So i was wondering, because VXlan requeres a high mtu to work properly (some set it even as high as the max configurable MTU (9000ish)), how would providing internet access for these nodes/servers residing in these vxlan networks be possible? I mean the default gateway would have to do heavy amounts of fragmentation which would obviously be very CPU intensive.
2
-
"the max configurable MTU (9000ish)" That is not the maximum MTU. Different data-link protocols have different MTUs. For example, the ethernet MTU is 1500, while Wi-Fi is 2304, but various other protocols have MTU around 4500 or something else. For the Internet, do not expect anything above 1500.– Ron Maupin ♦Aug 14, 2020 at 13:25
-
@Maupin , cool thanks for the headsup, There,i learned something– LocoAug 14, 2020 at 21:12
Add a comment
|
1 Answer
VXLAN is an L2 tunneling protocol over UDP/IP. Basically, the tunnel provides a virtual link, so you just route that traffic like you would route from/to any other link.
The inner frame is encapsulated by UDP and in turn by IP, so their headers plus the inner L2 header eat into the MTU of an inner L3 packet.
Using a larger outer MTU for VXLAN transport is highly recommended, so that a large, inner packet doesn't need to be fragmented before being sent over a reduced-MTU tunnel. Fragmentation wastes bandwidth and processing resources, but Internet access is certainly possible either way.
VTEPs MUST NOT fragment VXLAN packets. Intermediate routers may fragment encapsulated VXLAN packets due to the larger frame size. The destination VTEP MAY silently discard such VXLAN fragments. To ensure end-to-end traffic delivery without fragmentation, it is RECOMMENDED that the MTUs (Maximum Transmission Units) across the physical network infrastructure be set to a value that accommodates the larger frame size due to the encapsulation. Other techniques like Path MTU discovery (see [RFC1191] and [RFC1981]) MAY be used to address this requirement as well.
https://www.rfc-editor.org/rfc/rfc7348
VXLAN is normally used within datacenters or across datacenter locations to provide consistent L2 connectivity (e.g. share a common IP subnet among hosts even if they grow in different racks or locations). In that scenario enlarging the outer frame and packet should be possible.
I don't really see a use case for Internet access though. You could very easily connect a router (either WAN or intermediate) to one of the VTEPs and then go on from there.
-
good that you pointed out that it should not be the VTEPs that fragment packets, but have you come across any real world setup where people were providing internet access with vxlan and so as a part of the process fragmenting these pacekts? curious to know if this is in real world applicable with the datacenter traffic load.– LocoAug 14, 2020 at 10:34
-
@Loco Internet access via VXLAN doesn't differ substantially from Internet access via VPN or even simple PPPoE. All of these protocols eat into the usable MTU and require either explicitly configured, reduced client MTU or fragmentation (with IPv4). As VXLAN is often run across private infrastructure it's pretty much standard to increase the outer MTU but that may not always be possible.– Zac67 ♦Aug 14, 2020 at 15:24
-
Yeah i think you may be right just heavy fragmentation i guess heh. The sole reason i asked was because i read Some time ago that vxlan is not preferable with internet as an additional Option, this was weird to me since i just came across artikels where people were providing internet with their setup– LocoAug 14, 2020 at 21:14