Aruba FlexFabric 5710 Switch Series VXLAN Configuration Guide

Category
Networking
Type
Configuration Guide

This manual is also suitable for

HPE FlexFabric 5710 Switch Series
VXLAN Configuration Guide
Software version: Release 671x and later
Document version: 6W100-20230822
© Copyright 2023 Hewlett Packard Enterprise Development LP
The information contained herein is subject to change without notice. The only warranties for Hewlett Packard
Enterprise products and services are set forth in the express warranty statements accompanying such
products and services. Nothing herein should be construed as constituting an additional warranty. Hewlett
Packard Enterprise shall not be liable for technical or editorial errors or omissions contained herein.
Confidential computer software. Valid license from Hewlett Packard Enterprise required for possession, use, or
copying. Consistent with FAR 12.211 and 12.212, Commercial Computer Software, Computer Software
Documentation, and Technical Data for Commercial Items are licensed to the U.S. Government under vendor’s
standard commercial license.
Links to third-party websites take you outside the Hewlett Packard Enterprise website. Hewlett Packard
Enterprise has no control over and is not responsible for information outside the Hewlett Packard Enterprise
website.
Acknowledgments
Intel®, Itanium®, Pentium®, Intel Inside®, and the Intel Inside logo are trademarks of Intel Corporation in the
United States and other countries.
Microsoft® and Windows® are either registered trademarks or trademarks of Microsoft Corporation in the
United States and/or other countries.
Adobe® and Acrobat® are trademarks of Adobe Systems Incorporated.
Java and Oracle are registered trademarks of Oracle and/or its affiliates.
UNIX® is a registered trademark of The Open Group.
i
Contents
VXLAN overview ···························································································· 1
VXLAN benefits ·················································································································································· 1
VXLAN network model ······································································································································· 1
VXLAN packet format········································································································································· 2
VXLAN working mechanisms ····························································································································· 3
Generic VXLAN network establishment and forwarding process······························································· 3
VXLAN tunnel establishment and assignment ··························································································· 3
Assignment of traffic to VXLANs ················································································································ 3
MAC learning ············································································································································· 4
Unicast forwarding ····································································································································· 4
Flood ·························································································································································· 6
Access modes of VSIs ······························································································································· 8
ARP and ND flood suppression ························································································································· 9
VXLAN IP gateways ········································································································································· 10
Protocols and standards ·································································································································· 10
Configuring basic VXLAN features ······························································· 11
VXLAN tasks at a glance ································································································································· 11
Prerequisites for VXLAN ·································································································································· 11
Setting the VXLAN hardware resource mode ·································································································· 12
Setting the VXLAN hardware resource mode ·································································································· 12
Creating a VXLAN on a VSI ····························································································································· 12
Configuring a VXLAN tunnel ···························································································································· 13
Manually creating a VXLAN tunnel ·········································································································· 13
Enabling BFD on a VXLAN tunnel ··········································································································· 14
Manually assigning VXLAN tunnels to a VXLAN ····························································································· 15
Assigning customer frames to a VSI ················································································································ 16
Restrictions and guidelines for configuring traffic assignment methods ·················································· 16
Mapping a static Ethernet service instance to a VSI ················································································ 16
Mapping dynamic Ethernet service instances to VSIs ············································································· 18
Configuring VLAN-based VXLAN assignment ························································································· 19
Managing MAC address entries ······················································································································· 20
About MAC address entry management ·································································································· 20
Configuring static MAC address entries ··································································································· 20
Disabling local-MAC address learning ····································································································· 20
Disabling remote-MAC address learning ································································································· 21
Enabling local-MAC logging ····················································································································· 21
Setting the MAC learning priority of an Ethernet service instance ··························································· 21
Enabling software-based MAC learning on an interface ·········································································· 22
Configuring VXLAN over VXLAN ····················································································································· 23
Configuring a multicast-mode VXLAN ············································································································· 23
About multicast methods for multicast-mode VXLANs ············································································· 23
Prerequisites for multicast-mode VXLANs ······························································································· 24
Configuring a multicast-mode VXLAN that uses the PIM method···························································· 24
Configuring a multicast-mode VXLAN that uses the IGMP host method ················································· 25
Configuring private VSI ···································································································································· 25
About private VSI ····································································································································· 25
Restrictions and guidelines ······················································································································ 26
Configuring a primary VSI ························································································································ 27
Configuring a secondary VSI ··················································································································· 27
Setting the destination UDP port number of VXLAN packets ·········································································· 27
Configuring VXLAN packet check ···················································································································· 28
Enabling default VXLAN decapsulation ··········································································································· 28
Disabling flooding for a VSI ······························································································································ 29
Enabling ARP flood suppression······················································································································ 30
Enabling ND flood suppression ························································································································ 30
Enabling VXLAN packet statistics ···················································································································· 31
ii
Enabling packet statistics for a VSI ·········································································································· 31
Enabling packet statistics for an AC ········································································································· 31
Enabling packet statistics for VXLAN tunnels ·························································································· 32
Setting the L2VPN statistics collection interval ························································································ 32
Testing the reachability of a remote VM ·········································································································· 33
Display and maintenance commands for VXLANs ·························································································· 33
VXLAN configuration examples ······················································································································· 34
Example: Configuring a unicast-mode VXLAN ························································································ 34
Example: Configuring a multicast-mode VXLAN ······················································································ 39
Configuring VXLAN IP gateways ································································· 46
About VXLAN IP gateways ······························································································································ 46
VXLAN IP gateways separated from VTEPs ··························································································· 46
Centralized VXLAN IP gateway deployment ···························································································· 47
Centralized VXLAN gateway group deployment ······················································································ 48
Distributed VXLAN IP gateway deployment ····························································································· 49
Restrictions and guidelines: VXLAN IP gateway configuration ········································································ 54
VXLAN IP gateway tasks at a glance··············································································································· 55
Prerequisites for VXLAN IP gateway configuration ·························································································· 55
Configuring a centralized VXLAN IP gateway ·································································································· 56
Restrictions and guidelines ······················································································································ 56
Configuring a gateway interface on a centralized VXLAN IP gateway····················································· 56
Assigning a subnet to a VSI ····················································································································· 56
Configuring a centralized VXLAN IP gateway group························································································ 57
Configuring a VTEP group ······················································································································· 57
Specifying a VTEP group as the gateway for an access layer VTEP ······················································ 58
Configuring a distributed VXLAN IP gateway ·································································································· 58
Restrictions and guidelines for distributed VXLAN IP gateway configuration ·········································· 58
Configuring a gateway interface on a distributed VXLAN IP gateway ····················································· 59
Enabling dynamic ARP or ND entry synchronization for distributed VXLAN IP gateways ······················· 60
Assigning a subnet to a VSI ····················································································································· 60
Managing ARP entries and ND entries ············································································································ 61
Adding a static ARP entry ························································································································ 61
Disabling remote ARP or ND learning for VXLANs ·················································································· 61
Configuring a VSI interface ······························································································································ 62
Configuring optional parameters for a VSI interface ················································································ 62
Restoring the default settings of the VSI interface ··················································································· 62
Display and maintenance commands for VXLAN IP gateways········································································ 63
VXLAN IP gateway configuration examples····································································································· 63
Example: Configuring a centralized VXLAN IP gateway ·········································································· 63
Example: Configuring a centralized VXLAN IP gateway group································································ 68
Example: Configuring distributed VXLAN IP gateways (IPv4 underlay) ·················································· 72
Example: Configuring distributed VXLAN IP gateways (IPv6 underlay) ·················································· 82
Configuring VXLAN-DCI ·············································································· 92
About VXLAN-DCI············································································································································ 92
VXLAN-DCI network model ······················································································································ 92
Working mechanisms ······························································································································· 92
Intra-VXLAN traffic forwarding between sites ·························································································· 93
Inter-VXLAN traffic forwarding between sites ·························································································· 94
VXLAN-DCI tasks at a glance ·························································································································· 95
Configuring a VXLAN-DCI tunnel ····················································································································· 95
Assigning VXLAN-DCI tunnels to a VXLAN ····································································································· 96
Configuring a gateway interface on an ED ······································································································ 97
Enabling packet statistics for manually created VXLAN-DCI tunnels ······························································ 97
Display and maintenance commands for VXLAN-DCI ····················································································· 98
VXLAN-DCI configuration examples ················································································································ 98
Example: Configuring a basic VXLAN-DCI network ················································································· 98
Configuring the VTEP as an OVSDB VTEP ··············································· 107
About OVSDB VTEP ······································································································································ 107
Working mechanisms ····························································································································· 107
iii
Protocols and standards ································································································································ 107
Restrictions and guidelines: OVSDB VTEP configuration·············································································· 107
OVSDB VTEP tasks at a glance ···················································································································· 107
Prerequisites for OVSDB VTEP configuration ······························································································· 108
Setting up an OVSDB connection to a controller ··························································································· 108
About OVSDB connection types ············································································································ 108
Restrictions and guidelines for OVSDB controller connection setup ····················································· 108
Prerequisites for OVSDB controller connection setup ··········································································· 108
Configuring active SSL connection settings ··························································································· 109
Configuring passive SSL connection settings ························································································ 109
Configuring active TCP connection settings ·························································································· 109
Configuring passive TCP connection settings ························································································ 110
Enabling the OVSDB server··························································································································· 110
Enabling the OVSDB VTEP service ··············································································································· 110
Specifying a global source address for VXLAN tunnels ················································································· 110
Specifying a VTEP access port ······················································································································ 111
Enabling flood proxy on multicast VXLAN tunnels ························································································· 111
Disabling the ACLs issued by the OVSDB controller ····················································································· 112
OVSDB VTEP configuration examples ·········································································································· 112
Example: Configuring a unicast-mode VXLAN ······················································································ 112
Example: Configuring flood proxy for a VXLAN ····················································································· 115
Document conventions and icons ······························································ 120
Conventions ··················································································································································· 120
Network topology icons ·································································································································· 121
Support and other resources ····································································· 122
Accessing Hewlett Packard Enterprise Support····························································································· 122
Accessing updates ········································································································································· 122
Websites ················································································································································ 123
Customer self repair ······························································································································· 123
Remote support ······································································································································ 123
Documentation feedback ······················································································································· 123
Index ·········································································································· 125
1
VXLAN overview
Virtual eXtensible LAN (VXLAN) is a MAC-in-UDP technology that provides Layer 2 connectivity
between distant network sites across an IP network. VXLAN is typically used in data centers and the
access layer of campus networks for multitenant services.
VXLAN benefits
VXLAN provides the following benefits:
•
Support for more virtual switched domains than VLANs—Each VXLAN is uniquely
identified by a 24-bit VXLAN ID. The total number of VXLANs can reach 16777216 (224). This
specification makes VXLAN a better choice than 802.1Q VLAN to isolate traffic for user
terminals.
•
Easy deployment and maintenance—VXLAN requires deployment only on the edge devices
of the transport network. Devices in the transport network perform typical Layer 3 forwarding.
VXLAN network model
As shown in Figure 1, a VXLAN is a virtual Layer 2 network (known as the overlay network) built on
top of an existing physical Layer 3 network (known as the underlay network). The overlay network
encapsulates inter-site Layer 2 frames into VXLAN packets and forwards the packets to the
destination along the Layer 3 forwarding paths provided by the underlay network. The underlay
network is transparent to tenants, and geographically dispersed sites of a tenant are merged into a
Layer 2 network.
The site networks can be IPv4 or IPv6 networks. The undelay network can only be IPv4 networks.
The transport edge devices assign user terminals to different VXLANs, and then forward traffic
between sites for user terminals by using VXLAN tunnels. Supported user terminals include PCs,
wireless terminals, and VMs on servers.
NOTE:
This document uses
VMs as examples to describe the mechanisms of VXLAN. The mechanisms do
not differ between different kinds of user terminals.
The transport edge devices are VXLAN tunnel endpoints (VTEP). The VTEP implementation of the
device uses ACs, VSIs, and VXLAN tunnels to provide VXLAN services.
•
VSI—A virtual switch instance is a virtual Layer 2 switched domain. Each VSI provides
switching services only for one VXLAN. VSIs learn MAC addresses and forward frames
independently of one another. VMs in different sites have Layer 2 connectivity if they are in the
same VXLAN.
•
Attachment circuit (AC)—An AC is a physical or virtual link that connects a VTEP to a local
site. Typically, ACs are Ethernet service instances that are associated with the VSI of a VXLAN.
Traffic received from an AC is assigned to the VSI associated with the AC. Ethernet service
instances are created on site-facing Layer 2 interfaces. An Ethernet service instance matches a
list of custom VLANs by using a frame match criterion.
•
VXLAN tunnel—Logical point-to-point tunnels between VTEPs over the transport network.
Each VXLAN tunnel can trunk multiple VXLANs.
VTEPs encapsulate VXLAN traffic in the VXLAN, outer UDP, and outer IP headers. The devices in
the transport network forward VXLAN traffic only based on the outer IP header.
2
Figure 1 VXLAN network model
VXLAN packet format
As shown in Figure 2, a VTEP encapsulates a frame in the following headers:
•
8-byte VXLAN header—VXLAN information for the frame.
 Flags—If the I bit is 1, the VXLAN ID is valid. If the I bit is 0, the VXLAN ID is invalid. All
other bits are reserved and set to 0.
 24-bit VXLAN ID—Identifies the VXLAN of the frame. It is also called the virtual network
identifier (VNI).
•
8-byte outer UDP header for VXLAN—The default VXLAN destination UDP port number is
4789.
•
20-byte outer IP header—Valid addresses of VTEPs or VXLAN multicast groups on the
transport network. Devices in the transport network forward VXLAN packets based on the outer
IP header.
Figure 2 VXLAN packet format
Underlay network
Overlay network
VTEP 1 VTEP 2
Site 2
Site 1
VXLAN tunnel
Transport
network
P
Terminal
Terminal
VSI/VXLAN 10
VSI/VXLAN 20
VSI/VXLAN 10
VSI/VXLAN 20
Terminal
Terminal
Original Layer 2 frame
Outer UDP
header VXLAN
header
Outer IP header
Flags
RRRRIRRR Reserved
VXLAN ID Reserved
3
VXLAN working mechanisms
Generic VXLAN network establishment and forwarding
process
The VTEP uses the following process to establish the VXLAN network and forward an inter-site
frame:
1. Discovers remote VTEPs, establishes VXLAN tunnels, and assigns the VXLAN tunnels to
VXLANs.
2. Assigns the frame to its matching VXLAN if the frame is sent between sites.
3. Performs MAC learning on the VXLAN's VSI.
4. Forwards the frame through VXLAN tunnels.
This section describes this process in detail. For intra-site frames in a VSI, the system performs
typical Layer 2 forwarding, and it processes 802.1Q VLAN tags as described in "Access modes of
VSIs."
VXLAN tunnel establishment and assignment
To provide Layer 2 connectivity for a VXLAN between two sites, you must create a VXLAN tunnel
between the sites and assign the tunnel to the VXLAN.
VXLAN tunnel establishment
VXLAN supports manual and automatic VXLAN tunnel establishment.
•
Manual creation—Manually create a VXLAN tunnel interface, and specify the tunnel source
and destination IP addresses on the peer VTEPs.
VXLAN tunnel assignment
VXLAN supports manual and automatic VXLAN tunnel assignment.
•
Manual assignment—Manually assign VXLAN tunnels to VXLANs.
Assignment of traffic to VXLANs
Traffic from the local site to a remote site
The VTEP uses the following methods to assign customer frames to a VXLAN:
•
Ethernet service instance-to-VSI mapping—This method uses the frame match criterion of
an Ethernet service instance to match a list of VLANs on a site-facing Layer 2 interface. The
frame match criterion specifies the characteristics of traffic from the VLANs, such as tagging
status and VLAN IDs. The VTEP assigns customer traffic to a VXLAN by mapping the Ethernet
service instance to a VSI.
•
VLAN-based VXLAN assignment—This method maps a VLAN to a VXLAN. The VTEP
assigns all frames of the VLAN to the VXLAN.
As shown in Figure 3, Ethernet service instance 1 matches VLAN 2 and is mapped to VSI A (VXLAN
10). When a frame from VLAN 2 arrives, the VTEP assigns the frame to VXLAN 10, and looks up VSI
A's MAC address table for the outgoing interface.
4
Figure 3 Identifying traffic from the local site
Traffic from a remote site to the local site
When a frame arrives at a VXLAN tunnel, the VTEP uses the VXLAN ID in the frame to identify its
VXLAN.
MAC learning
The VTEP performs source MAC learning on the VSI as a Layer 2 switch.
•
For traffic from the local site to the remote site, the VTEP learns the source MAC address
before VXLAN encapsulation.
•
For traffic from the remote site to the local site, the VTEP learns the source MAC address after
removing the VXLAN header.
A VSI's MAC address table includes the following types of MAC address entries:
•
Local MAC—MAC entries learned from the local site. The outgoing interfaces for the MAC
address entries are site-facing interfaces.
 Static—Manually added MAC entries.
 Dynamic—Dynamically learned MAC entries.
•
Remote MAC—MAC entries learned from a remote site, including static and dynamic MAC
entries. The outgoing interfaces for the MAC addresses are VXLAN tunnel interfaces.
 Static—Manually added MAC entries.
 Dynamic—MAC entries learned in the data plane from incoming traffic on VXLAN tunnels.
The learned MAC addresses are contained in the inner Ethernet header.
 OpenFlow—MAC entries issued by a remote controller through OpenFlow. For more
information, see OpenFlow Configuration Guide.
 OVSDB—MAC entries issued by a remote controller through OVSDB.
The following shows the priority order of different types of remote MAC address entries:
a. Static MAC address entries, and MAC address entries issued by a remote controller
through OpenFlow or OVSDB. These types of entries have the same priority and overwrite
each other.
b. Dynamic MAC address entries.
Unicast forwarding
Intra-site unicast forwarding
The VTEP uses the following process to forward a known unicast frame within a site:
1. Identifies the VSI of the frame.
Server
Service instance 1:
VLAN 2VSI A
VXLAN 10
VLAN 2
VM 1
VM 2
VM 3
Service instance 2:
VLAN 3
Service instance 3:
VLAN 4
VLAN 3
VLAN 4
VSI B
VXLAN 20
VSI C
VXLAN 30
VTEP
5
2. Looks up the destination MAC address in the VSI's MAC address table for the outgoing
interface.
3. Sends the frame out of the matching outgoing interface.
As shown in Figure 4, VTEP 1 forwards a frame from VM 1 to VM 4 within the local site in VLAN 10 as
follows:
4. Identifies that the frame belongs to VSI A when the frame arrives at Interface A.
5. Looks up the destination MAC address (MAC 4) in the MAC address table of VSI A for the
outgoing interface.
6. Sends the frame out of the matching outgoing interface (Interface B) to VM 4 in VLAN 10.
Figure 4 Intra-site unicast
Inter-site unicast forwarding
The following process (see Figure 5) applies to a known unicast frame between sites:
1. The source VTEP encapsulates the Ethernet frame in the VXLAN/UDP/IP header.
In the outer IP header, the source IP address is the source VTEP's VXLAN tunnel source IP
address. The destination IP address is the VXLAN tunnel destination IP address.
2. The source VTEP forwards the encapsulated packet out of the outgoing VXLAN tunnel
interface found in the VSI's MAC address table.
3. The intermediate transport devices (P devices) forward the frame to the destination VTEP by
using the outer IP header.
4. The destination VTEP removes the headers on top of the inner Ethernet frame. It then performs
MAC address table lookup in the VXLAN's VSI to forward the frame out of the matching
outgoing interface.
VXLAN tunnel
VTEP 1 VTEP 2
Transport
network
P
VM 1
VM 2
VM 3
VM 7
VM 8
VM 9
MAC table on VTEP 1
VXLAN/VSI MAC Interface
VXLAN 10/VSI A MAC 1 Interface A, VLAN 2
VXLAN 10/VSI A MAC 4 Interface B, VLAN 10
VM 4
VM 5
VM 6
Interface A
Interface B
6
Figure 5 Inter-site unicast
Flood
The source VTEP floods a broadcast, multicast, or unknown unicast frame to all site-facing
interfaces and VXLAN tunnels in the VXLAN, except for the incoming interface. Each destination
VTEP floods the inner Ethernet frame to all site-facing interfaces in the VXLAN. To avoid loops, the
destination VTEPs do not flood the frame back to VXLAN tunnels.
VXLAN supports unicast mode (also called head-end replication), multicast mode (also called
tandem replication), and flood proxy mode for flood traffic.
Unicast mode (head-end replication)
As shown in Figure 6, the source VTEP replicates the flood frame, and then sends one replica to the
destination IP address of each VXLAN tunnel in the VXLAN.
7
Figure 6 Unicast mode
Multicast mode (tandem replication)
As shown in Figure 7, the source VTEP sends the flood frame in a multicast VXLAN packet destined
for a multicast group address. Transport network devices replicate and forward the packet to remote
VTEPs based on their multicast forwarding entries.
Figure 7 Multicast mode
8
Flood proxy mode (proxy server replication)
As shown in Figure 8, the source VTEP sends the flood frame in a VXLAN packet over a VXLAN
tunnel to a flood proxy server. The flood proxy server replicates and forwards the packet to each
remote VTEP through its VXLAN tunnels.
The flood proxy mode applies to VXLANs that have many sites. This mode reduces flood traffic in the
transport network without using a multicast protocol. To use a flood proxy server, you must set up a
VXLAN tunnel to the server on each VTEP.
Figure 8 Flood proxy mode
The flood proxy mode is typically used in SDN transport networks that have a flood proxy server. For
VTEPs to forward packets based on the MAC address table issued by an SDN controller, you must
perform the following tasks on the VTEPs:
•
Disable remote-MAC address learning by using the vxlan tunnel mac-learning
disable command.
•
Disable source MAC check on all transport-facing interfaces by using the undo
mac-address static source-check enable command. If the VTEP is an IRF fabric,
you must also disable the feature on all IRF ports.
Access modes of VSIs
The access mode of a VSI determines how the VTEP processes the 802.1Q VLAN tags in the
Ethernet frames.
VLAN access mode
In this mode, Ethernet frames received from or sent to the local site must contain 802.1Q VLAN tags.
•
For an Ethernet frame received from the local site, the VTEP removes all its 802.1Q VLAN tags
before forwarding the frame.
9
•
For an Ethernet frame destined for the local site, the VTEP adds 802.1Q VLAN tags to the
frame before forwarding the frame. If an Ethernet service instance matches multiple VLANs for
a layer of VLAN tag, the lowest VLAN ID is added to the VLAN tag.
In VLAN access mode, VXLAN packets sent between sites do not contain 802.1Q VLAN tags. You
can use different 802.1Q VLANs to provide the same service in different sites.
Ethernet access mode
The VTEP does not process the 802.1Q VLAN tags of Ethernet frames received from or sent to the
local site.
•
For an Ethernet frame received from the local site, the VTEP forwards the frame with the
802.1Q VLAN tags intact.
•
For an Ethernet frame destined for the local site, the VTEP forwards the frame without adding
802.1Q VLAN tags.
In Ethernet access mode, VXLAN packets sent between VXLAN sites contain 802.1Q VLAN tags.
You must use the same VLAN to provide the same service between sites.
ARP and ND flood suppression
ARP or ND flood suppression reduces ARP request broadcasts or ND request multicasts by
enabling the VTEP to reply to ARP or ND requests on behalf of VMs.
As shown in Figure 9, this feature works as follows:
1. The VTEP snoops ARP or ND packets to populate the ARP or ND flood suppression table with
local and remote MAC addresses.
2. If an ARP or ND request from the local site does not have a matching entry, the VTEP drops the
request or floods it over the transport network. If an ARP or ND request has a matching entry,
the VTEP acts as follows:
ï‚¡ In proxy reply mode, the VTEP replies to the ARP or ND request on behalf of the target IP
address. In the ARP reply, the sender IP address is the target IP address in the ARP request,
and the sender and source MAC addresses are the MAC address in the matching ARP
flood suppression entry. In the ND reply, the sender IP address is the target IP address in
the ND request, and the source MAC address is the MAC address in the matching ND flood
suppression entry.
ï‚¡ In unicast forwarding mode, the VTEP replaces the target MAC address and destination
MAC address in the ARP request with the MAC address in the entry and unicasts the ARP
request. For an ND request, the VTEP replaces the destination MAC address with the MAC
address in the entry and unicasts the ND request.
Proxy reply mode decreases system resource consumption. Unicast forwarding mode reduces the
ARP or ND entry learning errors caused by the delay in refreshing ARP or ND flood suppression
entries at the expense of high system resource usage.
To avoid incorrect packet discards, do not enable the VTEP to discard ARP or ND requests that do
not match any flood suppression entries before the VTEP creates ARP or ND flood suppression
entries.
10
Figure 9 ARP flood suppression
The following uses ARP flood suppression that operates in proxy reply mode and floods ARP
requests that do not match any ARP flood suppression entries as an example to explain the flood
suppression workflow:
3. VM 1 sends an ARP request to obtain the MAC address of VM 7.
4. VTEP 1 creates a suppression entry for VM 1, and floods the ARP request in the VXLAN.
5. VTEP 2 and VTEP 3 de-encapsulate the ARP request. The VTEPs create a suppression entry
for VM 1, and broadcast the request in the local site.
6. VM 7 sends an ARP reply.
7. VTEP 2 creates a suppression entry for VM 7 and forwards the ARP reply to VTEP 1.
8. VTEP 1 de-encapsulates the ARP reply, creates a suppression entry for VM 7, and forwards the
ARP reply to VM 1.
9. VM 4 sends an ARP request to obtain the MAC address of VM 1 or VM 7.
10. VTEP 1 creates a suppression entry for VM 4 and replies to the ARP request.
11. VM 10 sends an ARP request to obtain the MAC address of VM 1.
12. VTEP 3 creates a suppression entry for VM 10 and replies to the ARP request.
VXLAN IP gateways
A VXLAN IP gateway provides Layer 3 forwarding services for VMs in VXLANs. A VXLAN IP gateway
can be an independent device or be collocated with a VTEP. For more information about VXLAN IP
gateway placement, see "Configuring VXLAN IP gateways."
Protocols and standards
RFC 7348, Virtual eXtensible Local Area Network (VXLAN): A Framework for Overlaying Virtualized
Layer 2 Networks over Layer 3 Networks
(1)
VTEP 1 VTEP 2
Transport network
P
Server 1
VM 1
VM 2
VM 3
Server 3
VM 7
VM 8
VM 9
Server 2
VM 4
VM 5
VM 6
VXLAN tunnel
VXLAN tunnel
VTEP 3
VXLAN tunnel
Server 4
VM 10
VM 11
VM 12
(2)
(2)
(3)
(3)
(4)
(5)
(6)
(7)
(8)
(9) (10)
(2)
11
Configuring basic VXLAN features
VXLAN tasks at a glance
To configure basic VXLAN settings, perform the following tasks on VTEPs:
1. (Optional.) Setting the VXLAN hardware resource mode
2. Creating a VXLAN on a VSI
3. Configuring a VXLAN tunnel
4. Manually assigning VXLAN tunnels to a VXLAN
5. Assigning customer frames to a VSI
6. (Optional.) Managing MAC address entries
ï‚¡ Configuring static MAC address entries
ï‚¡ Disabling local-MAC address learning
ï‚¡ Disabling remote-MAC address learning
ï‚¡ Enabling local-MAC logging
ï‚¡ Setting the MAC learning priority of an Ethernet service instance
ï‚¡ Enabling software-based MAC learning on an interface
7. (Optional.) Configuring VXLAN over VXLAN
8. Configuring a multicast-mode VXLAN
If the network is multicast dense, configure the VTEP to flood VXLAN traffic in multicast mode.
9. (Optional.) Configuring private VSI
Configure private VSI on the VTEP and private VLAN on an attached server to isolate traffic of
different VMs or apply security policies.
10. (Optional.) Configuring VXLAN packet parameters
ï‚¡ Setting the destination UDP port number of VXLAN packets
ï‚¡ Configuring VXLAN packet check
ï‚¡ Enabling default VXLAN decapsulation
11. (Optional.) Reducing flood traffic in the transport network
ï‚¡ Disabling flooding for a VSI
ï‚¡ Enabling ARP flood suppression
ï‚¡ Enabling ND flood suppression
12. Maintaining VXLAN networks
ï‚¡ Enabling VXLAN packet statistics
ï‚¡ Testing the reachability of a remote VM
Prerequisites for VXLAN
Configure a routing protocol on the devices in the transport network to make sure the VTEPs can
reach one another.
12
Setting the VXLAN hardware resource mode
Setting the VXLAN hardware resource mode
About the VXLAN hardware resource mode
Set the hardware resource mode for VXLAN based on the role of the device.
•
l2gw—Applies to VTEPs that perform only Layer 2 forwarding.
•
l3gw16k—Applies to VXLAN IP gateways.
•
border24k, border28k—Applies to Layer 3 border gateways that provide access to external
networks.
Restrictions and guidelines
For the hardware resource mode to take effect, you must reboot the device.
For Ethernet service instances to correctly match Layer 2 traffic, do not configure FCoE if VXLAN is
configured on the device that acts as a border device operating in advanced mode. For more
information about the system operating mode, see device management in Fundamentals
Configuration Guide. For more information about FCoE, see FC and FCoE Configuration Guide.
Procedure
1. Enter system view.
system-view
2. Set the VXLAN hardware resource mode.
hardware-resource vxlan { border24k | l2gw | l3gw16k | border28k }
By default, the VXLAN hardware resource mode is l2gw.
Creating a VXLAN on a VSI
Restrictions and guidelines
If you use both the restrain and bandwidth commands on a VSI, the bandwidth command
limits only the bandwidth of the traffic not restrained by the restrain command.
If you use both the restrain and selective-flooding mac-address commands on a VSI,
the restrain command limits only the bandwidth of the traffic not enabled with selective flood.
Procedure
1. Enter system view.
system-view
2. Enable L2VPN.
l2vpn enable
By default, L2VPN is disabled.
3. Create a VSI and enter VSI view.
vsi vsi-name
4. Enable the VSI.
undo shutdown
By default, a VSI is enabled.
5. Create a VXLAN and enter VXLAN view.
13
vxlan vxlan-id
You can create only one VXLAN on a VSI.
The VXLAN ID must be unique for each VSI.
6. (Optional.) Configure VSI parameters:
a. Return to VSI view.
quit
b. Configure a VSI description.
description text
By default, a VSI does not have a description.
c. Set the MTU for the VSI.
mtu size
The default MTU for a VSI is 1500 bytes.
d. Set the maximum bandwidth for the VSI.
bandwidth bandwidth
By default, the maximum bandwidth is not limited for a VSI.
e. Set the broadcast, multicast, or unknown unicast restraint bandwidth for the VSI.
restrain { broadcast | multicast | unknown-unicast } bandwidth
By default, a VSI's broadcast restraint bandwidth, unknown multicast restraint bandwidth,
and unknown unicast restraint bandwidth are not set.
f. Enable MAC address learning for the VSI.
mac-learning enable
By default, MAC address learning is enabled for a VSI.
g. Set a limit for the VSI's MAC address table.
mac-table limit mac-limit
By default, no limit is set for a VSI's MAC address table.
In an IRF fabric, the master and subordinates might learn different numbers of MAC
addresses. Do not use this command on an IRF fabric.
h. Enable the VSI to drop source-unknown unicast frames if the MAC address table is full.
mac-table limit drop-unknown
By default, the VSI forwards source-unknown unicast frames without learning the source
MAC address if the MAC address table is full.
Configuring a VXLAN tunnel
Manually creating a VXLAN tunnel
About this task
When you manually create a VXLAN tunnel, specify addresses on the local VTEP and the remote
VTEP as the tunnel source and destination addresses, respectively.
Restrictions and guidelines
As a best practice, do not configure multiple VXLAN tunnels to use the same source and destination
IP addresses.
Make sure the following VXLAN tunnels are not associated with the same VXLAN when they have
the same tunnel destination IP address:
14
•
A manually created VXLAN tunnel.
This task provides basic VXLAN tunnel configuration. For more information about tunnel
configuration and commands, see Layer 3—IP Services Configuration Guide and Layer 3—IP
Services Command Reference.
Do not configure the following interfaces as traffic outgoing interfaces for the same VXLAN tunnel:
•
A main Layer 3 interface.
•
A subinterface on the main Layer 3 interface, or a VLAN interface.
If you do so, packets transmitted through the VXLAN tunnel might carry incorrect VLAN tags, and the
main Layer 3 interface cannot forward traffic correctly.
Procedure
1. Enter system view.
system-view
2. (Optional.) Specify a global source IP address for VXLAN tunnels.
tunnel global source-address ipv4-address
By default, no global source IP address is specified for VXLAN tunnels.
A VXLAN tunnel uses the global source address if you do not specify a source interface or
source address for the tunnel.
3. Create a VXLAN tunnel interface and enter tunnel interface view.
interface tunnel tunnel-number mode vxlan
The endpoints of a tunnel must use the same tunnel mode.
4. Specify a source address for the tunnel. Choose one of the following methods:
ï‚¡ Specify a source IP address for the tunnel.
source ipv4-address
The specified IP address is used in the outer IP header of tunneled VXLAN packets.
ï‚¡ Specify a source interface for the tunnel.
source interface-type interface-number
The IP address of the specified interface is used in the outer IP header of tunneled VXLAN
packets.
By default, no source IP address or source interface is specified for a tunnel.
Do not perform this step if you are using OVSDB for VXLAN tunnel management.
For a multicast-mode VXLAN, the source IP address cannot be a loopback interface's address,
and the source interface cannot be a loopback interface.
5. Specify a destination IP address for the tunnel.
destination ipv4-address
By default, no destination IP address is specified for a tunnel.
Specify the remote VTEP's IP address. This IP address will be the destination IP address in the
outer IP header of tunneled VXLAN packets.
Enabling BFD on a VXLAN tunnel
About this task
Enable BFD on both ends of a VXLAN tunnel for quick link connectivity detection. The VTEPs
periodically send BFD single-hop control packets to each other through the VXLAN tunnel. A VTEP
sets the tunnel state to Defect if it has not received control packets from the remote end for 5
seconds. In this situation, the tunnel interface state is still Up. The tunnel state will change from
Defect to Up if the VTEP can receive BFD control packets again.
15
Restrictions and guidelines
You must enable BFD on both ends of a VXLAN tunnel.
Procedure
1. Enter system view.
system-view
2. Specify the reserved VXLAN.
reserved vxlan vxlan-id
By default, no VXLAN has been reserved.
For BFD sessions to come up, you must reserve a VXLAN.
You can specify only one reserved VXLAN on the VTEP. The reserved VXLAN cannot be the
VXLAN created on any VSI.
The reserved VXLAN ID cannot be the same as the remote VXLAN ID specified by using the
mapping vni command.
3. Enter VXLAN tunnel interface view.
interface tunnel tunnel-number
4. Enable BFD on the tunnel.
tunnel bfd enable destination-mac mac-address
By default, BFD is disabled on a tunnel.
Manually assigning VXLAN tunnels to a VXLAN
About this task
To provide Layer 2 connectivity for a VXLAN between two sites, you must assign the VXLAN tunnel
between the sites to the VXLAN.
You can assign multiple VXLAN tunnels to a VXLAN, and configure a VXLAN tunnel to trunk multiple
VXLANs. For a unicast-mode VXLAN, the system floods unknown unicast, multicast, and broadcast
traffic to each tunnel associated with the VXLAN. If a flood proxy server is used, the VTEP sends
flood traffic to the server through the flood proxy tunnel. The flood proxy server replicates and
forwards flood traffic to remote VTEPs.
Restrictions and guidelines
For full Layer 2 connectivity in the VXLAN, make sure the VXLAN contains the VXLAN tunnel
between each pair of sites in the VXLAN.
Procedure
1. Enter system view.
system-view
2. Enter VSI view.
vsi vsi-name
3. Enter VXLAN view.
vxlan vxlan-id
4. Assign VXLAN tunnels to the VXLAN.
tunnel { tunnel-number [ backup-tunnel tunnel-number | flooding-proxy ]
| all }
By default, a VXLAN does not contain any VXLAN tunnels.
  • Page 1 1
  • Page 2 2
  • Page 3 3
  • Page 4 4
  • Page 5 5
  • Page 6 6
  • Page 7 7
  • Page 8 8
  • Page 9 9
  • Page 10 10
  • Page 11 11
  • Page 12 12
  • Page 13 13
  • Page 14 14
  • Page 15 15
  • Page 16 16
  • Page 17 17
  • Page 18 18
  • Page 19 19
  • Page 20 20
  • Page 21 21
  • Page 22 22
  • Page 23 23
  • Page 24 24
  • Page 25 25
  • Page 26 26
  • Page 27 27
  • Page 28 28
  • Page 29 29
  • Page 30 30
  • Page 31 31
  • Page 32 32
  • Page 33 33
  • Page 34 34
  • Page 35 35
  • Page 36 36
  • Page 37 37
  • Page 38 38
  • Page 39 39
  • Page 40 40
  • Page 41 41
  • Page 42 42
  • Page 43 43
  • Page 44 44
  • Page 45 45
  • Page 46 46
  • Page 47 47
  • Page 48 48
  • Page 49 49
  • Page 50 50
  • Page 51 51
  • Page 52 52
  • Page 53 53
  • Page 54 54
  • Page 55 55
  • Page 56 56
  • Page 57 57
  • Page 58 58
  • Page 59 59
  • Page 60 60
  • Page 61 61
  • Page 62 62
  • Page 63 63
  • Page 64 64
  • Page 65 65
  • Page 66 66
  • Page 67 67
  • Page 68 68
  • Page 69 69
  • Page 70 70
  • Page 71 71
  • Page 72 72
  • Page 73 73
  • Page 74 74
  • Page 75 75
  • Page 76 76
  • Page 77 77
  • Page 78 78
  • Page 79 79
  • Page 80 80
  • Page 81 81
  • Page 82 82
  • Page 83 83
  • Page 84 84
  • Page 85 85
  • Page 86 86
  • Page 87 87
  • Page 88 88
  • Page 89 89
  • Page 90 90
  • Page 91 91
  • Page 92 92
  • Page 93 93
  • Page 94 94
  • Page 95 95
  • Page 96 96
  • Page 97 97
  • Page 98 98
  • Page 99 99
  • Page 100 100
  • Page 101 101
  • Page 102 102
  • Page 103 103
  • Page 104 104
  • Page 105 105
  • Page 106 106
  • Page 107 107
  • Page 108 108
  • Page 109 109
  • Page 110 110
  • Page 111 111
  • Page 112 112
  • Page 113 113
  • Page 114 114
  • Page 115 115
  • Page 116 116
  • Page 117 117
  • Page 118 118
  • Page 119 119
  • Page 120 120
  • Page 121 121
  • Page 122 122
  • Page 123 123
  • Page 124 124
  • Page 125 125
  • Page 126 126
  • Page 127 127
  • Page 128 128
  • Page 129 129
  • Page 130 130
  • Page 131 131
  • Page 132 132
  • Page 133 133
  • Page 134 134
  • Page 135 135
  • Page 136 136
  • Page 137 137
  • Page 138 138
  • Page 139 139

Aruba FlexFabric 5710 Switch Series VXLAN Configuration Guide

Category
Networking
Type
Configuration Guide
This manual is also suitable for

Ask a question and I''ll find the answer in the document

Finding information in a document is now easier with AI