VXLAN分布式网关跨VPC互通

ENSP模拟器拓扑图设备脚本Leaf1脚本Leaf1dis cu!Software Version V200R005C10SPC607B607!Last configuration was updated at 2026-03-19 21:04:1600:00!Last configuration was saved at 2026-03-19 22:14:3800:00#sysname Leaf1#device board 17 board-type CE-MPUBdevice board 1 board-type CE-LPUE#evpn-overlay enable#ip vpn-instance vpc1ipv4-familyroute-distinguisher 100:100vpn-target 5000:5000 export-extcommunityvpn-target 5000:5000 export-extcommunity evpnvpn-target 5000:5000 import-extcommunityvpn-target 5000:5000 import-extcommunity evpnvxlan vni 5000#bfd#bridge-domain 100vxlan vni 100evpnroute-distinguisher 100:100vpn-target 100:100 export-extcommunityvpn-target 5000:5000 export-extcommunityvpn-target 100:100 import-extcommunityvpn-target 5000:5000 import-extcommunity#bridge-domain 200vxlan vni 200evpnroute-distinguisher 100:200vpn-target 200:200 export-extcommunityvpn-target 5000:5000 export-extcommunityvpn-target 200:200 import-extcommunity#aaa#authentication-scheme default#authorization-scheme default#accounting-scheme default#domain default#domain default_admin#interface Vbdif100ip binding vpn-instance vpc1ip address 192.168.10.254 255.255.255.0arp broadcast-detect enablemac-address 0000-5e00-0020vxlan anycast-gateway enablearp collect host enable#interface Vbdif200ip binding vpn-instance vpc1ip address 192.168.20.254 255.255.255.0arp broadcast-detect enablemac-address 0000-5e00-0021vxlan anycast-gateway enablearp collect host enable#interface MEth0/0/0undo shutdown#interface GE1/0/0undo portswitchundo shutdownip address 192.168.0.2 255.255.255.252ospf network-type p2pospf enable 1 area 0.0.0.0#interface GE1/0/1undo shutdown#interface GE1/0/1.10 mode l2encapsulation dot1q vid 10bridge-domain 100#interface GE1/0/1.20 mode l2encapsulation dot1q vid 20bridge-domain 200#interface GE1/0/2shutdown#interface GE1/0/3shutdown#interface GE1/0/4shutdown#interface GE1/0/5shutdown#interface GE1/0/6shutdown#interface GE1/0/7shutdown#interface GE1/0/8shutdown#interface GE1/0/9shutdown#interface LoopBack0ip address 10.1.1.1 255.255.255.255ospf enable 1 area 0.0.0.0#interface LoopBack1ip address 192.168.10.1 255.255.255.255ospf enable 1 area 0.0.0.0#interface Nve1source 10.1.1.1vni 100 head-end peer-list protocol bgpvni 200 head-end peer-list protocol bgpvni 300 head-end peer-list protocol bgp#interface NULL0#bgp 100router-id 192.168.10.1peer 192.168.10.3 as-number 100peer 192.168.10.3 connect-interface LoopBack1#ipv4-family unicastpeer 192.168.10.3 enable#ipv4-family vpn-instance vpc1default-route importedimport-route directimport-route staticadvertise l2vpn evpn#l2vpn-family evpnpolicy vpn-targetpeer 192.168.10.3 enablepeer 192.168.10.3 advertise irb#ospf 1 router-id 192.168.10.1bfd all-interfaces enablebfd all-interfaces min-tx-interval 500 min-rx-interval 500lsa-arrival-interval intelligent-timer 50 50 50area 0.0.0.0#ssh authorization-type default aaa#ssh server cipher aes256_gcm aes128_gcm aes256_ctr aes192_ctr aes128_ctr aes256_cbc aes128_cbc 3des_cbc#ssh server dh-exchange min-len 1024#ssh client cipher aes256_gcm aes128_gcm aes256_ctr aes192_ctr aes128_ctr aes256_cbc aes128_cbc 3des_cbc#user-interface con 0#vm-manager#returnLeaf3脚本Leaf3dis cu!Software Version V200R005C10SPC607B607!Last configuration was updated at 2026-03-19 21:13:4900:00!Last configuration was saved at 2026-03-19 22:14:4100:00#sysname Leaf3#device board 17 board-type CE-MPUBdevice board 1 board-type CE-LPUE#evpn-overlay enable#ip vpn-instance vpc1ipv4-familyroute-distinguisher 200:100vpn-target 5000:5000 export-extcommunityvpn-target 5000:5000 export-extcommunity evpnvpn-target 5000:5000 import-extcommunityvpn-target 5000:5000 import-extcommunity evpnvxlan vni 5000#ip vpn-instance vpc2ipv4-familyroute-distinguisher 200:200vpn-target 5001:5001 export-extcommunityvpn-target 5001:5001 export-extcommunity evpnvpn-target 5001:5001 import-extcommunityvpn-target 5001:5001 import-extcommunity evpnvxlan vni 5001#bfd#bridge-domain 100vxlan vni 100evpnroute-distinguisher 200:100vpn-target 100:100 export-extcommunityvpn-target 5000:5000 export-extcommunityvpn-target 100:100 import-extcommunity#bridge-domain 200vxlan vni 200evpnroute-distinguisher 200:200vpn-target 200:200 export-extcommunityvpn-target 5000:5000 export-extcommunityvpn-target 200:200 import-extcommunity#bridge-domain 300vxlan vni 300evpnroute-distinguisher 200:300vpn-target 300:300 export-extcommunityvpn-target 5001:5001 export-extcommunityvpn-target 300:300 import-extcommunity#aaa#authentication-scheme default#authorization-scheme default#accounting-scheme default#domain default#domain default_admin#interface Vbdif100ip binding vpn-instance vpc1ip address 192.168.10.254 255.255.255.0arp broadcast-detect enablemac-address 0000-5e00-0020vxlan anycast-gateway enablearp collect host enable#interface Vbdif200ip binding vpn-instance vpc1ip address 192.168.20.254 255.255.255.0arp broadcast-detect enablemac-address 0000-5e00-0021vxlan anycast-gateway enablearp collect host enable#interface Vbdif300ip binding vpn-instance vpc2ip address 192.168.30.254 255.255.255.0arp broadcast-detect enablemac-address 0000-5e00-0022vxlan anycast-gateway enablearp collect host enable#interface MEth0/0/0undo shutdown#interface GE1/0/0undo portswitchundo shutdownip address 192.168.0.6 255.255.255.252ospf network-type p2pospf enable 1 area 0.0.0.0#interface GE1/0/1undo shutdown#interface GE1/0/1.10 mode l2encapsulation dot1q vid 10bridge-domain 100#interface GE1/0/1.20 mode l2encapsulation dot1q vid 20bridge-domain 200#interface GE1/0/1.30 mode l2encapsulation dot1q vid 30bridge-domain 300#interface GE1/0/2undo shutdown#interface GE1/0/3undo shutdown#interface GE1/0/4undo shutdown#interface GE1/0/5undo shutdown#interface GE1/0/6shutdown#interface GE1/0/7shutdown#interface GE1/0/8shutdown#interface GE1/0/9shutdown#interface LoopBack0ip address 10.2.2.2 255.255.255.255ospf enable 1 area 0.0.0.0#interface LoopBack1ip address 192.168.10.2 255.255.255.255ospf enable 1 area 0.0.0.0#interface Nve1source 10.2.2.2vni 100 head-end peer-list protocol bgpvni 200 head-end peer-list protocol bgpvni 300 head-end peer-list protocol bgp#interface NULL0#bgp 100router-id 192.168.10.2peer 192.168.10.3 as-number 100peer 192.168.10.3 connect-interface LoopBack1#ipv4-family unicastpeer 192.168.10.3 enable#ipv4-family vpn-instance vpc1default-route importedimport-route directimport-route staticadvertise l2vpn evpn#l2vpn-family evpnpolicy vpn-targetpeer 192.168.10.3 enablepeer 192.168.10.3 advertise irb#ospf 1 router-id 192.168.10.2bfd all-interfaces enablebfd all-interfaces min-tx-interval 500 min-rx-interval 500lsa-arrival-interval intelligent-timer 50 50 50area 0.0.0.0#ssh authorization-type default aaa#ssh server cipher aes256_gcm aes128_gcm aes256_ctr aes192_ctr aes128_ctr aes256_cbc aes128_cbc 3des_cbc#ssh server dh-exchange min-len 1024#ssh client cipher aes256_gcm aes128_gcm aes256_ctr aes192_ctr aes128_ctr aes256_cbc aes128_cbc 3des_cbc#user-interface con 0#vm-manager#returnLeaf3Spine1脚本Spine1dis cu!Software Version V200R005C10SPC607B607!Last configuration was updated at 2026-03-19 22:37:4100:00!Last configuration was saved at 2026-03-19 22:38:0000:00#sysname Spine1#device board 17 board-type CE-MPUBdevice board 1 board-type CE-LPUE#evpn-overlay enable#ip vpn-instance externalipv4-familyroute-distinguisher 300:300vpn-target 5002:5002 export-extcommunityvpn-target 5002:5002 export-extcommunity evpnvpn-target 5002:5002 import-extcommunityvpn-target 5002:5002 import-extcommunity evpnvxlan vni 5002#ip vpn-instance vpc1ipv4-familyroute-distinguisher 300:100vpn-target 5000:5000 export-extcommunityvpn-target 5000:5000 export-extcommunity evpnvpn-target 5000:5000 import-extcommunityvpn-target 5000:5000 import-extcommunity evpnvxlan vni 5000#ip vpn-instance vpc2ipv4-familyroute-distinguisher 300:200vpn-target 5001:5001 export-extcommunityvpn-target 5001:5001 export-extcommunity evpnvpn-target 5001:5001 import-extcommunityvpn-target 5001:5001 import-extcommunity evpnvxlan vni 5001#bfd#bridge-domain 400vxlan vni 400evpnroute-distinguisher 300:400vpn-target 400:400 export-extcommunityvpn-target 5000:5000 export-extcommunityvpn-target 400:400 import-extcommunity#bridge-domain 500vxlan vni 500evpnroute-distinguisher 300:500vpn-target 500:500 export-extcommunityvpn-target 5001:5001 export-extcommunityvpn-target 500:500 import-extcommunity#bridge-domain 600vxlan vni 600evpnroute-distinguisher 300:600vpn-target 600:600 export-extcommunityvpn-target 5002:5002 export-extcommunityvpn-target 600:600 import-extcommunity#bridge-domain 700vxlan vni 700evpnroute-distinguisher 300:700vpn-target 700:700 export-extcommunityvpn-target 5002:5002 export-extcommunityvpn-target 700:700 import-extcommunity#aaa#authentication-scheme default#authorization-scheme default#accounting-scheme default#domain default#domain default_admin#interface Vbdif400ip binding vpn-instance vpc1ip address 10.0.0.1 255.255.255.252arp broadcast-detect enablemac-address 0000-5e00-0023vxlan anycast-gateway enablearp collect host enable#interface Vbdif500ip binding vpn-instance vpc2ip address 10.0.1.1 255.255.255.252arp broadcast-detect enablemac-address 0000-5e00-0024vxlan anycast-gateway enablearp collect host enable#interface Vbdif600ip binding vpn-instance externalip address 10.0.2.1 255.255.255.252arp broadcast-detect enablemac-address 0000-5e00-0025vxlan anycast-gateway enablearp collect host enable#interface Vbdif700ip binding vpn-instance externalip address 112.43.3.146 255.255.255.252arp broadcast-detect enablemac-address 0000-5e00-0026vxlan anycast-gateway enablearp collect host enable#interface MEth0/0/0undo shutdown#interface GE1/0/0undo portswitchundo shutdownip address 192.168.0.1 255.255.255.252ospf network-type p2pospf enable 1 area 0.0.0.0#interface GE1/0/1undo portswitchundo shutdownip address 192.168.0.5 255.255.255.252ospf network-type p2pospf enable 1 area 0.0.0.0#interface GE1/0/2undo shutdown#interface GE1/0/2.1000 mode l2encapsulation dot1q vid 1000bridge-domain 400#interface GE1/0/2.1001 mode l2encapsulation dot1q vid 1001bridge-domain 500#interface GE1/0/2.1002 mode l2encapsulation dot1q vid 1002bridge-domain 600#interface GE1/0/3undo shutdown#interface GE1/0/3.1003 mode l2encapsulation dot1q vid 1003bridge-domain 700interface LoopBack0ip address 10.3.3.3 255.255.255.255ospf enable 1 area 0.0.0.0#interface LoopBack1ip address 192.168.10.3 255.255.255.255ospf enable 1 area 0.0.0.0#interface Nve1source 10.3.3.3vni 400 head-end peer-list protocol bgpvni 500 head-end peer-list protocol bgp#interface NULL0#bgp 100router-id 192.168.10.3peer 192.168.10.1 as-number 100peer 192.168.10.1 connect-interface LoopBack1peer 192.168.10.2 as-number 100peer 192.168.10.2 connect-interface LoopBack1#ipv4-family unicastpeer 192.168.10.1 enablepeer 192.168.10.2 enable#ipv4-family vpn-instance vpc1default-route importedimport-route directimport-route staticadvertise l2vpn evpn#ipv4-family vpn-instance vpc2default-route importedimport-route directimport-route staticadvertise l2vpn evpn#l2vpn-family evpnundo policy vpn-targetpeer 192.168.10.1 enablepeer 192.168.10.1 advertise irbpeer 192.168.10.1 reflect-clientpeer 192.168.10.2 enablepeer 192.168.10.2 advertise irbpeer 192.168.10.2 reflect-client#ospf 1 router-id 192.168.10.3bfd all-interfaces enablebfd all-interfaces min-tx-interval 500 min-rx-interval 500lsa-arrival-interval intelligent-timer 50 50 50area 0.0.0.0#ip route-static vpn-instance vpc1 0.0.0.0 0.0.0.0 10.0.0.2ip route-static vpn-instance vpc1 192.168.30.0 255.255.255.0 10.0.0.2ip route-static vpn-instance vpc2 0.0.0.0 0.0.0.0 10.0.1.2ip route-static vpn-instance vpc2 192.168.10.0 255.255.255.0 10.0.1.2ip route-static vpn-instance vpc2 192.168.20.0 255.255.255.0 10.0.1.2ip route-static vpn-instance external 0.0.0.0 0.0.0.0 112.43.3.145ip route-static vpn-instance external 192.168.10.0 255.255.255.0 10.0.2.2ip route-static vpn-instance external 192.168.20.0 255.255.255.0 10.0.2.2ip route-static vpn-instance external 192.168.30.0 255.255.255.0 10.0.2.2#ssh authorization-type default aaa#ssh server cipher aes256_gcm aes128_gcm aes256_ctr aes192_ctr aes128_ctr aes256_cbc aes128_cbc 3des_cbc#ssh server dh-exchange min-len 1024#ssh client cipher aes256_gcm aes128_gcm aes256_ctr aes192_ctr aes128_ctr aes256_cbc aes128_cbc 3des_cbc#user-interface con 0#vm-manager#returnFW防火墙脚本FW-Adis cu2026-03-19 15:19:57.780!Software Version V500R005C10SPC300#sysname FW-A#l2tp domain suffix-separator #vlan batch 1000 to 1002#ipsec sha2 compatible enable#undo telnet server enableundo telnet ipv6 server enable#update schedule location-sdb weekly Sun 23:24#firewall defend action discard#banner enable#user-manage web-authentication security port 8887undo privacy-statement englishundo privacy-statement chinesepage-settinguser-manage security version tlsv1.1 tlsv1.2password-policylevel highuser-manage single-sign-on aduser-manage single-sign-on tsmuser-manage single-sign-on radiususer-manage auto-sync online-user#web-manager security version tlsv1.1 tlsv1.2web-manager enableweb-manager security enable#firewall dataplane to manageplane application-apperceive default-action drop#undo ips log merge enable#decoding uri-cache disable#update schedule ips-sdb daily 03:45update schedule av-sdb daily 03:45update schedule sa-sdb daily 03:45update schedule cnc daily 03:45update schedule file-reputation daily 03:45#vsys enableresource-class r0##vsys name vpc1 1assign vlan 1000#vsys name vpc2 2assign vlan 1001#vsys name external 3assign vlan 1002#ip vpn-instance defaultipv4-family#ip vpn-instance externalipv4-familyipv6-family#ip vpn-instance vpc1ipv4-familyipv6-family#ip vpn-instance vpc2ipv4-familyipv6-family#time-range worktimeperiod-range 08:00:00 to 18:00:00 working-day#ike proposal defaultencryption-algorithm aes-256 aes-192 aes-128dh group14authentication-algorithm sha2-512 sha2-384 sha2-256authentication-method pre-shareintegrity-algorithm hmac-sha2-256prf hmac-sha2-256#aaaauthentication-scheme defaultauthentication-scheme admin_localauthentication-scheme admin_radius_localauthentication-scheme admin_hwtacacs_localauthentication-scheme admin_ad_localauthentication-scheme admin_ldap_localauthentication-scheme admin_radiusauthentication-scheme admin_hwtacacsauthentication-scheme admin_adauthorization-scheme defaultaccounting-scheme defaultdomain defaultservice-type internetaccess ssl-vpn l2tp ikeinternet-access mode passwordreference user current-domainmanager-user audit-adminpassword cipher %%#TDB%JK6Lzsa-e~7G9S/m/dnVKE(U,iEyf)]*nk;S/p9%%service-type web terminallevel 15manager-user api-adminpassword cipher %%I^{f!cfW%MXqMQvi3[(s)WjUcPNsv7.97pDTmYB)Zs%%level 15manager-user adminpassword cipher %%dF7d$HG6hl0!$ts(U57#5V)A\PBro6!ZdUA0ZkWQ7#85%%service-type web terminallevel 15role system-adminrole device-adminrole device-admin(monitor)role audit-adminbind manager-user audit-admin role audit-adminbind manager-user admin role system-admin#interface Vlanif1000ip binding vpn-instance vpc1ip address 10.0.0.2 255.255.255.252service-manage http permitservice-manage https permitservice-manage ping permitservice-manage ssh permitservice-manage telnet permit#interface Vlanif1001ip binding vpn-instance vpc2ip address 10.0.1.2 255.255.255.252service-manage http permitservice-manage https permitservice-manage ping permitservice-manage ssh permitservice-manage telnet permit#interface Vlanif1002ip binding vpn-instance externalip address 10.0.2.2 255.255.255.252service-manage http permitservice-manage https permitservice-manage ping permitservice-manage ssh permitservice-manage telnet permit#l2tp-group default-lns#interface GigabitEthernet0/0/0undo shutdownip binding vpn-instance defaultip address 192.168.0.1 255.255.255.0alias GE0/METH#interface GigabitEthernet1/0/0portswitchundo shutdownport link-type trunkport trunk allow-pass vlan 1000 to 1002#interface Virtual-if0#interface Virtual-if1ip address 20.0.0.1 255.255.255.0#interface Virtual-if2ip address 20.0.0.2 255.255.255.0#interface Virtual-if3ip address 20.0.0.3 255.255.255.0#interface NULL0#firewall zone localset priority 100#firewall zone trustset priority 85add interface GigabitEthernet0/0/0#firewall zone untrustset priority 5#firewall zone dmzset priority 50#ip route-static vpn-instance vpc1 0.0.0.0 0.0.0.0 vpn-instance externalip route-static vpn-instance vpc1 192.168.30.0 255.255.255.0 vpn-instance vpc2ip route-static vpn-instance vpc2 0.0.0.0 0.0.0.0 vpn-instance externalip route-static vpn-instance vpc2 192.168.10.0 255.255.255.0 vpn-instance vpc1ip route-static vpn-instance vpc2 192.168.20.0 255.255.255.0 vpn-instance vpc1ip route-static vpn-instance external 192.168.10.0 255.255.255.0 vpn-instance vpc1ip route-static vpn-instance external 192.168.20.0 255.255.255.0 vpn-instance vpc1ip route-static vpn-instance external 192.168.30.0 255.255.255.0 vpn-instance vpc2#undo ssh server compatible-ssh1x enablessh authentication-type default passwordssh server cipher aes256_ctr aes128_ctrssh server hmac sha2_256 sha1ssh client cipher aes256_ctr aes128_ctrssh client hmac sha2_256 sha1#firewall forward cross-vsys extended#firewall detect ftp#user-interface con 0authentication-mode aaauser-interface vty 0 4authentication-mode aaaprotocol inbound sshuser-interface vty 16 20#pki realm default#sa#location#multi-linkifmode proportion-of-weight#right-manager server-group#device-classificationdevice-group pcdevice-group mobile-terminaldevice-group undefined-group#user-manage server-sync tsm#security-policydefault action permit#auth-policy#traffic-policy#policy-based-route#nat-policy#quota-policy#pcp-policy#dns-transparent-policy#rightm-policy#return#防火墙FWA虚拟系统VPC1脚本switch vsys vpc1#l2tp domain suffix-separator #firewall defend action discard#page-settingpassword-policylevel high#time-range worktimeperiod-range 08:00:00 to 18:00:00 working-day#aaaauthentication-scheme defaultauthentication-scheme admin_localauthentication-scheme admin_radius_localauthentication-scheme admin_hwtacacs_localauthentication-scheme admin_ad_localauthentication-scheme admin_ldap_localauthentication-scheme admin_radiusauthentication-scheme admin_hwtacacsauthentication-scheme admin_adauthorization-scheme defaultaccounting-scheme defaultdomain defaultservice-type internetaccess ssl-vpn l2tp ikeinternet-access mode passwordreference user current-domainrole system-adminrole device-adminrole device-admin(monitor)role audit-admin#interface Vlanif1000ip binding vpn-instance vpc1ip address 10.0.0.2 255.255.255.252service-manage http permitservice-manage https permitservice-manage ping permitservice-manage ssh permitservice-manage telnet permit#l2tp-group default-lns#interface Virtual-if1ip address 20.0.0.1 255.255.255.0#sa#firewall zone localset priority 100#firewall zone trustset priority 85add interface Vlanif1000#firewall zone untrustset priority 5add interface Virtual-if1#firewall zone dmzset priority 50#location#multi-linkifmode proportion-of-weight#security-policyrule name 10.0toexternalsource-address 192.168.10.0 mask 255.255.255.0destination-address 50.50.50.50 mask 255.255.255.255action permitrule name 20.0-externalsource-address 192.168.20.0 mask 255.255.255.0destination-address 50.50.50.50 mask 255.255.255.255action permitrule name vpc1-vpc2source-address 192.168.10.0 mask 255.255.255.0source-address 192.168.20.0 mask 255.255.255.0destination-address 192.168.30.0 mask 255.255.255.0action permitrule name vpc2-vpc1source-address 192.168.30.0 mask 255.255.255.0destination-address 192.168.10.0 mask 255.255.255.0destination-address 192.168.20.0 mask 255.255.255.0action permit#auth-policy#traffic-policy#policy-based-route#nat-policy#quota-policy#pcp-policy#ip route-static 192.168.10.0 255.255.255.0 10.0.0.1ip route-static 192.168.20.0 255.255.255.0 10.0.0.1#return#防火墙FWA虚拟系统VPC2#switch vsys vpc2#l2tp domain suffix-separator #firewall defend action discard#page-settingpassword-policylevel high#time-range worktimeperiod-range 08:00:00 to 18:00:00 working-day#aaaauthentication-scheme defaultauthentication-scheme admin_localauthentication-scheme admin_radius_localauthentication-scheme admin_hwtacacs_localauthentication-scheme admin_ad_localauthentication-scheme admin_ldap_localauthentication-scheme admin_radiusauthentication-scheme admin_hwtacacsauthentication-scheme admin_adauthorization-scheme defaultaccounting-scheme defaultdomain defaultservice-type internetaccess ssl-vpn l2tp ikeinternet-access mode passwordreference user current-domainrole system-adminrole device-adminrole device-admin(monitor)role audit-admin#interface Vlanif1001ip binding vpn-instance vpc2ip address 10.0.1.2 255.255.255.252service-manage http permitservice-manage https permitservice-manage ping permitservice-manage ssh permitservice-manage telnet permit#l2tp-group default-lns#interface Virtual-if2ip address 20.0.0.2 255.255.255.0#sa#firewall zone localset priority 100#firewall zone trustset priority 85add interface Vlanif1001#firewall zone untrustset priority 5add interface Virtual-if2#firewall zone dmzset priority 50#location#multi-linkifmode proportion-of-weight#security-policyrule name vpc1-vpc2source-address 192.168.10.0 mask 255.255.255.0source-address 192.168.20.0 mask 255.255.255.0destination-address 192.168.30.0 mask 255.255.255.0action permitrule name vpc2-vpc1source-address 192.168.30.0 mask 255.255.255.0destination-address 192.168.10.0 mask 255.255.255.0destination-address 192.168.20.0 mask 255.255.255.0action permit#auth-policy#traffic-policy#policy-based-route#nat-policy#quota-policy#pcp-policy#ip route-static 192.168.30.0 255.255.255.0 10.0.1.1#return#防火墙FWA虚拟系统externalswitch vsys external#l2tp domain suffix-separator #firewall defend action discard#page-settingpassword-policylevel high#time-range worktimeperiod-range 08:00:00 to 18:00:00 working-day#aaaauthentication-scheme defaultauthentication-scheme admin_localauthentication-scheme admin_radius_localauthentication-scheme admin_hwtacacs_localauthentication-scheme admin_ad_localauthentication-scheme admin_ldap_localauthentication-scheme admin_radiusauthentication-scheme admin_hwtacacsauthentication-scheme admin_adauthorization-scheme defaultaccounting-scheme defaultdomain defaultservice-type internetaccess ssl-vpn l2tp ikeinternet-access mode passwordreference user current-domainrole system-adminrole device-adminrole device-admin(monitor)role audit-admin#interface Vlanif1002ip binding vpn-instance externalip address 10.0.2.2 255.255.255.252service-manage http permitservice-manage https permitservice-manage ping permitservice-manage ssh permitservice-manage telnet permit#l2tp-group default-lns#interface Virtual-if3ip address 20.0.0.3 255.255.255.0#sa#firewall zone localset priority 100#firewall zone trustset priority 85#firewall zone untrustset priority 5add interface Virtual-if3add interface Vlanif1002#firewall zone dmzset priority 50#location#multi-linkifmode proportion-of-weight#security-policyrule name 10.0toexternalsource-address 192.168.10.0 mask 255.255.255.0destination-address 50.50.50.50 mask 255.255.255.255action permitrule name 20.0-externalsource-address 192.168.20.0 mask 255.255.255.0destination-address 50.50.50.50 mask 255.255.255.255action permit#auth-policy#traffic-policy#policy-based-route#nat-policy#quota-policy#pcp-policy#ip route-static 0.0.0.0 0.0.0.0 10.0.2.1#return终端测试PC1到同VPC下PC2 192.168.10.1----192.168.20.1查看Leaf交换机的BGP EVPN 2类MAC路由查看Leaf交换机的arp学习情况PC1到不同VPC下PC3 192.168.10.1----192.168.30.1查看Leaf交换机的vrf vpc1路由表下一跳10.3.3.3走VXLAN隧道到Spine节点Spine节点通过配置的vrf vpc1 静态路由转发到防火墙vlan1000接口地址10.0.0.2FWA节点虚拟系统vpc1通过静态路由转发至FWA虚拟系统vpc2 Virtual-if2接口FWA节点虚拟系统vpc2通过配置的静态路由转发到Spine1节点的vpc2平面互联接口10.0.1.1FWA防火墙会话情况PC1至外部网络LSW1 192.168.10.1---50.50.50.50PC2至外部网络LSW1 192.168.20.1---50.50.50.50PC3由于在防火墙虚拟系统vpc2和external上配置了应用控制策略无法正常访问外部网络LSW1192.168.30.1---50.50.50.50外部网络LSW1由于在防火墙虚拟系统vpc1和external上配置了应用控制策略无法正常反向访问vpc1 vpc2 50.50.50.50----192.168.10.1 50.50.50.50----192.168.20.1