华为CloudEngine系列交换机VXLAN技术白皮书

VLAN技术白皮书华为技术有限公司北京市上地信息产业基地信息中路3号华为大厦 100085二ＯＯ三年三月摘要本文基于华为技术有限公司Quidway 系列以太网交换产品详细介绍了目前以太网平台上的主流VLAN技术以及华为公司在VLAN技术方面的扩展，其中包括基于端口的VLAN划分、PVLAN，动态VLAN注册协议，如GVRP和VTP等等。

本文全面地总结了当前的VLAN技术发展，并逐步探讨了Quidway 系列以太网交换产品在VLAN技术方面的通用特性和部分独有特性，并结合每个主题，简要的介绍了系列VLAN技术在实际组网中的应用方式。

关键词VLAN，PVLAN， GVRP，VTP1 VLAN概述VLAN（Virtual Local Area Network）即虚拟局域网，是一种通过将局域网内的设备逻辑地而不是物理地划分成一个个网段从而实现虚拟工作组的新兴技术。

IEEE于1999年颁布了用以标准化VLAN实现方案的802.1Q协议标准草案。

VLAN技术允许网络管理者将一个物理的LAN逻辑地划分成不同的广播域（或称虚拟LAN，即VLAN），每一个VLAN都包含一组有着相同需求的计算机工作站，与物理上形成的LAN有着相同的属性。

但由于它是逻辑地而不是物理地划分，所以同一个VLAN内的各个工作站无须被放置在同一个物理空间里，即这些工作站不一定属于同一个物理LAN网段。

一个VLAN内部的广播和单播流量都不会转发到其他VLAN中，从而有助于控制流量、减少设备投资、简化网络管理、提高网络的安全性。

VLAN是为解决以太网的广播问题和安全性而提出的一种协议，它在以太网帧的基础上增加了VLAN头，用VLAN ID把用户划分为更小的工作组，限制不同工作组间的用户二层互访，每个工作组就是一个虚拟局域网。

虚拟局域网的好处是可以限制广播范围，并能够形成虚拟工作组，动态管理网络。

VLAN在交换机上的实现方法，可以大致划分为4类:1、基于端口划分的VLAN这种划分VLAN的方法是根据以太网交换机的端口来划分，比如Quidway S3526的1~4端口为VLAN 10，5~17为VLAN 20，18~24为VLAN 30，当然，这些属于同一VLAN的端口可以不连续，如何配置，由管理员决定，如果有多个交换机，例如，可以指定交换机 1 的1~6端口和交换机 2 的1~4端口为同一VLAN，即同一VLAN可以跨越数个以太网交换机，根据端口划分是目前定义VLAN的最广泛的方法，IEEE 802.1Q规定了依据以太网交换机的端口来划分VLAN的国际标准。

1接口基础配置关于本章1.1 接口简介通过本小节，您可以了解到设备的接口分类和接口编号规则。

1.2 配置接口基本参数配置接口基本参数，包括接口描述信息、接口流量统计时间间隔功能以及开启或关闭接口。

1.3 维护接口您可以通过清除接口统计信息以方便查询一定时间内接口的流量信息。

1.1 接口简介通过本小节，您可以了解到设备的接口分类和接口编号规则。

接口分类接口是设备与网络中的其它设备交换数据并相互作用的部件，分为管理接口、物理业务接口和逻辑接口三类，其中：l管理接口管理接口主要为用户提供配置管理支持，也就是用户通过此类接口可以登录到设备，并进行配置和管理操作。

管理接口不承担业务传输。

关于管理接口的详细配置，请参见《CloudEngine 7800&6800&5800系列交换机配置指南-基础配置》。

设备支持的管理接口如表1-1所示：表1-1各管理接口介绍l V100R005C00版本下，仅CE6850-48S6Q-HI支持Mini USB接口。

V100R005C10及以后版本，CE6850-48S6Q-HI、CE6850–48T4Q-HI和CE6850U-HI支持Mini USB接口。

l CE6850HI和CE6850U-HI设备上有两个Combo类型的管理接口，每个Combo口包括一个光接口和一个电接口。

光接口和电接口只能同时激活其中一个。

l物理业务接口物理业务接口是真实存在、有器件支持的接口。

物理接口需要承担业务传输。

物理接口有时也被称为端口，为便于描述，在本手册中，统一描述为接口。

设备支持的物理接口如表1-2所示。

表1-2物理接口缺省情况下，设备的以太网接口工作在二层模式，如果需要应用接口的三层功能，可以使用undo portswitch命令将接口转换为三层模式。

l逻辑接口逻辑接口是指能够实现数据交换功能但物理上不存在、需要通过配置建立的接口。

逻辑接口需要承担业务传输。

设备支持的逻辑接口如表1-3所示。

CloudEngine Is the Foundation of the Intent-driven NetworkHuawei CloudEngine Series Switches Technical PresentationContentsClick to add Title 1Click to add Title 2Click to add Title 3CloudEngine Switch OverviewCloudEngine Switch HighlightsCloudEngine Switch Market ProgressSwitches Are the Cornerstone for Transforming Data Centers from Service Centers to Value CentersCloud computingBig DataDistributed storageMetcalfe's Law: The effect of a telecommunications network is proportional to the square of the number of connected users of the system.-Robert Metcalfe who invented Ethernet, founder of 3Com In the future, even if all hardware network devices will disappear, data center switches used as the buses connecting to servers, will always exist. The Ethernet helps release the value of data.AISDN NFVIntent-driven networkUltra-broadbandInfrastructureSimplifiedOpenController and management tool layerControllerAnalyzerSecurityCharacteristics of the Future of DC Switches: Ultra-broadband, Simplified, Intelligent, Secure, and OpenIntelligentSecureManagementControlAnalysisOpenConvergenceEcosystemSpine LeafGatewayBandwidth -> LatencyLayer 2 and Layer 3 -> SecurityManual driving -> Automated drivingWeb page -> Service integrationCloudEngine Series Data Center Switches Portfolio(1)Core SwitchesAccess SwitchesCloudEngine 6881-48S6CQ (New)CloudEngine 6863-48S6CQ (New)CloudEngine 16800 (New)CloudEngine 16816CloudEngine 16808CloudEngine 1680410GE ToR switch25GE ToR switchCloudEngine Series Data Center Switches Portfolio(2)Core SwitchesAccess Switches10GE ToR switchCE6851-48S6Q-HICE6810-48S4Q-LICE6810-32T16S4Q-LIGE ToR switchCE5855-48T4S2Q-EICE5855-24T4S2Q-EIVirtual SwitchesCE1800VCE6855/CE6856-48S6Q-HICE6855/CE6856-48T6Q-HI10GE large-buffer ToR switchCE6870-48S6CQ-EIToR switch with flexible cardsCE8861-4C-EI40GE switchCE7855-32Q-EICE6865-48S8CQ-EI25GE ToR switch100GE switchCE8850-64CQ-EICE12816CE12812CE12808CE12808S CE12804SCE12804CE12800CE12800SCE6870-48T6CQ-EICE6875-48S4CQ-EICE8850-32CQ-EICE6860-48S8CQ-EICE6857-48S6CQ-EICE8860-4C-EICE5880-48T6Q-EICE6880-24S4Q2CQ-EIOrthogonal architectureStrict front-to-back airflow designNon-blocking switchingCounter-rotating fansLine cardNo cabling of the backplaneIncreased bandwidth of the entire systemCE12800Patent No.: CN201110339954.1Independent front-to-back airflowEven heat dissipation, suitable for data centersCell switching and VoQTraffic balancing, improving bandwidth utilizationCounter-rotating and turbo fansHighly efficient heat dissipationLeading energy-conserving designHigh-Quality CloudEngine: High-Quality Architecture Creates a Green and Stable Network•Industry-leading architecture design and high quality:orthogonal SFU design,Clos architecture,cell switching,and Virtual Output Queue (VOQ)mechanism 1/31/31/31/31/31/31/31/31/31/31/31/31/31/31/31/31/31/3ContentsClick to add Title 1Click to add TitleCloudEngine Switch Overview3CloudEngine Switch Market Progress▪Ultra-broadband Cloud Engine ▪Simplified Cloud Engine ▪Intelligent Cloud Engine▪Secure Cloud Engine ▪Open Cloud Engine2CloudEngine Switch HighlightsClos Theory: Cluster Scale Is the Driving Force for Data Center Network Architecture EvolutionSpineLeafCore EdgeSpineLeafCoreEdgeSpineLeafEdgeL2L310GE10GE40GE 40GE 40GEL2BGPL3L3First generation: 3K GE serversSecond generation: 10K GE serversThird generation: 20K 10GE servers⚫The port capacity of cards increases continuously, and CE switches canprovide 36*100GE ports.⚫To avoid HASH polarization, CE switches provide 128 ECMP paths.⚫Network congestion control: CE switches provide large buffer, and split a single flow into multiple ones to load balance them.Difficulties in the non-blocking Clos architecture: The convergence ratio and packet loss ratio cannot be compromised.⚫Data center network architecture: A fat-tree topology is used and the capacity of the root node determines the server cluster scale.⚫Evolution direction: Add network layers, and increase the quantity and capacity of spine or code nodes.⚫Network congestion control: Increase the buffer and optimize load balancing.CE switches' buffer is 80 times higher than the industry average, implementing zero packet loss for microburst traffic. The switches' performance is 1032 Tbit/s. CE switches can connect to over 50,000 servers with no blocking.Larger Interface Rate: The Rise of 25GE Interfaces Balance the Cost and Efficiency10M1980100M: IEEE802.3u199519981000M: IEEE802.3ab/z20021G: IEEE802.3ae/ak201040G/100G: IEEE802.3ba2008DCB/PB (IETF TRILL)2013400G2009FCoE201625G: 802.byDevelopment of Ethernet:DPDKIn the past two years, why are 25GE interfaces used?➢The 25GE interface can better match the SerDes rate: 1.25 Gbit/s -> 3.125 Gbit/s -> 6.25 Gbit/s -> 10.3125 Gbit/s -> 25 Gbit/s -> 56 Gbit/s➢Compared with the 40GE NIC, the 25GE NIC has higher use efficiency of the PCIe channel. (40G+40G)/8G*16= 62.5%; 25G*2/(8G*8) = 78%➢Lower cabling costs for 25GE interfaces: The SFP28 module is used. Because only single-channel connections are used, the SFP28 module is compatible with LC optical fibers in the 10GE era, without cabling.➢The bandwidth between NICs has exceeded 10 Gbit/s: As technologies such as RDMA, SR-IOV, and DPDK develop, the bandwidth between NICs has exceeded 10 Gbit/s.APP RDMA NICCoprocess or/FPGAAPPRDMA NICFast CNPCNPPPVIQ: eliminates packet lossinside chipsVIQ12Dynamic ECN3Dynamic ECNFast CNPPacket lossTraditionalVIQVIQ enables the outbound interface to send backpressure signals to the inbound interface, achieving zero packet loss.PFCSRECNNormal CNPPhysical queueThreshold (Port-Buffer)SwitchServer Q0Q1ECN waterline ECN waterlineRR ServerServerServer.. .Dynamic ECN uses dynamic collection and dynamic threshold adjustment to realize low latency and high throughput.Fast CNP provides fast congestion feedback to improve networkconvergence performance by 30%.AI Fabric: Intelligent Lossless Data Center Network Solution Provides Low latency and Zero Packet LossFast CNPUltra-broadband Cloud Engine Simplified Cloud Engine Intelligent Cloud Engine Secure CloudEngine Open Cloud Engine➢Independent forwarding, control, anddetection, and 3-channel cluster design ➢Four dedicated GE interfaces are used ascluster control channels.➢ A maximum of 3.2 Tbit/s cluster bandwidthis supported.Unique three-channel separated cluster, control plane coupling…Control signalingchannelData forwardingchannel Dual-active detection (DAD) channel➢The control plane runs independently and synchronizes asmall amount of information about interface status entries.➢Devices in the DFS group can be upgraded independently,without interrupting services.➢When the peer-link is faulty or the M-LAG master devicefails twice, the M-LAG backup device can still work properly.Independent control plane, protocol-level coupling…Peer-linkDAD channelDevice Virtualization: Easy-to-Manage, High-Performing, Highly Reliable Virtual SystemsC luster S witch S ystem (CSS)M ulti-Chassis LAG (M-LAG)➢The control plane runs independently anddoes not have synchronization information.➢Two switches are configured with the samegateway IP address and MAC address.➢Two links of the server NIC are configured tosend broadcast packets simultaneously.Independent control planewithout couplingM-LAG Lite➢Provide a maximum of 1:16virtualization capabilities in port and port group mode.On-demand VS allocation, improving resource utilization➢Exclusive CPU, memory, and MAC/VLAN/FIB entriesExclusive resources in VSs and highest specificationsFault isolation between VSs, improving securityVS (V irtual S ystem )Ultra-broadband Cloud Engine Simplified Cloud Engine Intelligent Cloud Engine Secure CloudEngine Open Cloud EngineLayer 2 Boundary Extension: Build a Large-Scale Network Resource Pool Based on BGP EVPNBGP EVPN acts as the VXLAN control plane to provide the following functions:➢Triggers automatic VXLAN tunnel setup between VTEPs to avoid the need to manually configure full-mesh tunnels.➢Advertises host routes and MAC address table, prevents unknown traffic flooding, and optimizes packet forwarding.➢Implements Layer 2 interconnection between data centers in different networking.Layer 2 large-scale horizontal expansion in the data centerand extension to the remote DCVXLAN BGP EVPNVTEP VTEP VTEP VTEP RRRRBGP EVPNVTEP VTEPProtocol vitality: open interconnection and interworkingbetween devices from different vendorsNetwork Automation: Interconnection with Third-Party Management Tools, Controllers, Virtualization Management Platforms, and Cloud PlatformsScenario 1: traditional network management➢Interconnection with a third-party management tool : CE switches can interconnect with a third-party management tool such as Ansible to implement automatic network configuration.Scenario 2: network and computing association➢Interconnection with a virtualization management platform : CE switches are connected to the Agile Controller-DCN, and the Agile Controller-DCN is associated with the third-party computing management platform.Scenario 3: third-party management on the overlay➢Interconnection with a third-party controller : The CE switch functions as the VXLAN Layer 2 VTEP and is managed by the NSX.Scenario 4: cloud-network integration➢Interconnection with a cloud platform through the Agile Controller-DCN : CE switches are connected to the AgileController-DCN, and the Agile Controller-DCN connects to the third-party cloud platform.SpineLeafGateway10GE40GEDCScenario 1Interconnection with a managementtoolISP2Scenario 2Interconnection with avirtualization managementplatformScenario 3Interconnectionwith a third-party controller Scenario 4Interconnection with a cloud platformSimplified Deployment: IPv4 and IPv6, Unicast and Overlay Multicast, and Rollout of Full-stack Services Within MinutesServer leaf IPv6IPv4VTEP Server leaf SpineVTEPServer leaf VM VM VMOVSBorder-LeafBMVTEP VM VM VMOVSServer leaf VTEPBMIPv4 extranetIPv4Service-centered IPv6 evolution mode➢2018 Q3: virtualization ➢2019 Q1: cloud-network cooperationServer leafIPv6IPv4VTEP Server leaf SpineVTEPServer leaf VM VM VMOVSBorder-LeafBMVTEP VM VM VMOVSServer leaf VTEPIPv6 extranetIPv4 extranetIPv4IPv6 extranetReplicate IPv4 O&MexperiencesServer leafVTEP Server leaf SpineVTEPServer leaf VM VM VMOVSBM VTEP VM VM VMOVSServer leaf VTEPIPv4 extranetIPv4 extranetOverlay multicastSave bandwidthServer leafVTEP Server leaf SpineVTEPServer leaf VM VM VMOVSBM VTEP VM VM VMOVSServer leaf VTEPIPv4 extranetIPv4 extranetDual-stackMulticastIngress replicationIGMP/PIM-SM➢2018 Q3: commercial chip ready ➢2019 Q1: controller mappingCollectorAnalyzerCPU Forwarding Chip CollectorAnalyzerCPUForwarding ChipCollectorAnalyzerCPUForwarding ChipNP•SNMP or NETCONF uses the query/response mechanism, minute-level reporting, and XML or text encoding, which is inefficient.•NetStream uses the flow sampling mechanism and requires CPU participation, which has low performance and is inaccurate.•gRPC uses the subscription/reporting mechanism, subsecond-level reporting , protobuffer coding, and HTTP transmission, which has a high efficiency .•ERSPAN+ adds ingress and egress ports or timestamps of original flows to calculate the flow path and delay .•INT supports in-line path or quality detection.SNMP NetconfNetstreamERSPANSNMP NetconfNetstreamERSPAN+INTgRPCSNMP NetconfFlow tableProtobuf over UDPgRPCERSPAN+Netstream1:1•Protobuf over UDP is used to encode andtransmit forwarding plane information, which is efficient and does not affect CPU performance .•Small NP intelligent analysis algorithm is used to perform in-depth analysis of abnormal flows to learn in-depth information such as the latency, jitter, packet loss ratio, and packet loss location .Historical CapabilitiesCurrent CapabilitiesFuture EvolutionTelemetry Capability: Transformation of the Data Collection Mode Is the Basis of Big Data O&MUltra-broadband Cloud Engine Simplified Cloud Engine Intelligent Cloud Engine Secure CloudEngine Open Cloud EngineMicroburst Detection Capability: Millisecond-level Buffer Monitoring and Subscription Collection, Which Are Visible and ClearData CenterService exceptionNormal networkTraditional NMSArtifactFreezeSubsecond-levelcollectiongRPC subscription . . .Content feedbackOne request formultiple tasks•Visible: subsecond-level subscription data collection510us50%100%The buffer is full and packet loss may occur.2-ms buffer monitoring•Clear: high-precision data monitoring5-minute pollingperiodSNMP request and response. . .Multiple requests for a single task510s50%100%Normal buffer detectionMicrosecond-level buffer monitoring•The collection period is too long, which may ignore network details.•The detection interval is too long, so device details may be incomplete.Forwarding chipCPUFPGACE8860Monitoring queueNote: The CE8860 supports this function.VM 1VM 2VM 3 1.1.1.1 1.1.1.2 1.1.1.3VM 4VM 5VM 6 2.2.2.1 2.2.2.2 2.2.2.3As Is: subnet-based isolation To Be:VM-level isolationFine-grained DefenseDefining applications based on VM names and discrete IP addresses, with finer granularity and wider dimensionsFlexible DeploymentDefining services based on application groups and decoupling from subnets to achieve flexible deployment Distributed SecurityTraffic of access switches is filtered nearby and east-west isolation is implemented without using firewalls.Use Microsegmentation to Achieve Fine-grained Isolation and Service SecurityWebAppAFW IDS LB NATVASResource poolSimplified deploymentThe SDN controller definesservice chains through drag-and-drop operations.Efficient forwardingProvide traffic diversion for one time, simple configuration, service traffic forwarding, and secure monitoring.Flexible orchestrationDecouple the VAS function from Fabric, providing flexible orchestration.Switch SwitchSwitchAgile CloudEngine: Supporting NSH Service Chains, Providing Easier VAS OrchestrationACOpticalfiber/transmissiondevice/Layer 2 transparenttransmissionMacSec at the Link Layer: IP Layer 3 Features such as Encryption Are Introduced to the MAC Link LayerSwitch ASwitch BScenario➢In scenarios that require high data confidentiality, such asgovernment, military, and finance scenarios, interconnection is required between data centers or between different modules of data centers across buildings.➢The CE6875 uplink port (100GE), and CEL16CQFD (16*100GE) and CEL08CFFG1 (8*200GE) cards of the CE12800 can be used.Definition➢Media Access Control Security (MACsec) ensures securecommunication within LANs in compliance with IEEE 802.1AE and 802.1X. It provides identity authentication, data encryption, integrity check, and replay protection to protect Ethernet frames and prevent devices from processing attack packets.NetworkingNetworkingOriginal packetData encryption protectionMACsec packetData integrity protectionStandardsChinaIntegration InnovationEcological cooperationGermany MoscowMulti-vendor pre-integration verificationMulti-layer open ecosystemOpen Ecosystem: Huawei Joins Hands with 20+ Industry Chain Partners to Perform System IntegrationOpen ecosystem: fast integration andsimplified managementSystem integration: 10+ OpenLabs in the globeManufacturerNSXAnsible. . .Rapid response to service requirementsHardware BFDMicrosegmentationNSH modeIPv6 over VXLANCPUForwarding chipIntra-card CPU chip Quad-core CPU:▪Protocol packet processing▪FIB entry delivery ▪. . .Co-processor▪Hardware BFD ▪High-performance sFlow ▪. . .Forwarding chipAdjustable processes New service processes Adjustable entry resourcesEnhanced serviceprocessesVRPnetconfCLILinux ContainergRPCopenflowSSHpuppetFuncEditnetconfSNMPLinux and driverFragmentation and reassemblyOpen architecture, Flexible Business Innovation•Higher interface rate: 25GE interfaces and larger buffer cope with traffic surge in N:1 scenarios.•Flowlet&DLB: One flow is load balanced among multiple links.•AI Fabric intelligent lossless data center network solution: low latency and zero packet lossUltra-broadband: higher interface rate, more even load balancing, larger buffer, and lower latency•Telemetry capability•Microburst detection •Edge analysis capability•Microsegmentation used to isolate east-west traffic on switches (east-west traffic is isolated on firewalls originally)•SFC used to divert traffic from the control plane to the data plane•MACsec hardware encryption, providing high security and reliability•Open API•Interconnection with third-party management tools: Ansible•Interconnection with third-party management tools or controllers: VMaare NSX•Multiple virtualization technologies: CSS, M-LAG, M-LAG Lite, and VS •VXLAN + BGP EVPN: intra-DC and inter-DC virtualization•SDN controller: deployment in drag-and-drop mode, IPv4 and IPv6, rollout of unicast and multicast full-stack services in minutesIntelligent: enabling service agilitySimplified: automatic deployment of full-stack services and service rollout within minutesOpen: easy integration and timelyresponse to servicesSecure: best quality in the industry and pioneering energy-saving technology CloudEngine High-Performance Cloud SwitchesContents1Click to add Title 2CloudEngine Switch OverviewCloudEngine Switch Highlights Click to add Title 3CloudEngine Switch Market ProgressChina's No.1 and One of World's Top 3 DCN Vendors2014Source: IHS “2015 Infonetics Data Center and Enterprise SDN Vendor Leadership Analysis ”20132012•Data center network vendor with the fastest growth•First release of InterOP impressing the world •Industry-leading ultra-high performance2015•Huawei was the only Chinese vendor in the global SDN leadership list.•Largest market share in China in Q2•Huawei was the global data center network vendor with the fastest growth.•Annual growth rate up to 137%Global SDN AuthoritativeReport of Leading Vendors2016•The market share ranks No. 1 in Chi na and the third largest in the world .•SDN capability won the Best of ShowNet Award at Tokyo Interop.2017•Huawei was positioned as challenger in Gartner's Magic Quadrant for Data Center Networking.2018•Huawei has been positioned as a leader in data center hardware platforms for SDN.•The AI Fabric won the Best of Show Gold Award.In 2013, the CloudEngine 12800 won the Best of Show Award at Interop, which is the highest exhibition in the IT industry. Huawei is the first Chinese provider that wins the position.Highly Recognized PerformanceAward of Excellent Product Trusted byCIOAward of the Most Competitive Product Awards and CertificationsPreferred Brand of Cloud Computing and Network SolutionAward of Annual Excellent TechnologyChina SDN SDN Best Practice AwardAward of Excellent Product in Big DataIn 2016, the CE8860 and CE6851 won the Best of Show Award at Interop.InterOP AwardsHuawei's AI FabricIntelligent Lossless Data Center Network Solution Takes Home Interop Tokyo Best of Show AwardCloudEngineSeries Switches Serve 7800+ Global Customers⚫The market share is No.1in China and No.3in theworld.⚫The global market share growth rate is No. 1 for fourconsecutive years .⚫Over 32,000 CE12800 switches have been soldaround the world, serving 7800+customers in 120+countries.DC SDN SDN hardware platform leader⚫2018 Approaching the Leaders Quadrant ⚫2017 ChallengerGartner Peer InsightsCustomers’ Choice for Data Center NetworkingCopyright©2018 Huawei Technologies Co., Ltd.All Rights Reserved.The information in this document may contain predictivestatements including, without limitation, statements regarding the future financial and operating results, future productportfolio, new technology, etc. There are a number of factors that could cause actual results and developments to differ materially from those expressed or implied in the predictive statements. Therefore, such information is provided for reference purpose only and constitutes neither an offer nor an acceptance. Huawei may change the information at any time without notice.把数字世界带入每个人、每个家庭、每个组织，构建万物互联的智能世界。

vxlan概述-回复什么是VXLAN？VXLAN（Virtual Extensible LAN）是一种网络虚拟化技术，用于在计算机网络之上创建虚拟局域网（VLAN）。

VXLAN在网络中封装数据包，使其可以在现有的IP网络基础上进行传输。

它旨在解决传统VLAN技术在大规模数据中心网络中面临的限制，如VLAN数量受限和扩展性差等问题。

1. VXLAN的起源VXLAN最初由VMware、Cisco和Arista共同推出。

它被设计用于在云计算环境中，特别是大规模虚拟化环境中提供更好的虚拟局域网解决方案。

为了解决传统VLAN技术所面临的限制，VXLAN采用了一种新的封装方法。

2. VXLAN的工作原理VXLAN通过将原始数据包封装在一个UDP数据包中，以实现在IP网络上进行传输。

VXLAN使用一个24位的虚拟网络标识符（VNI），将传输的数据包与特定VXLAN网络相关联。

这样可以实现虚拟隔离、多租户隔离和跨子网通信等功能。

VXLAN数据包的源和目的地IP地址是物理网络中用于传输的设备。

3. VXLAN的组成要素VXLAN由三个主要组成要素构成：VXLAN头、内部数据报和UDP封装。

VXLAN头包含VNI和VXLAN网络标识符标志，用于标识传输的虚拟网络。

内部数据报是原始数据包的载体，其将被封装在VXLAN头之后。

UDP 封装则用于在IP网络上传输VXLAN数据包。

4. VXLAN的优势相比传统的VLAN技术，VXLAN具有以下几个优势：- 扩展性: VXLAN支持数量庞大的虚拟网络标识符（VNI），可以满足大规模数据中心网络的需求。

- 多租户隔离: VXLAN通过虚拟隔离，可以为不同的用户或组织提供独立的虚拟网络，提高了网络的安全性和隔离性。

- 跨子网通信: VXLAN可以在不同的子网之间进行通信，解决了传统VLAN技术在这方面的限制。

- 灵活性: VXLAN可以在现有的IP网络基础上部署，不需要对底层网络进行修改或改造。

华为CloudFabric 技术白皮书目录1执行摘要/Executive Summary (4)2简介/Introduction (5)2.1传统数据中心组网技术 (5)2.2云数据中心网络的需求 (5)3解决方案/Solution (7)3.1Fabric 概念 (7)3.2Overlay 基本原理 (8)3.3Underlay 路由 (9)3.4VxLAN 部署模式 (10)3.5VxLAN 与SDN (16)4典型应用/Typical Application (17)5结论/Conclusion (19)缩略语表/Acronyms and Abbreviations (20)1执行摘要/Executive Summary本白皮书主要介绍了云数据中心Fabric 的概念，主要业务需求以及构建云数据中心 Fabric 的主流Overlay 及VxLAN 技术，并详细介绍了 Overlay 网络的几种部署方式，说明了各自的特点和使用场景，最后结合具体的商业应用给出 Fabric 典型部署方式。

2简介/Introduction2.1传统数据中心组网技术众所周知，数据中心出于对可靠性的强烈需求，通常会采用冗余设备、冗余链路来保障业务不会因为单点、单链路故障而中断，而二层网络的核心问题就是冗余设备与链路带来的环路问题和环路产生的广播风暴，传统数据中心用来规避二层环路的最主要的技术就是 VLAN 和xSTP。

VLAN 技术通过将一个大的物理二层域划分成许多小的逻辑二层域，同一个VLAN 内可以进行二层通信，不同VLAN 之间是二层隔离的，但是VLAN 技术不能解决广播风暴问题。

xSTP，则是从环路产生的根源—冗余设备与链路，通过在正常情况下阻塞掉冗余的设备端口和链路来防止环路的产生。

xSTP 原理上永远有部分端口与链路被闲置，这样的资源利用效率显然是无法接受的。

并且这种阻断端口与链路的方式，只适应在小规模组网场景下，当网络规模到一定程度，网络出现故障整网的收敛速度会呈指数级下降，显然无法满足云数据中心所需的大二层网络。

BrochureProduct OverviewThe CloudEngine S5732-H series switches are the next-generation enhanced Ethernet switches developed by Huawei. The CloudEngine S5732-H builds on Huawei's unified Versatile Routing Platform (VRP) and boasts various IDN features. For example, the integrated wireless AC capabilities can manage up to 1,024 wireless APs; the free mobility feature ensures consistent user experience; the VXLAN functionality implements network virtualization; and built-in security probes support abnormal traffic detection, threat analysis even in encrypted traffic, and network-wide threat deception. With these merits, the CloudEngine S5732-H can function as core switches for small-sized campus networks and branches of medium- and large-sized campus networks, and also work as access switches for Metropolitan Area Network.Models and AppearancesThe following models are available in the CloudEngine S5732-H series.CloudEngine S5732-H24S6QCloudEngine S5732-H48S6QFeatures and HighlightsEnabling Networks to Be More Agile for Services●CloudEngine S5732-H has a built-in high-speed and flexible processor chip. The chip's flexible packet processing and traffic control capabilities can meet current and future service requirements, helping build a highly scalable network.●In addition to capabilities of traditional switches, the CloudEngine S5732-H provides open interfaces and supports user-defined forwarding behavior. Enterprises can use the open interfaces to develop new protocols and functions independently or jointly with equipment vendors to build campus networks meeting their own needs.●CloudEngine S5732-H series switches, on which enterprises can define their own forwarding models, forwarding behavior, and lookup algorithms. Microcode programmability makes it possible to provide new services within six months, without the need of replacing the hardware. In contrast, traditional ASIC chips use a fixed forwarding architecture and follow a fixed forwarding process. For this reason, new services cannot be provisioned until new hardware is developed to support the services one to three years later.Delivering Abundant Services More Agilely●This CloudEngine S5732-H provides the integrated WLAN AC function that can manage 1,024 APs, reducing the costs of purchasing additional WLAN AC hardware and breaking the forwarding performance bottleneck of an external WLAN AC. With this switch series, customers can stay ahead in the high-speed wireless era.●With the unified user management function, the CloudEngine S5732-H authenticates both wired and wireless users, ensuring a consistent user experience no matter whether they are connected to the network through wired or wireless access devices. The unified user management function supports various authentication methods, including 802.1x, MAC address, and Portal authentication, and is capable of managing users based on user groups, domains, and time ranges. These functions visualize user and service management and boost the transformation from device-centric management to user-centric management.●The CloudEngine S5732-H provides excellent quality of service (QoS) capabilities and supports queue scheduling and congestion control algorithms. Additionally, it adopts innovative priority queuing and multi-level scheduling mechanisms to implement fine-grained scheduling of data flows, meeting service quality requirements of different user terminals and services.Providing Fine Granular Network Management More Agilely●The CloudEngine S5732-H uses the Packet Conservation Algorithm for Internet (iPCA) technology that changes the traditional method of using simulated traffic for fault location. iPCA technology can monitor network quality for any service flow anywhere and anytime, without extra costs. It can detect temporary service interruptions in a very short time and can identify faulty ports accurately. This cutting-edge fault detection technology turns "extensive management" to "fine granular management."●The CloudEngine S5732-H supports Two-Way Active Measurement Protocol (TWAMP) to accurately check any IP link and obtain the entire network's IP performance. This protocol eliminates the need of using a dedicated probe or a proprietary protocol.●The CloudEngine S5732-H supports SVF and functions as a parent switch. With this virtualization technology, a physical network with the "Small-sized core/aggregation switches + Access switches + APs" structure can be virtualized into a "super switch", greatly simplifying network management.●With the Easy Deploy function, the CloudEngine S5732-H manages access switches in a similar way an AC manages APs. In deployment, access switches and APs can go online with zero-touch configuration. In the Easy Deploy solution, the Commander collects topology information about the connected clients and stores the clients' startup information based on the topology. Clients can be replaced with zero-touch configuration. The Commander can deliver configurations and scripts to clients in batches and query the delivery results. In addition, the Commander can collect and display information about power consumption on the entire network.Comprehensive VPN Technologies●The CloudEngine S5732-H supports the MPLS function, and can be used as access devices of high-quality enterprise leased line.●The CloudEngine S5732-H allows users in different VPNs to connect to the same switch and isolates users through multi-instance routing. Users in multiple VPNs connect to a provider edge (PE) device through the same physical port on the switch, which reduces the cost on VPN network deployment.Flexible Ethernet Networking●In addition to traditional Spanning Tree Protocol (STP), Rapid Spanning Tree Protocol (RSTP), and Multiple Spanning Tree Protocol (MSTP), the CloudEngine S5732-H supports Huawei-developed Smart Ethernet Protection (SEP) technology and the latest Ethernet Ring Protection Switching (ERPS) standard. SEP is a ring protection protocol specific to the Ethernet link layer, and applies to various ring network topologies, such as open ring topology, closed ring topology, and cascading ring topology. This protocol is reliable, easy to maintain, and implements fast protection switching within 50 ms. ERPS is defined in ITU-TG.8032. It implements millisecond-level protection switching based on traditional Ethernet MAC and bridging functions.●The CloudEngine S5732-H supports Smart Link and Virtual Router Redundancy Protocol (VRRP), which implement backup of uplinks. One CloudEngine S5732-H switch can connect to multiple aggregation switches through multiple links, significantly improving reliability of access devices.Various Security Control Methods●The CloudEngine S5732-H supports 802.1x authentication, MAC address authentication, Portal authentication, and hybrid authentication, and can dynamically delivery user policies such as VLANs, QoS policies, and access control lists (ACL). It also supports user management based on user groups.●The CloudEngine S5732-H provides a series of mechanisms to defend against DoS and user-targeted attacks. DoS attacks are targeted at switches and include SYN flood, Land, Smurf, and ICMP flood attacks. User-targeted attacks include bogus DHCP server attacks, IP/MAC address spoofing, DHCP request flood, and change of the DHCP CHADDR value.●The CloudEngine S5732-H sets up and maintains a DHCP snooping binding table, and discards the packets that do not match the table entries. You can specify DHCP snooping trusted and untrusted ports to ensure that users connect only to the authorized DHCP server.●The CloudEngine S5732-H supports strict ARP learning, which prevents ARP spoofing attackers from exhausting ARP entries.Mature IPv6 Features●The CloudEngine S5732-H is developed based on the mature, stable VRP and supports IPv4/IPv6 dual stacks, IPv6 routing protocols (RIPng, OSPFv3, BGP4+, and IS-IS for IPv6). With these IPv6 features, the CloudEngine S5732-H can be deployed on a pure IPv4 network, a pure IPv6 network, or a shared IPv4/IPv6 network, helping achieve IPv4-to-IPv6 transition.Intelligent Stack (iStack)●The CloudEngine S5732-H supports the iStack function that combines multiple switches into a logical switch. Member switches in a stack implement redundancy backup to improve device reliability and use inter-device link aggregation to improve link reliability. iStack provides high network scalability. You can increase a stack's ports, bandwidth, and processing capacity by simply adding member switches. iStack also simplifies device configuration and management. After a stack is set up, up to nine physical switches can be virtualized into one logical device. You can log in to any member switch in the stack to manage all the member switches in the stack.VXLAN Features●VXLAN is used to construct a Unified Virtual Fabric (UVF). As such, multiple service networks or tenant networks can be deployed on the same physical network, and service and tenant networks are isolated from each other. This capability truly achieves 'one network for multiple purposes'. The resulting benefits include enabling data transmission of different services or customers, reducing the network construction costs, and improving network resource utilization.●The CloudEngine S5732-H series switches are VXLAN-capable and allow centralized and distributed VXLAN gateway deployment modes. These switches also support the BGP EVPN protocol for dynamically establishing VXLAN tunnels and can be configured using NETCONF/YANG.Big Data Security Collaboration●The CloudEngine S5732-H switches use NetStream to collect campus network data and then report such data to the Huawei Cybersecurity Intelligence System (CIS). The purposes of doing so are to detect network security threats, display the security posture across the entire network, and enable automated or manual response to security threats. The CIS delivers the security policies to the Agile Controller. The Agile Controller then delivers such policies to switches that will handle security events accordingly. All these ensure campus network security.●The CloudEngine S5732-H supports Encrypted Communication Analytics (ECA). It uses built-in ECA probes to extract characteristics of encrypted streams based on NetStream sampling and Service Awareness (SA), generates metadata, and reports the metadata to Huawei Cybersecurity Intelligence System (CIS). The CIS uses the AI algorithm to train the traffic model and compare characteristics of extracted encrypted traffic to identify malicious traffic. The CIS displays detection results on the GUI, provides threat handling suggestions, and automatically isolates threats with the Agile Controller to ensure campus network security.●The CloudEngine S5732-H supports deception. It functions as a sensor to detect threats such as IP address scanning and port scanning on a network and lures threat traffic to the honeypot for further checks. The honeypot performs in-depth interaction with the initiator of the threat traffic, records various application-layer attack methods of the initiator, and reports security logs to the CIS. The CIS analyzes security logs. If the CIS determines that the suspicious traffic is an attack, it generates an alarm and provides handling suggestions. After the administrator confirms the alarm, the CIS delivers a policy to the Agile Controller. The Agile Controller delivers the policy to the switch for security event processing, ensuring campus network security.Intelligent O&M●The CloudEngine S5732-H provides telemetry technology to collect device data in real time and send the data to Huawei campus network analyzer CampusInsight. The CampusInsight analyzes network data based on the intelligent fault identification algorithm, accurately displays the real-time network status, effectively demarcates and locates faults in a timely manner, and identifies network problems that affect user experience, accurately guaranteeing user experience.●The CloudEngine S5732-H supports a variety of intelligent O&M features for audio and video services, including the enhanced Media Delivery Index (eMDI). With this eDMI function, the switch can function as a monitored node to periodically conduct statistics and report audio and video service indicators to the CampusInsight platform. In this way, the CampusInsight platform can quickly demarcate audio and video service quality faults based on the results of multiple monitored nodes.Intelligent Upgrade●Switches support the intelligent upgrade feature. Specifically, switches obtain the version upgrade path and download the newest version for upgrade from the Huawei Online Upgrade Platform (HOUP). The entire upgrade process is highly automated and achieves one-click upgrade. In addition, preloading the version is supported, which greatly shortens the upgrade time and service interruption time.●The intelligent upgrade feature greatly simplifies device upgrade operations and makes it possible for the customer to upgrade the version independently. This greatly reduces the customer's maintenance costs. In addition, the upgrade policies on the HOUP platform standardize the upgrade operations, which greatly reduces the risk of upgrade failures.Open Programmability System (OPS)●Open Programmability System (OPS) is an open programmable system based on the Python language. IT administrators can program the O&M functions of a switch through Python scripts to quickly innovate functions and implement intelligent O&M.LicensingCloudEngine S5732-H supports both the traditional feature-based licensing mode and the latest Huawei IDN One Software (N1 mode for short) licensing mode. The N1 mode is ideal for deploying Huawei CloudCampus Solution in the on-premises scenario, as it greatly enhances the customer experiences in purchasing and upgrading software services with simplicity.Software Package Features in N1 ModeNote: Only V200R019C00 and later versions can support N1 modeProduct SpecificationsService FeaturesNetworking and ApplicationsLarge-Scale Enterprise Campus NetworkCloudEngine S5732-H series switches can be deployed at the access layer of a campus network to build a high-performance and highly reliable enterprise network.Small- or Medium-scale Enterprise Campus NetworkCloudEngine S5732-H series switches can be deployed at the aggregation layer of a campus network to build a high-performance, multi-service, and highly reliable enterprise network.Small-scale Enterprise Campus NetworkWith powerful aggregation and routing capabilities of CloudEngine S5732-H series switches make them suitable for use as core switches in a small-scale enterprise network. Two or more S5732-H switches use iStack technology to ensure highreliability. They provide a variety of access control policies to achieve centralized management and simplify configuration.Application on a MANCloudEngine S5732-H series switches can be deployed at the access layer of a MAN(Metropolitan Area Network) to build ahigh-performance, multi-service, and highly reliable ISP MAN network.Application in Public CloudCloudCampus Solution is a network solution suite based on Huawei public cloud. CloudEngine S5732-H series switches can be located at the access layer.The switches are plug-and-play. They go online automatically after being powered on and connected with network cables, without the need for complex configurations. The switches can connect to the management and control system (CloudCampus@AC-Campus for switches running V200R019C00 and earlier versions; iMaster NCE-Campus for switches running V200R019C10 and later versions), and use bidirectional certificate authentication to ensure management channel security. The switches provide the NETCONF and YANG interfaces, through which the management and control system delivers configurations to them. In addition, remote maintenance and fault diagnosis can be performed on the management and control system.The following table lists ordering information of the CloudEngine S5732-H series switches.More InformationFor more information about Huawei Campus Switches, visit or contact us in the following ways: ●Global service hotline: /en/service-hotline ●Logging in to the Huawei Enterprise technical support website: /enterprise/ ●Sendinganemailtothecustomerservicemailbox:********************Copyright © Huawei Technologies Co., Ltd. 2020. All rights reserved.No part of this document may be reproduced or transmitted in any form or by any means without prior writtenconsent of Huawei Technologies Co., Ltd.Trademarks and Permissionsand other Huawei trademarks are trademarks of Huawei Technologies Co., Ltd.All other trademarks and trade names mentioned in this document are the property of their respective holders.NoticeThe purchased products, services and features are stipulated by the contract made between Huawei and thecustomer. All or part of the products, services and features described in this document may not be within thepurchase scope or the usage scope. Unless otherwise specified in the contract, all statements, information, andrecommendations in this document are provided "AS IS" without warranties, guarantees or representations ofany kind, either express or implied.The information in this document is subject to change without notice. Every effort has been made in thepreparation of this document to ensure accuracy of the contents, but all statements, information, andrecommendations in this document do not constitute a warranty of any kind, express or implied. Huawei Technologies Co., Ltd. Address:Huawei Industrial Base Bantian, Longgang Shenzhen 518129 People's Republic of China Website:。

HUAWEI TECHNOLOGIES CO.,LTD.华为云存储服务技术白皮书huawei2012/6/26目录1 华为云存储服务介绍 (5)1.1 简介 (5)1.2 服务定位 (5)2 华为云存储应用场景 (6)2.1 网盘服务 (6)2.2 互联网海量数据存储 (7)2.3 数据备份/容灾 (8)2.4 数据归档 (9)2.5 BigData/HPC (9)3 华为云存储服务概念及功能介绍 (11)3.1 云存储基本概念 (11)3.1.1 对象（Objects） (11)3.1.2 存储空间 (12)3.1.3 REST接口 (12)3.2 云存储功能 (12)3.3 访问权限控制 (13)3.4 线下大数据量导入/导出服务 (14)3.5 对象的版本化管理 (15)3.6 可定制的日志服务 (15)4 华为云存储服务特点 (16)4.1 易用性 (16)4.2 高扩展性 (16)4.3 高可靠性 (17)4.3.1 数据可靠性 (17)4.3.2 数据校验 (18)4.3.3 数据自动修复 (18)4.4 高可用性 (19)4.4.1 网络级可靠性设计............................................... 错误!未定义书签。

4.4.2 节点可靠性设计 (19)4.4.3 进程可靠性设计 (19)4.5 高性能 (19)4.5.1 并发访问性能 (20)4.5.2 吞吐能力 (20)4.6 安全性 (20)4.6.1 软件控制安全 (20)4.6.2 数据分块存储（暂未实现） (21)4.7 易管理性 (21)4.8 按需计费 (21)5 华为云存储服务结构简介 (22)5.1 华为云存储服务框架简介 (22)5.2 UDS结构简介 (23)5.2.1 UDS系统结构描述 .............................................. 错误!未定义书签。

iMaster NCE-Campus VxLAN技术白皮书文档版本01发布日期2020-07-08目录1 概述 (1)1.1 产生背景 (1)1.2 技术/方案特点 (2)1.3 关键术语解释 (2)2 关键技术介绍 (3)2.1 SDN网络架构 (3)2.1.1 SDN网络架构的三层模型 (3)2.1.2 SDN网络的优势 (4)2.2 OverLay网络技术 (4)2.3 VXLAN技术介绍 (5)2.3.1 VXLAN技术背景 (5)2.3.2 VXLAN技术原理 (7)2.4 VXLAN方案及其实现原理介绍 (10)2.4.1 分布式VXLAN方案实现原理 (11)3 华为iMaster NCE-Campus整体方案介绍 (13)3.1 整体方案关键部件 (13)3.2 iMaster NCE-Campus典型组网 (14)3.2.1 分布式VXLAN网络组网 (14)3.2.2 集中式VXLAN网络组网 (15)3.2.3 集中式VLAN组网 (16)3.2.4 用户网关在Fabric外VXLAN组网 (17)3.3 Fabric出口组网能力的多样性 (18)3.3.1 外部网络类型 (18)3.3.2 边界网关节点与外部设备的典型组网 (20)3.4 iMaster NCE-Campus典型业务流量 (24)3.4.1 访问DHCP等公共服务资源 (24)3.4.2 访问internet外部网关 (25)3.4.3 虚拟网络（VN）之间互访 (26)3.4.4 用户网关在外部网关设备 (27)3.5 用户接入典型组网 (27)3.5.1 有线用户认证 (27)3.5.2 无线用户认证 (29)3.6 iMaster NCE-Campus方案特点 (30)3.6.1 子网网段赋予业务属性 (30)3.6.2 网络按需实时交付 (32)3.6.3 有线无线深度统一 (33)1 概述1.1 产生背景1.2 技术/方案特点1.3 关键术语解释1.1 产生背景随着企业业务的快速发展和园区网络全面数字化转型的推进，企业园区网络的业务也越来越复杂。

vxlan概念摘要：一、VXLAN 简介1.VXLAN 的定义2.VXLAN 的作用二、VXLAN 的工作原理1.VTEP（VXLAN 隧道端点）2.VNI（VXLAN 网络标识符）3.VXLAN 封装与解封装三、VXLAN 的优势1.扩展IP 地址空间2.提高数据包转发效率3.隔离不同租户的网络四、VXLAN 的应用场景1.数据中心网络虚拟化2.云计算环境中的网络隔离3.运营商网络中的流量工程正文：一、VXLAN 简介VXLAN（Virtual Extensible LAN，虚拟扩展局域网）是一种网络虚拟化技术，通过在现有网络架构上叠加一层虚拟网络，实现二层网络在三层范围内进行扩展。

VXLAN 能够提高数据中心网络的灵活性和可扩展性，满足云计算环境中的网络需求。

二、VXLAN 的工作原理1.VTEP（VXLAN 隧道端点）：VTEP 是VXLAN 隧道中的两个端点，负责建立、维护和断开VXLAN 隧道。

在VXLAN 网络中，每个VTEP 都有一个唯一的VTEP 地址，用于标识隧道中的端点。

2.VNI（VXLAN 网络标识符）：VNI 用于区分不同的VXLAN 网络，具有相同VNI 的节点可以在同一VXLAN 网络中通信。

通过使用不同的VNI，可以在同一物理网络基础设施上构建多个逻辑上相互隔离的网络。

3.VXLAN 封装与解封装：在发送端，数据包首先被封装到VXLAN 协议中，添加VNI 和VTEP 地址等字段。

在接收端，数据包被解封装，还原为原始的二层数据包，以便进一步处理。

三、VXLAN 的优势1.扩展IP 地址空间：VXLAN 技术通过在现有IP 网络上叠加一层虚拟网络，可以有效扩展IP 地址空间，提高地址利用率。

2.提高数据包转发效率：VXLAN 利用底层网络的特性，如MPLS 或GRE，实现数据包的快速转发，降低网络延迟。

3.隔离不同租户的网络：通过使用不同的VNI，VXLAN 技术可以实现不同租户之间的网络隔离，确保网络安全性和数据隐私。

华为CloudEngine S系列园区交换机产品介绍目录1园区网络展望2CloudEngine S交换机主打产品3CloudEngine S交换机亮点特性Wi-Fi 6新时代，需要全新的园区承载网视频监控AR/VR门禁资产管理Wi-Fi 6AP办公高清会议AP =10Gbps不同业务网络如何统筹部署？办公，安防，生产……用户并发流量洪峰如何应对？高突发➔丢包智简园区，打造Wi-Fi 6时代的高品质园区网络Wi-Fi 6改变企业Wi-Fi 6时代的自动驾驶管控析平台，iMaster NCE-Campus源自华为5G的AirEngine Wi-Fi 6，打造全无线园区开放的行业应用开发平台SDK | API管理、控制、分析TelemetryNETCONF/YANGCloudEngine S系列园区交换机AirEngine Wi-Fi 6客流分析电子书包健康管理智慧办公网络层管控层改变办公Wi-Fi 6时代的高品质承载网络一根光电混合缆接入全万兆，释放Wi-Fi 6的速度•Multi-GE交换机+ 高密25GE盒式交换机+ 100G核心，构建Wi-Fi 6超宽通道•全无线融合策略管理，高达10K AP，50K用户并发，满足Wi-Fi 6时代海量用户并发接入•万人无线园区，百G核心CloudEngine12700E，吞吐57.6Tbps，管理5万无线用户，6倍性能建网全自动，使能Wi-Fi 6的业务规划自动化· 建网自动化· 策略自动化运维全智能，保障Wi-Fi 6的体验用户体验可视· 故障定界· 网络调优自愈极速业界独家双频16天线10.75Gbps，是业界的2倍覆盖稳智能天线波随人动，覆盖远20%应用稳DynamicTurbo应用加速，<10ms时延漫游稳Lossless Roaming漫游“0”丢包改变生产改变公共服务未来园区网络典型架构，满足不同场景需求TO-BE ：极简组网48*Multi-GE 25/40GE 25/40GE48*10GE•两级架构，全链路无阻塞转发TO-BE ：经典组网48*Multi-GE 25GE100GE 100GE25GE48*10GE •逐层收敛+虚拟化，网络资源利用率高VxLAN48*GEN*10GEAS-IS•百兆/千兆接入，专网专用。

CloudEngine 12800 系列交换机V100R006C00NQA技术白皮书文档版本02发布日期2016-06-21版权所有 © 华为技术有限公司 2016。

保留一切权利。

非经本公司书面许可，任何单位和个人不得擅自摘抄、复制本文档内容的部分或全部，并不得以任何形式传播。

商标声明和其他华为商标均为华为技术有限公司的商标。

本文档提及的其他所有商标或注册商标，由各自的所有人拥有。

注意您购买的产品、服务或特性等应受华为公司商业合同和条款的约束，本文档中描述的全部或部分产品、服务或特性可能不在您的购买或使用范围之内。

除非合同另有约定，华为公司对本文档内容不做任何明示或默示的声明或保证。

由于产品版本升级或其他原因，本文档内容会不定期进行更新。

除非另有约定，本文档仅作为使用指导，本文档中的所有陈述、信息和建议不构成任何明示或暗示的担保。

华为技术有限公司地址：深圳市龙岗区坂田华为总部办公楼邮编：518129网址：目录1 NQA简介 (1)2 原理描述 (2)3 测试机制 (3)3.1 ICMP Jitter测试 (4)3.2 ICMP测试 (4)3.3 TCP测试 (5)3.4 Trace测试 (5)3.5 UDP Jitter测试 (6)3.6 LSP Ping测试 (7)3.7 LSP Trace测试 (7)4 NQA联动机制 (9)5 应用场景 (10)6 配置任务概览 (12)7 配置注意事项 (13)8 配置NQA测试例 (14)8.1 配置ICMP测试 (15)8.2 配置ICMP Jitter测试 (16)8.3 配置TCP测试 (18)8.4 配置Trace测试 (19)8.5 配置UDP Jitter测试 (20)8.6 配置LSP Ping测试 (22)8.7 配置LSP Trace测试 (23)8.8 查看配置结果 (25)9 配置NQA传输延迟阈值及阈值告警 (26)9.1 配置NQA双向传输延迟阈值 (27)9.2 配置NQA单向传输延迟阈值 (27)10 配置NQA测试的Trap开关 (28)10.1 使能NQA告警 (30)10.2 配置测试失败发送Trap (30)10.3 配置探测失败发送Trap (30)10.4 配置探测成功发送Trap (31)10.5 配置超过阈值发送Trap (31)10.6 检查配置结果 (32)11 调度NQA测试例 (33)11.1 启动NQA测试例 (34)11.2 （可选）终止NQA测试例 (35)11.3 查看测试结果 (35)12 维护NQA (37)12.1 清除统计信息 (38)13 配置举例 (39)13.1 配置ICMP测试示例 (40)13.2 配置ICMP Jitter测试示例 (42)13.3 配置TCP测试示例 (44)13.4 配置Trace测试示例 (47)13.5 配置UDP Jitter测试示例 (49)13.6 配置普通LSP隧道LSP Ping测试示例 (52)13.7 配置普通LSP隧道LSP Trace测试示例 (55)14 参考信息 (60)NQA技术白皮书 1 NQA简介1 NQA简介定义网络质量分析NQA（Network Quality Analysis）是一种实时的网络性能探测和统计技术，可以对响应时间、网络抖动、丢包率等网络信息进行统计。

CloudEngine系列数据中心交换机产品&方案概述CloudEngine（以下简称CE）系列是华为公司面向下一代数据中心和高端园区推出的“云”级高性能交换机，包括全球最高配置的旗舰级核心交换机CloudEngine 12800系列，以及高性能的汇聚/接入交换机CloudEngine 8800/7800/6800/5800系列。

CloudEngine系列软件平台基于华为新一代的VRP8操作系统，支持丰富的数据中心和园区业务特性。

基于CloudEngine系列交换机和华为公司齐全的传输、路由、安全及网管产品，华为公司全球发布面向下一代云计算数据中心的敏捷数据中心网络解决方案，旨在为客户打造未来十年的稳定网络架构。

产品系列介绍CloudEngine 12800系列CE12800系列交换机是华为公司面向数据中心和高端园区网络推出的新一代高性能核心交换机。

CE12800系列采用先进的硬件架构设计，是目前全球最高配置的核心交换机。

整机最大支持160Tbps交换容量，最高支持576个100GE、576个40GE、2304个25GE或2304个10GE全线速接口。

CE12800系列具备业界领先的Clos交换架构和工业级的可靠性，以及严格的前后风道设计，并支持全面的虚拟化能力和丰富的数据中心特性。

此外，CloudEngine 12800作为新一代核心交换机采用了多种绿色节能创新技术，大幅降低设备能源消耗。

CE12800系列提供CE12816、CE12812、CE12808、CE12804、CE12808S和CE12804S六种产品形态，整个系列秉承模块通用化、部件归一化的设计理念，最小化备件成本，在保证设备扩展性的同时最大限度地保护用户投资。

32个40GE QSFP+接口48个10GE SFP+ 接口，或 2/4/8G FC 接口，6个40GE QSFP+接口CE6850U-24S2Q-HI�24个10GE SFP+ 接口，或 2/4/8G FC 接口，2个40GE QSFP+接口48个10GE SFP+接口，6个40GE QSFP+接口48个10GE Base-T接口，6个40GE QSFP+接口CE6850-48S6Q-HI48个10GE SFP+接口，6个40GE QSFP+接口CE6850-48T4Q-EI48个10GE Base-T接口，4个40GE QSFP+接口CE6850-48S4Q-EI48个10GE SFP+接口，4个40GE QSFP+接口48个10GE SFP+接口，4个40GE QSFP+接口48个10GE SFP+接口，4个40GE QSFP+接口32个10GE Base-T接口，16个10GE SFP+接口，4个40GE QSFP+接口48个10GE SFP+接口CE6810-24S2Q-LI24个10GE SFP+接口，2个40GE QSFP+接口CloudEngine 5800系列系列交换机定位于数据中心的高密千兆接入，同时可用于园区网的汇聚或接入。

华为云计算解决方案白皮书―FusionCloud1 OpenStack为IT基础设施交付模式与商业模式的变革带来契机1.1 运营商及企业IT基础设施云平台建设面临的挑战运营商及企业为通过引入云计算实现对其IT基础设施与业务应用平台的升级改造，实现降低TCO、提升企业核心业务部署与运行效率的核心价值，面临如下关键挑战：1.将分布式的、多厂家异构的基础设施资源以云服务的方式提供和消费，同时不同应用也必将对基础设施资源提出完全不同的需求。

基础设施层的水平分层采购，很好地避免了Vendor-Lock-In的问题，但使得数据中心内遍布不同厂家的服务器、存储、网络和安全硬件，操作系统从Unix到Linux到Windows并存局面不可避免，大大增加了云服务抽象和统一化的难度，同时不同应用所需的云服务能力如容灾、备份需求也各不相同。

2.如何在云平台的分阶段建设中为企业创造业务价值。

不同企业数据中心建设的模式各有不同。

新建数据中心可以从头规划，使用全新理念建设可以事半功倍。

但是针对已运行多年且正在服务的数据中心不能说改造就改造，云服务带来价值再好，也需要在现有基础上逐步改造建设。

在逐步改造的过程中如何既能满足当前业务要求，又能够保障数据中心的持续演进，是云建设必须解决的挑战。

3.多供应商如何能够在云服务中完美整合，面临商业和技术上的挑战由于IT基础设施资源池云化所带来的大颗粒和统一管控的特征，针对运营商及大型企业客户，数据中心建设的基础设施云化必然需要面临如何有效解决云服务产品和解决方案供应商的Vendor-Lock-In问题。

多供应商在云服务中的协同，是数据中心启动改造和建设之初就应未雨绸缪的问题。

4.固定接入和移动接入并存带给云服务的挑战针对运行在运营商和企业数据中心云端的各类电信增值业务，以及IT桌面应用，以及C/S、B/S架构应用，甚至数据中心本身的营运运维，无论是个人消费者，抑或企业用户，都希望通过无所不在的固定和移动宽带网络接入这些云端应用，从而在保障业务体验一致性、连续性的前提下，实现最终个人用户与企业用户与这些云端应用的高效交互。

彩页产品概述CloudEngine S6730-H系列交换机，是新一代企业级核心和汇聚层交换机，具备高性能、高可靠、云管理和智能运维能力。

采用华为领先的VRP平台，专为安全性，物联网和云而构建。

可广泛用于企业园区、高校、数据中心等应用场景。

CloudEngine S6730-H系列交换机，是华为面向园区网络推出的10G、25G、40G和100G以太网交换机，丰富的端口类型满足多样化的网络带宽需求。

产品支持云管理，实现包括规划、部署、监控、体验可视化、故障修复与网络优化的全生命周期云管理网络服务，让网络管理化繁为简。

产品支持随板AC能力，集成AC功能，可管理大规模的AP，有效简化了客户网络架构和设备数量，降低组网成本。

产品具备业务随行能力，实现了身份信息的全网统一，不管用户从哪里接入，都可以享受一致的权限和用户体验，充分满足企业移动办公的要求。

产品支持VXLAN技术，通过网络虚拟化实现业务隔离，一网多用，极大提升了网络容量和利用率。

本系列交换机在成本、灵活性、可扩展性等方面都是新一代物联融合网络的最优选择。

全系列产品内置安全探针，支持异常流量检测、加密流量的威胁分析，以及全网威胁诱捕等功能，从传统的被动防御转变为主动防御，有效保障园区网络安全。

产品型号和外观CloudEngine S6730-H48X6CCloudEngine S6730-H24X4Y4C产品特性和优势让网络更敏捷地为业务服务●该系列交换机内置高速灵活的处理器芯片，针对以太网专属设计，凭借其灵活的报文处理及流量控制能力，深入贴近业务，满足现在及未来的各种挑战，助力客户构建弹性扩展的网络。

●该系列交换机支持完全自定义流量的转发模式、转发行为和查找算法。

通过微码编程实现新业务，客户无需更换新的硬件，快速灵活，6个月即可上线。

●该系列交换机在完全覆盖传统交换机能力基础上，通过开放接口和自定义转发流程，满足企业定制化业务诉求。

企业既可以直接利用多层次的开放接口自主开发新的协议、功能，也可以将诉求交由厂商，与厂商共同开发完成，打造企业专属园区网络。