255.255.255

Manual or controller-based

Specify the local networks to be advertised by BGP.

address-family ipv6 unicast

address-family ipv6 unicast

Manual or controller-based

Create the BGP-VPN IPv6 unicast address family and enter its view.

balance 4

balance 4

Manual or controller-based

Enable load balancing and set the maximum number of BGP ECMP routes for load balancing.

network FD00:0:97B0:1013:: 64

network FD00:0:97B0:1013::FFFF 128

network FD00:0:97B0:1042:: 64

network FD00:0:97B0:1042::FFFF 128

network FD00:0:97B0:1013:: 64

network FD00:0:97B0:1013::FFFF 128

network FD00:0:97B0:1042:: 64

network FD00:0:97B0:1042::FFFF 128

Manual or controller-based

Specify the local networks to be advertised by BGP.

interface Bridge-Aggregation257

interface Bridge-Aggregation257

Manual or controller-based

Enter the view of the aggregate interface connected to firewall EW.

service-instance 997

service-instance 997

Manual or controller-based

Create an Ethernet service instance.

encapsulation s-vid 997

encapsulation s-vid 997

Manual or controller-based

Specify the outer VLAN IDs to match.

xconnect vsi SDN_VSI_10997

xconnect vsi SDN_VSI_10997

Manual or controller-based

Map the AC to a VSI.

service-instance 998

service-instance 998

Manual or controller-based

Create an Ethernet service instance.

encapsulation s-vid 998

encapsulation s-vid 998

Manual or controller-based

Specify the outer VLAN IDs to match.

xconnect vsi SDN_VSI_10998

xconnect vsi SDN_VSI_10998

Manual or controller-based

Map the AC to a VSI.

quit

quit

Manual or controller-based

Return to interface view.

service-instance 999

service-instance 999

Manual or controller-based

Create an Ethernet service instance.

encapsulation s-vid 999

encapsulation s-vid 999

Manual or controller-based

Specify the outer VLAN IDs to match.

xconnect vsi SDN_VSI_10999

xconnect vsi SDN_VSI_10999

Manual or controller-based

Map the AC to a VSI.

quit

quit

Manual or controller-based

Return to interface view.

service-instance 1000

service-instance 1000

Manual or controller-based

Create an Ethernet service instance.

encapsulation s-vid1000

encapsulation s-vid 1000

Manual or controller-based

Specify the outer VLAN IDs to match.

xconnect vsi SDN_VSI_11000

xconnect vsi SDN_VSI_11000

Manual or controller-based

Map the AC to a VSI.

quit

quit

quit

quit

Manual or controller-based

Return to system view.

interface Bridge-Aggregation258

interface Bridge-Aggregation258

Manual or controller-based

Enter the view of the aggregate interface connected to firewall NS.

service-instance 997

service-instance 997

Manual or controller-based

Create an Ethernet service instance.

encapsulation s-vid 997

encapsulation s-vid 997

Manual or controller-based

Specify the outer VLAN IDs to match.

xconnect vsi SDN_VSI_10997

xconnect vsi SDN_VSI_10997

Manual or controller-based

Map the AC to a VSI.

quit

quit

Manual or controller-based

Return to interface view.

service-instance 998

service-instance 998

Manual or controller-based

Create an Ethernet service instance.

encapsulation s-vid 998

encapsulation s-vid 998

Manual or controller-based

Specify the outer VLAN IDs to match.

xconnect vsi SDN_VSI_10998

xconnect vsi SDN_VSI_10998

Manual or controller-based

Map the AC to a VSI.

quit

quit

Manual or controller-based

Return to interface view.

service-instance 999

service-instance 999

Manual or controller-based

Create an Ethernet service instance.

encapsulation s-vid 999

encapsulation s-vid 999

Manual or controller-based

Specify the outer VLAN IDs to match.

xconnect vsi SDN_VSI_10999

xconnect vsi SDN_VSI_10999

Manual or controller-based

Map the AC to a VSI.

quit

quit

Manual or controller-based

Return to interface view.

service-instance 1000

service-instance 1000

Manual or controller-based

Create an Ethernet service instance.

encapsulation s-vid1000

encapsulation s-vid 1000

Manual or controller-based

Specify the outer VLAN IDs to match.

xconnect vsi SDN_VSI_11000

xconnect vsi SDN_VSI_11000

Manual or controller-based

Map the AC to a VSI.

quit

quit

quit

quit

Manual or controller-based

Return to system view.

router id 197.32.241.43

router id 197.32.241.44

Manual or controller-based

Specify a unique global router ID for each device.

N/A

ospf 65530

ospf 65530

Manual or controller-based

Create OSPF process 65530.

N/A

non-stop-routing

non-stop-routing

Manual or controller-based

Enable non-stop routing (NSR) for OSPF.

N/A

stub-router include-stub on-startup 900

stub-router include-stub on-startup 900

Manual or controller-based

To accelerate network convergence, specify the router as a stub router during reboot for the specified period of time.

This command sets the cost of stub links to the maximum value (65535). Neighbors on such links will not send packets to the stub router as long as they have a route with a smaller cost.

area 0.0.0.0

area 0.0.0.0

Manual or controller-based

Create OSPF area 0.0.0.0.

N/A

interface loopback 0

interface loopback 0

Manual or controller-based

Enter the interface view of Loopback 0.

N/A

ospf 65530 area 0.0.0.0

ospf 65530 area 0.0.0.0

Manual or controller-based

Enable OSPF on interface Loopback 0.

N/A

quit

quit

Manual or controller-based

Return to system view.

N/A

interface loopback 2

interface loopback 2

Manual or controller-based

Enter the interface view of Loopback 2.

N/A

ospf 65530 area 0.0.0.0

ospf 65530 area 0.0.0.0

Manual or controller-based

Enable OSPF on interface Loopback 2.

N/A

interface loopback 0

interface loopback 0

Manual or controller-based

Configure interface Loopback 0.

N/A

ip address 197.32.241.43 255.255.255.255

ip address 197.32.241.44 255.255.255.255

Manual or controller-based

Assign an IP address to interface Loopback 0.

N/A

quit

quit

Manual or controller-based

Return to system view.

N/A

interface loopback 2

interface loopback 2

Manual or controller-based

Configure interface Loopback 2.

N/A

ip address 197.32.241.64 255.255.255.255

ip address 197.32.241.64 255.255.255.255

Manual or controller-based

Assign an IP address to interface Loopback 2.

N/A

ip vpn-instance auto-online-mlag

ip vpn-instance auto-online-mlag

Manual or controller-based

Create a VPN instance for the M-LAG keepalive link. In this example, the VPN instance name is auto-online-mlag.

N/A

quit

quit

Manual or controller-based

Return to system view.

N/A

ip vpn-instance mgmt

ip vpn-instance mgmt

Manual or controller-based

Create a VPN instance for the management port. In this example, the VPN instance name is mgmt.

N/A

quit

quit

Manual or controller-based

Return to system view.

N/A

ip vpn-instance ZHTESTCTVRF

 route-distinguisher3:10000

 address-family ipv4

  vpn-target 0:10000 1:10000 0.39.18.0:10000 0.39.17.0:10000 import-extcommunity

  vpn-target 0:10000 1:10000 0.39.18.0:10000 0.39.17.0:10000 export-extcommunity

  quit

address-family ipv6

  vpn-target 0:10000 1:10000 0.39.18.0:10000 0.39.17.0:10000 import-extcommunity

  vpn-target 0:10000 1:10000 0.39.18.0:10000 0.39.17.0:10000 export-extcommunity

quit

 address-family evpn

  vpn-target 0:10000 1:10000 0.39.18.0:10000 0.39.17.0:10000 import-extcommunity

  vpn-target0:10000 1:10000 0.39.18.0:10000 0.39.17.0:10000 export-extcommunity

  quit

ip vpn-instance ZHTESTCTVRF

 route-distinguisher 4:10000

 address-family ipv4

  vpn-target 0:10000 1:10000 0.39.18.0:10000 0.39.17.0:10000 import-extcommunity

  vpn-target 0:10000 1:10000 0.39.18.0:10000 0.39.17.0:10000 export-extcommunity

  quit

address-family ipv6

  vpn-target 0:10000 1:10000 0.39.18.0:10000 0.39.17.0:10000 import-extcommunity

  vpn-target 0:10000 1:10000 0.39.18.0:10000 0.39.17.0:10000

export-extcommunity

quit

 address-family evpn

  vpn-target 0:10000 1:10000 0.39.18.0:10000 0.39.17.0:10000 import-extcommunity

  vpn-target 0:10000 1:10000 0.39.18.0:10000 0.39.17.0:10000 export-extcommunity

  quit

Manual or controller-based

Configure the VPN instance for user services. Set an RD for the VPN instance, and set the import and export RTs for the VPN instance IPv4/IPv6 address family and EVPN address family.

For two devices to learn routes from each other in the VPN instance, make sure the import RTs on one device match the export RTs on the other.

quit

quit

Manual or controller-based

Return to system view.

N/A

ip vpn-instance ZHTESTCTFWNS01VRF

 route-distinguisher 3:10001

 address-family ipv4

  vpn-target 0:10001 1:10001 0.39.17.0:10000 import-extcommunity

  vpn-target 0:10001 1:10001 0.39.17.0:10000 export-extcommunity

  quit

address-family ipv6

  vpn-target 0:10001 1:10001 0.39.17.0:10000 import-extcommunity

  vpn-target 0:10001 1:10001 0.39.17.0:10000

export-extcommunity

quit

 address-family evpn

  vpn-target 0:10001 1:10001 0.39.17.0:10000 import-extcommunity

  vpn-target 0:10001 1:10001 0.39.17.0:10000 export-extcommunity

  quit

ip vpn-instance ZHTESTCTFWNS01VRF

 route-distinguisher 4:10001

 address-family ipv4

  vpn-target 0:10001 1:10001 0.39.17.0:10000 import-extcommunity

  vpn-target 0:10001 1:10001 0.39.17.0:10000 export-extcommunity

  quit

  address-family ipv6

  vpn-target 0:10001 1:10001 0.39.17.0:10000 import-extcommunity

  vpn-target 0:10001 1:10001 0.39.17.0:10000

export-extcommunity

quit

address-family evpn

  vpn-target 0:10001 1:10001 0.39.17.0:10000 import-extcommunity

  vpn-target 0:10001 1:10001 0.39.17.0:10000 export-extcommunity

  quit

Manual or controller-based

Configure the VPN instance for the north-south firewall service. Set an RD for the VPN instance, and set the import and export RTs for the VPN instance IPv4/IPv6 address family and EVPN address family.

For two devices to learn routes from each other in the VPN instance, make sure the import RTs on one device match the export RTs on the other.

quit

quit

Manual or controller-based

Return to system view.

N/A

ip vpn-instance ZHTESTCTFWEW01VRF

 route-distinguisher 3:10002

 address-family ipv4

  vpn-target 0:10002 1:10002 0.39.18.0:10000 import-extcommunity

  vpn-target 0:10002 1:10002 0.39.18.0:10000 export-extcommunity

  quit

address-family ipv6

  vpn-target 0:10002 1:10002 0.39.18.0:10000 import-extcommunity

  vpn-target 0:10002 1:10002 0.39.18.0:10000  export-extcommunity

quit

 address-family evpn

  vpn-target 0:10002 1:10002 0.39.18.0:10000 import-extcommunity

  vpn-target 0:10002 1:10002 0.39.18.0:10000 export-extcommunity

ip vpn-instance ZHTESTCTFWEW01VRF

 route-distinguisher 4:10002

 address-family ipv4

  vpn-target 0:10002 1:10002 0.39.18.0:10000 import-extcommunity

  vpn-target 0:10002 1:10002 0.39.18.0:10000 export-extcommunity

  quit

address-family ipv6

  vpn-target 0:10002 1:10002 0.39.18.0:10000 import-extcommunity

  vpn-target  0:10002 1:10002 0.39.18.0:10000

export-extcommunity

quit

 address-family evpn

  vpn-target 0:10002 1:10002 0.39.18.0:10000 import-extcommunity

  vpn-target 0:10002 1:10002 0.39.18.0:10000 export-extcommunity

Manual or controller-based

Configure the VPN instance for the east-west firewall service. Set a route distinguisher (RD) for the VPN instance, and set the import and export route targets (RTs) for the VPN instance IPv4/IPv6 address family and EVPN address family.

For two devices to learn routes from each other in the VPN instance, make sure the import RTs on one device match the export RTs on the other.

m-lag system-mac   0c3a-fa36-acef

m-lag system-mac 0c3a-fa36-acef

Manual or controller-based

Set the MAC address of the M-LAG system.

You must assign the same M-LAG system MAC address to the member devices in an M-LAG system.

m-lag system-number 1

m-lag system-number 2

Manual or controller-based

Set the M-LAG system number.

You must assign different M-LAG system numbers to the member devices in an M-LAG system.

m-lag system-priority 10

m-lag system-priority 10

Manual or controller-based

Set the M-LAG system priority.

You must set the same M-LAG system priority on the member devices in an M-LAG system.

m-lag keepalive ip destination 197.32.241.62 source 197.32.241.61 vpn-instance auto-online-mlag

m-lag keepalive ip destination 197.32.241.61 source 197.32.241.62 vpn-instance auto-online-mlag

Manual or controller-based

Configure the source and destination IP addresses of keepalive packets.

The source and destination IP addresses specified on one member device must be the destination and source IP addresses specified on the other, respectively.

m-lag restore-delay 300

m-lag restore-delay 300

Manual or controller-based

Set the data restoration interval. This parameter specifies the maximum amount of time for the secondary M-LAG member device to synchronize data with the primary M-LAG member device during M-LAG system setup.

To avoid packet loss and forwarding failure, increase the data restoration interval if the amount of data is large, for example, when the device has a large number of routes and interfaces.

m-lag mad default-action none

m-lag mad default-action none

Manual or controller-based

Set the M-LAG MAD action to none. When the M-LAG system splits, M-LAG MAD will not shut down any network interfaces, except the interfaces configured manually or by the system to be shut down by M-LAG MAD.

N/A

m-lag mad include interface HundredGigE1/0/25

m-lag mad include interface HundredGigE1/0/26

m-lag mad include interface HundredGigE1/0/25

m-lag mad include interface HundredGigE1/0/26

Manual or controller-based

Configure M-LAG MAD to shut down the uplink interfaces.

N/A

interface

Twenty-FiveGigE 1/0/54

interface Twenty-FiveGigE 1/0/54

Manual or controller-based

Enter the interface view for the keepalive link.

N/A

port link-mode route

port link-mode route

Manual or controller-based

Configure the interface for keepalive detection to operate in route mode as a Layer 3 interface.

N/A

ip binding vpn-instance auto-online-mlag

ip binding vpn-instance auto-online-mlag

Manual or controller-based

Associate the interface with VPN instance auto-online-mlag, the VPN instance for M-LAG keepalive detection.

N/A

ip address 197.32.241.61 255.255.255.252

ip address 197.32.241.62 255.255.255.252

Manual or controller-based

Assign an IP address to the interface as planned.

N/A

quit

quit

Manual or controller-based

Return to system view.

N/A

interface bridge-aggregation 256

interface bridge-aggregation 256

Manual or controller-based

Create the Layer 2 aggregate interface to be used as the peer-link interface, and enter interface view.

N/A

link-aggregation mode dynamic

link-aggregation mode dynamic

Manual or controller-based

Configure the aggregate interface to operate in dynamic mode.

N/A

quit

quit

Manual or controller-based

Return to system view.

N/A

interface HundredGigE1/0/31

interface HundredGigE1/0/31

Manual or controller-based

Enter the view of the physical port for the peer link.

N/A

port link-aggregation group 256

port link-aggregation group 256

Manual or controller-based

Assign the physical port to the aggregation group for the peer link (aggregation group 256).

N/A

interface bridge-aggregation 256

interface bridge-aggregation 256

Manual or controller-based

Enter aggregate interface view.

N/A

port m-lag peer-link 1

port m-lag peer-link 1

Manual or controller-based

Specify the aggregate interface (Bridge-Aggregation 256) as the peer-link interface.

N/A

port trunk pvid vlan 4094

port trunk pvid vlan 4094

Manual or controller-based

Set the PVID of the physical port to 4094.

N/A

undo mac-address static source-check enable

undo mac-address static source-check enable

Manual or controller-based

Disable the static source check feature on Bridge-Aggregation 256.

N/A

quit

quit

Manual or controller-based

Return to system view.

N/A

interface Vlan-interface 4094

interface Vlan-interface 4094