Virtual eXtensible LAN (VXLAN) is a MAC-in-UDP technology that provides Layer 2 connectivity between distant network sites across an IP network. VXLAN is typically used in data centers for multitenant services.

VXLAN benefits

VXLAN provides the following benefits:

· Support for more virtual switched domains than VLANs—Each VXLAN is uniquely identified by a 24-bit VXLAN ID. The total number of VXLANs can reach 16777216 (224). This specification makes VXLAN a better choice than 802.1Q VLAN to isolate traffic for VMs.

· Easy deployment and maintenance—VXLAN requires deployment only on the edge devices of the transport network. Devices in the transport network perform typical Layer 3 forwarding.

VXLAN network model

As shown in Figure 1, a VXLAN is a virtual Layer 2 network (known as the overlay network) built on top of an existing physical Layer 3 network (known as the underlay network). The overlay network encapsulates inter-site Layer 2 frames into VXLAN packets and forwards the packets to the destination along the Layer 3 forwarding paths provided by the underlay network. The underlay network is transparent to tenants, and geographically dispersed sites of a tenant are merged into a Layer 2 network.

The undelay network can be an IPv4 or IPv6 network.

The transport edge devices assign VMs to different VXLANs, and then forward traffic between sites for VMs by using VXLAN tunnels.

The transport edge devices are VXLAN tunnel endpoints (VTEP). They can be servers that host VMs or independent network devices.

The VTEP implementation of the device uses attachment circuits (ACs), virtual switch instances (VSIs), and VXLAN tunnels to provide VXLAN services.

· VSI—A VSI is a virtual Layer 2 switched domain. Each VSI provides switching services only for one VXLAN. VSIs learn MAC addresses and forward frames independently of one another. VMs in different sites have Layer 2 connectivity if they are in the same VXLAN.

· AC—An AC is a physical or virtual link that connects a VTEP to the local site. Typically, ACs are site-facing Layer 3 interfaces or Ethernet service instances that are associated with the VSI of a VXLAN. Traffic received from an AC is assigned to the VSI associated with the AC. Ethernet service instances are created on site-facing Layer 2 interfaces. An Ethernet service instance uses a frame match criterion to match a list of custom VLANs.

· VXLAN tunnel—Logical point-to-point tunnels between VTEPs over the transport network. Each VXLAN tunnel can trunk multiple VXLANs.

VTEPs encapsulate VXLAN traffic in the VXLAN, outer UDP, and outer IP headers. The devices in the transport network forward VXLAN traffic only based on the outer IP header.

Figure 1 VXLAN network model

VXLAN packet format

As shown in Figure 2, a VTEP encapsulates a frame in the following headers:

· 8-byte VXLAN header—VXLAN information for the frame.

? Flags—If the I bit is 1, the VXLAN ID is valid. If the I bit is 0, the VXLAN ID is invalid. All other bits are reserved and set to 0.

? 24-bit VXLAN ID—Identifies the VXLAN of the frame. It is also called the virtual network identifier (VNI).

· 8-byte outer UDP header for VXLAN—The default VXLAN destination UDP port number is 4789.

· 20-byte outer IP header—Valid addresses of VTEPs or VXLAN multicast groups on the transport network. Devices in the transport network forward VXLAN packets based on the outer IP header.

Figure 2 VXLAN packet format

VXLAN working mechanisms

Generic VXLAN network establishment and forwarding process

The VTEP uses the following process to establish the VXLAN network and forward an inter-site frame:

1. Discovers remote VTEPs, establishes VXLAN tunnels, and assigns the VXLAN tunnels to VXLANs.

2. Assigns the frame to its matching VXLAN if the frame is sent between sites.

3. Performs MAC learning on the VXLAN's VSI.

4. Forwards the frame through VXLAN tunnels.

This section describes this process in detail. For intra-site frames in a VSI, the system performs typical Layer 2 forwarding, and it processes 802.1Q VLAN tags as described in "Access modes of VSIs."

VXLAN tunnel establishment and assignment

To provide Layer 2 connectivity for a VXLAN between two sites, you must create a VXLAN tunnel between the VTEPs of the sites and assign the tunnel to the VXLAN.

Assignment of traffic to VXLANs

Traffic from the local site to a remote site

The VTEP uses an Ethernet service instance or Layer 3 interface to match a list of VLANs on a site-facing interface. The VTEP assigns customer traffic to a VXLAN by mapping the Layer 3 interface or Ethernet service instance to a VSI.

As shown in Figure 3, Ethernet service instance 1 matches VLAN 2 and is mapped to VSI A (VXLAN 10). When a frame from VLAN 2 arrives, the VTEP assigns the frame to VXLAN 10, and looks up VSI A's MAC address table for the outgoing interface.

Figure 3 Identifying traffic from the local site

Traffic from a remote site to the local site

When a frame arrives at a VXLAN tunnel, the VTEP uses the VXLAN ID in the frame to identify its VXLAN.

MAC learning

The VTEP performs source MAC learning on the VSI as a Layer 2 switch.

· For traffic from the local site to the remote site, the VTEP learns the source MAC address before VXLAN encapsulation.

· For traffic from the remote site to the local site, the VTEP learns the source MAC address after removing the VXLAN header.

A VSI's MAC address table includes the following types of MAC address entries:

· Local MAC—Dynamic MAC entries learned from the local site. The outgoing interfaces are site-facing interfaces on which the MAC addresses are learned. VXLAN does not support manual local-MAC entries.

· Remote MAC—MAC entries learned from a remote site, including static and dynamic MAC entries. The outgoing interfaces for the MAC addresses are VXLAN tunnel interfaces.

? Static—Manually added MAC entries.

? Dynamic—MAC entries learned in the data plane from incoming traffic on VXLAN tunnels. The learned MAC addresses are contained in the inner Ethernet header.

? BGP EVPN—MAC entries advertised through BGP EVPN. For more information, see EVPN Configuration Guide.

? OpenFlow—MAC entries issued by a remote controller through OpenFlow. For more information, see OpenFlow Configuration Guide.

The following shows the priority order of different types of remote MAC address entries:

a. Static MAC address entries and MAC address entries issued by a remote controller through OpenFlow. These types of entries have the same priority and overwrite each other.

b. MAC address entries advertised through BGP EVPN.

c. Dynamic MAC address entries.

Unicast forwarding

Intra-site unicast forwarding

The VTEP uses the following process to forward a known unicast frame within a site:

1. Identifies the VSI of the frame.

2. Looks up the destination MAC address in the VSI's MAC address table for the outgoing interface.

3. Sends the frame out of the matching outgoing interface.

As shown in Figure 4, VTEP 1 forwards a frame from VM 1 to VM 4 within the local site in VLAN 10 as follows:

1. Identifies that the frame belongs to VSI A when the frame arrives at Interface A.

2. Looks up the destination MAC address (MAC 4) in the MAC address table of VSI A for the outgoing interface.

3. Sends the frame out of the matching outgoing interface (Interface B) to VM 4 in VLAN 10.

Figure 4 Intra-site unicast

Inter-site unicast forwarding

The following process (see Figure 5) applies to a known unicast frame between sites:

1. The source VTEP encapsulates the Ethernet frame in the VXLAN/UDP/IP header.

In the outer IP header, the source IP address is the source VTEP's VXLAN tunnel source IP address. The destination IP address is the VXLAN tunnel destination IP address.

2. The source VTEP forwards the encapsulated packet out of the outgoing VXLAN tunnel interface found in the VSI's MAC address table.

3. The intermediate transport devices (P devices) forward the frame to the destination VTEP by using the outer IP header.

4. The destination VTEP removes the headers on top of the inner Ethernet frame. It then performs MAC address table lookup in the VXLAN's VSI to forward the frame out of the matching outgoing interface.

Figure 5 Inter-site unicast

‌

Flood

The source VTEP floods a broadcast, multicast, or unknown unicast frame to all site-facing interfaces and VXLAN tunnels in the VXLAN, except for the incoming interface. Each destination VTEP floods the inner Ethernet frame to all site-facing interfaces in the VXLAN. To avoid loops, the destination VTEPs do not flood the frame back to VXLAN tunnels.

VXLAN supports unicast mode (also called head-end replication) and multicast mode (also called tandem replication).

Unicast mode (head-end replication)

As shown in Figure 6, the source VTEP replicates the flood frame, and then sends one replica to the destination IP address of each VXLAN tunnel in the VXLAN.

Figure 6 Unicast mode

Multicast mode (tandem replication)

IMPORTANT:

Multicast mode is not supported if the underlay network is an IPv6 network.

‌

As shown in Figure 7, the source VTEP sends the flood frame in a multicast VXLAN packet destined for a multicast group address. Transport network devices replicate and forward the packet to remote VTEPs based on their multicast forwarding entries.

Figure 7 Multicast mode

Access modes of VSIs

The access mode of a VSI determines how the VTEP processes the 802.1Q VLAN tags in the Ethernet frames.

VLAN access mode

In this mode, Ethernet frames received from or sent to the local site must contain 802.1Q VLAN tags.

· For an Ethernet frame received from the local site, the VTEP removes all its 802.1Q VLAN tags before forwarding the frame.

· For an Ethernet frame destined for the local site, the VTEP adds 802.1Q VLAN tags to the frame before forwarding the frame.

In VLAN access mode, VXLAN packets sent between sites do not contain 802.1Q VLAN tags. You can use different 802.1Q VLANs to provide the same service in different sites.

Ethernet access mode

The VTEP does not process the 802.1Q VLAN tags of Ethernet frames received from or sent to the local site.

· For an Ethernet frame received from the local site, the VTEP forwards the frame with the 802.1Q VLAN tags intact.

· For an Ethernet frame destined for the local site, the VTEP forwards the frame without adding 802.1Q VLAN tags.

In Ethernet access mode, VXLAN packets sent between VXLAN sites contain 802.1Q VLAN tags. You must use the same VLAN to provide the same service between sites.

ARP flood suppression

ARP flood suppression reduces ARP request broadcasts by enabling the VTEP to reply to ARP requests on behalf of VMs.

As shown in Figure 8, this feature snoops ARP packets to populate the ARP flood suppression table with local and remote MAC addresses. If an ARP request has a matching entry, the VTEP replies to the request on behalf of the VM. If no match is found, the VTEP floods the request to both local and remote sites.

Figure 8 ARP flood suppression

ARP flood suppression uses the following workflow:

1. VM 1 sends an ARP request to obtain the MAC address of VM 7.

2. VTEP 1 creates a suppression entry for VM 1, and floods the ARP request in the VXLAN.

3. VTEP 2 and VTEP 3 de-encapsulate the ARP request. The VTEPs create a suppression entry for VM 1, and broadcast the request in the local site.

4. VM 7 sends an ARP reply.

5. VTEP 2 creates a suppression entry for VM 7 and forwards the ARP reply to VTEP 1.

6. VTEP 1 de-encapsulates the ARP reply, creates a suppression entry for VM 7, and forwards the ARP reply to VM 1.

7. VM 4 sends an ARP request to obtain the MAC address of VM 1 or VM 7.

8. VTEP 1 creates a suppression entry for VM 4 and replies to the ARP request.

9. VM 10 sends an ARP request to obtain the MAC address of VM 1.

10. VTEP 3 creates a suppression entry for VM 10 and replies to the ARP request.

VXLAN IP gateways

A VXLAN IP gateway provides Layer 3 forwarding services for VMs in VXLANs. A VXLAN IP gateway can be an independent device or be collocated with a VTEP. For more information about VXLAN IP gateway placement, see "Configuring VXLAN IP gateways."

Protocols and standards

RFC 7348, Virtual eXtensible Local Area Network (VXLAN): A Framework for Overlaying Virtualized Layer 2 Networks over Layer 3 Networks

Configuring basic VXLAN features

Restrictions: Hardware compatibility with VXLAN

VXLAN is supported only on CSPEX (except CSPEX-1204 and CSPEX-1104-E) and CEPC cards.

Restrictions and guidelines: VXLAN configuration

The device does not support IPv6-based VXLAN if it is operating in standard mode. For more information about the system operating mode, see device management in Fundamentals Configuration Guide.

Devices in the transport network do not support load sharing among ECMP routes for traffic of the same VXLAN.

VLAN interfaces do not support VXLAN.

VXLAN tasks at a glance

To configure basic VXLAN settings, perform the following tasks on VTEPs:

1. Creating a VXLAN on a VSI

2. Configuring a VXLAN tunnel

3. Assigning a VXLAN tunnel to a VXLAN

4. Mapping ACs to a VSI

5. (Optional.) Managing MAC address entries

6. Configuring a multicast-mode VXLAN

If the network is multicast dense, configure the VTEP to flood VXLAN traffic in multicast mode.

7. (Optional.) Configuring VXLAN packet parameters

? Setting the destination UDP port number of VXLAN packets

? Configuring VXLAN packet check

8. (Optional.) Reducing flood traffic in the transport network

? Confining floods to the local site

? Enabling ARP flood suppression

9. Disabling remote ARP or ND learning for VXLANs

10. Maintaining VXLAN networks

? Enabling VXLAN packet statistics

Prerequisites for VXLAN

Configure a routing protocol on the devices in the transport network to make sure the VTEPs can reach one another.

Creating a VXLAN on a VSI

1. Enter system view.

system-view

2. Enable L2VPN.

l2vpn enable

By default, L2VPN is disabled.

3. Create a VSI and enter VSI view.

vsi vsi-name

4. Enable the VSI.

undo shutdown

By default, a VSI is not manually shut down.

5. Create a VXLAN and enter VXLAN view.

vxlan vxlan-id

You can create only one VXLAN on a VSI.

The VXLAN ID must be unique for each VSI.

6. (Optional.) Configure VSI parameters:

a. Return to VSI view.

quit

b. Configure a VSI description.

description text

By default, a VSI does not have a description.

c. Set the MTU for the VSI.

mtu mtu

The default MTU for a VSI is 1500 bytes.

d. Set the maximum bandwidth for known unicast traffic of the VSI.

bandwidth bandwidth

By default, the maximum bandwidth is not limited for known unicast traffic of a VSI.

e. Set the broadcast, multicast, or unknown unicast bandwidth restraints for the VSI.

restrain { broadcast | multicast | unknown-unicast } bandwidth

The default broadcast, multicast, and unknown unicast bandwidth restraints are 5120 kbps.

f. Enable local-MAC address learning for the VSI.

mac-learning enable

By default, local-MAC address learning is enabled for a VSI.

This command disables the learning of local MAC addresses. To disable the learning of remote MAC addresses, use the vxlan tunnel mac-learning disable command.

g. Set a limit for the VSI's MAC address table.

mac-table limit mac-limit

By default, no limit is set for a VSI's MAC address table.

For more information about these commands, see VPLS commands in MPLS Command Reference.

Configuring a VXLAN tunnel

About VXLAN tunnel configuration

When you manually create a VXLAN tunnel, specify addresses on the local VTEP and the remote VTEP as the tunnel source and destination addresses, respectively.

Restrictions and guidelines

As a best practice, do not configure multiple VXLAN tunnels to use the same source and destination IP addresses.

Make sure the following VXLAN tunnels are not associated with the same VXLAN when they have the same tunnel destination IP address:

· A VXLAN tunnel automatically created by EVPN.

· A manually created VXLAN tunnel.

For more information about EVPN, see EVPN Configuration Guide.

This task provides basic VXLAN tunnel configuration. For more information about tunnel configuration and commands, see Layer 3—IP Services Configuration Guide and Layer 3—IP Services Command Reference.

Procedure

1. Enter system view.

system-view

2. (Optional.) Specify a global source IP address for VXLAN tunnels.

tunnel global source-address ipv4-address

By default, no global source IP address is specified for VXLAN tunnels.

A VXLAN tunnel uses the global source address if you do not specify a source interface or source address for the tunnel.

3. Create a VXLAN tunnel interface and enter tunnel interface view.

interface tunnel tunnel-number mode vxlan

The endpoints of a tunnel must use the same tunnel mode.

4. Specify a source address for the tunnel. Choose one of the following methods:

? Specify a source IP address for the tunnel.

source ipv4-address

The specified IP address is used in the outer IP header of tunneled VXLAN packets.

? Specify a source interface for the tunnel.

source interface-type interface-number

The primary IP address of the specified interface is used in the outer IP header of tunneled VXLAN packets.

By default, no source IP address or source interface is specified for a tunnel.

For a multicast-mode VXLAN, the source IP address cannot be a loopback interface's address, and the source interface cannot be a loopback interface.

5. Specify a destination IP address for the tunnel.

destination ipv4-address

By default, no destination IP address is specified for a tunnel.

Specify the remote VTEP's IP address. This IP address will be the destination IP address in the outer IP header of tunneled VXLAN packets.

6. (Optional.) Set the type of service (ToS) for tunneled packets.

tunnel tos tos-value

For more information about this command, see tunneling commands in Layer 3—IP Services Command Reference.

Assigning a VXLAN tunnel to a VXLAN

About VXLAN tunnel assignment

To provide Layer 2 connectivity for a VXLAN between two sites, you must assign the VXLAN tunnel between the sites to the VXLAN.

You can assign multiple VXLAN tunnels to a VXLAN, and configure a VXLAN tunnel to trunk multiple VXLANs. For a unicast-mode VXLAN, the system floods unknown unicast, multicast, and broadcast traffic to each tunnel associated with the VXLAN.

Restrictions and guidelines

For full Layer 2 connectivity in the VXLAN, make sure the VXLAN contains the VXLAN tunnel between each pair of sites in the VXLAN.

Procedure

1. Enter system view.

system-view

2. Enter VSI view.

vsi vsi-name

3. Enter VXLAN view.

vxlan vxlan-id

4. Assign a VXLAN tunnel to the VXLAN.

tunnel tunnel-number

By default, a VXLAN does not contain any VXLAN tunnels.

Mapping ACs to a VSI

Mapping a Layer 3 interface to a VSI

About Layer 3 interface-to-VSI mapping

To assign the customer traffic on a Layer 3 interface to a VXLAN, map the interface to the VXLAN's VSI. The VSI uses its MAC address table to forward the customer traffic.

Procedure

1. Enter system view.

system-view

2. Enter Layer 3 interface view.

interface interface-type interface-number

3. Map the Layer 3 interface to a VSI.

xconnect vsi vsi-name [ access-mode { ethernet | vlan } ] [ track track-entry-number&<1-3> ]

By default, a Layer 3 interface is not mapped to any VSI.

Mapping an Ethernet service instance to a VSI

About Ethernet service instance-to-VSI mapping

An Ethernet service instance matches a list of VLANs on a site-facing interface. The VTEP assigns customer traffic from the VLANs to a VXLAN by mapping the Ethernet service instance to a VSI.

Restrictions and guidelines

An Ethernet service instance can contain only one match criterion. To change the match criterion, you must remove the original criterion first. When you remove the match criterion in an Ethernet service instance, the mapping between the service instance and the VSI is removed automatically.

Procedure

1. Enter system view.

system-view

2. Enter interface view.

? Enter Layer 2 Ethernet interface view.

interface interface-type interface-number

? Enter Layer 2 aggregate interface view.

interface bridge-aggregation interface-number

3. Create an Ethernet service instance and enter Ethernet service instance view.

service-instance instance-id

4. Configure the Ethernet service instance to match frames tagged with the specified outer 802.1Q VLAN ID.

encapsulation s-vid vlan-id

By default, an Ethernet service instance does not contain a frame match criterion.

5. Map the Ethernet service instance to a VSI.

xconnect vsi vsi-name [ access-mode { ethernet | vlan } ] [ track track-entry-number&<1-3> ]

By default, an Ethernet service instance is not mapped to any VSI.

Managing MAC address entries

About MAC address entry management

With VXLAN, local MAC addresses are learned dynamically. You cannot manually add local MAC addresses.

Remote-MAC address entries can be generated by a variety of methods, including manual creation and dynamic learning.

Configuring static remote-MAC address entries

Restrictions and guidelines

Do not configure static remote-MAC entries for VXLAN tunnels that are automatically established by using EVPN.

· EVPN re-establishes VXLAN tunnels if the transport-facing interface goes down and then comes up. If you have configured static remote-MAC entries, the entries are deleted when the tunnels are re-established.

· EVPN re-establishes VXLAN tunnels if you perform configuration rollback. If the tunnel IDs change during tunnel re-establishment, configuration rollback fails, and static remote-MAC entries on the tunnels cannot be restored.

For more information about EVPN, see EVPN Configuration Guide.

Procedure

1. Enter system view.

system-view

2. Add a static remote-MAC address entry.

mac-address static mac-address interface tunnel tunnel-number vsi vsi-name

For the setting to take effect, make sure the VSI's VXLAN has been created and specified on the VXLAN tunnel.

Disabling remote-MAC address learning

About disabling remote-MAC address learning

When network attacks occur, disable remote-MAC address learning to prevent the device from learning incorrect remote MAC addresses. You can manually add static remote-MAC address entries.

Procedure

1. Enter system view.

system-view

2. Disable remote-MAC address learning.

vxlan tunnel mac-learning disable

By default, remote-MAC address learning is enabled.

Configuring a multicast-mode VXLAN

About multicast methods for multicast-mode VXLANs

A multicast-mode VXLAN supports the following multicast methods:

· PIM—VTEPs and transport network devices run PIM to generate multicast forwarding entries. To forward multicast traffic correctly, you must use the source IP address of an up VXLAN tunnel as the source IP address of multicast VXLAN packets. As a best practice, use the source IP address of a VXLAN tunnel that uses the IP address of a loopback interface. If the VTEP has multiple transport-facing interfaces, PIM dynamically selects the outgoing interfaces for multicast VXLAN packets.

· IGMP host—VTEPs and transport network devices run PIM and IGMP to generate multicast forwarding entries.

? Transport-facing interfaces of VTEPs act as IGMP hosts.

? Transport network devices connected to a VTEP run IGMP.

? All transport network devices run PIM.

On a VTEP, you must use the IP address of the transport-facing interface as the source IP address for multicast VXLAN packets. If the VTEP has multiple transport-facing interfaces, multicast VXLAN packets are sent to the transport network through the interface that provides the source IP address for multicast VXLAN packets.

VTEPs in a multicast-mode VXLAN can use different multicast methods.

Prerequisites for multicast-mode VXLANs

For a multicast-mode VXLAN to flood traffic, you must perform the following tasks in addition to multicast-mode configuration:

· Enable IP multicast routing on all VTEPs and transport network devices.

· Configure a multicast routing protocol on transport network devices.

· Enable IGMP on transport network devices that are connected to an IGMP host-enabled VTEP.

Configuring a multicast-mode VXLAN that uses the PIM method

1. Enter system view.

system-view

2. Enter VSI view.

vsi vsi-name

3. Enter VXLAN view.

vxlan vxlan-id

4. Assign a multicast group address for flood traffic, and specify a source IP address for multicast VXLAN packets.

group group-address source source-address

By default, a VXLAN uses unicast mode for flood traffic. No multicast group address or source IP address is specified for multicast VXLAN packets.

You must assign all VTEPs in a multicast-mode VXLAN to the same multicast group.

5. Enter interface view.

interface interface-type interface-number

Enable PIM on the loopback interface and all transport-facing interfaces.

6. Enable PIM. Choose one of the following modes:

? Enable PIM-SM

pim sm

? Enable PIM-DM

pim dm

By default, PIM is disabled on an interface.

Configuring a multicast-mode VXLAN that uses the IGMP host method

1. Enter system view.

system-view

2. Enter VSI view.

vsi vsi-name

3. Enter VXLAN view.

vxlan vxlan-id

4. Assign a multicast group address for flood traffic, and specify a source IP address for multicast VXLAN packets.

group group-address source source-address

By default, a VXLAN uses unicast mode for flood traffic. No multicast group address or source IP address is specified for multicast VXLAN packets.

You must assign all VTEPs in a multicast-mode VXLAN to the same multicast group.

5. Enter the view of the transport-facing interface.

interface interface-type interface-number

6. Enable the IGMP host feature.

igmp host enable

By default, the IGMP host feature is disabled on an interface.

The IGMP host feature enables the interface to send IGMP reports in response to IGMP queries before it can receive traffic from the multicast group.

Setting the destination UDP port number of VXLAN packets

1. Enter system view.

system-view

2. Set a destination UDP port for VXLAN packets.

vxlan udp-port port-number

By default, the destination UDP port number is 4789 for VXLAN packets.

You must configure the same destination UDP port number on all VTEPs in a VXLAN.

Configuring VXLAN packet check

About VXLAN packet check

The device checks the inner Ethernet header of each VXLAN packet for 802.1Q VLAN tags. If the header contains 802.1Q VLAN tags, the device drops the packet.

Restrictions and guidelines

If a remote VTEP uses the Ethernet access mode, its VXLAN packets might contain 802.1Q VLAN tags. To prevent the local VTEP from dropping the VXLAN packets, do not execute the vxlan invalid-vlan-tag discard command on the local VTEP.

The access mode is configurable by using the xconnect vsi command.

Procedure

1. Enter system view.

system-view

2. Enable the VTEP to drop VXLAN packets that have 802.1Q VLAN tags in the inner Ethernet header.

vxlan invalid-vlan-tag discard

By default, the VTEP does not check the inner Ethernet header for 802.1Q VLAN tags.

Confining floods to the local site

About flood confining to the local site

By default, the VTEP floods broadcast, unknown unicast, and unknown multicast frames received from the local site to the following interfaces in the frame's VXLAN:

· All site-facing interfaces except for the incoming interface.

· All VXLAN tunnel interfaces.

To confine flood traffic to the site-facing interfaces, disable flooding on the VSI bound to the VXLAN. The VSI will not flood the corresponding frames to VXLAN tunnel interfaces.

To exclude a remote MAC address from the flood suppression done by using this feature, enable selective flood for the MAC address. The VTEP will flood the frames destined for the MAC address to remote sites.

Restrictions and guidelines

Do not configure selective flood for an all-F MAC address, all-zero MAC address, or multicast MAC address.

Procedure

1. Enter system view.

system-view

2. Enter VSI view.

vsi vsi-name

3. Disable flooding for the VSI.

flooding disable all

By default, flooding is enabled for a VSI.

4. (Optional.) Enable selective flood for a MAC address.

selective-flooding mac-address mac-address

Enabling ARP flood suppression

Restrictions and guidelines

The aging timer is fixed at 25 minutes for ARP flood suppression entries. If the suppression table is full, the VTEP stops learning new entries. For the VTEP to learn new entries, you must wait for old entries to age out, or use the reset arp suppression vsi command to clear the table.

If the flooding disable command is configured, set the MAC aging timer to a higher value than the aging timer for ARP flood suppression entries on all VTEPs. This setting prevents the traffic blackhole that occurs when a MAC address entry ages out before its ARP flood suppression entry ages out. To set the MAC aging timer, use the mac-address timer command.

When remote ARP learning is disabled for VXLANs, the device does not use ARP flood suppression entries to respond to ARP requests received on VXLAN tunnels.

The subinterfaces of a Layer 3 interface AC do not support QinQ termination or ambiguous Dot1q termination if the VSI associated with that AC is configured with ARP flood suppression. For more information about QinQ termination and Dot1q termination, see VLAN termination in Layer 2—LAN Switching Configuration Guide.

Procedure

1. Enter system view.

system-view

2. Enter VSI view.

vsi vsi-name

3. Enable ARP flood suppression.

arp suppression enable

By default, ARP flood suppression is disabled.

Disabling remote ARP or ND learning for VXLANs

About disabling remote ARP or ND learning for VXLANs

By default, the device learns ARP or ND information of remote VMs from packets received on VXLAN tunnel interfaces. To conserve resources on the VTEPs in an SDN transport network, you can temporarily disable remote ARP or ND learning when the controller and VTEPs are synchronizing entries. After the entry synchronization is completed, enable remote ARP or ND learning.

Restrictions and guidelines

As a best practice, disable remote ARP learning for VXLANs only when the controller and VTEPs are synchronizing entries.

Procedure

1. Enter system view.

system-view

2. Disable remote ARP learning for VXLANs.

vxlan tunnel arp-learning disable

By default, remote ARP learning is enabled for VXLANs.

3. Disable remote ND learning for VXLANs.

vxlan tunnel nd-learning disable

By default, remote ND learning is enabled for VXLANs.

Enabling VXLAN packet statistics

Enabling packet statistics for an AC

Restrictions and guidelines

For the ac statistics enable command to take effect on a Layer 3 interface, you must map the Layer 3 interface to a VSI. When you modify the VSI mapping, the packet statistics of the interface are cleared.

For the statistics enable command to take effect on an Ethernet service instance, you must configure a frame match criterion for the Ethernet service instance and map it to a VSI. When you modify the frame match criterion or VSI mapping, the packet statistics of the instance are cleared.

Enabling packet statistics for a Layer 3 interface

Enabling packet statistics for an Ethernet service instance

1. Enter system view.

system-view

2. Enter interface view.

? Enter Layer 2 Ethernet interface view.

interface interface-type interface-number

? Enter Layer 2 aggregate interface view.

interface bridge-aggregation interface-number

3. Enter Ethernet service instance view.

service-instance instance-id

4. Enable packet statistics for the Ethernet service instance.

statistics enable

By default, the packet statistics feature is disabled for all Ethernet service instances.

Enabling packet statistics for VXLAN tunnels

About packet statistics of VXLAN tunnels

VXLAN tunnels can be manually or automatically created. You can enable packet statistics for VXLAN tunnels by using the following methods:

· In tunnel interface view, enable packet statistics for a manually created VXLAN tunnel.

· In system view, enable packet statistics globally for automatically created VXLAN tunnels.

· In VSI view, enable packet statistics for all VXLAN tunnels of a VSI.

If you enable packet statistics in tunnel interface view or system view, follow these guidelines:

· To display the packet statistics for VXLAN tunnels, use the display interface tunnel command in any view.

· To clear the packet statistics for VXLAN tunnels, use the reset counters interface tunnel command in user view.

If you enable packet statistics in VSI view, follow these guidelines:

· To display the packet statistics for VXLAN tunnels, use the display vxlan tunnel command in any view.

· To clear the packet statistics for VXLAN tunnels, use the reset l2vpn statistics tunnel command in user view.

Restrictions and guidelines

When the packet statistics feature is enabled for VXLAN tunnels, use the display vxlan tunnel vxlan-id vxlan-id tunnel tunnel-number command to view packet statistics of VXLAN tunnels. The VXLAN tunnel packet statistics output from the display interface tunnel command are inaccurate.

Enabling packet statistics for a manually created VXLAN tunnel

1. Enter system view.

system-view

2. Enter VXLAN tunnel interface view.

interface tunnel tunnel-number [ mode vxlan ]

3. Enable packet statistics for the tunnel.

statistics enable

By default, the packet statistics feature is disabled for manually created VXLAN tunnels.

Enabling packet statistics for automatically created VXLAN tunnels

1. Enter system view.

system-view

2. Enable packet statistics for automatically created VXLAN tunnels.

tunnel statistics vxlan auto

By default, the packet statistics feature is disabled for automatically created VXLAN tunnels.

This command enables the device to collect packet statistics for all VXLAN tunnels that are automatically created by EVPN. For more information about EVPN, see EVPN Configuration Guide.

Enable packet statistics for all VXLAN tunnels of a VSI

1. Enter system view.

system-view

2. Enter VSI view.

vsi vsi-name

3. Enable packet statistics for all VXLAN tunnels associated with the VSI.

tunnel statistics enable

By default, the packet statistics feature is disabled for the VXLAN tunnels associated with a VSI.

This command enables packet statistics only for VXLAN tunnels. It does not take effect on VXLAN-DCI tunnels.

Setting the VXLAN statistics collection interval

Restrictions and guidelines

As a best practice, set the VXLAN statistics collection interval to a value smaller than 3600 seconds (1 hour).

Procedure

1. Enter system view.

system-view

2. Set the VXLAN statistics collection interval.

l2vpn statistics interval interval

By default, the VXLAN statistics collection interval is 15 minutes.

Display and maintenance commands for VXLANs

Execute display commands in any view and reset commands in user view.

Task	Command
Display ARP flood suppression entries on VSIs.	In standalone mode: display arp suppression vsi [ name vsi-name ] [ slot slot-number ] [ count ] In IRF mode: display arp suppression vsi [ name vsi-name ] [ chassis chassis-number slot slot-number ] [ count ]
Display L2VPN information for Layer 3 interfaces that are mapped to VSIs.	display l2vpn interface [ vsi vsi-name \| interface-type interface-number ] [ verbose ]
Display L2VPN MAC address entries.	display l2vpn mac-address [ interface interface-type interface-number [ service-instance instance-id ] \| vsi vsi-name [ ac ] ] [ dynamic ] [ count ]
Display information about Ethernet service instances.	display l2vpn service-instance [ interface interface-type interface-number [ service-instance instance-id ] ] [ verbose ]
Display information about VSIs.	display l2vpn vsi [ name vsi-name ] [ verbose ]
Display information about the multicast groups that contain IGMP host-enabled interfaces.	display igmp host group [ group-address \| interface interface-type interface-number ] [ verbose ]
Display information about tunnel interfaces.	display interface [ tunnel [ number ] ] [ brief [ description \| down ] ]
Display VXLAN tunnel information for VXLANs.	display vxlan tunnel [ vxlan vxlan-id [ tunnel tunnel-number ] ]
Clear ARP flood suppression entries on VSIs.	reset arp suppression vsi [ name vsi-name ]
Clear dynamic MAC address entries on VSIs.	reset l2vpn mac-address [ vsi vsi-name ]
Clear packet statistics on VXLAN tunnel interfaces.	reset l2vpn statistics tunnel [ vsi vsi-name ]
Clear packet statistics on ACs.	reset l2vpn statistics ac [ interface interface-type interface-number [ service-instance instance-id ] ]

NOTE:

For more information about the display interface tunnel command, see tunneling commands in Layer 3—IP Services Command Reference.

VXLAN configuration examples

Example: Configuring a unicast-mode VXLAN

Network configuration

As shown in Figure 9:

· Configure VXLAN 10 as a unicast-mode VXLAN on Device A, Device B, and Device C to provide Layer 2 connectivity for the VMs across the network sites.

· Manually establish VXLAN tunnels and assign the tunnels to VXLAN 10.

· Enable remote-MAC address learning.

Figure 9 Network diagram

‌

Procedure

1. Configure IP addresses and unicast routing settings:

# Assign IP addresses to interfaces, as shown in Figure 9. (Details not shown.)

# Configure OSPF on all transport network devices (Devices A through D). (Details not shown.)

2. Configure Device A:

# Enable L2VPN.

<DeviceA> system-view

[DeviceA] l2vpn enable

# Create VSI vpna and VXLAN 10.

[DeviceA] vsi vpna

[DeviceA-vsi-vpna] vxlan 10

[DeviceA-vsi-vpna-vxlan-10] quit

[DeviceA-vsi-vpna] quit

# Assign an IP address to Loopback 0. The IP address will be used as the source IP address of the VXLAN tunnels to Device B and Device C.

[DeviceA] interface loopback 0

[DeviceA-Loopback0] ip address 1.1.1.1 255.255.255.255

[DeviceA-Loopback0] quit

# Create a VXLAN tunnel to Device B. The tunnel interface name is Tunnel 1.

[DeviceA] interface tunnel 1 mode vxlan

[DeviceA-Tunnel1] source 1.1.1.1

[DeviceA-Tunnel1] destination 2.2.2.2

[DeviceA-Tunnel1] quit

# Create a VXLAN tunnel to Device C. The tunnel interface name is Tunnel 2.

[DeviceA] interface tunnel 2 mode vxlan

[DeviceA-Tunnel2] source 1.1.1.1

[DeviceA-Tunnel2] destination 3.3.3.3

[DeviceA-Tunnel2] quit

# Assign Tunnel 1 and Tunnel 2 to VXLAN 10.

[DeviceA] vsi vpna

[DeviceA-vsi-vpna] vxlan 10

[DeviceA-vsi-vpna-vxlan-10] tunnel 1

[DeviceA-vsi-vpna-vxlan-10] tunnel 2

[DeviceA-vsi-vpna-vxlan-10] quit

[DeviceA-vsi-vpna] quit

# Map GigabitEthernet 3/1/1 to VSI vpna.

[DeviceA] interface gigabitethernet 3/1/1

[DeviceA-GigabitEthernet3/1/1] xconnect vsi vpna

[DeviceA-GigabitEthernet3/1/1] quit

3. Configure Device B:

# Enable L2VPN.

<DeviceB> system-view

[DeviceB] l2vpn enable

# Create VSI vpna and VXLAN 10.

[DeviceB] vsi vpna

[DeviceB-vsi-vpna] vxlan 10

[DeviceB-vsi-vpna-vxlan-10] quit

[DeviceB-vsi-vpna] quit

# Assign an IP address to Loopback 0. The IP address will be used as the source IP address of the VXLAN tunnels to Device A and Device C.

[DeviceB] interface loopback 0

[DeviceB-Loopback0] ip address 2.2.2.2 255.255.255.255

[DeviceB-Loopback0] quit

# Create a VXLAN tunnel to Device A. The tunnel interface name is Tunnel 2.

[DeviceB] interface tunnel 2 mode vxlan

[DeviceB-Tunnel2] source 2.2.2.2

[DeviceB-Tunnel2] destination 1.1.1.1

[DeviceB-Tunnel2] quit

# Create a VXLAN tunnel to Device C. The tunnel interface name is Tunnel 3.

[DeviceB] interface tunnel 3 mode vxlan

[DeviceB-Tunnel3] source 2.2.2.2

[DeviceB-Tunnel3] destination 3.3.3.3

[DeviceB-Tunnel3] quit

# Assign Tunnel 2 and Tunnel 3 to VXLAN 10.

[DeviceB] vsi vpna

[DeviceB-vsi-vpna] vxlan 10

[DeviceB-vsi-vpna-vxlan-10] tunnel 2

[DeviceB-vsi-vpna-vxlan-10] tunnel 3

[DeviceB-vsi-vpna-vxlan-10] quit

[DeviceB-vsi-vpna] quit

# Map GigabitEthernet 3/1/1 to VSI vpna.

[DeviceB] interface gigabitethernet 3/1/1

[DeviceB-GigabitEthernet3/1/1] xconnect vsi vpna

[DeviceB-GigabitEthernet3/1/1] quit

4. Configure Device C:

# Enable L2VPN.

<DeviceC> system-view

[DeviceC] l2vpn enable

# Create VSI vpna and VXLAN 10.

[DeviceC] vsi vpna

[DeviceC-vsi-vpna] vxlan 10

[DeviceC-vsi-vpna-vxlan-10] quit

[DeviceC-vsi-vpna] quit

# Assign an IP address to Loopback 0. The IP address will be used as the source IP address of the VXLAN tunnels to Device A and Device B.

[DeviceC] interface loopback 0

[DeviceC-Loopback0] ip address 3.3.3.3 255.255.255.255

[DeviceC-Loopback0] quit

# Create a VXLAN tunnel to Device A. The tunnel interface name is Tunnel 1.

[DeviceC] interface tunnel 1 mode vxlan

[DeviceC-Tunnel1] source 3.3.3.3

[DeviceC-Tunnel1] destination 1.1.1.1

[DeviceC-Tunnel1] quit

# Create a VXLAN tunnel to Device B. The tunnel interface name is Tunnel 3.

[DeviceC] interface tunnel 3 mode vxlan

[DeviceC-Tunnel3] source 3.3.3.3

[DeviceC-Tunnel3] destination 2.2.2.2

[DeviceC-Tunnel3] quit

# Assign Tunnel 1 and Tunnel 3 to VXLAN 10.

[DeviceC] vsi vpna

[DeviceC-vsi-vpna] vxlan 10

[DeviceC-vsi-vpna-vxlan-10] tunnel 1

[DeviceC-vsi-vpna-vxlan-10] tunnel 3

[DeviceC-vsi-vpna-vxlan-10] quit

[DeviceC-vsi-vpna] quit

# Map GigabitEthernet 3/1/1 to VSI vpna.

[DeviceC] interface gigabitethernet 3/1/1

[DeviceC-GigabitEthernet3/1/1] xconnect vsi vpna

[DeviceC-GigabitEthernet3/1/1] quit

Verifying the configuration

1. Verify the VXLAN settings on the VTEPs. This example uses Device A.

# Verify that the VXLAN tunnel interfaces on the VTEP are up.

[DeviceA] display interface tunnel 1

Tunnel1

Current state: UP

Line protocol state: UP

...

# Verify that the VXLAN tunnels have been assigned to the VXLAN.

[DeviceA] display l2vpn vsi verbose

VSI Name: vpna

VSI Index : 0

VSI State : Up

MTU : 1500

Bandwidth : Unlimited

Broadcast Restrain : 5120 kbps

Multicast Restrain : 5120 kbps

Unknown Unicast Restrain: 5120 kbps

MAC Learning : Enabled

MAC Table Limit : Unlimited

MAC Learning rate : -

Drop Unknown : -

Flooding : Enabled

VXLAN ID : 10

Tunnel Statistics : Disabled

Tunnels:

Tunnel Name Link ID State Type Flood Proxy

Tunnel1 0x5000001 Up Manual Disabled

Tunnel2 0x5000002 Up Manual Disabled

ACs:

AC Link ID State

GE3/1/1 0 Up

# Verify that the VTEP has learned the MAC addresses of remote VMs.

<DeviceA> display l2vpn mac-address

MAC Address State VSI Name Link ID/Name Aging

cc3e-5f9c-6cdb Dynamic vpna Tunnel1 Aging

cc3e-5f9c-23dc Dynamic vpna Tunnel2 Aging

--- 2 mac address(es) found ---

2. Verify that VM 1, VM 2, and VM 3 can ping each other. (Details not shown.)

Example: Configuring a multicast-mode VXLAN

Network configuration

As shown in Figure 10:

· Configure VXLAN 10 as a multicast-mode VXLAN on Device A, Device B, and Device C to provide Layer 2 connectivity for the VMs across the network sites.

· Manually establish VXLAN tunnels and assign the tunnels to VXLAN 10.

· Enable remote-MAC address learning.

Figure 10 Network diagram

‌

Table 1 IP address assignment

Device	Interface	IP address	Device	Interface	IP address
Device A:			Device C:
	GigabitEthernet 3/1/2	11.1.1.1/24		GigabitEthernet 3/1/2	13.1.1.3/24
Device D:			Device E:
	GigabitEthernet 3/1/1	11.1.1.4/24		GigabitEthernet 3/1/1	13.1.1.5/24
	GigabitEthernet 3/1/2	21.1.1.4/24		GigabitEthernet 3/1/2	23.1.1.5/24
Device F:			Device G:
	GigabitEthernet 3/1/1	21.1.1.6/24		GigabitEthernet 3/1/1	22.1.1.7/24
	GigabitEthernet 3/1/2	23.1.1.6/24		GigabitEthernet 3/1/2	12.1.1.7/24
	GigabitEthernet 3/1/3	22.1.1.6/24	Device B:
	Loop 0	6.6.6.6/32		GigabitEthernet 3/1/2	12.1.1.2/24

Procedure

1. Configure IP addresses and unicast routing settings:

# Assign IP addresses to interfaces, as shown in Figure 10. (Details not shown.)

# Configure OSPF on all transport network devices (Devices A through G). (Details not shown.)

2. Configure Device A:

# Enable L2VPN.

<DeviceA> system-view

[DeviceA] l2vpn enable

# Enable IP multicast routing.

[DeviceA] multicast routing

[DeviceA-mrib] quit

# Create VSI vpna and VXLAN 10.

[DeviceA] vsi vpna

[DeviceA-vsi-vpna] vxlan 10

[DeviceA-vsi-vpna-vxlan-10] quit

[DeviceA-vsi-vpna] quit

# Assign an IP address to GigabitEthernet 3/1/2, and enable the IGMP host feature on the interface. This interface's IP address will be the source IP address of VXLAN packets sent by the VTEP.

[DeviceA] interface gigabitethernet 3/1/2

[DeviceA-GigabitEthernet3/1/2] ip address 11.1.1.1 24

[DeviceA-GigabitEthernet3/1/2] igmp host enable

[DeviceA-GigabitEthernet3/1/2] quit

# Create a VXLAN tunnel to Device B. The tunnel interface name is Tunnel 1.

[DeviceA] interface tunnel 1 mode vxlan

[DeviceA-Tunnel1] source 11.1.1.1

[DeviceA-Tunnel1] destination 12.1.1.2

[DeviceA-Tunnel1] quit

# Create a VXLAN tunnel to Device C. The tunnel interface name is Tunnel 2.

[DeviceA] interface tunnel 2 mode vxlan

[DeviceA-Tunnel2] source 11.1.1.1

[DeviceA-Tunnel2] destination 13.1.1.3

[DeviceA-Tunnel2] quit

# Assign Tunnel 1 and Tunnel 2 to VXLAN 10.

[DeviceA] vsi vpna

[DeviceA-vsi-vpna] vxlan 10

[DeviceA-vsi-vpna-vxlan-10] tunnel 1

[DeviceA-vsi-vpna-vxlan-10] tunnel 2

# Configure the multicast group address and source IP address for multicast VXLAN packets.

[DeviceA-vsi-vpna-vxlan-10] group 225.1.1.1 source 11.1.1.1

[DeviceA-vsi-vpna-vxlan-10] quit

[DeviceA-vsi-vpna] quit

# Map GigabitEthernet 3/1/1 to VSI vpna.

[DeviceA] interface gigabitethernet 3/1/1

[DeviceA-GigabitEthernet3/1/1] xconnect vsi vpna

[DeviceA-GigabitEthernet3/1/1] quit

3. Configure Device B:

# Enable L2VPN.

<DeviceB> system-view

[DeviceB] l2vpn enable

# Enable IP multicast routing.

[DeviceB] multicast routing

[DeviceB-mrib] quit

# Create VSI vpna and VXLAN 10.

[DeviceB] vsi vpna

[DeviceB-vsi-vpna] vxlan 10

[DeviceB-vsi-vpna-vxlan-10] quit

[DeviceB-vsi-vpna] quit

# Assign an IP address to GigabitEthernet 3/1/2, and enable the IGMP host feature on the interface. This interface's IP address will be the source IP address of VXLAN packets sent by the VTEP.

[DeviceB] interface gigabitethernet 3/1/2

[DeviceB-GigabitEthernet3/1/2] ip address 12.1.1.2 24

[DeviceB-GigabitEthernet3/1/2] igmp host enable

[DeviceB-GigabitEthernet3/1/2] quit

# Create a VXLAN tunnel to Device A. The tunnel interface name is Tunnel 2.

[DeviceB] interface tunnel 2 mode vxlan

[DeviceB-Tunnel2] source 12.1.1.2

[DeviceB-Tunnel2] destination 11.1.1.1

[DeviceB-Tunnel2] quit

# Create a VXLAN tunnel to Device C. The tunnel interface name is Tunnel 3.

[DeviceB] interface tunnel 3 mode vxlan

[DeviceB-Tunnel3] source 12.1.1.2

[DeviceB-Tunnel3] destination 13.1.1.3

[DeviceB-Tunnel3] quit

# Assign Tunnel 2 and Tunnel 3 to VXLAN 10.

[DeviceB] vsi vpna

[DeviceB-vsi-vpna] vxlan 10

[DeviceB-vsi-vpna-vxlan-10] tunnel 2

[DeviceB-vsi-vpna-vxlan-10] tunnel 3

# Configure the VXLAN multicast group address and the source IP address for VXLAN packets.

[DeviceB-vsi-vpna-vxlan-10] group 225.1.1.1 source 12.1.1.2

[DeviceB-vsi-vpna-vxlan-10] quit

[DeviceB-vsi-vpna] quit

# Map GigabitEthernet 3/1/1 to VSI vpna.

[DeviceB] interface gigabitethernet 3/1/1

[DeviceB-GigabitEthernet3/1/1] xconnect vsi vpna

[DeviceB-GigabitEthernet3/1/1] quit

4. Configure Device C:

# Enable L2VPN.

<DeviceC> system-view

[DeviceC] l2vpn enable

# Enable IP multicast routing.

[DeviceC] multicast routing

[DeviceC-mrib] quit

# Create VSI vpna and VXLAN 10.

[DeviceC] vsi vpna

[DeviceC-vsi-vpna] vxlan 10

[DeviceC-vsi-vpna-vxlan-10] quit

[DeviceC-vsi-vpna] quit

# Assign an IP address to GigabitEthernet 3/1/2, and enable the IGMP host feature on the interface. This interface's IP address will be the source IP address of VXLAN packets sent by the VTEP.

[DeviceC] interface gigabitethernet 3/1/2

[DeviceC-GigabitEthernet3/1/2] ip address 13.1.1.3 24

[DeviceC-GigabitEthernet3/1/2] igmp host enable

[DeviceC-GigabitEthernet3/1/2] quit

# Create a VXLAN tunnel to Device A. The tunnel interface name is Tunnel 1.

[DeviceC] interface tunnel 1 mode vxlan

[DeviceC-Tunnel1] source 13.1.1.3

[DeviceC-Tunnel1] destination 11.1.1.1

[DeviceC-Tunnel1] quit

# Create a VXLAN tunnel to Device B. The tunnel interface name is Tunnel 3.

[DeviceC] interface tunnel 3 mode vxlan

[DeviceC-Tunnel3] source 13.1.1.3

[DeviceC-Tunnel3] destination 12.1.1.2

[DeviceC-Tunnel3] quit

# Assign Tunnel 1 and Tunnel 3 to VXLAN 10.

[DeviceC] vsi vpna

[DeviceC-vsi-vpna] vxlan 10

[DeviceC-vsi-vpna-vxlan-10] tunnel 1

[DeviceC-vsi-vpna-vxlan-10] tunnel 3

# Configure the multicast group address and source IP address for VXLAN multicast packets.

[DeviceC-vsi-vpna-vxlan-10] group 225.1.1.1 source 13.1.1.3

[DeviceC-vsi-vpna-vxlan-10] quit

[DeviceC-vsi-vpna] quit

# Map GigabitEthernet 3/1/1 to VSI vpna.

[DeviceC] interface gigabitethernet 3/1/1

[DeviceC-GigabitEthernet3/1/1] xconnect vsi vpna

[DeviceC-GigabitEthernet3/1/1] quit

5. Configure Device D:

# Enable IP multicast routing.

<DeviceD> system-view

[DeviceD] multicast routing

[DeviceD-mrib] quit

# Enable IGMP and PIM-SM on GigabitEthernet 3/1/1.

[DeviceD] interface gigabitethernet 3/1/1

[DeviceD-GigabitEthernet3/1/1] igmp enable

[DeviceD-GigabitEthernet3/1/1] pim sm

[DeviceD-GigabitEthernet3/1/1] quit

# Enable PIM-SM on GigabitEthernet 3/1/2.

[DeviceD] interface gigabitethernet 3/1/2

[DeviceD-GigabitEthernet3/1/2] pim sm

[DeviceD-GigabitEthernet3/1/2] quit

6. Configure Device E:

# Enable IP multicast routing.

<DeviceE> system-view

[DeviceE] multicast routing

[DeviceE-mrib] quit

# Enable IGMP and PIM-SM on GigabitEthernet 3/1/1.

[DeviceE] interface gigabitethernet 3/1/1

[DeviceE-GigabitEthernet3/1/1] igmp enable

[DeviceE-GigabitEthernet3/1/1] pim sm

[DeviceE-GigabitEthernet3/1/1] quit

# Enable PIM-SM on GigabitEthernet 3/1/2.

[DeviceE] interface gigabitethernet 3/1/2

[DeviceE-GigabitEthernet3/1/2] pim sm

[DeviceE-GigabitEthernet3/1/2] quit

7. Configure Device F:

# Enable IP multicast routing.

<DeviceF> system-view

[DeviceF] multicast routing

[DeviceF-mrib] quit

# Enable PIM-SM on GigabitEthernet 3/1/1, GigabitEthernet 3/1/2, GigabitEthernet 3/1/3, and Loopback 0.

[DeviceF] interface gigabitethernet 3/1/1

[DeviceF-GigabitEthernet3/1/1] pim sm

[DeviceF-GigabitEthernet3/1/1] quit

[DeviceF] interface gigabitethernet 3/1/2

[DeviceF-GigabitEthernet3/1/2] pim sm

[DeviceF-GigabitEthernet3/1/2] quit

[DeviceF] interface gigabitethernet 3/1/3

[DeviceF-GigabitEthernet3/1/3] pim sm

[DeviceF-GigabitEthernet3/1/3] quit

[DeviceF] interface loopback 0

[DeviceF-LoopBack0] pim sm

[DeviceF-LoopBack0] quit

8. Configure Device G:

# Enable IP multicast routing.

<DeviceG> system-view

[DeviceG] multicast routing

[DeviceG-mrib] quit

# Enable IGMP and PIM-SM on GigabitEthernet 3/1/2.

[DeviceG] interface gigabitethernet 3/1/2

[DeviceG-GigabitEthernet3/1/2] igmp enable

[DeviceG-GigabitEthernet3/1/2] pim sm

[DeviceG-GigabitEthernet3/1/2] quit

# Enable PIM-SM on GigabitEthernet 3/1/1.

[DeviceG] interface gigabitethernet 3/1/1

[DeviceG-GigabitEthernet3/1/1] pim sm

[DeviceG-GigabitEthernet3/1/1] quit

Verifying the configuration

1. Verify the VXLAN settings on the VTEPs. This example uses Device A.

# Verify that the VXLAN tunnel interfaces on the VTEP are up.

[DeviceA] display interface tunnel 1

Tunnel1

Current state: UP

Line protocol state: UP

...

# Verify that the VXLAN tunnels have been assigned to the VXLAN.

[DeviceA] display l2vpn vsi verbose

VSI Name: vpna

VSI Index : 0

VSI State : Up

MTU : 1500

Bandwidth : Unlimited

Broadcast Restrain : 5120 kbps

Multicast Restrain : 5120 kbps

Unknown Unicast Restrain: 5120 kbps

MAC Learning : Enabled

MAC Table Limit : Unlimited

MAC Learning rate : -

Drop Unknown : -

Flooding : Enabled

VXLAN ID : 10

Tunnel Statistics : Disabled

Tunnels:

Tunnel Name Link ID State Type Flood Proxy

Tunnel1 0x5000001 Up Manual Disabled

Tunnel2 0x5000002 Up Manual Disabled

MTunnel0 0x6000000 Up Auto Disabled

ACs:

AC Link ID State

GE3/1/1 0 Up

# Verify that the VTEP has learned the MAC addresses of remote VMs.

<DeviceA> display l2vpn mac-address

MAC Address State VSI Name Link ID/Name Aging

cc3e-5f9c-6cdb Dynamic vpna Tunnel1 Aging

cc3e-5f9c-23dc Dynamic vpna Tunnel2 Aging

--- 2 mac address(es) found ---

# Verify that the VTEP has joined the VXLAN multicast group on GigabitEthernet 3/1/2.

<DeviceA> display igmp host group

IGMP host groups in total: 1

GigabitEthernet3/1/2(11.1.1.1):

IGMP host groups in total: 1

Group address Member state Expires

225.1.1.1 Idle Off

2. Verify that VM 1, VM 2, and VM 3 can ping each other. (Details not shown.)

Configuring VXLAN IP gateways

About VXLAN IP gateways

The following are available IP gateway placement designs for VXLANs:

· VXLAN IP gateways separated from VTEPs—Use a VXLAN-unaware device as a gateway to the external network for VXLANs. On the gateway, you do not need to configure VXLAN settings.

· VXLAN IP gateways collocated with VTEPs—Include the following placement designs:

? Centralized VXLAN IP gateway deployment—Use one VTEP to provide Layer 3 forwarding for VXLANs. Typically, the gateway-collocated VTEP connects to other VTEPs and the external network. To use this design, make sure the IP gateway has sufficient bandwidth and processing capability. Centralized VXLAN IP gateways provide services only for IPv4 networks.

? Centralized VXLAN gateway group deployment—Use one VTEP group that contains redundant centralized VXLAN IP gateways to provide reliable gateway services for VXLANs.

? Distributed VXLAN IP gateway deployment—Deploy one VXLAN IP gateway on each VTEP to provide Layer 3 forwarding for VXLANs at their respective sites. This design distributes the Layer 3 traffic load across VTEPs. However, its configuration is more complex than the centralized VXLAN IP gateway design. Distributed gateways can provide services for both IPv4 and IPv6 networks.

In a collocation design, the VTEPs use virtual Layer 3 VSI interfaces as gateway interfaces to provide services for VXLANs.

VXLAN IP gateways separated from VTEPs

As shown in Figure 11, an independent VXLAN IP gateway connects a Layer 3 network to a VTEP. VMs send Layer 3 traffic in Layer 2 frames to the gateway through VXLAN tunnels. When the tunneled VXLAN packets arrive, the VTEP terminates the VXLANs and forwards the inner frames to the gateway. In this gateway placement design, the VTEP does not perform Layer 3 forwarding for VXLANs.

Figure 11 VXLAN IP gateway separated from VTEPs

Centralized VXLAN IP gateway deployment

As shown in Figure 12, a VTEP acts as a gateway for VMs in the VXLANs. The VTEP both terminates the VXLANs and performs Layer 3 forwarding for the VMs.

Figure 12 Centralized VXLAN IP gateway placement design

As shown in Figure 13, the network uses the following process to forward Layer 3 traffic from VM 10.1.1.11 to the Layer 3 network:

1. The VM sends an ARP request to obtain the MAC address of the gateway (VTEP 3) at 10.1.1.1.

2. VTEP 1 floods the ARP request to all remote VTEPs.

3. VTEP 3 de-encapsulates the ARP request, creates an ARP entry for the VM, and sends an ARP reply to the VM.

4. VTEP 1 forwards the ARP reply to the VM.

5. The VM learns the MAC address of the gateway, and sends the Layer 3 traffic to the gateway.

6. VTEP 3 removes the VXLAN encapsulation and inner Ethernet header for the traffic, and forwards the traffic to the destination node.

Inter-VXLAN forwarding is the same as this process except for the last step. At the last step of inter-VLAN forwarding, the gateway replaces the source-VXLAN encapsulation with the destination-VXLAN encapsulation, and then forwards the traffic.

Figure 13 Example of centralized VXLAN IP gateway deployment

Centralized VXLAN gateway group deployment

As shown in Figure 14, a VTEP group uses redundant centralized VXLAN IP gateways to provide reliable gateway services for VMs in the VXLANs. All member VTEPs in the group participate in Layer 3 forwarding and load share traffic between the Layer 3 network and the VXLANs. This design distributes processing among multiple VTEPs and prevents single points of failure.

Figure 14 Example of centralized VXLAN IP gateway group deployment

The VTEP group is a virtual gateway that provides services at a group IP address. Access layer VTEPs set up VXLAN tunnels to the group IP address for data traffic forwarding. Each VTEP in the group automatically uses its member IP address to set up tunnels to the other member VTEPs and access layer VTEPs. The tunnels are used to transmit protocol packets and synchronize ARP entries.

Distributed VXLAN IP gateway deployment

About distributed VXLAN IP gateway deployment

As shown in Figure 15, each site's VTEP acts as a gateway to perform Layer 3 forwarding for the VXLANs of the local site. A VTEP acts as a border gateway to the Layer 3 network for the VXLANs. The VTEPs perform Layer 3 forwarding based on ARP or ND entries. The ARP or ND entries are dynamically learned.

IMPORTANT:

The site-connected gateways are called distributed gateways. On the distributed gateways, you must enable local proxy ARP (for IPv4 sites) or local ND proxy (for IPv6 sites).

Figure 15 Distributed VXLAN IP gateway placement design

Figure 16 shows an example of distributed VXLAN IP gateway deployment. This section uses this figure to describe the forwarding processes for intra-VXLAN traffic, inter-VXLAN traffic, and traffic from a VXLAN to an external network. In these processes, VTEPs use dynamically learned ARP entries.

Figure 16 Example of distributed VXLAN IP gateway deployment

Intra-VXLAN traffic forwarding between sites

As shown in Figure 16, the network uses the following process to forward traffic in a VXLAN between sites (for example, from VM 1 to VM 4 in VXLAN 10):

1. VM 1 sends an ARP request to obtain the MAC address of VM 4.

2. GW 1 performs the following operations:

a. Creates an ARP entry for VM 1 and replies with the MAC address of VSI-interface 10 (the gateway interface for VXLAN 10).

b. Replaces the sender MAC address of the ARP request with the MAC address of VSI-interface 10, and then floods the request to all remote VTEPs.

3. VM 1 creates an ARP entry for VM 4. The MAC address in the entry is the MAC address of VSI-interface 10 on GW 1.

4. GW 2 (the VTEP for VM 4) performs the following operations:

a. De-encapsulates the ARP request and creates an ARP entry for VM 1. The entry contains VM 1's IP address (10.1.1.11), the MAC address of VSI-interface 10 on GW 1, and the incoming tunnel interface.

b. Replaces the sender MAC address of the request with the MAC address of VSI-interface 10 on GW 2, and then floods the request to the local site in VXLAN 10.

5. VM 4 creates an ARP entry for VM 1, and then sends a reply to GW 2. The MAC address in the ARP entry is the MAC address of VSI-interface 10 on GW 2.

6. GW 2 performs the following operations:

a. Creates an ARP entry for VM 4.

b. Replaces the sender MAC address of the request with the MAC address of VSI-interface 10 on GW 2, and sends the reply to GW 1.

7. GW 1 de-encapsulates the ARP request and creates an ARP entry for VM 4. The entry contains VM 4's IP address (10.1.1.12), the MAC address of VSI-interface 10 on GW 2, and the incoming tunnel interface.

8. For subsequent traffic between VM 1 and VM 4, GW 1 and GW 2 use their respective ARP tables to make the forwarding decision.

Inter-VXLAN traffic forwarding between sites

As shown in Figure 16, the network uses the following process to forward traffic between VXLANs (for example, from VM 1 in VXLAN 10 to VM 5 in VXLAN 20):

1. VM 1 sends an ARP request to obtain the MAC address of the gateway at 10.1.1.1.

2. GW 1 creates an ARP entry for VM 1 and replies with the MAC address of VSI-interface 10 (the gateway interface for VXLAN 10).

3. VM 1 sends the packet destined for VM 5 to GW 1.

4. GW 1 sends an ARP request to the local site and remote sites to obtain the MAC address of VM 5. In the ARP request, the sender IP address is 20.1.1.1, and the sender MAC address is the MAC address of VSI-interface 20 on GW 1.

5. GW 2 performs the following operations:

a. De-encapsulates the ARP request and creates an ARP entry for GW 1. The entry contains IP address 20.1.1.1 and MAC address of VSI-interface 20 on GW 1, and the incoming tunnel interface.

b. Replaces the sender MAC address of the request with the MAC address of VSI-interface 20 on GW 2, and then floods the request to the local site in VXLAN 20.

6. VM 5 creates an ARP entry for GW 2, and then sends a reply to GW 2. The entry contains the IP address (20.1.1.1) and MAC address of VSI-interface 20 on GW 2).

7. GW 2 performs the following operations:

a. Creates an ARP entry for VM 5.

b. Replaces the sender MAC address in the request with the MAC address of VSI-interface 20 on GW 2, and then sends the reply to GW 1.

8. GW 1 de-encapsulates the ARP request and creates an ARP entry for VM 5. The entry contains VM 5's IP address 20.1.1.12, the MAC address of VSI-interface 20 on GW 2, and the incoming tunnel interface.

9. For subsequent traffic between VM 1 and VM 5, GW 1 and GW 2 use their respective ARP tables to make the forwarding decision.

VXLAN-to-external network traffic forwarding

As shown in Figure 16, the network uses the following process to forward traffic from a VXLAN to the Layer 3 network (for example, from VM 1 to the host at 50.1.1.1):

1. VM 1 sends an ARP request to obtain the MAC address of the gateway at 10.1.1.1.

2. GW 1 creates an ARP entry for VM 1 and replies with the MAC address of VSI-interface 10 (the gateway interface for VXLAN 10).

3. VM 1 sends a packet destined for the host to GW 1.

4. GW 1 performs the following operations:

a. Searches the IP routing policies or routing table for the next hop. In this example, the next hop for the packet is 10.1.1.2 (the border gateway).

b. Floods an ARP request to the local and remote sites in VXLAN 10 to obtain the MAC address of 10.1.1.2.

5. The border gateway de-encapsulates the ARP request, creates an ARP entry for GW 1, and tunnels a reply to GW 1.

6. GW 1 de-encapsulates the ARP reply and creates an ARP entry for 10.1.1.2.

7. GW 1 sends the packet destined for the host to the border gateway.

8. The border gateway de-encapsulates the packet and forwards it to the host.

Restrictions and guidelines: VXLAN IP gateway configuration

On a VXLAN IP gateway, ACs do not support Ethernet access mode.

The subinterfaces of a Layer 3 interface AC on a gateway do not support QinQ termination or ambiguous Dot1q termination if that gateway has the centralized VXLAN IP gateway group settings. For more information about QinQ termination and Dot1q termination, see VLAN termination in Layer 2—LAN Switching Configuration Guide.

VSI interfaces do not support Layer 3 multicast.

Do not configure both centralized VXLAN IP gateway settings and centralized VXLAN IP gateway group settings on a device.

As a best practice to avoid forwarding failure, set a large MTU on the traffic outgoing interfaces for VXLAN tunnels on VXLAN IP gateways.

QoS policies and PBR are supported only by VSI interfaces configured on the CSPEX (except CSPEX-1204 and CSPEX-1104-E) and CEPC cards. In addition, do not use the if-match command to configure the following match criteria for the QoS policies:

· Matches an ACL that contains the VPN instance criterion.

· Matches an authentication user or destination MAC address.

· Matches a Layer 2 ACL that contains the destination MAC address criterion.

Prerequisites for VXLAN IP gateway configuration

Before you configure a centralized or distributed VXLAN IP gateway, you must perform the following tasks on VTEPs:

· Create VSIs and VXLANs.

· Configure VXLAN tunnels and assign them to VXLANs.

Configuring a centralized VXLAN IP gateway

Restrictions and guidelines

Do not execute the local-proxy-arp enable command on a centralized VXLAN IP gateway.

Procedure

1. Enter system view.

system-view

2. Create a VSI interface and enter VSI interface view.

interface vsi-interface vsi-interface-id

3. Assign an IPv4 address to the VSI interface.

ip address ip-address { mask | mask-length }

By default, no IPv4 address is assigned to a VSI interface.

4. Return to system view.

quit

5. Enter VSI view.

vsi vsi-name

6. Specify a gateway interface for the VSI.

gateway vsi-interface vsi-interface-id

By default, no gateway interface is specified for a VSI.

Configuring a centralized VXLAN IP gateway group

Configuring a VTEP group

Restrictions and guidelines

Make sure the member VTEPs use the same VXLAN settings.

Procedure

1. Enter system view.

system-view

2. Create a VSI interface and enter VSI interface view.

interface vsi-interface vsi-interface-id

This interface will be used as the gateway interface for the VSI.

3. Assign an IP address to the VSI interface.

ip address ip-address { mask | mask-length }

By default, no IP address is assigned to a VSI interface.

You must assign the same IP address to the VSI interface on each VTEP in the VTEP group.

4. Assign a MAC address to the VSI interface.

mac-address mac-address

By default, the MAC address of VSI interfaces equals the bridge MAC address plus 2.

You must assign the same MAC address to the VSI interface on each VTEP in the VTEP group.

5. Return to system view.

quit

6. Enter VSI view.

vsi vsi-name

7. Specify the VSI interface as the gateway interface for the VSI.

gateway vsi-interface vsi-interface-id

By default, no gateway interface is specified for a VSI.

8. Return to system view.

quit

9. Assign the local VTEP to a VTEP group and specify a member IP address for the VTEP.

vtep group group-ip member local member-ip

By default, a VTEP is not assigned to any VTEP group.

The specified member IP address must already exist on the local VTEP and be unique in the VTEP group. You must configure a routing protocol to advertise the IP address to the transport network.

10. Specify the member IP address of all the other VTEPs in the VTEP group.

vtep group group-ip member remote member-ip&<1-8>

By default, the list of remote VTEPs is not configured.

Specifying a VTEP group as the gateway for an access layer VTEP

Prerequisites

Before you specify a VTEP group on an access layer VTEP, perform the following tasks on the VTEP:

· Configure VSIs and VXLANs.

· Set up VXLAN tunnels to remote sites and the VTEP group, and assign the tunnels to VXLANs.

Procedure

1. Enter system view.

system-view

2. Specify a VTEP group and all its member VTEPs.

vtep group group-ip member remote member-ip&<1-8>

By default, no VTEP group is specified.

Perform this task to specify all member VTEPs in the VTEP group.

Configuring a distributed VXLAN IP gateway

Restrictions and guidelines for distributed VXLAN IP gateway configuration

For a VXLAN that requires access to the external network, specify the VXLAN's VSI interface on the border gateway as the next hop by using one of the following methods:

· Configure a static route.

· Configure a routing policy, and apply the policy by using the apply default-next-hop command. For more information about configuring routing policies, see routing policy configuration in Layer 3—IP Routing Configuration Guide.

If both ARP flood suppression and local proxy ARP are enabled on a distributed VXLAN IP gateway, only local proxy ARP takes effect. As a best practice, do not use these features together on distributed VXLAN IP gateways. For more information about ARP flood suppression, see "Enabling ARP flood suppression."

Configuring a distributed VXLAN IP gateway interface

1. Enter system view.

system-view

2. Create a VSI interface and enter VSI interface view.

interface vsi-interface vsi-interface-id

3. Assign an IP address to the VSI interface.

IPv4:

ip address ip-address { mask | mask-length } [ sub ]

IPv6:

See IPv6 basics in Layer 3—IP Services Configuration Guide.

By default, no IP address is assigned to a VSI interface.

4. Specify the VSI interface as a distributed gateway.

distributed-gateway local

By default, a VSI interface is not a distributed gateway.

5. Enable local proxy ARP or local ND proxy.

IPv4:

local-proxy-arp enable [ ip-range startIP to endIP ]

By default, local proxy ARP is disabled.

For more information about this command, see proxy ARP commands in Layer 3—IP Services Command Reference.

IPv6:

local-proxy-nd enable

By default, local ND proxy is disabled.

For more information about this command, see IPv6 basics commands in Layer 3—IP Services Command Reference.

6. Bring up the VSI interface.

undo shutdown

By default, a VSI interface is not manually shut down.

7. Return to system view.

quit

8. Enter VSI view.

vsi vsi-name

9. Specify the VSI interface as the gateway interface for the VSI.

gateway vsi-interface vsi-interface-id

By default, no gateway interface is specified for a VSI.

Enabling dynamic ARP or ND entry synchronization for distributed VXLAN IP gateways

About dynamic ARP or ND entry synchronization for distributed VXLAN IP gateways

When local proxy ARP or local ND proxy is enabled on distributed VXLAN IP gateways, enable this feature for all gateways to have the same ARP or ND entries.

A controller or the EVPN feature can also synchronize ARP or ND entries among distributed VXLAN IP gateways. When you use a controller or EVPN, do not enable dynamic ARP or ND entry synchronization.

Enabling dynamic ARP entry synchronization

1. Enter system view.

system-view

2. Enable dynamic ARP entry synchronization for distributed VXLAN IP gateways.

arp distributed-gateway dynamic-entry synchronize

By default, dynamic ARP entry synchronization is disabled for distributed VXLAN IP gateways.

Enabling dynamic ND entry synchronization

1. Enter system view.

system-view

2. Enable dynamic ND entry synchronization for distributed VXLAN IP gateways.

ipv6 nd distributed-gateway dynamic-entry synchronize

By default, dynamic ND entry synchronization is disabled for distributed VXLAN IP gateways.

Assigning a subnet to a VSI

About subnet assignment to a VSI

Perform this task on VSIs that share a gateway interface. This task enables the VSI interface to identify the VSI of a packet.

You can assign a maximum of eight IPv4 and IPv6 subnets to a VSI. Make sure these subnets are on the same network as one of the IP addresses on the gateway interface. On an IPv4 network, you can assign one primary IP address and multiple secondary IP addresses to the gateway interface. On an IPv6 network, you can assign multiple IPv6 addresses to the gateway interface.

For VSIs that share a gateway interface, the subnets must be unique.

If you remove the gateway interface from the VSI, the VSI's subnet settings are automatically deleted.

Restrictions and guidelines

For multiple VSIs to share a VSI interface, you must assign IP addresses of different subnets to the VSI interface and specify a subnet for each VSI. If the IP addresses of a VSI interface belong to the same subnet, the VSI interface can be assigned only to one VSI.

Procedure

1. Enter system view.

system-view

2. Enter VSI view.

vsi vsi-name

3. Assign a subnet to the VSI.

gateway subnet { ipv4-address wildcard-mask | ipv6-address prefix-length }

By default, no subnet exists on a VSI.

Configuring optional parameters for a VSI interface

1. Enter system view.

system-view

2. Enter VSI interface view.

interface vsi-interface vsi-interface-id

3. Assign a MAC address to the VSI interface.

mac-address mac-address

By default, the MAC address of VSI interfaces equals the bridge MAC address plus 2.

4. Configure the description of the VSI interface.

description text

The default description of a VSI interface is interface-name plus Interface (for example, Vsi-interface100 Interface).

5. Set the MTU for the VSI interface.

mtu mtu-value

By default, the MTU of VSI interfaces is 1500 bytes.

6. Set the expected bandwidth for the VSI interface.

bandwidth bandwidth-value

The default expected bandwidth (in kbps) equals the interface baudrate divided by 1000.

The expected bandwidth is an informational parameter used only by higher-layer protocols for calculation. You cannot adjust the actual bandwidth of an interface by using this command.

7. Set an ARP packet sending rate limit for the VSI interface.

arp send-rate pps

By default, the ARP packet sending rate is not limited for a VSI interface.

Restoring the default settings of the VSI interface

Restrictions and guidelines

CAUTION:

This operation might interrupt ongoing network services. Make sure you are fully aware of the impact of this operation when you perform it on a live network.

This operation might fail to restore the default settings for some commands for reasons such as command dependencies or system restrictions. Use the display this command in interface view to identify these commands. Use their undo forms or follow the command reference to restore their default settings. If your restoration attempt still fails, follow the error message instructions to resolve the problem.

Procedure

1. Enter system view.

system-view

2. Enter VSI interface view.

interface vsi-interface vsi-interface-id

3. Restore the default settings of the interface.

default

Display and maintenance commands for VXLAN IP gateways

Execute display commands in any view and reset commands in user view.

Task	Command
Display information about VSI interfaces.	display interface [ vsi-interface [ vsi-interface-id ] ] [ brief [ description \| down ] ]
Clear statistics on VSI interfaces.	reset counters interface [ vsi-interface [ vsi-interface-id ] ]

VXLAN IP gateway configuration examples

Example: Configuring a centralized VXLAN IP gateway

Network configuration

As shown in Figure 17:

· Configure VXLAN 10 as a unicast-mode VXLAN on Device A, Device B, and Device C to provide connectivity for the VMs across the network sites.

· Configure a centralized VXLAN IP gateway on Device B to provide gateway services for VXLAN 10.

· Manually establish VXLAN tunnels and assign the tunnels to VXLAN 10.

· Enable remote-MAC address learning.

Figure 17 Network diagram

‌

Procedure

1. On VM 1 and VM 2, specify 10.1.1.1 as the gateway address. (Details not shown.)

2. Configure IP addresses and unicast routing settings:

# Assign IP addresses to interfaces, as shown in Figure 17. (Details not shown.)

# Configure OSPF on all transport network devices (Devices A through D). (Details not shown.)

# Configure OSPF to advertise routes to networks 10.1.1.0/24 and 20.1.1.0/24 on Device B and Device E. (Details not shown.)

3. Configure Device A:

# Enable L2VPN.

<DeviceA> system-view

[DeviceA] l2vpn enable

# Create VSI vpna and VXLAN 10.

[DeviceA] vsi vpna

[DeviceA-vsi-vpna] vxlan 10

[DeviceA-vsi-vpna-vxlan-10] quit

[DeviceA-vsi-vpna] quit

# Assign an IP address to Loopback 0. The IP address will be used as the source IP address of the VXLAN tunnels to Device B and Device C.

[DeviceA] interface loopback 0

[DeviceA-Loopback0] ip address 1.1.1.1 255.255.255.255

[DeviceA-Loopback0] quit

# Create a VXLAN tunnel to Device B. The tunnel interface name is Tunnel 1.

[DeviceA] interface tunnel 1 mode vxlan

[DeviceA-Tunnel1] source 1.1.1.1

[DeviceA-Tunnel1] destination 2.2.2.2

[DeviceA-Tunnel1] quit

# Create a VXLAN tunnel to Device C. The tunnel interface name is Tunnel 2.

[DeviceA] interface tunnel 2 mode vxlan

[DeviceA-Tunnel2] source 1.1.1.1

[DeviceA-Tunnel2] destination 3.3.3.3

[DeviceA-Tunnel2] quit

# Assign Tunnel 1 and Tunnel 2 to VXLAN 10.

[DeviceA] vsi vpna

[DeviceA-vsi-vpna] vxlan 10

[DeviceA-vsi-vpna-vxlan-10] tunnel 1

[DeviceA-vsi-vpna-vxlan-10] tunnel 2

[DeviceA-vsi-vpna-vxlan-10] quit

[DeviceA-vsi-vpna] quit

# Map GigabitEthernet 3/1/1 to VSI vpna.

[DeviceA] interface gigabitethernet 3/1/1

[DeviceA-GigabitEthernet3/1/1] xconnect vsi vpna

[DeviceA-GigabitEthernet3/1/1] quit

4. Configure Device B:

# Enable L2VPN.

<DeviceB> system-view

[DeviceB] l2vpn enable

# Create VSI vpna and VXLAN 10.

[DeviceB] vsi vpna

[DeviceB-vsi-vpna] vxlan 10

[DeviceB-vsi-vpna-vxlan-10] quit

[DeviceB-vsi-vpna] quit

# Assign an IP address to Loopback 0. The IP address will be used as the source IP address of the VXLAN tunnels to Device A and Device C.

[DeviceB] interface loopback 0

[DeviceB-Loopback0] ip address 2.2.2.2 255.255.255.255

[DeviceB-Loopback0] quit

# Create a VXLAN tunnel to Device A. The tunnel interface name is Tunnel 2.

[DeviceB] interface tunnel 2 mode vxlan

[DeviceB-Tunnel2] source 2.2.2.2

[DeviceB-Tunnel2] destination 1.1.1.1

[DeviceB-Tunnel2] quit

# Create a VXLAN tunnel to Device C. The tunnel interface name is Tunnel 3.

[DeviceB] interface tunnel 3 mode vxlan

[DeviceB-Tunnel3] source 2.2.2.2

[DeviceB-Tunnel3] destination 3.3.3.3

[DeviceB-Tunnel3] quit

# Assign Tunnel 2 and Tunnel 3 to VXLAN 10.

[DeviceB] vsi vpna

[DeviceB-vsi-vpna] vxlan 10

[DeviceB-vsi-vpna-vxlan-10] tunnel 2

[DeviceB-vsi-vpna-vxlan-10] tunnel 3

[DeviceB-vsi-vpna-vxlan-10] quit

[DeviceB-vsi-vpna] quit

# Create VSI-interface 1 and assign the interface an IP address. The IP address will be used as the gateway address for VXLAN 10.

[DeviceB] interface vsi-interface 1

[DeviceB-Vsi-interface1] ip address 10.1.1.1 255.255.255.0

[DeviceB-Vsi-interface1] quit

# Specify VSI-interface 1 as the gateway interface for VSI vpna.

[DeviceB] vsi vpna

[DeviceB-vsi-vpna] gateway vsi-interface 1

[DeviceB-vsi-vpna] quit

5. Configure Device C:

# Enable L2VPN.

<DeviceC> system-view

[DeviceC] l2vpn enable

# Create VSI vpna and VXLAN 10.

[DeviceC] vsi vpna

[DeviceC-vsi-vpna] vxlan 10

[DeviceC-vsi-vpna-vxlan-10] quit

[DeviceC-vsi-vpna] quit

# Assign an IP address to Loopback 0. The IP address will be used as the source IP address of the VXLAN tunnels to Device A and Device B.

[DeviceC] interface loopback 0

[DeviceC-Loopback0] ip address 3.3.3.3 255.255.255.255

[DeviceC-Loopback0] quit

# Create a VXLAN tunnel to Device A. The tunnel interface name is Tunnel 1.

[DeviceC] interface tunnel 1 mode vxlan

[DeviceC-Tunnel1] source 3.3.3.3

[DeviceC-Tunnel1] destination 1.1.1.1

[DeviceC-Tunnel1] quit

# Create a VXLAN tunnel to Device B. The tunnel interface name is Tunnel 3.

[DeviceC] interface tunnel 3 mode vxlan

[DeviceC-Tunnel3] source 3.3.3.3

[DeviceC-Tunnel3] destination 2.2.2.2

[DeviceC-Tunnel3] quit

# Assign Tunnel 1 and Tunnel 3 to VXLAN 10.

[DeviceC] vsi vpna

[DeviceC-vsi-vpna] vxlan 10

[DeviceC-vsi-vpna-vxlan-10] tunnel 1

[DeviceC-vsi-vpna-vxlan-10] tunnel 3

[DeviceC-vsi-vpna-vxlan-10] quit

[DeviceC-vsi-vpna] quit

# Map GigabitEthernet 3/1/1 to VSI vpna.

[DeviceC] interface gigabitethernet 3/1/1

[DeviceC-GigabitEthernet3/1/1] xconnect vsi vpna

[DeviceC-GigabitEthernet3/1/1] quit

Verifying the configuration

1. Verify the VXLAN IP gateway settings on Device B:

# Verify that the VXLAN tunnel interfaces are up on Device B.

[DeviceB] display interface tunnel 2

Tunnel2

Current state: UP

Line protocol state: UP

...

# Verify that VSI-interface 1 is up.

[DeviceB] display interface vsi-interface 1

Vsi-interface1

Current state: UP

Line protocol state: UP

...

# Verify that the VXLAN tunnels have been assigned to the VXLAN, and VSI-interface 1 is the gateway interface of VSI vpna.

[DeviceB] display l2vpn vsi verbose

VSI Name: vpna

VSI Index : 0

VSI State : Up

MTU : 1500

Bandwidth : Unlimited

Broadcast Restrain : 5120 kbps

Multicast Restrain : 5120 kbps

Unknown Unicast Restrain: 5120 kbps

MAC Learning : Enabled

MAC Table Limit : Unlimited

MAC Learning rate : -

Drop Unknown : -

Flooding : Enabled

Gateway interface : VSI-interface 1

VXLAN ID : 10

Tunnel Statistics : Disabled

Tunnels:

Tunnel Name Link ID State Type Flood Proxy

Tunnel2 0x5000002 Up Manual Disabled

Tunnel3 0x5000003 Up Manual Disabled

# Verify that Device B has created ARP entries for the VMs.

[DeviceB] display arp

Type: S-Static D-Dynamic O-Openflow R-Rule I-Invalid

IP address MAC address VLAN/VSI name Interface Aging Type

20.1.1.5 000c-29c1-5e46 -- GE3/1/1 19 D

10.1.1.11 0000-1234-0001 0 Tunnel2 20 D

10.1.1.12 0000-1234-0002 0 Tunnel3 19 D

# Verify that Device B has created FIB entries for the VMs.

[DeviceB] display fib 10.1.1.11

Destination count: 1 FIB entry count: 1

Flag:

U:Usable G:Gateway H:Host B:Blackhole D:Dynamic S:Static

R:Relay F:FRR

Destination/Mask Nexthop Flag OutInterface/Token Label

10.1.1.11/32 10.1.1.11 UH Vsi1 Null

2. Verify that the network connectivity for the VMs meets the network requirements:

# Verify that VM 1 and VM 2 can ping each other. (Details not shown.)

# Verify that VM 1, VM 2, and GigabitEthernet 3/1/1 (20.1.1.5) on Device E can ping each other. (Details not shown.)

Example: Configuring distributed VXLAN IPv4 gateways

Network configuration

As shown in Figure 18:

· Configure VXLAN 10, VXLAN 20, and VXLAN 30 as unicast-mode VXLANs on Device A, Device B, and Device C to provide connectivity for the VMs across the network sites.

· Manually establish VXLAN tunnels and assign the tunnels to the VXLANs.

· Configure distributed VXLAN IP gateways on Device A and Device C to forward traffic between the VXLANs.

· Configure Device B as a border gateway to forward traffic between the VXLANs and the WAN connected to Device E.

Figure 18 Network diagram

‌

Procedure

1. On VM 1, VM 2, and VM 3, specify 10.1.1.1, 10.1.2.1, and 20.1.1.1 as the gateway address, respectively. (Details not shown.)

2. Configure IP addresses and unicast routing settings:

# Assign IP addresses to interfaces, as shown in Figure 18. (Details not shown.)

# Configure OSPF on all transport network devices (Devices A through D). (Details not shown.)

# Configure OSPF to advertise routes to networks 10.1.1.0/24, 10.1.2.0/24, 20.1.1.0/24, and 25.1.1.0/24 on Device B and Device E. (Details not shown.)

3. Configure Device A:

# Enable L2VPN.

<DeviceA> system-view

[DeviceA] l2vpn enable

# Create VSI vpna and VXLAN 10.

[DeviceA] vsi vpna

[DeviceA-vsi-vpna] vxlan 10

[DeviceA-vsi-vpna-vxlan-10] quit

[DeviceA-vsi-vpna] quit

# Create VSI vpnb and VXLAN 20.

[DeviceA] vsi vpnb

[DeviceA-vsi-vpnb] vxlan 20

[DeviceA-vsi-vpnb-vxlan-20] quit

[DeviceA-vsi-vpnb] quit

# Create VSI vpnc and VXLAN 30.

[DeviceA] vsi vpnc

[DeviceA-vsi-vpnc] vxlan 30

[DeviceA-vsi-vpnc-vxlan-30] quit

[DeviceA-vsi-vpnc] quit

# Assign an IP address to Loopback 0. The IP address will be used as the source IP address of the VXLAN tunnels to Device B and Device C.

[DeviceA] interface loopback 0

[DeviceA-Loopback0] ip address 1.1.1.1 255.255.255.255

[DeviceA-Loopback0] quit

# Create a VXLAN tunnel to Device B. The tunnel interface name is Tunnel 1.

[DeviceA] interface tunnel 1 mode vxlan

[DeviceA-Tunnel1] source 1.1.1.1

[DeviceA-Tunnel1] destination 2.2.2.2

[DeviceA-Tunnel1] quit

# Create a VXLAN tunnel to Device C. The tunnel interface name is Tunnel 2.

[DeviceA] interface tunnel 2 mode vxlan

[DeviceA-Tunnel2] source 1.1.1.1

[DeviceA-Tunnel2] destination 3.3.3.3

[DeviceA-Tunnel2] quit

# Assign Tunnel 1 and Tunnel 2 to VXLAN 10.

[DeviceA] vsi vpna

[DeviceA-vsi-vpna] vxlan 10

[DeviceA-vsi-vpna-vxlan-10] tunnel 1

[DeviceA-vsi-vpna-vxlan-10] tunnel 2

[DeviceA-vsi-vpna-vxlan-10] quit

[DeviceA-vsi-vpna] quit

# Assign Tunnel 1 and Tunnel 2 to VXLAN 20.

[DeviceA] vsi vpnb

[DeviceA-vsi-vpnb] vxlan 20

[DeviceA-vsi-vpnb-vxlan-20] tunnel 1

[DeviceA-vsi-vpnb-vxlan-20] tunnel 2

[DeviceA-vsi-vpnb-vxlan-20] quit

[DeviceA-vsi-vpnb] quit

# Assign Tunnel 2 to VXLAN 30.

[DeviceA] vsi vpnc

[DeviceA-vsi-vpnc] vxlan 30

[DeviceA-vsi-vpnc-vxlan-30] tunnel 2

[DeviceA-vsi-vpnc-vxlan-30] quit

[DeviceA-vsi-vpnc] quit

# Map GigabitEthernet 3/1/1 to VSI vpna.

[DeviceA] interface gigabitethernet 3/1/1

[DeviceA-GigabitEthernet3/1/1] xconnect vsi vpna

[DeviceA-GigabitEthernet3/1/1] quit

# Map GigabitEthernet 3/1/3 to VSI vpnb.

[DeviceA] interface gigabitethernet 3/1/3

[DeviceA-GigabitEthernet3/1/3] xconnect vsi vpnb

[DeviceA-GigabitEthernet3/1/3] quit

# Create VSI-interface 1 and assign the interface an IP address and a MAC address. The IP address will be used as the gateway address for VXLAN 10.

[DeviceA] interface vsi-interface 1

[DeviceA-Vsi-interface1] ip address 10.1.1.1 255.255.255.0

[DeviceA-Vsi-interface1] mac-address 1-1-1

# Specify VSI-interface 1 as a distributed gateway and enable local proxy ARP on the interface.

[DeviceA-Vsi-interface1] distributed-gateway local

[DeviceA-Vsi-interface1] local-proxy-arp enable

[DeviceA-Vsi-interface1] quit

# Create VSI-interface 2 and assign the interface an IP address and a MAC address. The IP address will be used as the gateway address for VXLAN 20.

[DeviceA] interface vsi-interface 2

[DeviceA-Vsi-interface2] ip address 10.1.2.1 255.255.255.0

[DeviceA-Vsi-interface2] mac-address 2-2-2

# Specify VSI-interface 2 as a distributed gateway and enable local proxy ARP on the interface.

[DeviceA-Vsi-interface2] distributed-gateway local

[DeviceA-Vsi-interface2] local-proxy-arp enable

[DeviceA-Vsi-interface2] quit

# Enable dynamic ARP entry synchronization for distributed VXLAN IP gateways.

[DeviceA] arp distributed-gateway dynamic-entry synchronize

# Specify VSI-interface 1 as the gateway interface for VSI vpna. Assign subnet 10.1.1.0/24 to the VSI.

[DeviceA] vsi vpna

[DeviceA-vsi-vpna] gateway vsi-interface 1

[DeviceA-vsi-vpna] gateway subnet 10.1.1.0 0.0.0.255

[DeviceA-vsi-vpna] quit

# Specify VSI-interface 2 as the gateway interface for VSI vpnb.

[DeviceA] vsi vpnb

[DeviceA-vsi-vpnb] gateway vsi-interface 2

[DeviceA-vsi-vpnb] quit

# Assign a secondary IP address to VSI-interface 1. The IP address will be used as the gateway address for VXLAN 30.

[DeviceA] interface vsi-interface 1

[DeviceA-Vsi-interface1] ip address 20.1.1.1 255.255.255.0 sub

[DeviceA-Vsi-interface1] quit

# Specify VSI-interface 1 as the gateway interface for VSI vpnc. Assign subnet 20.1.1.0/24 to the VSI.

[DeviceA] vsi vpnc

[DeviceA-vsi-vpnc] gateway vsi-interface 1

[DeviceA-vsi-vpnc] gateway subnet 20.1.1.0 0.0.0.255

[DeviceA-vsi-vpnc] quit

# Configure a routing policy for VXLAN 10. Set the policy name to vxlan10, and set the default next hop to 10.1.1.2 (VSI-interface 1 on Device B).

[DeviceA] acl advanced 3000

[DeviceA-acl-ipv4-adv-3000] rule 0 permit ip

[DeviceA-acl-ipv4-adv-3000] quit

[DeviceA] policy-based-route vxlan10 permit node 5

[DeviceA-pbr-vxlan10-5] if-match acl 3000

[DeviceA-pbr-vxlan10-5] apply default-next-hop 10.1.1.2

[DeviceA-pbr-vxlan10-5] quit

# Configure a routing policy for VXLAN 20. Set the policy name to vxlan20, and set the default next hop to 10.1.2.2 (VSI-interface 2 on Device B).

[DeviceA] policy-based-route vxlan20 permit node 5

[DeviceA-pbr-vxlan20-5] if-match acl 3000

[DeviceA-pbr-vxlan20-5] apply default-next-hop 10.1.2.2

[DeviceA-pbr-vxlan20-5] quit

# Apply policies vxlan10 and vxlan20 to VSI-interface 1 and VSI-interface 2, respectively.

[DeviceA] interface vsi-interface 1

[DeviceA-Vsi-interface1] ip policy-based-route vxlan10

[DeviceA-Vsi-interface1] quit

[DeviceA] interface vsi-interface 2

[DeviceA-Vsi-interface2] ip policy-based-route vxlan20

[DeviceA-Vsi-interface2] quit

4. Configure Device B:

# Enable L2VPN.

<DeviceB> system-view

[DeviceB] l2vpn enable

# Create VSI vpna and VXLAN 10.

[DeviceB] vsi vpna

[DeviceB-vsi-vpna] vxlan 10

[DeviceB-vsi-vpna-vxlan-10] quit

[DeviceB-vsi-vpna] quit

# Create VSI vpnb and VXLAN 20.

[DeviceB] vsi vpnb

[DeviceB-vsi-vpnb] vxlan 20

[DeviceB-vsi-vpnb-vxlan-20] quit

[DeviceB-vsi-vpnb] quit

# Create VSI vpnc and VXLAN 30.

[DeviceB] vsi vpnc

[DeviceB-vsi-vpnc] vxlan 30

[DeviceB-vsi-vpnc-vxlan-30] quit

[DeviceB-vsi-vpnc] quit

# Assign an IP address to Loopback 0. The IP address will be used as the source IP address of the VXLAN tunnels to Device A and Device C.

[DeviceB] interface loopback 0

[DeviceB-Loopback0] ip address 2.2.2.2 255.255.255.255

[DeviceB-Loopback0] quit

# Create a VXLAN tunnel to Device A. The tunnel interface name is Tunnel 2.

[DeviceB] interface tunnel 2 mode vxlan

[DeviceB-Tunnel2] source 2.2.2.2

[DeviceB-Tunnel2] destination 1.1.1.1

[DeviceB-Tunnel2] quit

# Create a VXLAN tunnel to Device C. The tunnel interface name is Tunnel 3.

[DeviceB] interface tunnel 3 mode vxlan

[DeviceB-Tunnel3] source 2.2.2.2

[DeviceB-Tunnel3] destination 3.3.3.3

[DeviceB-Tunnel3] quit

# Assign Tunnel 2 to VXLAN 10.

[DeviceB] vsi vpna

[DeviceB-vsi-vpna] vxlan 10

[DeviceB-vsi-vpna-vxlan-10] tunnel 2

[DeviceB-vsi-vpna-vxlan-10] quit

[DeviceB-vsi-vpna] quit

# Assign Tunnel 2 to VXLAN 20.

[DeviceB] vsi vpnb

[DeviceB-vsi-vpnb] vxlan 20

[DeviceB-vsi-vpnb-vxlan-20] tunnel 2

[DeviceB-vsi-vpnb-vxlan-20] quit

[DeviceB-vsi-vpnb] quit

# Assign Tunnel 3 to VXLAN 30.

[DeviceB] vsi vpnc

[DeviceB-vsi-vpnc] vxlan 30

[DeviceB-vsi-vpnc-vxlan-30] tunnel 3

[DeviceB-vsi-vpnc-vxlan-30] quit

[DeviceB-vsi-vpnc] quit

# Create VSI-interface 1 and assign the interface an IP address.

[DeviceB] interface vsi-interface 1

[DeviceB-Vsi-interface1] ip address 10.1.1.2 255.255.255.0

[DeviceB-Vsi-interface1] quit

# Create VSI-interface 2 and assign the interface an IP address.

[DeviceB] interface vsi-interface 2

[DeviceB-Vsi-interface2] ip address 10.1.2.2 255.255.255.0

[DeviceB-Vsi-interface2] quit

# Create VSI-interface 3 and assign the interface an IP address.

[DeviceB] interface vsi-interface 3

[DeviceB-Vsi-interface3] ip address 20.1.1.2 255.255.255.0

[DeviceB-Vsi-interface3] quit

# Specify VSI-interface 1 as the gateway interface for VSI vpna.

[DeviceB] vsi vpna

[DeviceB-vsi-vpna] gateway vsi-interface 1

[DeviceB-vsi-vpna] quit

# Specify VSI-interface 2 as the gateway interface for VSI vpnb.

[DeviceB] vsi vpnb

[DeviceB-vsi-vpnb] gateway vsi-interface 2

[DeviceB-vsi-vpnb] quit

# Specify VSI-interface 3 as the gateway interface for VSI vpnc.

[DeviceB] vsi vpnc

[DeviceB-vsi-vpnc] gateway vsi-interface 3

[DeviceB-vsi-vpnc] quit

5. Configure Device C:

# Enable L2VPN.

<DeviceC> system-view

[DeviceC] l2vpn enable

# Create VSI vpna and VXLAN 10.

[DeviceC] vsi vpna

[DeviceC-vsi-vpna] vxlan 10

[DeviceC-vsi-vpna-vxlan-10] quit

[DeviceC-vsi-vpna] quit

# Create VSI vpnb and VXLAN 20.

[DeviceC] vsi vpnb

[DeviceC-vsi-vpnb] vxlan 20

[DeviceC-vsi-vpnb-vxlan-20] quit

[DeviceC-vsi-vpnb] quit

# Create VSI vpnc and VXLAN 30.

[DeviceC] vsi vpnc

[DeviceC-vsi-vpnc] vxlan 30

[DeviceC-vsi-vpnc-vxlan-30] quit

[DeviceC-vsi-vpnc] quit

# Assign an IP address to Loopback 0. The IP address will be used as the source IP address of the VXLAN tunnels to Device A and Device B.

[DeviceC] interface loopback 0

[DeviceC-Loopback0] ip address 3.3.3.3 255.255.255.255

[DeviceC-Loopback0] quit

# Create a VXLAN tunnel to Device A. The tunnel interface name is Tunnel 1.

[DeviceC] interface tunnel 1 mode vxlan

[DeviceC-Tunnel1] source 3.3.3.3

[DeviceC-Tunnel1] destination 1.1.1.1

[DeviceC-Tunnel1] quit

# Create a VXLAN tunnel to Device B. The tunnel interface name is Tunnel 3.

[DeviceC] interface tunnel 3 mode vxlan

[DeviceC-Tunnel3] source 3.3.3.3

[DeviceC-Tunnel3] destination 2.2.2.2

[DeviceC-Tunnel3] quit

# Assign Tunnel 1 to VXLAN 10.

[DeviceC] vsi vpna

[DeviceC-vsi-vpna] vxlan 10

[DeviceC-vsi-vpna-vxlan-10] tunnel 1

[DeviceC-vsi-vpna-vxlan-10] quit

[DeviceC-vsi-vpna] quit

# Assign Tunnel 1 to VXLAN 20.

[DeviceC] vsi vpnb

[DeviceC-vsi-vpnb] vxlan 20

[DeviceC-vsi-vpnb-vxlan-20] tunnel 1

[DeviceC-vsi-vpnb-vxlan-20] quit

[DeviceC-vsi-vpnb] quit

# Assign Tunnel 1 and Tunnel 3 to VXLAN 30.

[DeviceC] vsi vpnc

[DeviceC-vsi-vpnc] vxlan 30

[DeviceC-vsi-vpnc-vxlan-30] tunnel 1

[DeviceC-vsi-vpnc-vxlan-30] tunnel 3

[DeviceC-vsi-vpnc-vxlan-30] quit

[DeviceC-vsi-vpnc] quit

# Map GigabitEthernet 3/1/1 to VSI vpnc.

[DeviceC] interface gigabitethernet 3/1/1

[DeviceC-GigabitEthernet3/1/1] xconnect vsi vpnc

[DeviceC-GigabitEthernet3/1/1] quit

# Create VSI-interface 1 and assign the interface an IP address and a MAC address. The IP address will be used as the gateway address for VXLAN 10.

[DeviceC] interface vsi-interface 1

[DeviceC-Vsi-interface1] ip address 10.1.1.1 255.255.255.0

[DeviceC-Vsi-interface1] mac-address 1-1-1

# Specify VSI-interface 1 as a distributed gateway and enable local proxy ARP on the interface.

[DeviceC-Vsi-interface1] distributed-gateway local

[DeviceC-Vsi-interface1] local-proxy-arp enable

[DeviceC-Vsi-interface1] quit

# Create VSI-interface 2 and assign the interface an IP address and a MAC address. The IP address will be used as the gateway address for VXLAN 20.

[DeviceC] interface vsi-interface 2

[DeviceC-Vsi-interface2] ip address 10.1.2.1 255.255.255.0

[DeviceC-Vsi-interface2] mac-address 2-2-2

# Specify VSI-interface 2 as a distributed gateway and enable local proxy ARP on the interface.

[DeviceC-Vsi-interface2] distributed-gateway local

[DeviceC-Vsi-interface2] local-proxy-arp enable

[DeviceC-Vsi-interface2] quit

# Enable dynamic ARP entry synchronization for distributed VXLAN IP gateways.

[DeviceC] arp distributed-gateway dynamic-entry synchronize

# Specify VSI-interface 1 as the gateway interface for VSI vpna. Assign subnet 10.1.1.0/24 to the VSI.

[DeviceC] vsi vpna

[DeviceC-vsi-vpna] gateway vsi-interface 1

[DeviceC-vsi-vpna] gateway subnet 10.1.1.0 0.0.0.255

[DeviceC-vsi-vpna] quit

# Specify VSI-interface 2 as the gateway interface for VSI vpnb.

[DeviceC] vsi vpnb

[DeviceC-vsi-vpnb] gateway vsi-interface 2

[DeviceC-vsi-vpnb] quit

# Assign a secondary IP address to VSI-interface 1. The IP address will be used as the gateway address for VXLAN 30.

[DeviceC] interface vsi-interface 1

[DeviceC-Vsi-interface1] ip address 20.1.1.1 255.255.255.0 sub

[DeviceC-Vsi-interface1] quit

# Specify VSI-interface 1 as the gateway interface for VSI vpnc. Assign subnet 20.1.1.0/24 to the VSI.

[DeviceC] vsi vpnc

[DeviceC-vsi-vpnc] gateway vsi-interface 1

[DeviceC-vsi-vpnc] gateway subnet 20.1.1.0 0.0.0.255

[DeviceC-vsi-vpnc] quit

# Configure a routing policy for the VXLANs. Set the policy name to vxlan, and set the default next hop to 20.1.1.2 (VSI-interface 1 on Device B).

[DeviceC] acl advanced 3000

[DeviceC-acl-ipv4-adv-3000] rule 0 permit ip

[DeviceC-acl-ipv4-adv-3000] quit

[DeviceC] policy-based-route vxlan permit node 5

[DeviceC-pbr-vxlan-5] if-match acl 3000

[DeviceC-pbr-vxlan-5] apply default-next-hop 20.1.1.2

[DeviceC-pbr-vxlan-5] quit

# Apply the policy vxlan to VSI-interface 1.

[DeviceC] interface vsi-interface1

[DeviceC-Vsi-interface1] ip policy-based-route vxlan

[DeviceC-Vsi-interface1] quit

Verifying the configuration

1. Verify the distributed VXLAN IP gateway settings on Device A:

# Verify that the VXLAN tunnel interfaces are up on Device A.

[DeviceA] display interface tunnel 2

Tunnel2

Current state: UP

...

# Verify that VSI-interface 1 is up.

[DeviceA] display interface vsi-interface 1

Vsi-interface1

Current state: UP

Line protocol state: UP

...

# Verify that the VXLAN tunnels have been assigned to VXLAN 10, and VSI-interface 1 is the gateway interface for VSI vpna.

[DeviceA] display l2vpn vsi name vpna verbose

VSI Name: vpna

VSI Index : 0

VSI State : Up

MTU : 1500

Bandwidth : Unlimited

Broadcast Restrain : 5120 kbps

Multicast Restrain : 5120 kbps

Unknown Unicast Restrain: 5120 kbps

MAC Learning : Enabled

MAC Table Limit : Unlimited

MAC Learning rate : -

Drop Unknown : -

Flooding : Enabled

Gateway interface : VSI-interface 1

VXLAN ID : 10

Tunnels:

Tunnel Name Link ID State Type Flood Proxy

Tunnel1 0x5000001 Up Manual Disabled

Tunnel2 0x5000002 Up Manual Disabled

ACs:

AC Link ID State

GE3/1/1 0 Up

# Verify that Device A has created ARP entries for the VMs.

[DeviceA] display arp

Type: S-Static D-Dynamic O-Openflow R-Rule I-Invalid

IP address MAC address VLAN/VSI name Interface Aging Type

11.1.1.4 000c-29c1-5e46 -- GE3/1/2 19 D

10.1.1.2 3c8c-400d-867a 0 Tunnel1 20 D

10.1.1.11 0cda-41b5-cf09 0 0 20 D

10.1.2.2 3c8c-400d-867a 1 Tunnel1 20 D

10.1.2.11 0cda-41b5-cf89 1 0 20 D

20.1.1.12 0001-0001-0001 2 Tunnel2 19 D

2. Verify the configuration on the border gateway Device B:

# Verify that the VXLAN tunnel interfaces are up on Device B.

[DeviceB] display interface tunnel 2

Tunnel2

Current state: UP

Line protocol state: UP

...

# Verify that VSI-interface 1 is up.

[DeviceB] display interface vsi-interface 1

Vsi-interface1

Current state: UP

Line protocol state: UP

...

# Verify that the VXLAN tunnels have been assigned to VXLAN 10, and VSI-interface 1 is the gateway interface for VSI vpna.

[DeviceB] display l2vpn vsi name vpna verbose

VSI Name: vpna

VSI Index : 0

VSI State : Up

MTU : 1500

Bandwidth : Unlimited

Broadcast Restrain : 5120 kbps

Multicast Restrain : 5120 kbps

Unknown Unicast Restrain: 5120 kbps

MAC Learning : Enabled

MAC Table Limit : Unlimited

MAC Learning rate : -

Drop Unknown : -

Flooding : Enabled

Gateway interface : VSI-interface 1

VXLAN ID : 10

Tunnels:

Tunnel Name Link ID State Type Flood Proxy

Tunnel1 0x5000001 Up Manual Disabled

Tunnel2 0x5000002 Up Manual Disabled

# Verify that Device B has created ARP entries for the VMs.

[DeviceB] display arp

Type: S-Static D-Dynamic O-Openflow R-Rule I-Invalid

IP address MAC address VLAN/VSI name Interface Aging Type

12.1.1.4 0000-fc00-00ab -- GE3/1/2 14 D

25.1.1.5 4431-9234-24bb -- GE3/1/1 17 D

10.1.1.1 0001-0001-0001 0 Tunnel2 17 D

10.1.1.11 0001-0001-0001 0 Tunnel2 20 D

10.1.2.1 0002-0002-0002 1 Tunnel2 17 D

10.1.2.11 0002-0002-0002 1 Tunnel2 20 D

20.1.1.1 0001-0001-0001 2 Tunnel3 17 D

20.1.1.12 0001-0001-0001 2 Tunnel3 20 D

# Verify that Device B has created FIB entries for the VMs.

[DeviceB] display fib 10.1.1.11

Destination count: 1 FIB entry count: 1

Flag:

U:Usable G:Gateway H:Host B:Blackhole D:Dynamic S:Static

R:Relay F:FRR

Destination/Mask Nexthop Flag OutInterface/Token Label

10.1.1.11/32 10.1.1.11 UH Vsi1 Null

[DeviceB] display fib 20.1.1.12

Destination count: 1 FIB entry count: 1

Flag:

U:Usable G:Gateway H:Host B:Blackhole D:Dynamic S:Static

R:Relay F:FRR

Destination/Mask Nexthop Flag OutInterface/Token Label

20.1.1.12/32 20.1.1.12 UH Vsi3 Null

3. Verify that the network connectivity for VMs meets the requirements:

# Verify that VM 1, VM 2, and VM 3 can ping each other. (Details not shown.)

# Verify that VM 1, VM 2, and VM 3 can ping GigabitEthernet 3/1/1 (25.1.1.5) on Device E for WAN access. (Details not shown.)

Example: Configuring distributed VXLAN IPv6 gateways

Network configuration

As shown in Figure 19:

· Configure VXLAN 10 and VXLAN 20 as unicast-mode VXLANs on Device A, Device B, and Device C to provide connectivity for the VMs across the network sites.

· Manually establish VXLAN tunnels and assign the tunnels to the VXLANs.

· Configure distributed VXLAN IP gateways on Device A and Device C to forward traffic between VXLANs.

· Configure Device B as a border gateway to forward traffic between the VXLANs and the WAN connected to Device E.

Figure 19 Network diagram

‌

Procedure

1. On VM 1 and VM 2, specify 1::1 and 4::1 as the gateway address, respectively. (Details not shown.)

2. Configure IP addresses and unicast routing settings:

# Assign IP addresses to interfaces, as shown in Figure 19. (Details not shown.)

# Configure OSPF on all transport network devices (Devices A through D). (Details not shown.)

# Configure OSPFv3 to advertise routes to networks 1::/64, 4::/64, and 3::/64 on Device B and Device E. (Details not shown.)

3. Configure Device A:

# Enable L2VPN.

<DeviceA> system-view

[DeviceA] l2vpn enable

# Create VSI vpna and VXLAN 10.

[DeviceA] vsi vpna

[DeviceA-vsi-vpna] vxlan 10

[DeviceA-vsi-vpna-vxlan-10] quit

[DeviceA-vsi-vpna] quit

# Create VSI vpnb and VXLAN 20.

[DeviceA] vsi vpnb

[DeviceA-vsi-vpnb] vxlan 20

[DeviceA-vsi-vpnb-vxlan-20] quit

[DeviceA-vsi-vpnb] quit

# Assign an IP address to Loopback 0. The IP address will be used as the source IP address of the VXLAN tunnels to Device B and Device C.

[DeviceA] interface loopback 0

[DeviceA-Loopback0] ip address 1.1.1.1 255.255.255.255

[DeviceA-Loopback0] quit

# Create a VXLAN tunnel to Device B. The tunnel interface name is Tunnel 1.

[DeviceA] interface tunnel 1 mode vxlan

[DeviceA-Tunnel1] source 1.1.1.1

[DeviceA-Tunnel1] destination 2.2.2.2

[DeviceA-Tunnel1] quit

# Create a VXLAN tunnel to Device C. The tunnel interface name is Tunnel 2.

[DeviceA] interface tunnel 2 mode vxlan

[DeviceA-Tunnel2] source 1.1.1.1

[DeviceA-Tunnel2] destination 3.3.3.3

[DeviceA-Tunnel2] quit

# Assign Tunnel 1 and Tunnel 2 to VXLAN 10.

[DeviceA] vsi vpna

[DeviceA-vsi-vpna] vxlan 10

[DeviceA-vsi-vpna-vxlan-10] tunnel 1

[DeviceA-vsi-vpna-vxlan-10] tunnel 2

[DeviceA-vsi-vpna-vxlan-10] quit

[DeviceA-vsi-vpna] quit

# Assign Tunnel 1 and Tunnel 2 to VXLAN 20.

[DeviceA] vsi vpnb

[DeviceA-vsi-vpnb] vxlan 20

[DeviceA-vsi-vpnb-vxlan-20] tunnel 1

[DeviceA-vsi-vpnb-vxlan-20] tunnel 2

[DeviceA-vsi-vpnb-vxlan-20] quit

[DeviceA-vsi-vpnb] quit

# Map GigabitEthernet 3/1/1 to VSI vpna.

[DeviceA] interface gigabitethernet 3/1/1

[DeviceA-GigabitEthernet3/1/1] xconnect vsi vpna

[DeviceA-GigabitEthernet3/1/1] quit

# Create VSI-interface 1 and assign the interface two IPv6 anycast addresses. The IP addresses will be used as gateway addresses for VXLAN 10 and VXLAN 20.

[DeviceA] interface vsi-interface 1

[DeviceA-Vsi-interface1] ipv6 address 1::1/64 anycast

[DeviceA-Vsi-interface1] ipv6 address 4::1/64 anycast

# Specify VSI-interface 1 as a distributed gateway and enable local ND proxy on the interface.

[DeviceA-Vsi-interface1] distributed-gateway local

[DeviceA-Vsi-interface1] local-proxy-nd enable

[DeviceA-Vsi-interface1] quit

# Specify VSI-interface 1 as the gateway interface for VSI vpna. Assign subnet 1::1/64 to the VSI.

[DeviceA] vsi vpna

[DeviceA-vsi-vpna] gateway vsi-interface 1

[DeviceA-vsi-vpna] gateway subnet 1::1 64

[DeviceA-vsi-vpna] quit

# Specify VSI-interface 1 as the gateway interface for VSI vpnb. Assign subnet 4::1/64 to the VSI.

[DeviceA] vsi vpnb

[DeviceA-vsi-vpnb] gateway vsi-interface 1

[DeviceA-vsi-vpnb] gateway subnet 4::1 64

[DeviceA-vsi-vpnb] quit

# Configure an IPv6 static route. Set the destination address to 3::/64 and the next hop to 1::2.

[DeviceA] ipv6 route-static 3:: 64 1::2

4. Configure Device B:

# Enable L2VPN.

<DeviceB> system-view

[DeviceB] l2vpn enable

# Create VSI vpna and VXLAN 10.

[DeviceB] vsi vpna

[DeviceB-vsi-vpna] vxlan 10

[DeviceB-vsi-vpna-vxlan-10] quit

[DeviceB-vsi-vpna] quit

# Create VSI vpnb and VXLAN 20.

[DeviceB] vsi vpnb

[DeviceB-vsi-vpnb] vxlan 20

[DeviceB-vsi-vpnb-vxlan-20] quit

[DeviceB-vsi-vpnb] quit

# Assign an IP address to Loopback 0. The IP address will be used as the source IP address of the VXLAN tunnels to Device A and Device C.

[DeviceB] interface loopback 0

[DeviceB-Loopback0] ip address 2.2.2.2 255.255.255.255

[DeviceB-Loopback0] quit

# Create a VXLAN tunnel to Device A. The tunnel interface name is Tunnel 2.

[DeviceB] interface tunnel 2 mode vxlan

[DeviceB-Tunnel2] source 2.2.2.2

[DeviceB-Tunnel2] destination 1.1.1.1

[DeviceB-Tunnel2] quit

# Create a VXLAN tunnel to Device C. The tunnel interface name is Tunnel 3.

[DeviceB] interface tunnel 3 mode vxlan

[DeviceB-Tunnel3] source 2.2.2.2

[DeviceB-Tunnel3] destination 3.3.3.3

[DeviceB-Tunnel3] quit

# Assign Tunnel 2 and Tunnel 3 to VXLAN 10.

[DeviceB] vsi vpna

[DeviceB-vsi-vpna] vxlan 10

[DeviceB-vsi-vpna-vxlan-10] tunnel 2

[DeviceB-vsi-vpna-vxlan-10] tunnel 3

[DeviceB-vsi-vpna-vxlan-10] quit

[DeviceB-vsi-vpna] quit

# Assign Tunnel 2 and Tunnel 3 to VXLAN 20.

[DeviceB] vsi vpnb

[DeviceB-vsi-vpnb] vxlan 20

[DeviceB-vsi-vpnb-vxlan-20] tunnel 2

[DeviceB-vsi-vpnb-vxlan-20] tunnel 3

[DeviceB-vsi-vpnb-vxlan-20] quit

[DeviceB-vsi-vpnb] quit

# Create VSI-interface 1 and assign the interface IPv6 addresses.

[DeviceB] interface vsi-interface 1

[DeviceB-Vsi-interface1] ipv6 address 1::2/64

[DeviceB-Vsi-interface1] ipv6 address 4::2/64

[DeviceB-Vsi-interface1] quit

# Specify VSI-interface 1 as the gateway interface for VSI vpna.

[DeviceB] vsi vpna

[DeviceB-vsi-vpna] gateway vsi-interface 1

[DeviceB-vsi-vpna] quit

# Specify VSI-interface 2 as the gateway interface for VSI vpnb.

[DeviceB] vsi vpnb

[DeviceB-vsi-vpnb] gateway vsi-interface 1

[DeviceB-vsi-vpnb] quit

5. Configure Device C:

# Enable L2VPN.

<DeviceC> system-view

[DeviceC] l2vpn enable

# Create VSI vpna and VXLAN 10.

[DeviceC] vsi vpna

[DeviceC-vsi-vpna] vxlan 10

[DeviceC-vsi-vpna-vxlan-10] quit

[DeviceC-vsi-vpna] quit

# Create VSI vpnb and VXLAN 20.

[DeviceC] vsi vpnb

[DeviceC-vsi-vpnb] vxlan 20

[DeviceC-vsi-vpnb-vxlan-20] quit

[DeviceC-vsi-vpnb] quit

# Assign an IP address to Loopback 0. The IP address will be used as the source IP address of the VXLAN tunnels to Device A and Device B.

[DeviceC] interface loopback 0

[DeviceC-Loopback0] ip address 3.3.3.3 255.255.255.255

[DeviceC-Loopback0] quit

# Create a VXLAN tunnel to Device A. The tunnel interface name is Tunnel 1.

[DeviceC] interface tunnel 1 mode vxlan

[DeviceC-Tunnel1] source 3.3.3.3

[DeviceC-Tunnel1] destination 1.1.1.1

[DeviceC-Tunnel1] quit

# Create a VXLAN tunnel to Device B. The tunnel interface name is Tunnel 3.

[DeviceC] interface tunnel 3 mode vxlan

[DeviceC-Tunnel3] source 3.3.3.3

[DeviceC-Tunnel3] destination 2.2.2.2

[DeviceC-Tunnel3] quit

# Assign Tunnel 1 and Tunnel 3 to VXLAN 10.

[DeviceC] vsi vpna

[DeviceC-vsi-vpna] vxlan 10

[DeviceC-vsi-vpna-vxlan-10] tunnel 1

[DeviceC-vsi-vpna-vxlan-10] tunnel 3

[DeviceC-vsi-vpna-vxlan-10] quit

[DeviceC-vsi-vpna] quit

#Assign Tunnel 1 and Tunnel 3 to VXLAN 20.

[DeviceC] vsi vpnb

[DeviceC-vsi-vpnb] vxlan 20

[DeviceC-vsi-vpnb-vxlan-20] tunnel 1

[DeviceC-vsi-vpnb-vxlan-20] tunnel 3

[DeviceC-vsi-vpnb-vxlan-20] quit

[DeviceC-vsi-vpnb] quit

# Map GigabitEthernet 3/1/1 to VSI vpnb.

[DeviceC] interface gigabitethernet 3/1/1

[DeviceC-GigabitEthernet3/1/1] xconnect vsi vpnb

[DeviceC-GigabitEthernet3/1/1] quit

# Create VSI-interface 1 and assign the interface two IPv6 anycast addresses. The IP addresses will be used as gateway addresses for VXLAN 10 and VXLAN 20.

[DeviceC] interface vsi-interface 1

[DeviceC-Vsi-interface1] ipv6 address 1::1/64 anycast

[DeviceC-Vsi-interface1] ipv6 address 4::1/64 anycast

# Specify VSI-interface 1 as a distributed gateway and enable local ND proxy on the interface.

[DeviceC-Vsi-interface1] distributed-gateway local

[DeviceC-Vsi-interface1] local-proxy-nd enable

[DeviceC-Vsi-interface1] quit

# Specify VSI-interface 1 as the gateway interface for VSI vpna. Assign subnet 1::1/64 to the VSI.

[DeviceC] vsi vpna

[DeviceC-vsi-vpna] gateway vsi-interface 1

[DeviceC-vsi-vpna] gateway subnet 1::1 64

[DeviceC-vsi-vpna] quit

# Specify VSI-interface 1 as the gateway interface for VSI vpnb. Assign subnet 4::1/64 to the VSI.

[DeviceC] vsi vpnb

[DeviceC-vsi-vpnb] gateway vsi-interface 1

[DeviceC-vsi-vpnb] gateway subnet 4::1 64

[DeviceC-vsi-vpnb] quit

# Configure an IPv6 static route. Set the destination address to 3::/64 and the next hop to 4::2.

[DeviceC] ipv6 route-static 3:: 64 4::2

Verifying the configuration

1. Verify the distributed VXLAN IP gateway settings on Device A:

# Verify that the VXLAN tunnel interfaces are up on Device A.

[DeviceA] display interface tunnel 2

Tunnel2

Current state: UP

Line protocol state: UP

...

# Verify that VSI-interface 1 is up.

[DeviceA] display interface vsi-interface 1

Vsi-interface1

Current state: UP

Line protocol state: UP

...

# Verify that the VXLAN tunnels have been assigned to VXLAN 10 and VXLAN 20, and VSI-interface 1 is the gateway interface for VSIs vpna and vpnb.

[DeviceA] display l2vpn vsi verbose

VSI Name: vpna

VSI Index : 0

VSI State : Up

MTU : 1500

Bandwidth : Unlimited

Broadcast Restrain : 5120 kbps

Multicast Restrain : 5120 kbps

Unknown Unicast Restrain: 5120 kbps

MAC Learning : Enabled

MAC Table Limit : Unlimited

MAC Learning rate : -

Drop Unknown : -

Flooding : Enabled

Gateway Interface : VSI-interface 1

VXLAN ID : 10

Tunnel Statistics : Disabled

Tunnels:

Tunnel Name Link ID State Type Flood Proxy

Tunnel1 0x5000001 Up Manual Disabled

Tunnel2 0x5000002 Up Manual Disabled

ACs:

AC Link ID State

GE3/1/1 0 Up

Statistics: Disabled

VSI Name: vpnb

VSI Index : 0

VSI State : Up

MTU : 1500

Bandwidth : Unlimited

Broadcast Restrain : 5120 kbps

Multicast Restrain : 5120 kbps

Unknown Unicast Restrain: 5120 kbps

MAC Learning : Enabled

MAC Table Limit : Unlimited

MAC Learning rate : -

Drop Unknown : -

Flooding : Enabled

Gateway Interface : VSI-interface 1

VXLAN ID : 20

Tunnel Statistics : Disabled

Tunnels:

Tunnel Name Link ID State Type Flood Proxy

Tunnel1 0x5000001 Up Manual Disabled

Tunnel2 0x5000002 Up Manual Disabled

# Verify that Device A has created neighbor entries for the VMs.

[DeviceA] display ipv6 neighbors all

Type: S-Static D-Dynamic O-Openflow R-Rule I-Invalid

IPv6 address Link layer VID Interface State T Age

1::2 3c8c-400d-867a 0 Tunnel1 STALE D 7

1::100 0001-0000-0047 0 0 STALE D 22

4::400 0002-0000-0047 1 Tunnel2 REACH D 5

FE80::201:FF:FE00:47 0001-0000-0047 0 Tunnel1 REACH D 30

FE80::202:FF:FE00:0 0002-0000-0000 1 Tunnel2 REACH D 27

FE80::202:FF:FE00:47 0002-0000-0047 0 0 DELAY D 5

# Verify that Device A has created FIB entries for the VMs.

[DeviceA] display ipv6 fib 4::400

Destination count: 1 FIB entry count: 1

Flag:

U:Usable G:Gateway H:Host B:Blackhole D:Dynamic S:Static

R:Relay F:FRR

Destination: 4::400 Prefix length: 128

Nexthop : 4::400 Flags: UH

Time stamp : 0x2c Label: Null

Interface : Vsi1 Token: Invalid

[DeviceA] display ipv6 fib 3::300

Destination count: 1 FIB entry count: 1

Flag:

U:Usable G:Gateway H:Host B:Blackhole D:Dynamic S:Static

R:Relay F:FRR

Destination: 3:: Prefix length: 40

Nexthop : 1::2 Flags: USGR

Time stamp : 0x23 Label: Null

Interface : Vsi1 Token: Invalid

2. Verify the configuration on the border gateway Device B:

# Verify that the VXLAN tunnel interfaces are up on Device B.

[DeviceB] display interface tunnel 2

Tunnel2

Current state: UP

Line protocol state: UP

...

# Verify that VSI-interface 1 is up.

[DeviceB] display interface vsi-interface 1

Vsi-interface1

Current state: UP

Line protocol state: UP

...

# Verify that the VXLAN tunnels have been assigned to VXLAN 10, and VSI-interface 1 is the gateway interface of VSI vpna.

[DeviceB] display l2vpn vsi name vpna verbose

VSI Name: vpna

VSI Index : 0

VSI State : Up

MTU : 1500

Bandwidth : Unlimited

Broadcast Restrain : 5120 kbps

Multicast Restrain : 5120 kbps

Unknown Unicast Restrain: 5120 kbps

MAC Learning : Enabled

MAC Table Limit : Unlimited

MAC Learning rate : -

Drop Unknown : -

Flooding : Enabled

Gateway interface : VSI-interface 1

VXLAN ID : 10

Tunnels:

Tunnel Name Link ID State Type Flood Proxy

Tunnel1 0x5000001 Up Manual Disabled

Tunnel2 0x5000002 Up Manual Disabled

# Verify that Device B has created neighbor entries for the VMs.

[DeviceB] display ipv6 neighbors all

Type: S-Static D-Dynamic O-Openflow R-Rule I-Invalid

IPv6 address Link layer VID Interface State T Age

3::300 0003-0000-0047 N/A GE3/1/1 DELAY D 3

FE80::203:FF:FE00:47 0003-0000-0047 N/A GE3/1/1 STALE D 222

1::100 0001-0000-0047 0 Tunnel2 STALE D 232

4::400 0002-0000-0047 1 Tunnel3 REACH D 3

FE80::201:FF:FE00:0 0001-0000-0000 0 Tunnel2 STALE D 237

FE80::201:FF:FE00:47 0001-0000-0047 N/A GE3/1/1 STALE D 222

FE80::202:FF:FE00:0 0002-0000-0000 1 Tunnel3 STALE D 345

# Verify that Device B has created FIB entries for the VMs.

[DeviceB] display ipv6 fib 1::100

Destination count: 1 FIB entry count: 1

Flag:

U:Usable G:Gateway H:Host B:Blackhole D:Dynamic S:Static

R:Relay F:FRR

Destination: 1::100 Prefix length: 128

Nexthop : 1::100 Flags: UH

Time stamp : 0x21 Label: Null

Interface : Vsi1 Token: Invalid

[DeviceB] display ipv6 fib 4::400

Destination count: 1 FIB entry count: 1

Flag:

U:Usable G:Gateway H:Host B:Blackhole D:Dynamic S:Static

R:Relay F:FRR

Destination: 4:: Prefix length: 64

Nexthop : :: Flags: U

Time stamp : 0x19 Label: Null

Interface : Vsi1 Token: Invalid

3. Verify that the network connectivity for the VMs meet the network requirements:

# Verify that VM 1 and VM 2 can ping each other. (Details not shown.)

# Verify that VM 1, VM 2, and GigabitEthernet 3/1/1 (3::300) on Device E can ping each other. (Details not shown.)

Configuring VXLAN-DCI

About VXLAN-DCI

VXLAN tunnels are used only for intra-data center connection. To provide Layer 2 connectivity between data centers over an IP transport network, you can use VXLAN data center interconnect (VXLAN-DCI) tunnels.

VXLAN-DCI network model

As shown in Figure 20, the VXLAN-DCI network contains edge devices (EDs) located at the edge of the transport network and VTEPs located at the data center sites. VXLAN tunnels are established between VTEPs and EDs, and VXLAN-DCI tunnels are established between EDs. VXLAN-DCI tunnels use VXLAN encapsulation. Each ED de-encapsulates received VXLAN packets and then re-encapsulates them based on the destination before forwarding them through a VXLAN or VXLAN-DCI tunnel.

Figure 20 VXLAN-DCI network model

Working mechanisms

In a VXLAN-DCI network, VTEPs use MAC address entries to perform Layer 2 forwarding for VXLANs, and EDs perform Layer 3 forwarding based on dynamically learned ARP or ND entries.

As shown in Figure 21, a VSI interface uses the same IP address to provide gateway services for a VXLAN on different EDs. Local proxy ARP (for IPv4 sites) or local ND proxy (for IPv6 sites) is enabled on the EDs.

Figure 21 VXLAN-DCI working mechanisms

Intra-VXLAN traffic forwarding between sites

As shown in Figure 21, the network uses the following process to forward traffic in a VXLAN between sites (for example, from VM 1 to VM 4 in VXLAN 10):

1. VM 1 sends an ARP request to obtain the MAC address of VM 4.

2. VTEP 1 learns the MAC address of VM 1 and floods the ARP request in VXLAN 10.

3. ED 1 performs the following operations:

a. Removes the VXLAN encapsulation of the ARP request.

b. Creates an ARP entry for VM 1 and replies with the MAC address of VSI-interface 10 (the gateway interface for VXLAN 10). The ARP reply is sent to VTEP 1.

4. VTEP 1 removes the VXLAN encapsulation of the ARP reply, learns the MAC address of ED 1, and forwards the ARP reply to VM 1.

5. VM 1 creates an ARP entry for VM 4. The MAC address in the entry is the MAC address of VSI-interface 10 on ED 1.

6. ED 1 replaces the sender MAC address of the request with the MAC address of VSI-interface 10 on ED 1, and then floods the request to the remote EDs in VXLAN 10.

7. ED 2 performs the following operations:

a. Removes the VXLAN encapsulation of the ARP request.

b. Creates an ARP entry for VM 1. The entry contains VM 1's IP address (10.1.1.100), the MAC address of VSI-interface 10 on ED 1, and the incoming VXLAN-DCI tunnel interface.

c. Replaces the sender MAC address of the request with the MAC address of VSI-interface 10 on ED 2, and then floods the request on all VXLAN tunnels of VXLAN 10.

8. VTEP 2 removes the VXLAN encapsulation of the ARP request, learns the MAC address of ED 2, and floods the ARP request to the local site.

9. VM 4 creates an ARP entry for VM 1, and then sends a reply to VTEP 2. The MAC address in the ARP entry is the MAC address of VSI-interface 10 on ED 2.

10. VTEP 2 looks up the MAC address table and forwards the ARP reply to ED 2.

11. ED 2 performs the following operations:

a. Removes the VXLAN encapsulation of the ARP reply.

b. Creates an ARP entry for VM 4

c. Replaces the sender MAC address of the ARP reply with the MAC address of VSI-interface 10 on ED 2, and sends the reply to ED 1.

12. ED 1 performs the following operations:

a. Removes the VXLAN encapsulation of the ARP reply.

b. Creates an ARP entry for VM 4. The entry contains VM 4's IP address (10.1.1.200), the MAC address of VSI-interface 10 on ED 2, and the incoming VXLAN-DCI tunnel interface.

13. For subsequent traffic between VM 1 and VM 4, the VTEPs and EDs use their respective MAC address tables and ARP tables to make the forwarding decision.

Inter-VXLAN traffic forwarding between sites

As shown in Figure 21, the network uses the following process to forward traffic between VXLANs (for example, from VM 1 in VXLAN 10 to VM 5 in VXLAN 20):

1. VM 1 sends an ARP request to obtain the MAC address of the gateway at 10.1.1.1.

2. VTEP 1 learns the MAC address of VM 1 and floods the ARP request in VXLAN 10.

3. ED 1 performs the following operations:

a. Removes the VXLAN encapsulation of the ARP request.

b. Creates an ARP entry for VM 1 and replies with the MAC address of VSI-interface 10 (the gateway interface for VXLAN 10). The ARP reply is sent to VTEP 1.

4. VTEP 1 removes the VXLAN encapsulation of the ARP reply, learns the MAC address of ED 1, and forwards the ARP reply to VM 1.

5. VM 1 creates an ARP entry for the gateway and sends the packet destined for VM 5 to VTEP 1.

6. VTEP 1 looks up the MAC address table and forwards the packet to ED 1.

7. ED 1 performs the following operations:

a. Removes the VXLAN encapsulation of the packet and looks up the routing table based on the destination IP address.

b. Sends an ARP request to the local VTEP and remote ED of VXLAN 20 to obtain the MAC address of VM 5. In the ARP request, the sender IP address is 20.1.1.1, and the sender MAC address is the MAC address of VSI-interface 20 on ED 1.

8. ED 2 performs the following operations:

a. Removes the VXLAN encapsulation of the ARP request.

b. Replaces the sender MAC address of the request with the MAC address of VSI-interface 20 on ED 2, and then floods the request on all VXLAN tunnels of VXLAN 20.

9. VTEP 2 removes the VXLAN encapsulation of the ARP request, learns the MAC address of ED 2, and floods the ARP request to the local site.

10. VM 5 creates an ARP entry for ED 2 and sends a reply to VTEP 2. The MAC address in the ARP entry is the MAC address of VSI-interface 20 on ED 2.

11. VTEP 2 looks up the MAC address table and forwards the ARP reply to ED 2.

12. ED 2 performs the following operations:

a. Removes the VXLAN encapsulation of the ARP reply.

b. Creates an ARP entry for VM 5.

c. Sends a gratuitous ARP packet to ED 1. In the packet, the sender and target IP address is 20.1.1.200, and the sender MAC address is the MAC address of VSI-interface 20 on ED 2.

13. ED 1 performs the following operations:

a. Removes the VXLAN encapsulation of the packet.

b. Creates an ARP entry for VM 5. The entry contains VM 5's IP address (20.1.1.200), the MAC address of VSI-interface 20 on ED 2, and the incoming VXLAN-DCI tunnel interface.

14. For subsequent traffic between VM 1 and VM 5, the VTEPs and EDs use their respective MAC address tables and ARP tables to make the forwarding decision.

VXLAN-DCI tasks at a glance

To configure a VXLAN-DCI network, perform the following tasks:

· Configure routing protocols on the transport network for EDs to reach one another.

· Configure routing protocols on EDs and VTEPs for them to reach one another.

· Configure VXLANs on EDs and VTEPs, and set up VXLAN tunnels between EDs and VTEPs.

· Configure VXLAN-DCI on EDs, and set up VXLAN-DCI tunnels between EDs.

To configure VXLAN-DCI on an ED, perform the following tasks:

1. Creating a VXLAN on a VSI

For more information, see "Creating a VXLAN on a VSI."

2. Configuring a VXLAN-DCI tunnel

3. Assigning a VXLAN-DCI tunnel to a VXLAN

4. Configuring a gateway interface on an ED

5. Configuring optional parameters for a VSI interface

For more information, see "Configuring optional parameters for a VSI interface."

6. Configuring VXLAN packet parameters

? Setting the destination UDP port number of VXLAN packets

For more information, see "Setting the destination UDP port number of VXLAN packets."

? Configuring VXLAN packet check

For more information, see "Configuring VXLAN packet check."

7. Enabling packet statistics for VXLAN-DCI

? Enabling packet statistics for manually created VXLAN-DCI tunnels

NOTE:

This chapter covers only the VXLAN-DCI configuration tasks available on an ED. For more information about basic VXLAN configuration and VXLAN IP gateway configuration, see "Configuring basic VXLAN features" and "Configuring VXLAN IP gateways."

Configuring a VXLAN-DCI tunnel

Restrictions and guidelines

You must specify the tunnel source and destination IP addresses when you manually set up a VXLAN-DCI tunnel between EDs. As a best practice, do not configure the same tunnel source and destination addresses for different VXLAN-DCI tunnels on an ED.

This task provides basic VXLAN-DCI tunnel configuration. For more information about tunnel configuration and commands, see Layer 3—IP Services Configuration Guide and Layer 3—IP Services Command Reference.

Procedure

1. Enter system view.

system-view

2. Create a VXLAN-DCI tunnel interface and enter tunnel interface view.

interface tunnel tunnel-number mode vxlan-dci

The endpoints of a tunnel must use the same tunnel mode.

3. Specify a source address for the tunnel. Choose one of the following tasks:

? Specify a source IP address.

source ipv4-address | interface-type interface-number }

The specified IP address is used as the source IP address in the outer IP header of tunneled VXLAN packets.

? Specify a source interface.

source interface-type interface-number

The primary IP address is used as the source IP address in the outer IP header of tunneled VXLAN packets.

By default, no source address is specified for a tunnel.

4. Specify a destination IP address for the tunnel.

destination ipv4-address

By default, no destination IP address is specified for a tunnel.

Specify the remote ED's IP address. This IP address will be the destination IP address in the outer IP header of tunneled VXLAN packets.

Assigning a VXLAN-DCI tunnel to a VXLAN

About VXLAN-DCI tunnel assignment

To provide connectivity for a VXLAN between two EDs, you must assign the VXLAN-DCI tunnel between the EDs to the VXLAN.

You can assign multiple VXLAN-DCI tunnels to a VXLAN, and configure a VXLAN-DCI tunnel to trunk multiple VXLANs. EDs use the VXLAN ID in VXLAN packets to identify the VXLAN. For a unicast-mode VXLAN, the system floods unknown unicast, multicast, and broadcast traffic to each VXLAN-DCI tunnel associated with the VXLAN.

Restrictions and guidelines

For full connectivity in the VXLAN, make sure the VXLAN contains the VXLAN-DCI tunnel between each pair of EDs in the VXLAN.

Procedure

1. Enter system view.

system-view

2. Enter VSI view.

vsi vsi-name

3. Enter VXLAN view.

vxlan vxlan-id

4. Assign a VXLAN-DCI tunnel to the VXLAN.

tunnel tunnel-number [ remote-vni vxlan-id ]

By default, a VXLAN does not contain any VXLAN-DCI tunnels.

If two data centers use different VXLANs to convey the same service, you can use the remote-vni vxlan-id option to specify the remote VXLAN ID on each ED for the VXLANs to communicate. The EDs will replace the local VXLAN ID in VXLAN packets with the remote VXLAN ID before sending the packets to a remote ED.

Configuring a gateway interface on an ED

1. Enter system view.

system-view

2. Create a VSI interface and enter VSI interface view.

interface vsi-interface vsi-interface-id

3. Assign an IP address to the VSI interface.

IPv4:

ip address ip-address { mask | mask-length } [ sub ]

IPv6:

See IPv6 basics in Layer 3—IP Services Configuration Guide.

By default, no IP address is assigned to a VSI interface.

4. Specify the VSI interface as a distributed gateway.

distributed-gateway local

By default, a VSI interface is not a distributed gateway.

5. Enable local proxy ARP or local ND proxy.

IPv4:

local-proxy-arp enable [ ip-range startIP to endIP ]

By default, local proxy ARP is disabled.

For more information about this command, see proxy ARP commands in Layer 3—IP Services Command Reference.

IPv6:

local-proxy-nd enable

By default, local ND proxy is disabled.

For more information about this command, see IPv6 basics commands in Layer 3—IP Services Command Reference.

6. Bring up the VSI interface.

undo shutdown

By default, a VSI interface is not manually shut down.

7. Return to system view.

quit

8. Enter VSI view.

vsi vsi-name

9. Specify the VSI interface as the gateway interface for the VSI.

gateway vsi-interface vsi-interface-id

By default, no gateway interface is specified for a VSI.

Enabling packet statistics for manually created VXLAN-DCI tunnels

About packet statistics of VXLAN-DCI tunnels

Perform this task to enable packet statistics for manually created VXLAN-DCI tunnels on a per-tunnel interface basis. To display the packet statistics for VXLAN-DCI tunnels, use the display interface tunnel command in any view. To clear the packet statistics for VXLAN-DCI tunnels, use the reset counters interface tunnel command in user view.

Procedure

1. Enter system view.

system-view

2. Enter VXLAN-DCI tunnel interface view.

interface tunnel tunnel-number [ mode vxlan-dci ]

3. Enable packet statistics for the tunnel.

statistics enable

By default, the packet statistics feature is disabled for manually created VXLAN-DCI tunnels.

Display and maintenance commands for VXLAN-DCI

Execute display commands in any view and reset commands in user view.

Task	Command
Display information about VSIs.	display l2vpn vsi [ name vsi-name ] [ verbose ]
Display information about tunnel interfaces.	display interface [ tunnel [ number ] ] [ brief [ description \| down ] ]
Display VXLAN-DCI tunnel information for VXLANs.	display vxlan tunnel [ vxlan-id vxlan-id [ tunnel tunnel-number ] ]

NOTE:

For more information about the display interface tunnel command, see tunneling commands in Layer 3—IP Services Command Reference.

VXLAN-DCI configuration examples

Example: Configuring a basic VXLAN-DCI network

Network configuration

As shown in Figure 22:

· Configure VXLAN 10 and VXLAN 20 as unicast-mode VXLANs on Device A, Device B, Device D, and Device E to provide connectivity for the VMs across the data center sites.

· Configure Device A and Device E as VTEPs, and Device B and Device D as EDs.

· Manually establish VXLAN tunnels and VXLAN-DCI tunnels, and assign the tunnels to the VXLANs.

Figure 22 Network diagram

‌

Procedure

1. Configure IP addresses and unicast routing settings:

# Assign IP addresses to interfaces, as shown in Figure 22. (Details not shown.)

# Configure OSPF on Devices A through E. (Details not shown.)

# Configure OSPF to advertise routes to networks 10.1.1.0/24 and 10.1.2.0/24 on Device B and Device D. (Details not shown.)

2. Configure Device A:

# Enable L2VPN.

<DeviceA> system-view

[DeviceA] l2vpn enable

# Create VSI vpna and VXLAN 10.

[DeviceA] vsi vpna

[DeviceA-vsi-vpna] vxlan 10

[DeviceA-vsi-vpna-vxlan-10] quit

[DeviceA-vsi-vpna] quit

# Create VSI vpnb and VXLAN 20.

[DeviceA] vsi vpnb

[DeviceA-vsi-vpnb] vxlan 20

[DeviceA-vsi-vpnb-vxlan-20] quit

[DeviceA-vsi-vpnb] quit

# Assign an IP address to Loopback 0. The IP address will be used as the source IP address of the VXLAN tunnel to Device B.

[DeviceA] interface loopback 0

[DeviceA-Loopback0] ip address 1.1.1.1 255.255.255.255

[DeviceA-Loopback0] quit

# Create a VXLAN tunnel to Device B. The tunnel interface name is Tunnel 1.

[DeviceA] interface tunnel 1 mode vxlan

[DeviceA-Tunnel1] source 1.1.1.1

[DeviceA-Tunnel1] destination 2.2.2.2

[DeviceA-Tunnel1] quit

# Assign Tunnel 1 to VXLAN 10.

[DeviceA] vsi vpna

[DeviceA-vsi-vpna] vxlan 10

[DeviceA-vsi-vpna-vxlan-10] tunnel 1

[DeviceA-vsi-vpna-vxlan-10] quit

[DeviceA-vsi-vpna] quit

# Assign Tunnel 1 to VXLAN 20.

[DeviceA] vsi vpnb

[DeviceA-vsi-vpnb] vxlan 20

[DeviceA-vsi-vpnb-vxlan-20] tunnel 1

[DeviceA-vsi-vpnb-vxlan-20] quit

[DeviceA-vsi-vpnb] quit

# Map GigabitEthernet 3/1/1 to VSI vpna.

[DeviceA] interface gigabitethernet 3/1/1

[DeviceA-GigabitEthernet3/1/1] xconnect vsi vpna

[DeviceA-GigabitEthernet3/1/1] quit

# Map GigabitEthernet 3/1/3 to VSI vpnb.

[DeviceA] interface gigabitethernet 3/1/3

[DeviceA-GigabitEthernet3/1/3] xconnect vsi vpnb

[DeviceA-GigabitEthernet3/1/3] quit

3. Configure Device B:

# Enable L2VPN.

<DeviceB> system-view

[DeviceB] l2vpn enable

# Create VSI vpna and VXLAN 10.

[DeviceB] vsi vpna

[DeviceB-vsi-vpna] vxlan 10

[DeviceB-vsi-vpna-vxlan-10] quit

[DeviceB-vsi-vpna] quit

# Create VSI vpnb and VXLAN 20.

[DeviceB] vsi vpnb

[DeviceB-vsi-vpnb] vxlan 20

[DeviceB-vsi-vpnb-vxlan-20] quit

[DeviceB-vsi-vpnb] quit

# Assign an IP address to Loopback 0. The IP address will be used as the source IP address of the VXLAN tunnel to Device A and the VXLAN-DCI tunnel to Device D.

[DeviceB] interface loopback 0

[DeviceB-Loopback0] ip address 2.2.2.2 255.255.255.255

[DeviceB-Loopback0] quit

# Create a VXLAN tunnel to Device A. The tunnel interface name is Tunnel 1.

[DeviceB] interface tunnel 1 mode vxlan

[DeviceB-Tunnel1] source 2.2.2.2

[DeviceB-Tunnel1] destination 1.1.1.1

[DeviceB-Tunnel1] quit

# Create a VXLAN-DCI tunnel to Device D. The tunnel interface name is Tunnel 2.

[DeviceB] interface tunnel 2 mode vxlan-dci

[DeviceB-Tunnel2] source 2.2.2.2

[DeviceB-Tunnel2] destination 3.3.3.3

[DeviceB-Tunnel2] quit

# Assign Tunnel 1 and Tunnel 2 to VXLAN 10.

[DeviceB] vsi vpna

[DeviceB-vsi-vpna] vxlan 10

[DeviceB-vsi-vpna-vxlan-10] tunnel 1

[DeviceB-vsi-vpna-vxlan-10] tunnel 2

[DeviceB-vsi-vpna-vxlan-10] quit

[DeviceB-vsi-vpna] quit

# Assign Tunnel 1 and Tunnel 2 to VXLAN 20.

[DeviceB] vsi vpnb

[DeviceB-vsi-vpnb] vxlan 20

[DeviceB-vsi-vpnb-vxlan-20] tunnel 1

[DeviceB-vsi-vpnb-vxlan-20] tunnel 2

[DeviceB-vsi-vpnb-vxlan-20] quit

[DeviceB-vsi-vpnb] quit

# Create VSI-interface 1 and assign the interface an IP address. The IP address will be used as the gateway address for VXLAN 10.

[DeviceB] interface vsi-interface 1

[DeviceB-Vsi-interface1] ip address 10.1.1.1 255.255.255.0

# Specify VSI-interface 1 as a distributed gateway and enable local proxy ARP on the interface.

[DeviceB-Vsi-interface1] distributed-gateway local

[DeviceB-Vsi-interface1] local-proxy-arp enable

[DeviceB-Vsi-interface1] quit

# Create VSI-interface 2 and assign the interface an IP address. The IP address will be used as the gateway address for VXLAN 20.

[DeviceB] interface vsi-interface 2

[DeviceB-Vsi-interface2] ip address 10.1.2.1 255.255.255.0

# Specify VSI-interface 2 as a distributed gateway and enable local proxy ARP on the interface.

[DeviceB-Vsi-interface2] distributed-gateway local

[DeviceB-Vsi-interface2] local-proxy-arp enable

[DeviceB-Vsi-interface2] quit

# Enable dynamic ARP entry synchronization for distributed VXLAN IP gateways.

[DeviceB] arp distributed-gateway dynamic-entry synchronize

# Specify VSI-interface 1 as the gateway interface for VSI vpna.

[DeviceB] vsi vpna

[DeviceB-vsi-vpna] gateway vsi-interface 1

[DeviceB-vsi-vpna] quit

# Specify VSI-interface 2 as the gateway interface for VSI vpnb.

[DeviceB] vsi vpnb

[DeviceB-vsi-vpnb] gateway vsi-interface 2

[DeviceB-vsi-vpnb] quit

4. Configure Device D:

# Enable L2VPN.

<DeviceD> system-view

[DeviceD] l2vpn enable

# Create VSI vpna and VXLAN 10.

[DeviceD] vsi vpna

[DeviceD-vsi-vpna] vxlan 10

[DeviceD-vsi-vpna-vxlan-10] quit

[DeviceD-vsi-vpna] quit

# Create VSI vpnb and VXLAN 20.

[DeviceD] vsi vpnb

[DeviceD-vsi-vpnb] vxlan 20

[DeviceD-vsi-vpnb-vxlan-20] quit

[DeviceD-vsi-vpnb] quit

# Assign an IP address to Loopback 0. The IP address will be used as the source IP address of the VXLAN-DCI tunnel to Device B and the VXLAN tunnel to Device E.

[DeviceD] interface loopback 0

[DeviceD-Loopback0] ip address 3.3.3.3 255.255.255.255

[DeviceD-Loopback0] quit

# Create a VXLAN tunnel to Device E. The tunnel interface name is Tunnel 1.

[DeviceD] interface tunnel 1 mode vxlan

[DeviceD-Tunnel1] source 3.3.3.3

[DeviceD-Tunnel1] destination 4.4.4.4

[DeviceD-Tunnel1] quit

# Create a VXLAN-DCI tunnel to Device B. The tunnel interface name is Tunnel 2.

[DeviceD] interface tunnel 2 mode vxlan-dci

[DeviceD-Tunnel2] source 3.3.3.3

[DeviceD-Tunnel2] destination 2.2.2.2

[DeviceD-Tunnel2] quit

# Assign Tunnel 1 and Tunnel 2 to VXLAN 10.

[DeviceD] vsi vpna

[DeviceD-vsi-vpna] vxlan 10

[DeviceD-vsi-vpna-vxlan-10] tunnel 1

[DeviceD-vsi-vpna-vxlan-10] tunnel 2

[DeviceD-vsi-vpna-vxlan-10] quit

[DeviceD-vsi-vpna] quit

# Assign Tunnel 2 to VXLAN 20.

[DeviceD] vsi vpnb

[DeviceD-vsi-vpnb] vxlan 20

[DeviceD-vsi-vpnb-vxlan-20] tunnel 2

[DeviceD-vsi-vpnb-vxlan-20] quit

[DeviceD-vsi-vpnb] quit

# Create VSI-interface 1 and assign the interface an IP address. The IP address will be used as the gateway address for VXLAN 10.

[DeviceD] interface vsi-interface 1

[DeviceD-Vsi-interface1] ip address 10.1.1.1 255.255.255.0

# Specify VSI-interface 1 as a distributed gateway and enable local proxy ARP on the interface.

[DeviceD-Vsi-interface1] distributed-gateway local

[DeviceD-Vsi-interface1] local-proxy-arp enable

[DeviceD-Vsi-interface1] quit

# Create VSI-interface 2 and assign the interface an IP address. The IP address will be used as the gateway address for VXLAN 20.

[DeviceD] interface vsi-interface 2

[DeviceD-Vsi-interface2] ip address 10.1.2.1 255.255.255.0

# Specify VSI-interface 2 as a distributed gateway and enable local proxy ARP on the interface.

[DeviceD-Vsi-interface2] distributed-gateway local

[DeviceD-Vsi-interface2] local-proxy-arp enable

[DeviceD-Vsi-interface2] quit

# Enable dynamic ARP entry synchronization for distributed VXLAN IP gateways.

[DeviceD] arp distributed-gateway dynamic-entry synchronize

# Specify VSI-interface 1 as the gateway interface for VSI vpna.

[DeviceD] vsi vpna

[DeviceD-vsi-vpna] gateway vsi-interface 1

[DeviceD-vsi-vpna] quit

# Specify VSI-interface 2 as the gateway interface for VSI vpnb.

[DeviceD] vsi vpnb

[DeviceD-vsi-vpnb] gateway vsi-interface 2

[DeviceD-vsi-vpnb] quit

5. Configure Device E:

# Enable L2VPN.

<DeviceE> system-view

[DeviceE] l2vpn enable

# Create VSI vpna and VXLAN 10.

[DeviceE] vsi vpna

[DeviceE-vsi-vpna] vxlan 10

[DeviceE-vsi-vpna-vxlan-10] quit

[DeviceE-vsi-vpna] quit

# Assign an IP address to Loopback 0. The IP address will be used as the source IP address of the VXLAN tunnel to Device D.

[DeviceE] interface loopback 0

[DeviceE-Loopback0] ip address 4.4.4.4 255.255.255.255

[DeviceE-Loopback0] quit

# Create a VXLAN tunnel to Device D. The tunnel interface name is Tunnel 1.

[DeviceE] interface tunnel 1 mode vxlan

[DeviceE-Tunnel1] source 4.4.4.4

[DeviceE-Tunnel1] destination 3.3.3.3

[DeviceE-Tunnel1] quit

# Assign Tunnel 1 to VXLAN 10.

[DeviceE] vsi vpna

[DeviceE-vsi-vpna] vxlan 10

[DeviceE-vsi-vpna-vxlan-10] tunnel 1

[DeviceE-vsi-vpna-vxlan-10] quit

[DeviceE-vsi-vpna] quit

# Map GigabitEthernet 3/1/1 to VSI vpna.

[DeviceA] interface gigabitethernet 3/1/1

[DeviceA-GigabitEthernet3/1/1] xconnect vsi vpna

[DeviceA-GigabitEthernet3/1/1] quit

Verifying the configuration

1. Verify the VXLAN-DCI settings on the EDs. This example uses Device B.

# Verify that the VXLAN and VXLAN-DCI tunnel interfaces are up on Device B.

[DeviceB] display interface tunnel

Tunnel1

Current state: UP

Line protocol state: UP

...

Tunnel2

Current state: UP

Line protocol state: UP

...

# Verify that VSI-interface 1 and VSI-interface 2 are up.

[DeviceB] display interface vsi-interface

Vsi-interface1

Current state: UP

Line protocol state: UP

...

Vsi-interface2

Current state: UP

Line protocol state: UP

...

# Verify that the VXLAN and VXLAN-DCI tunnels have been assigned to VXLAN 10 and VXLAN 20, and the VSI interfaces are the gateway interfaces for their respective VSIs.

[DeviceB] display l2vpn vsi verbose

VSI Name: vpna

VSI Index : 0

VSI State : Up

MTU : 1500

Bandwidth : Unlimited

Broadcast Restrain : 5120 kbps

Multicast Restrain : 5120 kbps

Unknown Unicast Restrain: 5120 kbps

MAC Learning : Enabled

MAC Table Limit : Unlimited

MAC Learning rate : -

Drop Unknown : -

Flooding : Enabled

Gateway interface : VSI-interface 1

VXLAN ID : 10

Tunnel Statistics : Disabled

Tunnels:

Tunnel Name Link ID State Type Flood Proxy

Tunnel1 0x5000001 Up Manual Disabled

Tunnel2 0x5000002 Up Manual Disabled

VSI Name: vpnb

VSI Index : 0

VSI State : Up

MTU : 1500

Bandwidth : Unlimited

Broadcast Restrain : 5120 kbps

Multicast Restrain : 5120 kbps

Unknown Unicast Restrain: 5120 kbps

MAC Learning : Enabled

MAC Table Limit : Unlimited

MAC Learning rate : -

Drop Unknown : -

Flooding : Enabled

Gateway interface : VSI-interface 2

VXLAN ID : 20

Tunnel Statistics : Disabled

Tunnels:

Tunnel Name Link ID State Type Flood Proxy

Tunnel1 0x5000001 Up Manual Disabled

Tunnel2 0x5000002 Up Manual Disabled

# Verify that Device B has created ARP entries for the VMs.

[DeviceB] display arp

Type: S-Static D-Dynamic O-Openflow R-Rule I-Invalid

IP address MAC address VLAN/VSI name Interface Aging Type

11.1.1.4 000c-29c1-5e46 11 Vlan11 19 D

10.1.1.11 0cda-41b5-cf09 0 Tunnel1 20 D

10.1.1.12 0011-4400-0102 0 Tunnel1 20 D

10.1.2.11 0cda-41b5-cf89 1 Tunnel2 20 D

2. Verify that VM 1, VM 2, and VM 3 can ping each other. (Details not shown.)

17-VXLAN Configuration Guide

VXLAN network model

VXLAN packet format

Traffic from the local site to a remote site

Traffic from a remote site to the local site

Intra-site unicast forwarding

Inter-site unicast forwarding

Unicast mode (head-end replication)

Multicast mode (tandem replication)

Access modes of VSIs

VLAN access mode

Ethernet access mode

VXLAN tasks at a glance

Configuring a VXLAN tunnel

About VXLAN tunnel configuration

Restrictions and guidelines

Procedure

Assigning a VXLAN tunnel to a VXLAN

About VXLAN tunnel assignment

Procedure

Mapping ACs to a VSI

About Layer 3 interface-to-VSI mapping

Procedure

About Ethernet service instance-to-VSI mapping

Restrictions and guidelines

Procedure

Managing MAC address entries

Restrictions and guidelines

Procedure

About disabling remote-MAC address learning

Procedure

About VXLAN packet check

Restrictions and guidelines

Procedure

Confining floods to the local site

About flood confining to the local site

Restrictions and guidelines

Procedure

Restrictions and guidelines

Procedure

About disabling remote ARP or ND learning for VXLANs

Restrictions and guidelines

Procedure

Restrictions and guidelines

Enabling packet statistics for a Layer 3 interface

Enabling packet statistics for an Ethernet service instance

About packet statistics of VXLAN tunnels

Restrictions and guidelines

Enable packet statistics for all VXLAN tunnels of a VSI

Restrictions and guidelines

Procedure

Display and maintenance commands for VXLANs

VXLAN configuration examples

Network configuration

Procedure

Verifying the configuration

Network configuration

Procedure

Verifying the configuration

Configuring VXLAN IP gateways

About VXLAN IP gateways

VXLAN IP gateways separated from VTEPs

About distributed VXLAN IP gateway deployment

Intra-VXLAN traffic forwarding between sites

Inter-VXLAN traffic forwarding between sites

VXLAN-to-external network traffic forwarding

Restrictions and guidelines

Procedure

Restrictions and guidelines

Procedure

Prerequisites

Procedure

About dynamic ARP or ND entry synchronization for distributed VXLAN IP gateways

Enabling dynamic ARP entry synchronization

Enabling dynamic ND entry synchronization

About subnet assignment to a VSI

Restrictions and guidelines

Procedure

Restrictions and guidelines

Procedure