Hot answers tagged

17

Yes, from the packet switching point-of-view, VXLAN is just a matter of sticking some encapsulation on top of an L2 frame: something that other protocols do as well. The real difference it makes is at the control and management layer. VXLAN evolved as a Data Center technology, so the ability to span a WAN is just an additional advantage, not the thing that ...


9

Yes - your understanding of encapsulation is correct: a given frame has a VXLAN header applied. This is carried in a UDP packet. UDP is used as a convenient format in terms of programming and its use of src/dst port provides a ready means to both multiplex connections as well as a means by which intermediary forwarding elements can hash connections over ...


7

The destination UDP port in the outer UDP header is specified in the VXLAN specification (Port 4789). This means it is a well-known service. So an UDP packet that arrives on Port 4789 is expected to be a VXLAN packet¹ in the same way that a TCP packet that arrives on Port 80 is expected to be a HTTP packet¹. The draft you linked to is outdated and is ...


7

As you've already stated, VXLAN is L2 tunneling over IP. It's a solution to use any L3 network for creating a L2 segment. While this is also possible with other protcols, VXLAN doesn't require additional infrastructure or special transport (given IP is available) and it can also use a single tunnel for up to 16 million subtunnels - with a large ...


5

"VXLAN" by itself is kind of meaningless. It's an encapsulation mechanism. Depending on the control plane and implementation in use it can be used to bridge L2 over L3 networks, provide multi-tenant L3 routing (again, over an L3 underlay) or even provide some measure of traffic engineering. There are a bunch of really key differences between various ...


5

VXLAN is L2 bridging over IP/UDP, so in short: no, it won't save you from a broadcast storm. There are a few things you can do to avoid broadcast storms from happening: make sure you implement (M/R)STP in your L2 zones to avoid bridge loops consider limiting broadcasts for misbehaving devices limit broadcasts on or before the VXLAN links/end points - ...


5

I'll try to help where I can. I know next to nothing about Juniper, but the theory should be the same. Implementation should be the only difference. So let's start with RD's. Each tenant has one VRF. Each VRF has a single Route Distinguisher. If you're not familiar with RD's, they are a way to mark routes in the BGP database, to keep them unique. More ...


5

I think you are confusing a couple of concepts. Looking at the last configuration section of the document you have linked: 7.2) VXLAN without CVX Configuration on VTEPs: ! vlan 100 vlan 200 ! interface Ethernet 1 switchport access vlan 100 ! interface Ethernet 2 switchport mode trunk switchport trunk allowed vlan 100,200 ! interface loopback 1 ...


5

My guess would be to use a DHCP relay agent on your core switch/router. Configure this under each vlan interface and point it to your DHCP server. The DHCP discoveries will only stay on the LAN segment so you need a relay agent so that the broadcast can be turned into a unicast and routed to the vlan or even external IP address to offer an IP address. Make ...


4

VXLAN by itself doesn't solve the problem of moving the active VM over the internet to different location - it may be possible given specific setup, but it may also be impossible. In that sense it's just like a VLAN - a transport feature (or for VXLAN - overlay protocol). If the VM is connected to VXLAN, then purely from transport perspective, it doesn't ...


4

A logical switch is a switch function implemented in software-defined networking. This isn't necessarily connected to VXLAN tunneling. Whether a logical switch is virtual or not is a matter of perspective. A virtual switch is a (somewhat) more common L2 switch that's integrated in a hypervisor (or otherwise non-physical). VLAN is no virtual switching ...


4

This is a very broad question and you need to do some more background reading, but quick answers to your questions: L2 MPLS VPN – forwards based on the L2 address of the L2 PDU. The L2 PDU is encapsulated in the transport protocol (MPLS). The VPN can provide point-to-point (AToM) or LAN type multipoint service (VPLS). Something to remember about these ...


4

The answer to the second part of your question if Anycast Gateway can be implemented without VXLAN/EVPN, was given by the guy who (quite literally) "wrote the book", Lukas Krattiger, here: https://learningnetwork.cisco.com/thread/122986#661288 From which (full quote of Lukas' answer, highlight by me) if there are two VPC domains and you use HSRP on all ...


4

You could solve this by running VXLAN on the hypervisor using software like FRR. That would imply that you run a full mesh BGP setup between your hypervisors, or use route reflectors. Then, you can create as many VNI's between your hypervisors which can be used as VPC's between virtual machines. We've done this in a test setup and it seems to work, so we're ...


4

VTEPs still need to know where traffic belongs. In simple terms, EVPN is "front loading" the MAC-destination tables. If a host is not already known (via EVPN, other vendor proprietary means, or previous multicast discovery), the VTEP will still attempt multicast discovery.


4

Yes, your understanding is correct. You need route type 2 messages to fill your ARP tables since there's no traditional broadcast domain anymore. You can find more details on type 2 messages in RFC7432. Type 5 routes are used, as you assumed, to fill routing tables, as described in draft-ietf-bess-evpn-prefix-advertisement, which also explains some of the ...


4

At layer-2, there is no order to frames. Frames are switched independently, regardless of any frames the have come before. The same thing holds true at layer-3 with packets, which are routed independently. Even with some transport protocols, there is no order, and data is presented to the application as it arrives. TCP puts sequence numbers on its segments ...


4

Can I use QinQ over VXLAN? This would make my life easy as I could assign a SVLAN to each office and be done with it. Yes. We're doing Q-in-Q on DCS-7150S-24's currently running EOS-4.20.11.1M. One thing I noticed when comparing our configs with yours is that your Vxlan1 interface does not have a flood VTEP defined for VLAN 500, just a VNI and a generic ...


3

OK - a few things worth noting here, in no particular order: "sho ip bgp sum" isn't going to show you numbers for EVPN routes. You could, in fact, completely omit the address-family ipv4 stanzas if you wanted. Seeing an established / working session with no messages is actually expected for your setup. If you want to see some routes show up then create a ...


3

The short answer is that VNI is globally significant within a fabric while 802.1q VLAN tags are locally significant to either a given VTEP or a port on that VTEP. So - using your example of VNI 5020. In a simple case we can imagine two VTEP's that each locally map VLAN 20 to VNI 5020. Any port on either VTEP that is assigned to VLAN 20 (or has a trunk ...


3

One additional reason to use UDP vs L2oIP is to enhance entropy. In most cases load-balancing is done per flow/5 tuple, UDP ports are the keys in the hash, VxLAN allows UDP source port to be set to any arbitrarily value (within the range), that could be exposed to the application layer, hence increasing granularity in flow setup and better load-balancing ...


3

Presumably, the outer vlan ID is used if you want to carry both your VXLAN trunk and a bunch of other non-VXLAN VLANs together on a traditional 802.1q trunk. So you end up with an outer .1q trunk just like you've always done, and an inner VXLAN trunk. The switches involved in this trunk have no knowledge of VXLAN, to them it's just another flow, like any ...


3

You haven't described the network very well, but if your switches are not set to use jumbo frames, any jumbo frames reaching a switch will be dropped as a giant. Jumbo frames are not really standardized. You need to make sure that all the devices through which the jumbo frames pass can handle the maximum MTU of any frames passing through those devices.


3

Anycast is when you terminate IP addresses in multiple locations in a network and make each location fully functional. Advertising these routes then takes care of each client using the shortest path = geographically nearest termination point. What exact method is used behind the anycast scheme is up to the architect. It may be just a routing shortcut (to ...


3

I don't think that what you're trying to do fits within the design of VXLAN or VXLAN EVPN. The whole point is that the fabric is templated, scalable and has the same multiple paths everywhere. As soon as you are doing per-VNI per-VTEP manipulation the scalability and uniform forwarding model is impacted. Furthermore, by having a single fabric split between ...


3

Does VXLAN always require UDP for encapsulation, Yes. VXLAN encapsulates (Ethernet) frames using UDP datagrams. cant it just send packet with only IP header? That's not VXLAN, that's "plain"/no tunneling. The point of tunneling is to hide "inner" addressing from the "outer" forwarding protocols. In VXLAN's case, the inner addressing is MAC, the outer ...


3

It depends on how you want to use the link. You can configure your MLAG normally, then have a dedicated VLAN run atop this MLAG and configure routing on this VLAN. This will work for static routing using the virtual IP as a next hop. If you perform dynamic routing, like BGP, then it's still possible, but then you have to establish a session with each ...


3

It looks like you're configuring EVPN Pure Type-5 routes (i.e. https://tools.ietf.org/html/draft-ietf-bess-evpn-prefix-advertisement-11#section-4.4.1) with VXLAN transport, this is not supported on MX80/104 until 18.2R1 (see the related feature explorer entry). MPLS transport, however, is supported as of 17.1R1.


2

No, host A cannot get the IP of host B, as they are in different subnets, which typically also means they are in different Layer 2 domains, so they need a Router to communicate with each other. Just as with VLANs, you need a Router set up on the host as a default gateway to communicate with hosts in other VLANs/VXLANs. You can read about how VTEPs do MAC ...


2

I found answer myself - unlike with ip command, you have to use append keyword, not add therefore it should be: # bridge fdb add 00:00:00:00:00:00 dev vxlandev dst 10.0.1.1 # bridge fdb append 00:00:00:00:00:00 dev vxlandev dst 10.0.1.2


Only top voted, non community-wiki answers of a minimum length are eligible