我正在使用 CentOS Linux 版本 8.3.2011，并且正在努力将其设置为交换机。网络拓扑如下：
[switch1]--------[vsphere]--------------[centos]--------------------[vRouter]
gi0/0 vmnic2 SW1-trunk end224 lnkbe296edcl2b Gi0/0.10
SW1 bridge11
拓扑1
所以，总而言之：
- 物理交换机 switch1，接口 gi0/0 配置为中继，并且一些交换虚拟接口配置了 IP 地址用于测试。对于此测试，我将使用接口 vlan 10，其 IP 地址为 192.168.0.10/24；
- vSphere 管理程序，带有 vSwitch SW1，包含端口组“SW1 - trunk”和物理适配器 vmnic2。端口组配置VLAN ID 4095，这是vmware上将端口配置为trunk的方式；
- CentOS VM，称为 CML，它使用 KVM 来托管虚拟网络功能。我在它上面配置了一个虚拟路由器。我创建了bridge11，并将面向vmware的接口(ens224)和面向vrouter的接口(lnkbe296edcl2b)关联到它。
- vRouter，它是 IOSv（虚拟化 Cisco IOS），具有 IP 地址为 192.168.0.11/24 的 IP 子接口。
vSphere 拓扑如下：
好吧，使用此配置，我无法从 vRouter (192.168.0.11) ping 到 switch1 SVI (192.168.0.10)。
R1#sh ip int br
Interface IP-Address OK? Method Status Protocol
GigabitEthernet0/0 unassigned YES manual up up
GigabitEthernet0/0.10 192.168.0.11 YES TFTP up up
GigabitEthernet0/1 unassigned YES unset administratively down down
GigabitEthernet0/2 unassigned YES unset administratively down down
GigabitEthernet0/3 unassigned YES unset administratively down down
R1#ping 192.168.0.10
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.0.10, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)
R1#sh arp
Protocol Address Age (min) Hardware Addr Type Interface
Internet 192.168.0.10 0 Incomplete ARPA
Internet 192.168.0.11 - 5254.0000.b61d ARPA GigabitEthernet0/0.10
R1#
如果我将网络拓扑更改为以下之一：
[switch1]--------[vsphere]--------------[centos]--------------------[vRouter]
gi0/0 vmnic2 SW1-trunk end224.10 lnkbe296edcl2b Gi0/0
SW1 bridge11
拓扑2 在此拓扑中：
- 我在 centos 上使用 vmware 的子接口，因此，它从网桥接收未标记的流量并将其标记发送到 VMWare 端口组 SW1-trunk；
- 我使用的是路由器的主界面。因此，流量没有被标记；
- 我已经向bridge11添加了一个IP地址 - 192.168.0.1/24，用于测试。
在这种情况下，我可以从网桥 11 ping 到交换机 1，从网桥 11 ping 到 vRouter，但不能从 vRouter ping 到交换机 1。
- CentOS测试：
[~]$ping -c5 -q 192.168.0.11
PING 192.168.0.11 (192.168.0.11) 56(84) bytes of data.
--- 192.168.0.11 ping statistics ---
5 packets transmitted, 5 received, 0% packet loss, time 11ms
rtt min/avg/max/mdev = 1.718/2.151/2.879/0.407 ms
[~]$ping -c5 -q 192.168.0.10
PING 192.168.0.10 (192.168.0.10) 56(84) bytes of data.
--- 192.168.0.10 ping statistics ---
5 packets transmitted, 5 received, 0% packet loss, time 103ms
rtt min/avg/max/mdev = 0.398/0.515/0.656/0.090 ms
[~]$ip nei show dev bridge11
192.168.0.10 lladdr 00:12:43:7e:4b:c1 STALE
192.168.0.11 lladdr 52:54:00:00:b6:1d STALE
[~]$
- vRouter (R1) 测试：
R1#ping 192.168.0.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.0.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/4 ms
R1#ping 192.168.0.10
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.0.10, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)
R1#show arp
Protocol Address Age (min) Hardware Addr Type Interface
Internet 192.168.0.1 0 000c.2997.7368 ARPA GigabitEthernet0/0
Internet 192.168.0.10 0 Incomplete ARPA
Internet 192.168.0.11 - 5254.0000.b61d ARPA GigabitEthernet0/0
R1#
我进行了搜索，只找到了有关 linux 取消标记流量和路由的参考...我需要 linux 充当 vlan 交换机，而不需要查看 ip 标头。
关于如何让 CentOS 切换 vlan 流量（从 trunk 到 trunk 端口）的任何提示？
提前致谢
编辑（5/16/21）- 包括 AB 要求的命令的输出：
[sysadmin]$sysctl -ne net.bridge.bridge-nf-call-iptables
0
[sysadmin]$tcpdump -e -n -i lnk2fb2a645ld1
dropped privs to tcpdump
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on lnk2fb2a645ld1, link-type EN10MB (Ethernet), capture size 262144 bytes
18:00:26.276792 52:54:00:00:b6:1d > 01:00:0c:cc:cc:cc, 802.3, length 396: LLC, dsap SNAP (0xaa) Individual, ssap SNAP (0xaa) Command, ctrl 0x03: oui Cisco (0x00000c), pid CDP (0x2000), length 388: CDPv2, ttl: 180s, Device-ID 'R1', length 388
18:00:31.178085 52:54:00:00:b6:1d > 52:54:00:00:b6:1d, ethertype Loopback (0x9000), length 60: Loopback, skipCount 0, Reply, receipt number 0, data (40 octets)
18:00:35.482297 52:54:00:00:b6:1d > Broadcast, ethertype 802.1Q (0x8100), length 64: vlan 10, p 0, ethertype ARP, Request who-has 192.168.0.10 tell 192.168.0.11, length 46
18:00:39.480774 52:54:00:00:b6:1d > Broadcast, ethertype 802.1Q (0x8100), length 64: vlan 10, p 0, ethertype ARP, Request who-has 192.168.0.10 tell 192.168.0.11, length 46
18:00:41.177503 52:54:00:00:b6:1d > 52:54:00:00:b6:1d, ethertype Loopback (0x9000), length 60: Loopback, skipCount 0, Reply, receipt number 0, data (40 octets)
18:00:41.480474 52:54:00:00:b6:1d > Broadcast, ethertype 802.1Q (0x8100), length 64: vlan 10, p 0, ethertype ARP, Request who-has 192.168.0.10 tell 192.168.0.11, length 46
18:00:41.655353 52:54:00:00:b6:1d > ab:00:00:02:00:00, ethertype MOP RC (0x6002), length 77:
0x0000: 3d00 0700 0000 0100 0303 0000 0200 0221 =..............!
0x0010: 0003 0006 0000 0000 0000 0400 023c 0005 .............<..
0x0020: 0002 d805 0600 0200 0107 0006 5254 0000 ............RT..
0x0030: b61d 6400 0179 9001 0101 9101 02ee 05 ..d..y.........
18:00:43.480161 52:54:00:00:b6:1d > Broadcast, ethertype 802.1Q (0x8100), length 64: vlan 10, p 0, ethertype ARP, Request who-has 192.168.0.10 tell 192.168.0.11, length 46
^C
8 packets captured
8 packets received by filter
0 packets dropped by kernel
[sysadmin]$
编辑 (5/16/21) - 包括 AB 请求的附加命令输出：
$ip link show
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN mode DEFAULT group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
2: ens160: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq master bridge0 state UP mode DEFAULT group default qlen 1000
link/ether 00:0c:29:97:73:54 brd ff:ff:ff:ff:ff:ff
3: ens192: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq master bridge1 state UP mode DEFAULT group default qlen 1000
link/ether 00:0c:29:97:73:5e brd ff:ff:ff:ff:ff:ff
4: ens224: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq master bridge11 state UP mode DEFAULT group default qlen 1000
link/ether 00:0c:29:97:73:68 brd ff:ff:ff:ff:ff:ff
5: ens256: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP mode DEFAULT group default qlen 1000
link/ether 00:0c:29:97:73:72 brd ff:ff:ff:ff:ff:ff
6: bridge0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP mode DEFAULT group default qlen 1000
link/ether 00:0c:29:97:73:54 brd ff:ff:ff:ff:ff:ff
7: bridge1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP mode DEFAULT group default qlen 1000
link/ether 00:0c:29:97:73:5e brd ff:ff:ff:ff:ff:ff
10: virbr0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN mode DEFAULT group default qlen 1000
link/ether 52:54:00:90:2d:88 brd ff:ff:ff:ff:ff:ff
11: virbr0-nic: <BROADCAST,MULTICAST> mtu 1500 qdisc fq_codel master virbr0 state DOWN mode DEFAULT group default qlen 1000
link/ether 52:54:00:90:2d:88 brd ff:ff:ff:ff:ff:ff
44: bridge11: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP mode DEFAULT group default qlen 1000
link/ether 00:0c:29:97:73:68 brd ff:ff:ff:ff:ff:ff
45: lnk2fb2a645ld1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel master bridge11 state UNKNOWN mode DEFAULT group default qlen 1000
link/ether f2:ca:f4:6e:96:14 brd ff:ff:ff:ff:ff:ff
$ip -br link show
lo UNKNOWN 00:00:00:00:00:00 <LOOPBACK,UP,LOWER_UP>
ens160 UP 00:0c:29:97:73:54 <BROADCAST,MULTICAST,UP,LOWER_UP>
ens192 UP 00:0c:29:97:73:5e <BROADCAST,MULTICAST,UP,LOWER_UP>
ens224 UP 00:0c:29:97:73:68 <BROADCAST,MULTICAST,UP,LOWER_UP>
ens256 UP 00:0c:29:97:73:72 <BROADCAST,MULTICAST,UP,LOWER_UP>
bridge0 UP 00:0c:29:97:73:54 <BROADCAST,MULTICAST,UP,LOWER_UP>
bridge1 UP 00:0c:29:97:73:5e <BROADCAST,MULTICAST,UP,LOWER_UP>
virbr0 DOWN 52:54:00:90:2d:88 <NO-CARRIER,BROADCAST,MULTICAST,UP>
virbr0-nic DOWN 52:54:00:90:2d:88 <BROADCAST,MULTICAST>
bridge11 UP 00:0c:29:97:73:68 <BROADCAST,MULTICAST,UP,LOWER_UP>
lnk2fb2a645ld1 UNKNOWN f2:ca:f4:6e:96:14 <BROADCAST,MULTICAST,UP,LOWER_UP>
$ip -br address
lo UNKNOWN 127.0.0.1/8 ::1/128
ens160 UP
ens192 UP
ens224 UP
ens256 UP
bridge0 UP 10.30.8.241/22 fe80::20c:29ff:fe97:7354/64
bridge1 UP x.x.x.x/25 fe80::20c:29ff:fe97:735e/64
virbr0 DOWN 192.168.255.1/24
virbr0-nic DOWN
bridge11 UP fe80::20c:29ff:fe97:7368/64
lnk2fb2a645ld1 UNKNOWN
$
答案1
为了让它发挥作用，我需要做两件事：
- 禁用 vlan_filtering（ip link set devbridge11 类型网桥 vlan_filtering 0）
- 在 vmware vSphere 上启用混杂模式和伪造传输（见下文）
