Hello @Hector Gustavo Serrano Gutierrez,   I just got the configuration running, the thing was that i forgot to put on the Route-Map of the reditribution of the bgp to the OSPF that conects to the ASA to put:   route-map RM-TRAFICO_VXLAN_LANs permit 10   match ip address prefix-list TRAFICO_VXLAN_LANs  match route-type internal external   and that was it so just one extra question if you can help me with it.   Is this the best way to do the redundancy to the DC or is ther any recomendation?   Thanks for the help by the way again.   Saludos, Gerardo Mejia. ... View more

Hello,   Actually i have that done that before and the best path default route for the second site is al ready the default route of the first site but the thing is, trafic still doesnt go through the first site. From the pc on the Second site i can ping the ip of the Border leaf that connects to the InterTenant firewall but when i try to ping the Firewall the reponse never comes.   Any idea why and is it posible to do this to use the primary site to get the trafic from site to to get out?   and thanks for the @Hector Gustavo Serrano Gutierrez .   Saludos, Gerardo Mejia ... View more

Question #1: what do you mean with external entites? outside connetions? and you can use SVI for external connection and depending o your diagram you can have Dynamic or static routing and for example use the SVI for a PBR like configuration to send the data over one link or the other. you can use the dynamic routing for the external conection just remember that if you want to send the VNI sements out of the VxLAN you have to redistribute them with match route-type internal on the IGP: ! ip prefix-list TRAFICO_VXLAN_LANs seq 5 permit 192.168.1.0/24 ip prefix-list TRAFICO_VXLAN_LANs seq 10 permit 192.168.2.0/24 ! route-map RM-TRAFICO_VXLAN_LANs permit 10 match ip address prefix-list TRAFICO_VXLAN_LANs match route-type internal !   Question #2:  two types of VLAN work? Yes you can have the same vlan on both sides and with the anycast-routing enable you should be able to do this with no problem.   I recommend you tu use the Nexus 9Kv and virtualize the enviroment for this in my lab i have 2 DC one with 2 Spines and 4 Leaf and the other one with 1 Spine 2 leaf.   Saludos, Gerardo Andree Mejia ... View more

here the topology al the nexus are Virtual machines on a VMware. and the config is next: SITE 1 spine SPINE_SITE1# sh run !Command: show running-config !Running configuration last done at: Fri May 10 14:49:36 2019 !Time: Fri May 10 15:06:16 2019 version 9.2(3) Bios:version hostname SPINE_SITE1 vdc SPINE_SITE1 id 1 limit-resource vlan minimum 16 maximum 4094 limit-resource vrf minimum 2 maximum 4096 limit-resource port-channel minimum 0 maximum 511 limit-resource u4route-mem minimum 128 maximum 128 limit-resource u6route-mem minimum 96 maximum 96 limit-resource m4route-mem minimum 58 maximum 58 limit-resource m6route-mem minimum 8 maximum 8 nv overlay evpn feature ospf feature bgp feature pim feature interface-vlan feature vn-segment-vlan-based feature nv overlay username admin password 5 $5$WoQmtFHc$u5s4GMtkqKL2PMfpho6LQJmwCUwYkV.lGSwJpHUOAP 1 role network-admin ip domain-lookup system jumbomtu 9000 ip access-list a 10 permit ip 10.101.1.0 0.0.0.255 any 20 permit ip 10.101.12.0 0.0.0.255 any evpn multisite border-gateway 101 delay-restore time 300 snmp-server user admin network-admin auth md5 0x51b17057bd12e6273fc6634ef5fa42c3 priv 0x51b17057bd12e6273fc6634ef5fa42c3 localizedkey rmon event 1 description FATAL(1) owner PMON@FATAL rmon event 2 description CRITICAL(2) owner PMON@CRITICAL rmon event 3 description ERROR(3) owner PMON@ERROR rmon event 4 description WARNING(4) owner PMON@WARNING rmon event 5 description INFORMATION(5) owner PMON@INFO fabric forwarding anycast-gateway-mac 0000.1111.2222 ip route 0.0.0.0/0 172.16.1.1 ip route 10.102.1.0/24 172.16.1.1 name EQUIPOS_DC2 ip route 10.102.12.0/24 172.16.1.1 name EQUIPOS_DC2 ip pim rp-address 10.101.1.1 group-list 224.0.0.0/4 ip pim ssm range 232.0.0.0/8 vlan 1,12,1001-1002 vlan 12 vn-segment 121212 vlan 1001 vn-segment 900001 vlan 1002 vn-segment 900002 route-map NEXT-HOP-UNCHANGED permit 10 set ip next-hop unchanged route-map a permit 10 match ip address a route-map unchanged permit 10 set ip next-hop unchanged vrf context TENANT-BANRURAL vni 121212 rd auto address-family ipv4 unicast route-target both auto route-target both auto evpn vrf context management interface Vlan1 interface Vlan12 no shutdown vrf member TENANT-BANRURAL ip forward interface nve1 no shutdown host-reachability protocol bgp source-interface loopback0 global mcast-group 239.0.0.1 L2 multisite border-gateway interface loopback3 member vni 121212 associate-vrf member vni 900001 multisite ingress-replication ingress-replication protocol bgp member vni 900002 multisite ingress-replication ingress-replication protocol bgp interface Ethernet1/1 description SPINE_SITE_XLEAF_SITE_1 no switchport ip address 10.101.101.1/30 ip ospf network point-to-point ip router ospf UNDERLAY_101 area 0.0.0.0 ip pim sparse-mode evpn multisite fabric-tracking no shutdown interface Ethernet1/2 no switchport ip address 172.16.1.2/30 ip router ospf DCI area 0.0.0.0 evpn multisite dci-tracking no shutdown   interface mgmt0 vrf member management interface loopback0 description Routing_ID_ANYCAST ip address 10.101.1.1/32 ip router ospf UNDERLAY_101 area 0.0.0.0 ip pim sparse-mode interface loopback1 description VTEP_ID ip address 10.101.12.1/32 ip router ospf UNDERLAY_101 area 0.0.0.0 ip pim sparse-mode interface loopback3 ip address 172.17.101.1/32 ip router ospf DCI area 0.0.0.0 ip pim sparse-mode line console line vty boot nxos bootflash:/nxos.9.2.3.bin router ospf DCI router-id 172.17.101.1 router ospf UNDERLAY_101 router-id 10.101.1.1 network 10.101.1.1/32 area 0.0.0.0 network 10.101.12.1/32 area 0.0.0.0 network 10.101.101.0/30 area 0.0.0.0 router bgp 65101 router-id 10.101.1.1 address-family ipv4 unicast address-family l2vpn evpn nexthop route-map unchanged template peer VTEP-PEERS remote-as 65101 update-source loopback0 address-family ipv4 unicast send-community send-community extended route-reflector-client address-family l2vpn evpn send-community send-community extended route-reflector-client neighbor 10.101.1.2 inherit peer VTEP-PEERS neighbor 172.17.102.1 remote-as 65102 update-source loopback3 ebgp-multihop 5 peer-type fabric-external address-family l2vpn evpn send-community send-community extended rewrite-evpn-rt-asn evpn vni 900001 l2 rd auto route-target import auto route-target export auto vni 900002 l2 rd auto route-target import auto route-target export auto     SITE1 LEAF LEAF_SITE1# sh run !Command: show running-config !Running configuration last done at: Fri May 10 14:36:40 2019 !Time: Fri May 10 15:09:38 2019 version 9.2(3) Bios:version hostname LEAF_SITE1 vdc LEAF_SITE1 id 1 limit-resource vlan minimum 16 maximum 4094 limit-resource vrf minimum 2 maximum 4096 limit-resource port-channel minimum 0 maximum 511 limit-resource u4route-mem minimum 128 maximum 128 limit-resource u6route-mem minimum 96 maximum 96 limit-resource m4route-mem minimum 58 maximum 58 limit-resource m6route-mem minimum 8 maximum 8 nv overlay evpn feature ospf feature bgp feature pim feature interface-vlan feature vn-segment-vlan-based feature nv overlay username admin password 5 $5$6aBohS/i$34DkDieA1YqeaGlG4SYKjdu9w9dOnWGwbY0Pupfkp. 6 role network-admin ip domain-lookup system jumbomtu 9000 copp profile strict snmp-server user admin network-admin auth md5 0x8ce9aeb2b012737f11b5990925534af0 priv 0x8ce9aeb2b012737f11b5990925534af0 localizedkey rmon event 1 description FATAL(1) owner PMON@FATAL rmon event 2 description CRITICAL(2) owner PMON@CRITICAL rmon event 3 description ERROR(3) owner PMON@ERROR rmon event 4 description WARNING(4) owner PMON@WARNING rmon event 5 description INFORMATION(5) owner PMON@INFO fabric forwarding anycast-gateway-mac 0000.1111.2222 ip route 0.0.0.0/0 10.101.101.1 ip route 10.102.1.0/24 10.101.101.1 name EQUIPOS_DC2 ip route 10.102.12.0/24 10.101.101.1 name EQUIPOS_DC2 ip pim rp-address 10.101.1.1 group-list 224.0.0.0/4 ip pim ssm range 232.0.0.0/8 vlan 1,12,1001-1002 vlan 12 vn-segment 121212 vlan 1001 vn-segment 900001 vlan 1002 vn-segment 900002 route-map unchanged permit 10 set ip next-hop unchanged vrf context TENANT-BANRURAL vni 121212 rd auto address-family ipv4 unicast route-target both auto route-target both auto evpn vrf context management interface Vlan1 interface Vlan12 no shutdown vrf member TENANT-BANRURAL ip forward interface Vlan1001 no shutdown vrf member TENANT-BANRURAL ip address 192.168.120.1/24 fabric forwarding mode anycast-gateway interface Vlan1002 no shutdown vrf member TENANT-BANRURAL ip address 192.168.121.1/24 fabric forwarding mode anycast-gateway interface nve1 no shutdown host-reachability protocol bgp source-interface loopback0 global mcast-group 239.0.0.1 L2 member vni 121212 associate-vrf member vni 900001 ingress-replication protocol bgp member vni 900002 ingress-replication protocol bgp interface Ethernet1/1 description SPINE_SITE_XLEAF_SITE_1 no switchport ip address 10.101.101.2/30 ip ospf network point-to-point ip router ospf UNDERLAY_101 area 0.0.0.0 ip pim sparse-mode no shutdown interface Ethernet1/2 switchport access vlan 1001   interface mgmt0 vrf member management interface loopback0 description Routing_ID_ANYCAST ip address 10.101.1.2/32 ip router ospf UNDERLAY_101 area 0.0.0.0 ip pim sparse-mode interface loopback1 description VTEP_ID ip address 10.101.12.2/32 ip router ospf UNDERLAY_101 area 0.0.0.0 ip pim sparse-mode line console line vty boot nxos bootflash:/nxos.9.2.3.bin router ospf ISP_DCI router-id 172.17.101.1 network 172.16.1.0/30 area 0.0.0.0 network 172.17.101.1/32 area 0.0.0.0 router ospf UNDERLAY_101 router-id 10.101.1.2 network 10.101.1.2/32 area 0.0.0.0 network 10.101.12.2/32 area 0.0.0.0 network 10.101.101.0/30 area 0.0.0.0 router bgp 65101 router-id 10.101.1.2 address-family ipv4 unicast address-family l2vpn evpn neighbor 10.101.1.1 remote-as 65101 update-source loopback0 address-family ipv4 unicast send-community send-community extended address-family l2vpn evpn send-community send-community extended vrf TENANT-BANRURAL evpn vni 900001 l2 rd auto route-target import auto route-target export auto vni 900002 l2 rd auto route-target import auto route-target export auto ///////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// SITE2_spine sITE2_SPINE# sh run !Command: show running-config !Running configuration last done at: Fri May 10 14:48:46 2019 !Time: Fri May 10 15:06:20 2019 version 9.2(3) Bios:version hostname SITE2_SPINE vdc SITE2_SPINE id 1 limit-resource vlan minimum 16 maximum 4094 limit-resource vrf minimum 2 maximum 4096 limit-resource port-channel minimum 0 maximum 511 limit-resource u4route-mem minimum 128 maximum 128 limit-resource u6route-mem minimum 96 maximum 96 limit-resource m4route-mem minimum 58 maximum 58 limit-resource m6route-mem minimum 8 maximum 8 nv overlay evpn feature ospf feature bgp feature pim feature interface-vlan feature vn-segment-vlan-based feature nv overlay username admin password 5 $5$GCQDA.HY$LDz1P9cPmzoij7ybOHbY1yo4lQZ0ly3HY5s.wEhYSc 6 role network-admin ip domain-lookup system jumbomtu 9000 ip access-list a 10 permit ip 10.102.1.0 0.0.0.255 any 20 permit ip 10.102.12.0 0.0.0.255 any copp profile strict evpn multisite border-gateway 102 delay-restore time 300 snmp-server user admin network-admin auth md5 0xf0bdbe1b1ed9d278f86e8659d0c681a2 priv 0xf0bdbe1b1ed9d278f86e8659d0c681a2 localizedkey rmon event 1 description FATAL(1) owner PMON@FATAL rmon event 2 description CRITICAL(2) owner PMON@CRITICAL rmon event 3 description ERROR(3) owner PMON@ERROR rmon event 4 description WARNING(4) owner PMON@WARNING rmon event 5 description INFORMATION(5) owner PMON@INFO ip route 0.0.0.0/0 172.16.2.1 ip route 10.101.1.0/24 172.16.2.1 name EQUIPOS_DC1 ip route 10.101.12.0/24 172.16.2.1 name EQUIPOS_DC1 ip pim rp-address 10.102.1.1 group-list 224.0.0.0/4 ip pim ssm range 232.0.0.0/8 vlan 1,12,1001-1002 vlan 12 vn-segment 121212 vlan 1001 vn-segment 900001 vlan 1002 vn-segment 900002 route-map NEXT-HOP-UNCHANGED permit 10 set ip next-hop unchanged route-map a permit 10 match ip address a route-map unchanged permit 10 set ip next-hop unchanged vrf context TENANT-BANRURAL vni 121212 rd auto address-family ipv4 unicast route-target both auto route-target both auto evpn vrf context management interface Vlan1 interface Vlan12 no shutdown vrf member TENANT-BANRURAL ip forward interface nve1 no shutdown host-reachability protocol bgp source-interface loopback0 global mcast-group 239.0.0.1 L2 multisite border-gateway interface loopback4 member vni 121212 associate-vrf member vni 900001 multisite ingress-replication ingress-replication protocol bgp member vni 900002 multisite ingress-replication ingress-replication protocol bgp interface Ethernet1/1 description SPINE_SITE_XLEAF_SITE_1 no switchport ip address 10.102.102.1/30 ip ospf network point-to-point ip router ospf UNDERLAY_102 area 0.0.0.0 ip pim sparse-mode evpn multisite fabric-tracking no shutdown interface Ethernet1/2 no switchport ip address 172.16.2.2/30 ip router ospf DCI area 0.0.0.0 evpn multisite dci-tracking no shutdown interface loopback0 description Routing_ID_ANYCAST ip address 10.102.1.1/32 ip router ospf UNDERLAY_102 area 0.0.0.0 interface loopback1 description VTEP ID ip address 10.102.12.1/32 ip router ospf UNDERLAY_102 area 0.0.0.0 interface loopback4 ip address 172.17.102.1/30 ip router ospf DCI area 0.0.0.0 ip pim sparse-mode line console line vty boot nxos bootflash:/nxos.9.2.3.bin router ospf DCI router-id 172.17.102.1 router ospf UNDERLAY_102 router-id 10.102.1.1 network 10.102.1.1/32 area 0.0.0.0 network 10.102.102.0/30 area 0.0.0.0 router bgp 65102 router-id 10.102.1.1 address-family ipv4 unicast address-family l2vpn evpn nexthop route-map unchanged template peer VTEP-PEERS remote-as 65102 update-source loopback0 address-family ipv4 unicast send-community send-community extended route-reflector-client address-family l2vpn evpn send-community send-community extended route-reflector-client neighbor 10.102.1.2 inherit peer VTEP-PEERS neighbor 172.17.101.1 remote-as 65101 update-source loopback4 ebgp-multihop 5 peer-type fabric-external address-family l2vpn evpn send-community send-community extended rewrite-evpn-rt-asn evpn vni 900001 l2 rd auto route-target import auto route-target export auto vni 900002 l2 rd auto route-target import auto route-target export auto   SITE2_LEAF SITE2_LEAF1# sh run !Command: show running-config !Running configuration last done at: Fri May 10 14:31:35 2019 !Time: Fri May 10 15:09:33 2019 version 9.2(3) Bios:version hostname SITE2_LEAF1 vdc SITE2_LEAF1 id 1 limit-resource vlan minimum 16 maximum 4094 limit-resource vrf minimum 2 maximum 4096 limit-resource port-channel minimum 0 maximum 511 limit-resource u4route-mem minimum 128 maximum 128 limit-resource u6route-mem minimum 96 maximum 96 limit-resource m4route-mem minimum 58 maximum 58 limit-resource m6route-mem minimum 8 maximum 8 nv overlay evpn feature ospf feature bgp feature pim feature interface-vlan feature vn-segment-vlan-based feature nv overlay username admin password 5 $5$TkZisnlL$fjPNZWVKwqCvSfRC775jzVYrgXeq.8Dr4qZec9uXNj 9 role network-admin ip domain-lookup system jumbomtu 9000 copp profile strict snmp-server user admin network-admin auth md5 0x9f53aa2d952e6a7e7338e2e658c8c3dc priv 0x9f53aa2d952e6a7e7338e2e658c8c3dc localizedkey rmon event 1 description FATAL(1) owner PMON@FATAL rmon event 2 description CRITICAL(2) owner PMON@CRITICAL rmon event 3 description ERROR(3) owner PMON@ERROR rmon event 4 description WARNING(4) owner PMON@WARNING rmon event 5 description INFORMATION(5) owner PMON@INFO fabric forwarding anycast-gateway-mac 0000.1111.2222 ip route 0.0.0.0/0 10.102.102.1 ip route 10.101.1.0/24 10.102.102.1 name EQUIPOS_DC1 ip route 10.101.12.0/24 10.102.102.1 name EQUIPOS_DC1 ip pim rp-address 10.102.1.1 group-list 224.0.0.0/4 ip pim ssm range 232.0.0.0/8 vlan 1,12,1001-1002,1021-1022 vlan 12 vn-segment 121212 vlan 1001 vn-segment 900001 vlan 1002 vn-segment 900002 vlan 1021 vn-segment 9000021 vlan 1022 vn-segment 9000022 vrf context TENANT-BANRURAL vni 121212 rd auto address-family ipv4 unicast route-target both auto route-target both auto evpn vrf context management interface Vlan1 interface Vlan12 no shutdown vrf member TENANT-BANRURAL ip forward interface Vlan1001 no shutdown vrf member TENANT-BANRURAL ip address 192.168.120.1/24 fabric forwarding mode anycast-gateway interface Vlan1002 no shutdown vrf member TENANT-BANRURAL ip address 192.168.121.1/24 fabric forwarding mode anycast-gateway interface Vlan1021 no shutdown vrf member TENANT-BANRURAL ip address 192.168.220.1/24 fabric forwarding mode anycast-gateway interface Vlan1022 no shutdown vrf member TENANT-BANRURAL ip address 192.168.221.1/24 fabric forwarding mode anycast-gateway interface nve1 no shutdown host-reachability protocol bgp source-interface loopback0 global mcast-group 239.0.0.1 L2 member vni 121212 associate-vrf member vni 900001 ingress-replication protocol bgp member vni 900002 ingress-replication protocol bgp member vni 9000021 member vni 9000022 interface Ethernet1/1 description SPINE_SITE_XLEAF_SITE_1 no switchport ip address 10.102.102.2/30 ip ospf network point-to-point ip router ospf UNDERLAY_102 area 0.0.0.0 ip pim sparse-mode no shutdown interface Ethernet1/2 switchport access vlan 1001   interface loopback0 description Routing_ID_ANYCAST ip address 10.102.1.2/32 ip router ospf UNDERLAY_102 area 0.0.0.0 ip pim sparse-mode interface loopback1 description VTEP_ID ip address 10.102.12.2/32 ip router ospf UNDERLAY_102 area 0.0.0.0 ip pim sparse-mode line console line vty boot nxos bootflash:/nxos.9.2.3.bin router ospf UNDERLAY_102 router-id 10.102.1.2 network 10.102.1.2/32 area 0.0.0.0 network 10.102.12.2/32 area 0.0.0.0 network 10.102.102.0/30 area 0.0.0.0 router bgp 65102 router-id 10.102.1.2 address-family ipv4 unicast address-family l2vpn evpn neighbor 10.102.1.1 remote-as 65102 update-source loopback0 address-family ipv4 unicast send-community send-community extended address-family l2vpn evpn send-community send-community extended vrf TENANT-BANRURAL evpn vni 900001 l2 rd auto route-target import auto route-target export auto vni 900002 l2 rd auto route-target import auto route-target export auto vni 9000021 l2 rd auto route-target import auto route-target export auto vni 9000022 l2 rd auto route-target import auto route-target export auto ... View more

Thanks for the help.   Primary Site: 2 - Border LEAF          | 2 - SPINE           | 2 - Clients LEAF   Secondary Site: 1 - Border LEAF:           | 1 - SPINE           | 1 - Clients LEAF   Border LEAF are for External Connection to the DC, And would be use for the BGW and should I user one for the Primary or both? Clients LEAF for Server. Question this will give me a Redundant L2 and L3 Saludos, Gerardo Andree Mejia ... View more

El nat es dentro del mismo equipo, con esto me refiero LANs que estan definidas en el mismo equipo y estan deben de poder llegar a la ip nateada y como les comento si responde ping pero nada mas funciona(e.g: telnet). De igual manera realize pruebas con esta definicion en el access-list y no funciono alguna otra idea? ... View more

El nat es dentro del mismo equipo con esto me refiero LANs que estan definidas en el mismo equipo deben de poder llegar a la ip nateada. De igual manera realize pruebas con esta definicion en el access-list y no funciono alguna otra idea? ... View more

Ill try and tell you if it work. thanks for the help. ... View more

The ping works but it does show on teh command: show ip nat translation command. Puting the IP NAT OUTSIDE ON THE SPECIFIC INT VLAN? ... View more

Yes if i dont filter traffic on the interface where the server is it wolud work, but because of a security requirement users cant access the server with the real ip thats the reson the user need to used the nated ip. Any other idea of how can this be done or where is the flaud? and THANKS by the way. ... View more