IP Locking and DHCP Relay on Border/Edge Leaf

onurgashi commented 1 year ago

Enhancement summary

With IP Locking it is required that the DHCP Relay should not be configured on Leafs where hosts are connected. In Symmetric IRB design we will have the IRB present on the Leaf where hosts are connected in addition to the Border Leaf or Edge Leaf (EVPN Gateway), thus today it is not possible with AVD to selectively configure the IP Helper only on Edge/Border Leaf switches and not on all Leafs in a POD/Fabric.

We should create a knob that abstracts the configuration for the IP Helper to selected devices such as Border Leafs or Edge Leafs.

DHCP Client --- Leaf pair (IRB with no helper) --- Spine --- Border/Edge Leaf pair (IRB with helper) -- DHCP Server

Which component of AVD is impacted

eos_designs

Use case example

Border Leaf pair config for IRB

interface Vlan1000
   description test
   no shutdown
   vrf test
   ip address virtual
   ipv6 address virtual
   ip helper-address 100.1.1.1
   ip helper-address 100.1.1.2
   ipv6 nd managed-config-flag
   ipv6 dhcp relay destination 2001:db8:1::1
   ipv6 dhcp relay destination 2001:db8:1::2

Standard Leaf pair config for IRB

interface Vlan1000
   description test
   no shutdown
   vrf test
   ip address virtual
   ipv6 address virtual

IP Locking config

Describe the solution you would like

A list of devices where DHCPv4/v6 relays to be configured.

(Required with IP Locking in Campus implementations or Centralised DHCP Relay)

dhcp_relays:
   - border-leaf1
   - border-leaf2
   - edge-leaf1
   - edge-leaf2

Describe alternatives you have considered

Manually removing the helper configs with a script after AVD run.

Additional context

No response

Contributing Guide

[X] I agree to follow this project's Code of Conduct

github-actions[bot] commented 1 year ago

This issue is stale because it has been open 90 days with no activity. The issue will be reviewed by a maintainer and may be closed

ClausHolbechArista commented 1 year ago

@onurgashi We now support all SVI settings under individual nodes, so you can configure the SVI like this:

...
    svis:
      - id: 123
        ...
        nodes:
          - node: border1
            ip_helpers:
              - ip_helper: 1.1.1.1
                source_interface: lo100
                source_vrf: TEST
          - node: border1
            ip_helpers:
              - ip_helper: 1.1.1.1
                source_interface: lo100
                source_vrf: TEST

github-actions[bot] commented 4 months ago

This issue is stale because it has been open 90 days with no activity. The issue will be reviewed by a maintainer and may be closed

aristanetworks / avd