场景说明：使用防火墙模拟OVS设备进行NAT，使用防火墙模拟NAT-SERVER位于DMZ区域，Spine/Border-Leaf融合部署作为集中式网关存在，Border-Leaf旁路部署防火墙，防火墙采用虚拟化vsys部署与Border-Leaf建立OSPF邻居关系。
PC1访问Internet路径为：PC1作为私网首先将流量转发给OVS -> OVS进行NAT将地址转换为vlan301内部地址然后将流量转发至集中式网关Border-Leaf（Inside VRF） -> Border-Leaf将流量转发给虚拟防火墙Inside -> 虚拟防火墙进行安全策略处理完毕后将流量发送回Border-Leaf （DMZ VRF） -> Border-Leaf将流量封装vxlan转发给NAT-SERVER -> NAT-SERVER收到流量后做SNAT处理将地址转为公网地址将流量转发给Border-Leaf （Inside_Internet VRF） -> Border-Leaf将流量转发给根墙进行处理 -> 防火墙根墙经过安全策略处理完毕后将流量转发至Border-Leaf（Internet VRF） -> Border-Leaf将流量转发至Internet。
来回路径一致

实验结果：

难点设备Border-Leaf配置：

#
 sysname SpineAndBorder-Leaf
#建立多个VRF来隔离路由
ip vpn-instance DMZ
#
ip vpn-instance Inside
#
ip vpn-instance Inside_Internet
#
ip vpn-instance Internet
#配置与根墙建立的OSPF邻居
ospf 1 router-id 10.0.12.1 vpn-instance Internet
 default-route-advertise type 1 //下发默认路由给根墙和Inside_Internet VRF
 area 0.0.0.0
  network 10.0.12.0 0.0.0.3
#配置与根墙建立的OSPF邻居
ospf 2 router-id 10.0.13.1 vpn-instance Inside_Internet
 vpn-instance-capability simple //这里由于VPN实例下 OSPF DN-BIT置位防环，需要配置该命令解决因为防环导致路由不学习的情况，否则无法学习到Internet下发的默认路由
 area 0.0.0.0
  network 10.0.13.0 0.0.0.3
  network 100.0.0.0 0.0.0.255 //宣告vxlan10200地址
#
ospf 3 router-id 10.0.11.1 vpn-instance DMZ
 default-route-advertise type 1 //下发默认路由给虚墙和Inside VRF
 area 0.0.0.0
  network 10.0.11.0 0.0.0.3
  network 10.0.209.0 0.0.0.255 //宣告vxlan10209地址
#
ospf 4 router-id 10.0.10.1 vpn-instance Inside
 vpn-instance-capability simple  //这里由于VPN实例下 OSPF DN-BIT置位防环，需要配置该命令解决因为防环导致路由不学习的情况，否则无法学习到DMZ下发的默认路由
 area 0.0.0.0
  network 10.0.10.0 0.0.0.3
  network 10.0.30.0 0.0.0.255 //宣告vxlan10301地址
#配置Underlay层通讯使用的OSPF
ospf 100 router-id 1.1.1.1 
 area 0.0.0.0
  network 1.1.1.1 0.0.0.0
  network 10.0.1.0 0.0.0.3
  network 10.0.1.4 0.0.0.3
#
vlan 10 to 13
#
vlan 301
#
 l2vpn enable
#创建3个vxlan并且关联网关和L2 VNI
vsi vxlan10200 
 gateway vsi-interface 200
 vxlan 10200
 evpn encapsulation vxlan
  route-distinguisher 1:10200
  vpn-target 1:10200 export-extcommunity
  vpn-target 1:10200 import-extcommunity
#
vsi vxlan10209
 gateway vsi-interface 209
 vxlan 10209
 evpn encapsulation vxlan
  route-distinguisher 1:10209
  vpn-target 1:10209 export-extcommunity
  vpn-target 1:10209 import-extcommunity
#
vsi vxlan10301
 gateway vsi-interface 301
 vxlan 10301
 evpn encapsulation vxlan
  route-distinguisher 1:10301
  vpn-target 1:10301 export-extcommunity
  vpn-target 1:10301 import-extcommunity
#
interface LoopBack0 //建立vxlan隧道使用的VTEP地址和建立BGP EVPN邻居关系的逻辑接口
 ip address 1.1.1.1 255.255.255.255
#vlan逻辑接口用于与防火墙根墙、防火墙虚墙互联的接口
interface Vlan-interface10
 ip binding vpn-instance Inside
 ip address 10.0.10.1 255.255.255.252
 ospf network-type p2p
#
interface Vlan-interface11
 ip binding vpn-instance DMZ
 ip address 10.0.11.1 255.255.255.252
 ospf network-type p2p
#
interface Vlan-interface12
 ip binding vpn-instance Internet
 ip address 10.0.12.1 255.255.255.252
 ospf network-type p2p
#
interface Vlan-interface13
 ip binding vpn-instance Inside_Internet
 ip address 10.0.13.1 255.255.255.252
 ospf network-type p2p
#与Internet 互联的接口
interface GigabitEthernet1/0/1
 port link-mode route
 combo enable fiber
 ip binding vpn-instance Internet
 ip address 100.1.1.2 255.255.255.252
#
interface GigabitEthernet1/0/48
 port link-mode bridge
 port link-type trunk
 undo port trunk permit vlan 1
 port trunk permit vlan 10 to 13
 combo enable fiber
#
interface Ten-GigabitEthernet1/0/50
 port link-mode route
 combo enable fiber
 ip address 10.0.1.1 255.255.255.252
 ospf network-type p2p
#
interface Ten-GigabitEthernet1/0/51
 port link-mode route
 combo enable fiber
 ip address 10.0.1.5 255.255.255.252
 ospf network-type p2p
#
interface Vsi-interface200 //vxlan10200的网关
 ip binding vpn-instance Inside_Internet
 ip address 100.0.0.254 255.255.255.0
#
interface Vsi-interface209 //vxlan10209的网关
 ip binding vpn-instance DMZ
 ip address 10.0.209.254 255.255.255.0
#
interface Vsi-interface301 //vxlan10301的网关
 ip binding vpn-instance Inside
 ip address 10.0.30.254 255.255.255.0
#
bgp 100 instance EVPN //通过BGP实例的方式来建立EVPN邻居关系，这样如果以后使用BGP其他的AS号来建立传统网络邻居关系依旧可行
 group Leaf internal
 peer Leaf connect-interface LoopBack0
 peer 1.1.1.2 group Leaf
 peer 1.1.1.3 group Leaf
 #
 address-family l2vpn evpn //由于是集中式网关，不需要配置undo policy vpn-target，如果网络内有其他二层vxlan需要通过Spine传递的话，则需要配置，或者Spine上创建该vxlan对应的RD/RT也行
  peer Leaf enable
  peer Leaf reflect-client //同时Spine又作为RR存在
#
 ip route-static vpn-instance Internet 0.0.0.0 0 100.1.1.1 //配置到Internet的出口的默认路由
 ip route-static vpn-instance DMZ 0.0.0.0 0 10.0.209.1 //配置到DMZ中NAT-SERVER的默认路由
#
return