业务链网络架构设计指南

1、业务链网络架构设计指南（配图）技术创新，变革未来网络中需要L4L7检测业务VAS设备是否由专门业务管理员配置是否想通过业务链编排引流到VASYESNO采用Service Policy模式采用Service Manager模式采用手工引流VAS设备能否被控制器纳管YESNO采用Network Policy模式结合第三方VAS管理平台NO采用Service Manager模式YESVAS设备能否被控制器纳管YESNO采用Network Policy模式结合第三方VAS管理平台2图1Policy ruleClassifier=五元组+TCP-Flag/ICMP-TypeAction = Forwar

2、d、Deny、RedirectPolicy rule setEPGEPGExternal-Network(Subnets)Logic Router(Subnets)Logic Switch(Subnets)SFPExternal-Network(Subnets)Logic Router(Subnets)Logic Switch(Subnets)3.1-图1iMaster NCE-FabricSFF1SF1SF2SFF2SF3CONSUMERPROVIDER下发NSH转发表引流点访问流量VXLAN转发隧道NSH转发表SCTORiMaster NCE-FabricSFF1SF1SF2SFF2SF3

3、CONSUMERPROVIDER下发重定向策略引流点访问流量VXLAN转发隧道SCTOR3.3.1-图13.3.2-图13.2SF(Physical)SF(VM)SF(Physical)SF(VM)SCSC交换机交换机网络overlayVXLAN应用A应用BSFFSFFOuter Ethernet headerOuter IP headerVXLAN headerPayload=IP PacketUDP headerVXLAN + NSH 封装格式NSH headerOuter Ethernet header802.1Q headerEth-Type=0 x894FPayload=IP Pac

4、ketETH + NSH 封装格式NSH header3.4 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+|Ver|O|U| TTL | Length |U|U|U|U|MD Type| Next Protocol |+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+| Service Path Ident

5、ifier (SPI) | Service Index |+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+| | Fixed-Length Context Header | | |+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-

6、+-+-+-+-+-+-+-+-+-+-+-+-+|Ver|O|U| TTL | Length |U|U|U|U|MD Type| Next Protocol |+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+| Service Path Identifier (SPI) | Service Index |+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+| | Variable-Length Context Headers (opt

7、.) | |+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+3.4L2/L3 FabricHuawei VAS SecoManager的HW SF业务PortaliMaster NCE-Farbic的SFC Portal统一Portal入口3rd VAS3rd SF业务Portal3rd 管理系统4.1-图1L2/L3 FabricHuawei VAS SecoManager的HW SF业务PortaliMaster NCE-Farbic的SFC Portal统一Portal入口3rd VAS3rd 业务Port

8、al3rd 管理系统OpenStack4.2-图1VASGo-to modeconsumerproviderBD1BD2LeafVRFVRFBD1BD2VASVASGo-through modeconsumerproviderLeafVRFABD1BD2VRFBVRFVRFABD1BD2VASVRFBVASOne-Arm modeconsumerproviderBD1LeafVRFVRFABD1VAS5.1.1-图1和图25.1.2-图1和图25.1.3-图1和图2consumerproviderPeer-link主备VAS设备聚合链路2内部链路聚合链路1consumerproviderPee

9、r-link聚合链路2内部链路1内部链路2或外部链路聚合链路1主备VAS设备5.2.1-图1和图2consumerproviderPeer-link主备VAS设备聚合链路2内部链路1内部链路2或外部链路聚合链路15.2.2-图1聚合链路2聚合链路1Peer-link心跳和同步M-LAG双活，有相同VTEP-IPVAS集群VIP聚合链路2聚合链路1M-LAG双活，有相同VTEP-IPVAS集群VIPPeer-link5.3.1-图1和图2VAS1-主Leaf1-1BD1BD2VRFLeaf1-2BD1BD2VRFVAS1-备聚合链路2聚合链路1业务路径聚合链路2聚合链路1业务路径主备Peer-l

10、inkPeer-link主备聚合链路2聚合链路1高可用路径Peer-link主备聚合链路2聚合链路1高可用路径Peer-link5.3.2-图1、图2和图3聚合链路2聚合链路1业务路径高可用路径聚合链路2聚合链路1业务路径聚合链路2聚合链路1业务路径高可用路径Peer-linkPeer-linkPeer-link5.3.2-图4、图5和图6DC-2外网BorderLeafServiceLeafFabric-GWSpineServerLeafServerLeafServerLeafVAS6.1-图1ServerLeafVRFVAS2VAS1External NetworkVM1VM2VM3同子网

11、过SF节点不同子网过SF节点内外网过SF节点ServiceLeaf&BorderLeafVRFExternal6.1-图2DC-2外网BorderLeafServiceLeafFabric-GWSpineServerLeafServerLeafServerLeafVAS6.2-图1ServerLeafVRFVAS1VAS2External NetworkVM1VM2VM3同子网过SF节点不同子网过SF节点内外网过SF节点ServiceLeafVRFExternalBorderLeafExternal6.2-图2InternetVxLAN TunnelServerLeaf1SpineBorder

12、LeafSF4SF1VM1VM2SF2ServiceLeaf1ServerLeaf2ServiceLeaf2SF3VM3VxLAN Tunnel7.1-图1VxLAN TunnelServerLeaf1Tenant_VRFServiceLeaf1Tenant_VRFServiceLeaf2Tenant_VRFServerLeaf2Tenant_VRFVM1VM3VxLAN TunnelVxLAN TunnelSF1(IP1)SF2(IP2)SF3(IP3)traffic classifier tc1 if-match acl 3000traffic behavior tb1 redirect

13、service-path 1 service-index 255traffic policy tp1 classifier tc1 behavior tb1interface vbdif 1 traffic-policy tp1 inboundNSH业务链引流点NSH转发表service-chain service-path 1 service-index 255 nexthop sff vtep serviceLeaf1 vni 1000service-chain service-path 1 service-index 255 nexthop sf remote-ip IP1 servic

14、e-index 254 nexthop sf remote-ip IP2 service-index 253 nexthop sff vtep serviceLeaf2 vni 1000 service-chain service-path 1 service-index 253 nexthop sf remote-ip IP3 service-index 252 path-terminal 7.2.2VxLAN TunnelServerLeaf1Tenant_VRFServiceLeaf1Tenant_VRFServiceLeaf2Tenant_VRFServerLeaf2Tenant_VR

15、FVM1VM3VxLAN TunnelVxLAN TunnelSF1(IP1)SF2(IP2)traffic classifier tc1 if-match acl 3000traffic behavior tb1 redirect service-path 1 service-index 255traffic policy tp1 classifier tc1 behavior tb1interface vbdif 1 traffic-policy tp1 inboundNSH业务链引流点NSH转发表service-chain service-path 1 service-index 255

16、 nexthop sff vtep ServiceLeaf1 vni 1000service-chain service-path 1 service-index 255 nexthop sf nsh-proxy remote-ip IP1 service-index 254 nexthop sff vtep ServiceLeaf2 vni 1000 service-chain service-path 1 service-index 254 nexthop sf nsh-proxy remote-ip IP2 service-index 253 path-terminaltraffic c

17、lassifier tc1 if-match acl 3000traffic behavior tb1 redirect service-path 1 service-index 254traffic policy tp1 classifier tc1 behavior tb1interface vbdif 2 traffic-policy tp1 inboundtraffic classifier tc1 if-match acl 3000traffic behavior tb1 redirect service-path 1 service-index 253traffic policy

18、tp1 classifier tc1 behavior tb1interface vbdif 2 traffic-policy tp1 inbound7.2.3VxLAN TunnelServerLeaf1Tenant_VRFServiceLeaf1Tenant_VRFServiceLeaf&BorderLeafTenant_VRFVM1VxLAN TunnelSF1(IP1)SF2(IP2)traffic classifier tc1 if-match acl 3000traffic behavior tb1 redirect service-path 1 service-index 255

19、traffic policy tp1 classifier tc1 behavior tb1interface vbdif 1 traffic-policy tp1 inboundExternal NetworkExternal_VRFNSH业务链引流点NSH转发表service-chain service-path 1 service-index 255 nexthop sf remote-ip IP1service-chain service-path 1 service-index 255 nexthop sf remote-ip IP1 service-index 254 nextho

20、p sf remote-ip IP2 service-chain service-path 1 service-index 254 nexthop sf nsh-proxy remote-ip IP2 7.2.4-1VxLAN TunnelServerLeaf1Tenant_VRFServiceLeaf1Tenant_VRFServiceLeaf&BorderLeafTenant_VRFVM1VxLAN TunnelSF1(IP1)SF2(IP2)External NetworkExternal_VRFNSH业务链引流点NSH转发表service-chain service-path 2 se

21、rvice-index 255 nexthop sf remote-ip IP1 service-index 254 path-terminalservice-chain service-path 2 service-index 255 nexthop sf remote-ip IP1traffic classifier tc1 if-match acl 3000traffic behavior tb1 redirect service-path 2 service-index 255traffic policy tp1 classifier tc1 behavior tb1interface

22、 vbdif 1 traffic-policy tp1 inbound7.2.4-2ServerLeaf1Tenant_VRFServerLeaf2Tenant_VRFVM1VM3SF1ServiceLeaf1Tenant_VRFVRF2VRF1ServiceLeaf2Tenant_VRFVRF2VRF1VxLAN TunnelVxLAN TunnelVxLAN TunnelIP1IP2IP3IP4SF2traffic classifier tc1 if-match acl 3000traffic behavior tb1 redirect remote IP2 tenant_vrftraff

23、ic policy tp1 classifier tc1 behavior tb1interface vbdif 1 traffic-policy tp1 inboundip route-static tenant_vrf IP2 32 vrf1 IP2traffic classifier tc1 if-match acl 3000 if-match vxlan vni 1000traffic behavior tb1 redirect nexthop IP2 vrf tenant_vrftraffic policy tp1 classifier tc1 behavior tb1traffic

24、-policy tp1 global inboundtraffic classifier tc2 if-match acl 3000traffic behavior tb2 redirect remote IP4 tenant_vrftraffic policy tp2 classifier tc2 behavior tb2interface vbdif 2 traffic-policy tp2 inboundip route-static vrf2 0.0.0.0 0 tenant_vrfip route-static tenant_vrf IP4 32 vrf1 IP4traffic cl

25、assifier tc1 if-match acl 3000 if-match vxlan vni 1000traffic behavior tb1 redirect nexthop IP4 vrf tenant_vrftraffic policy tp1 classifier tc1 behavior tb1traffic-policy tp1 global inboundPBR业务链引流点ip route-static vrf2 0.0.0.0 0 tenant_vrf7.3.1VxLAN TunnelServerLeaf1Tenant_VRFServiceLeaf1Tenant_VRFS

26、erviceLeaf2Tenant_VRFServerLeaf2Tenant_VRFVM1VM3VxLAN TunnelVxLAN TunnelSF1(IP1)SF2(IP2)SF3(IP3)PBR业务链引流点traffic classifier tc1 if-match acl 3000traffic behavior tb1 redirect remote IP1traffic policy tp1 classifier tc1 behavior tb1interface vbdif 1 traffic-policy tp1 inboundtraffic classifier tc1 if

27、-match acl 3000 if-match vxlan vni 1000traffic behavior tb1 redirect nexthop IP1traffic policy tp1 classifier tc1 behavior tb1traffic-policy tp1 global inboundtraffic classifier tc2 if-match acl 3000traffic behavior tb2 redirect nexthop IP2traffic policy tp2 classifier tc2 behavior tb2interface vbdi

28、f 1 traffic-policy tp2 inboundtraffic classifier tc3 if-match acl 3000traffic behavior tb3 redirect remote IP3traffic policy tp3 classifier tc3 behavior tb3interface vbdif 2 traffic-policy tp3 inboundtraffic classifier tc1 if-match acl 3000 if-match vxlan vni 1000traffic behavior tb1 redirect nextho

29、p IP3traffic policy tp1 classifier tc1 behavior tb1traffic-policy tp1 global inbound7.3.2VxLAN TunnelServerLeaf1Tenant_VRFServiceLeaf1Tenant_VRFServiceLeaf&BorderLeafTenant_VRFVM1VxLAN TunnelSF1(IP1)SF2(IP2)PBR业务链引流点traffic classifier tc1 if-match acl 3000traffic behavior tb1 redirect remote IP1traf

30、fic policy tp1 classifier tc1 behavior tb1interface vbdif 1 traffic-policy tp1 inboundtraffic classifier tc1 if-match acl 3000 if-match vxlan vni 1000traffic behavior tb1 redirect nexthop IP1traffic policy tp1 classifier tc1 behavior tb1traffic-policy tp1 global inboundExternal NetworkExternal_VRFtr

31、affic classifier tc1 if-match acl 3000 if-match vxlan vni 1000traffic behavior tb1 redirect nexthop IP2traffic policy tp1 classifier tc1 behavior tb1traffic-policy tp1 global inboundtraffic classifier tc1 if-match acl 3000traffic behavior tb1 redirect remote IP2traffic policy tp1 classifier tc1 beha

32、vior tb1interface vbdif 2 traffic-policy tp1 inbound7.3.3VxLAN TunnelServerLeaf1SpineSF1VM1VM2SF2ServiceLeaf1ServerLeaf2VM3VxLAN TunnelServiceLeaf2SF38.2.1-图1VxLAN TunnelServerLeaf1Tenant_VRFServiceLeaf1Tenant_VRFServiceLeaf2Tenant_VRFServerLeaf2Tenant_VRFVM1VM3VxLAN TunnelVxLAN TunnelSF1(IP1)shareIP1traffic classifier tc1 if-match acl 3000traffic behavior tb1 redirect service-path 1 service-index 255traffic policy tp1 classifier tc1 behavior tb1interface vbdif 1 traffic-policy tp1 inboundNSH业务链引流点NSH转发表service-ch