Different VRFs same address space VXLAN-EVPN

, ,
1

Hello,
I’m using vyos in this version: VyOS 1.5-rolling-202409160007 (I know is rolling, but not sure if you can also help me with this also), my vyos router is connected to 1 proxmox server in the same network segment, and they integrate an EVPN network. My problem is I can’t reach the VMs of my tenantC, despite of vyos showing the its routes for the VMs and subnets, nor the anycast gateway of proxmox SDN. However I can reach the VMs of tenantA (using ping and traceroute). I have this configuration for the two tenants:

interfaces {
    bridge br5000 {
        description tenantA
        member {
            interface vxlan5000 {
            }
        }
        vrf tenantA
    }
    bridge br5005 {
        description tenantC
        member {
            interface vxlan5005 {
            }
        }
        vrf tenantC
    }
    ethernet eth0 {
        address dhcp
        hw-id bc:24:11:85:a7:3a
        offload {
            gro
            gso
            sg
            tso
        }
        vrf management
    }
    ethernet eth1 {
        address 172.16.0.1/23
        description "proxmox nodes"
        hw-id bc:24:11:b1:fe:6e
        offload {
            gro
            gso
            sg
            tso
        }
    }
    ethernet eth2 {
        hw-id bc:24:11:9b:d0:95
        offload {
            gro
            gso
            sg
            tso
        }
    }
    loopback lo {
    }
    pseudo-ethernet peth2 {
        source-interface eth2
        vif 3 {
            address 172.16.2.3/28
            description PseudTenantA
            vrf tenantA
        }
    }
    vxlan vxlan5000 {
        mtu 1550
        parameters {
            nolearning
        }
        port 4789
        source-address 172.16.0.1
        vni 5000
    }
    vxlan vxlan5005 {
        mtu 1550
        parameters {
            nolearning
        }
        port 4789
        source-address 172.16.0.1
        vni 5005
    }
}
protocols {
    bgp {
        address-family {
            l2vpn-evpn {
                advertise {
                    ipv4 {
                        unicast {
                        }
                    }
                }
                advertise-all-vni
            }
        }
        neighbor 172.16.0.10 {
            peer-group ibgp
        }
        neighbor 172.16.0.11 {
            peer-group ibgp
        }
        parameters {
            log-neighbor-changes
        }
        peer-group ibgp {
            address-family {
                l2vpn-evpn {
                }
            }
            remote-as 64513
            update-source eth1
        }
        system-as 64513
    }
}
service {
    **ommited**
}
system {
    **ommited**
}
vrf {
    name management {
        table 100
    }
    name tenantA {
        protocols {
            bgp {
                address-family {
                    ipv4-unicast {
                        redistribute {
                            connected {
                            }
                            static {
                            }
                        }
                    }
                    l2vpn-evpn {
                        advertise {
                            ipv4 {
                                unicast {
                                }
                            }
                        }
                    }
                }
                neighbor 172.16.2.1 {
                    address-family {
                        ipv4-unicast {
                        }
                    }
                    remote-as 64514
                }
                system-as 64513
            }
        }
        table 5000
        vni 5000
    }
    name tenantC {
        protocols {
            bgp {
                address-family {
                    ipv4-unicast {
                        redistribute {
                            connected {
                            }
                            static {
                            }
                        }
                    }
                    l2vpn-evpn {
                        advertise {
                            ipv4 {
                                unicast {
                                }
                            }
                        }
                    }
                }
                system-as 64513
            }
        }
        table 5005
        vni 5005
    }
}

if I run the command to show all the routes:

show ip route vrf all

VRF default:
C>* 172.16.0.0/23 is directly connected, eth1, 00:07:57

VRF management:
S>* 0.0.0.0/0 [210/0] via 192.168.178.1, eth0, weight 1, 00:07:59
C>* 192.168.178.0/24 is directly connected, eth0, 00:08:00

VRF tenantA:
B>* 10.0.0.0/24 [200/0] via 172.16.0.11, br5000 onlink, weight 1, 00:07:50
C>* 172.16.2.0/28 is directly connected, peth2.3, 00:07:56

VRF tenantC:
B>* 10.0.1.0/24 [200/0] via 172.16.0.11, br5005 onlink, weight 1, 00:01:50

How can I also troubleshoot this a little bit more?
Thank you in advance.

2

Hello,
Already solved. Was my mis knowledge. I have no interface with IP in tenantC. When I created the pseudo interface, I was able to reach all the VMs of both tenants, even when the address space is the same for both tenants.
I leave here the full configuration of vyos, might be useful for someone.
Thanks.

interfaces {
    bridge br5000 {
        description tenantA
        member {
            interface vxlan5000 {
            }
        }
        vrf tenantA
    }
    bridge br5005 {
        description tenantC
        member {
            interface vxlan5005 {
            }
        }
        vrf tenantC
    }
    ethernet eth0 {
        address dhcp
        hw-id bc:24:11:85:a7:3a
        offload {
            gro
            gso
            sg
            tso
        }
        vrf management
    }
    ethernet eth1 {
        address 172.16.0.1/23
        description "proxmox nodes"
        hw-id bc:24:11:b1:fe:6e
        offload {
            gro
            gso
            sg
            tso
        }
    }
    ethernet eth2 {
        hw-id bc:24:11:9b:d0:95
        offload {
            gro
            gso
            sg
            tso
        }
    }
    loopback lo {
    }
    pseudo-ethernet peth2 {
        source-interface eth2
        vif 3 {
            address 172.16.2.3/28
            description PseudTenantA
            vrf tenantA
        }
    }
    pseudo-ethernet peth4 {
        source-interface eth2
        vif 4 {
            address 172.16.2.3/28
            description PseudTenantA
            vrf tenantC
        }
    }
    vxlan vxlan5000 {
        mtu 1550
        parameters {
            nolearning
        }
        port 4789
        source-address 172.16.0.1
        vni 5000
    }
    vxlan vxlan5005 {
        mtu 1550
        parameters {
            nolearning
        }
        port 4789
        source-address 172.16.0.1
        vni 5005
    }
}
protocols {
    bgp {
        address-family {
            l2vpn-evpn {
                advertise {
                    ipv4 {
                        unicast {
                        }
                    }
                }
                advertise-all-vni
            }
        }
        neighbor 172.16.0.10 {
            peer-group ibgp
        }
        neighbor 172.16.0.11 {
            peer-group ibgp
        }
        parameters {
            log-neighbor-changes
        }
        peer-group ibgp {
            address-family {
                l2vpn-evpn {
                }
            }
            remote-as 64513
            update-source eth1
        }
        system-as 64513
    }
}
service {
   ****
}
system {
    ****
}
vrf {
    name management {
        table 100
    }
    name tenantA {
        protocols {
            bgp {
                address-family {
                    ipv4-unicast {
                        redistribute {
                            connected {
                            }
                            static {
                            }
                        }
                    }
                    l2vpn-evpn {
                        advertise {
                            ipv4 {
                                unicast {
                                }
                            }
                        }
                    }
                }
                neighbor 172.16.2.1 {
                    address-family {
                        ipv4-unicast {
                        }
                    }
                    remote-as 64514
                }
                system-as 64513
            }
        }
        table 5000
        vni 5000
    }
    name tenantC {
        protocols {
            bgp {
                address-family {
                    ipv4-unicast {
                        redistribute {
                            connected {
                            }
                            static {
                            }
                        }
                    }
                    l2vpn-evpn {
                        advertise {
                            ipv4 {
                                unicast {
                                }
                            }
                        }
                    }
                }
                system-as 64513
            }
        }
        table 5005
        vni 5005
    }
}
1 Like