業(yè)務(wù)鏈網(wǎng)絡(luò)架構(gòu)設(shè)計(jì)指南

1、業(yè)務(wù)鏈網(wǎng)絡(luò)架構(gòu)設(shè)計(jì)指南（配圖）技術(shù)創(chuàng)新，變革未來(lái)網(wǎng)絡(luò)中需要L4L7檢測(cè)業(yè)務(wù)VAS設(shè)備是否由專(zhuān)門(mén)業(yè)務(wù)管理員配置是否想通過(guò)業(yè)務(wù)鏈編排引流到VASYESNO采用Service Policy模式采用Service Manager模式采用手工引流VAS設(shè)備能否被控制器納管YESNO采用Network Policy模式結(jié)合第三方VAS管理平臺(tái)NO采用Service Manager模式Y(jié)ESVAS設(shè)備能否被控制器納管YESNO采用Network Policy模式結(jié)合第三方VAS管理平臺(tái)2圖1Policy ruleClassifier=五元組+TCP-Flag/ICMP-TypeAction = Forwar

2、d、Deny、RedirectPolicy rule setEPGEPGExternal-Network(Subnets)Logic Router(Subnets)Logic Switch(Subnets)SFPExternal-Network(Subnets)Logic Router(Subnets)Logic Switch(Subnets)3.1-圖1iMaster NCE-FabricSFF1SF1SF2SFF2SF3CONSUMERPROVIDER下發(fā)NSH轉(zhuǎn)發(fā)表引流點(diǎn)訪(fǎng)問(wèn)流量VXLAN轉(zhuǎn)發(fā)隧道NSH轉(zhuǎn)發(fā)表SCTORiMaster NCE-FabricSFF1SF1SF2SFF2SF3

3、CONSUMERPROVIDER下發(fā)重定向策略引流點(diǎn)訪(fǎng)問(wèn)流量VXLAN轉(zhuǎn)發(fā)隧道SCTOR3.3.1-圖13.3.2-圖13.2SF(Physical)SF(VM)SF(Physical)SF(VM)SCSC交換機(jī)交換機(jī)網(wǎng)絡(luò)overlayVXLAN應(yīng)用A應(yīng)用BSFFSFFOuter Ethernet headerOuter IP headerVXLAN headerPayload=IP PacketUDP headerVXLAN + NSH 封裝格式NSH headerOuter Ethernet header802.1Q headerEth-Type=0 x894FPayload=IP Pac

4、ketETH + NSH 封裝格式NSH header3.4 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+|Ver|O|U| TTL | Length |U|U|U|U|MD Type| Next Protocol |+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+| Service Path Ident

5、ifier (SPI) | Service Index |+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+| | Fixed-Length Context Header | | |+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-

6、+-+-+-+-+-+-+-+-+-+-+-+-+|Ver|O|U| TTL | Length |U|U|U|U|MD Type| Next Protocol |+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+| Service Path Identifier (SPI) | Service Index |+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+| | Variable-Length Context Headers (opt

7、.) | |+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+3.4L2/L3 FabricHuawei VAS SecoManager的HW SF業(yè)務(wù)PortaliMaster NCE-Farbic的SFC Portal統(tǒng)一Portal入口3rd VAS3rd SF業(yè)務(wù)Portal3rd 管理系統(tǒng)4.1-圖1L2/L3 FabricHuawei VAS SecoManager的HW SF業(yè)務(wù)PortaliMaster NCE-Farbic的SFC Portal統(tǒng)一Portal入口3rd VAS3rd 業(yè)務(wù)Port

8、al3rd 管理系統(tǒng)OpenStack4.2-圖1VASGo-to modeconsumerproviderBD1BD2LeafVRFVRFBD1BD2VASVASGo-through modeconsumerproviderLeafVRFABD1BD2VRFBVRFVRFABD1BD2VASVRFBVASOne-Arm modeconsumerproviderBD1LeafVRFVRFABD1VAS5.1.1-圖1和圖25.1.2-圖1和圖25.1.3-圖1和圖2consumerproviderPeer-link主備VAS設(shè)備聚合鏈路2內(nèi)部鏈路聚合鏈路1consumerproviderPee

9、r-link聚合鏈路2內(nèi)部鏈路1內(nèi)部鏈路2或外部鏈路聚合鏈路1主備VAS設(shè)備5.2.1-圖1和圖2consumerproviderPeer-link主備VAS設(shè)備聚合鏈路2內(nèi)部鏈路1內(nèi)部鏈路2或外部鏈路聚合鏈路15.2.2-圖1聚合鏈路2聚合鏈路1Peer-link心跳和同步M-LAG雙活，有相同VTEP-IPVAS集群VIP聚合鏈路2聚合鏈路1M-LAG雙活，有相同VTEP-IPVAS集群VIPPeer-link5.3.1-圖1和圖2VAS1-主Leaf1-1BD1BD2VRFLeaf1-2BD1BD2VRFVAS1-備聚合鏈路2聚合鏈路1業(yè)務(wù)路徑聚合鏈路2聚合鏈路1業(yè)務(wù)路徑主備Peer-l

10、inkPeer-link主備聚合鏈路2聚合鏈路1高可用路徑Peer-link主備聚合鏈路2聚合鏈路1高可用路徑Peer-link5.3.2-圖1、圖2和圖3聚合鏈路2聚合鏈路1業(yè)務(wù)路徑高可用路徑聚合鏈路2聚合鏈路1業(yè)務(wù)路徑聚合鏈路2聚合鏈路1業(yè)務(wù)路徑高可用路徑Peer-linkPeer-linkPeer-link5.3.2-圖4、圖5和圖6DC-2外網(wǎng)BorderLeafServiceLeafFabric-GWSpineServerLeafServerLeafServerLeafVAS6.1-圖1ServerLeafVRFVAS2VAS1External NetworkVM1VM2VM3同子網(wǎng)

11、過(guò)SF節(jié)點(diǎn)不同子網(wǎng)過(guò)SF節(jié)點(diǎn)內(nèi)外網(wǎng)過(guò)SF節(jié)點(diǎn)ServiceLeaf&BorderLeafVRFExternal6.1-圖2DC-2外網(wǎng)BorderLeafServiceLeafFabric-GWSpineServerLeafServerLeafServerLeafVAS6.2-圖1ServerLeafVRFVAS1VAS2External NetworkVM1VM2VM3同子網(wǎng)過(guò)SF節(jié)點(diǎn)不同子網(wǎng)過(guò)SF節(jié)點(diǎn)內(nèi)外網(wǎng)過(guò)SF節(jié)點(diǎn)ServiceLeafVRFExternalBorderLeafExternal6.2-圖2InternetVxLAN TunnelServerLeaf1SpineBorder

12、LeafSF4SF1VM1VM2SF2ServiceLeaf1ServerLeaf2ServiceLeaf2SF3VM3VxLAN Tunnel7.1-圖1VxLAN TunnelServerLeaf1Tenant_VRFServiceLeaf1Tenant_VRFServiceLeaf2Tenant_VRFServerLeaf2Tenant_VRFVM1VM3VxLAN TunnelVxLAN TunnelSF1(IP1)SF2(IP2)SF3(IP3)traffic classifier tc1 if-match acl 3000traffic behavior tb1 redirect

13、service-path 1 service-index 255traffic policy tp1 classifier tc1 behavior tb1interface vbdif 1 traffic-policy tp1 inboundNSH業(yè)務(wù)鏈引流點(diǎn)NSH轉(zhuǎn)發(fā)表service-chain service-path 1 service-index 255 nexthop sff vtep serviceLeaf1 vni 1000service-chain service-path 1 service-index 255 nexthop sf remote-ip IP1 servic

14、e-index 254 nexthop sf remote-ip IP2 service-index 253 nexthop sff vtep serviceLeaf2 vni 1000 service-chain service-path 1 service-index 253 nexthop sf remote-ip IP3 service-index 252 path-terminal 7.2.2VxLAN TunnelServerLeaf1Tenant_VRFServiceLeaf1Tenant_VRFServiceLeaf2Tenant_VRFServerLeaf2Tenant_VR

15、FVM1VM3VxLAN TunnelVxLAN TunnelSF1(IP1)SF2(IP2)traffic classifier tc1 if-match acl 3000traffic behavior tb1 redirect service-path 1 service-index 255traffic policy tp1 classifier tc1 behavior tb1interface vbdif 1 traffic-policy tp1 inboundNSH業(yè)務(wù)鏈引流點(diǎn)NSH轉(zhuǎn)發(fā)表service-chain service-path 1 service-index 255

16、 nexthop sff vtep ServiceLeaf1 vni 1000service-chain service-path 1 service-index 255 nexthop sf nsh-proxy remote-ip IP1 service-index 254 nexthop sff vtep ServiceLeaf2 vni 1000 service-chain service-path 1 service-index 254 nexthop sf nsh-proxy remote-ip IP2 service-index 253 path-terminaltraffic c

17、lassifier tc1 if-match acl 3000traffic behavior tb1 redirect service-path 1 service-index 254traffic policy tp1 classifier tc1 behavior tb1interface vbdif 2 traffic-policy tp1 inboundtraffic classifier tc1 if-match acl 3000traffic behavior tb1 redirect service-path 1 service-index 253traffic policy

18、tp1 classifier tc1 behavior tb1interface vbdif 2 traffic-policy tp1 inbound7.2.3VxLAN TunnelServerLeaf1Tenant_VRFServiceLeaf1Tenant_VRFServiceLeaf&BorderLeafTenant_VRFVM1VxLAN TunnelSF1(IP1)SF2(IP2)traffic classifier tc1 if-match acl 3000traffic behavior tb1 redirect service-path 1 service-index 255

19、traffic policy tp1 classifier tc1 behavior tb1interface vbdif 1 traffic-policy tp1 inboundExternal NetworkExternal_VRFNSH業(yè)務(wù)鏈引流點(diǎn)NSH轉(zhuǎn)發(fā)表service-chain service-path 1 service-index 255 nexthop sf remote-ip IP1service-chain service-path 1 service-index 255 nexthop sf remote-ip IP1 service-index 254 nextho

20、p sf remote-ip IP2 service-chain service-path 1 service-index 254 nexthop sf nsh-proxy remote-ip IP2 7.2.4-1VxLAN TunnelServerLeaf1Tenant_VRFServiceLeaf1Tenant_VRFServiceLeaf&BorderLeafTenant_VRFVM1VxLAN TunnelSF1(IP1)SF2(IP2)External NetworkExternal_VRFNSH業(yè)務(wù)鏈引流點(diǎn)NSH轉(zhuǎn)發(fā)表service-chain service-path 2 se

21、rvice-index 255 nexthop sf remote-ip IP1 service-index 254 path-terminalservice-chain service-path 2 service-index 255 nexthop sf remote-ip IP1traffic classifier tc1 if-match acl 3000traffic behavior tb1 redirect service-path 2 service-index 255traffic policy tp1 classifier tc1 behavior tb1interface

22、 vbdif 1 traffic-policy tp1 inbound7.2.4-2ServerLeaf1Tenant_VRFServerLeaf2Tenant_VRFVM1VM3SF1ServiceLeaf1Tenant_VRFVRF2VRF1ServiceLeaf2Tenant_VRFVRF2VRF1VxLAN TunnelVxLAN TunnelVxLAN TunnelIP1IP2IP3IP4SF2traffic classifier tc1 if-match acl 3000traffic behavior tb1 redirect remote IP2 tenant_vrftraff

23、ic policy tp1 classifier tc1 behavior tb1interface vbdif 1 traffic-policy tp1 inboundip route-static tenant_vrf IP2 32 vrf1 IP2traffic classifier tc1 if-match acl 3000 if-match vxlan vni 1000traffic behavior tb1 redirect nexthop IP2 vrf tenant_vrftraffic policy tp1 classifier tc1 behavior tb1traffic

24、-policy tp1 global inboundtraffic classifier tc2 if-match acl 3000traffic behavior tb2 redirect remote IP4 tenant_vrftraffic policy tp2 classifier tc2 behavior tb2interface vbdif 2 traffic-policy tp2 inboundip route-static vrf2 0.0.0.0 0 tenant_vrfip route-static tenant_vrf IP4 32 vrf1 IP4traffic cl

25、assifier tc1 if-match acl 3000 if-match vxlan vni 1000traffic behavior tb1 redirect nexthop IP4 vrf tenant_vrftraffic policy tp1 classifier tc1 behavior tb1traffic-policy tp1 global inboundPBR業(yè)務(wù)鏈引流點(diǎn)ip route-static vrf2 0.0.0.0 0 tenant_vrf7.3.1VxLAN TunnelServerLeaf1Tenant_VRFServiceLeaf1Tenant_VRFS

26、erviceLeaf2Tenant_VRFServerLeaf2Tenant_VRFVM1VM3VxLAN TunnelVxLAN TunnelSF1(IP1)SF2(IP2)SF3(IP3)PBR業(yè)務(wù)鏈引流點(diǎn)traffic classifier tc1 if-match acl 3000traffic behavior tb1 redirect remote IP1traffic policy tp1 classifier tc1 behavior tb1interface vbdif 1 traffic-policy tp1 inboundtraffic classifier tc1 if

27、-match acl 3000 if-match vxlan vni 1000traffic behavior tb1 redirect nexthop IP1traffic policy tp1 classifier tc1 behavior tb1traffic-policy tp1 global inboundtraffic classifier tc2 if-match acl 3000traffic behavior tb2 redirect nexthop IP2traffic policy tp2 classifier tc2 behavior tb2interface vbdi

28、f 1 traffic-policy tp2 inboundtraffic classifier tc3 if-match acl 3000traffic behavior tb3 redirect remote IP3traffic policy tp3 classifier tc3 behavior tb3interface vbdif 2 traffic-policy tp3 inboundtraffic classifier tc1 if-match acl 3000 if-match vxlan vni 1000traffic behavior tb1 redirect nextho

29、p IP3traffic policy tp1 classifier tc1 behavior tb1traffic-policy tp1 global inbound7.3.2VxLAN TunnelServerLeaf1Tenant_VRFServiceLeaf1Tenant_VRFServiceLeaf&BorderLeafTenant_VRFVM1VxLAN TunnelSF1(IP1)SF2(IP2)PBR業(yè)務(wù)鏈引流點(diǎn)traffic classifier tc1 if-match acl 3000traffic behavior tb1 redirect remote IP1traf

30、fic policy tp1 classifier tc1 behavior tb1interface vbdif 1 traffic-policy tp1 inboundtraffic classifier tc1 if-match acl 3000 if-match vxlan vni 1000traffic behavior tb1 redirect nexthop IP1traffic policy tp1 classifier tc1 behavior tb1traffic-policy tp1 global inboundExternal NetworkExternal_VRFtr

31、affic classifier tc1 if-match acl 3000 if-match vxlan vni 1000traffic behavior tb1 redirect nexthop IP2traffic policy tp1 classifier tc1 behavior tb1traffic-policy tp1 global inboundtraffic classifier tc1 if-match acl 3000traffic behavior tb1 redirect remote IP2traffic policy tp1 classifier tc1 beha

32、vior tb1interface vbdif 2 traffic-policy tp1 inbound7.3.3VxLAN TunnelServerLeaf1SpineSF1VM1VM2SF2ServiceLeaf1ServerLeaf2VM3VxLAN TunnelServiceLeaf2SF38.2.1-圖1VxLAN TunnelServerLeaf1Tenant_VRFServiceLeaf1Tenant_VRFServiceLeaf2Tenant_VRFServerLeaf2Tenant_VRFVM1VM3VxLAN TunnelVxLAN TunnelSF1(IP1)shareIP1traffic classifier tc1 if-match acl 3000traffic behavior tb1 redirect service-path 1 service-index 255traffic policy tp1 classifier tc1 behavior tb1interface vbdif 1 traffic-policy tp1 inboundNSH業(yè)務(wù)鏈引流點(diǎn)NSH轉(zhuǎn)發(fā)表service-ch