Virtual eXtensible LAN (VXLAN) is a MAC-in-UDP technology that provides Layer 2 connectivity between distant network sites across an IP network. VXLAN is typically used in data centers and campus access networks for multitenant services.

VXLAN provides the following benefits:

· Support for more virtual switched domains than VLANs—Each VXLAN is uniquely identified by a 24-bit VXLAN ID. The total number of VXLANs can reach 16777216 (224). This specification makes VXLAN a better choice than 802.1Q VLAN to isolate traffic for user terminals.

· Easy deployment and maintenance—VXLAN requires deployment only on the edge devices of the transport network. Devices in the transport network perform typical Layer 3 forwarding.

VXLAN network model

As shown in Figure 1, a VXLAN is a virtual Layer 2 network (known as the overlay network) built on top of an existing physical Layer 3 network (known as the underlay network). The overlay network encapsulates inter-site Layer 2 frames into VXLAN packets and forwards the packets to the destination along the Layer 3 forwarding paths provided by the underlay network. The underlay network is transparent to tenants, and geographically dispersed sites of a tenant are merged into a Layer 2 network.

The transport edge devices assign user terminals to different VXLANs, and then forward traffic between sites for user terminals by using VXLAN tunnels. Supported user terminals include PCs, wireless terminals, and VMs on servers.

The transport edge devices are VXLAN tunnel endpoints (VTEP).

An H3C VTEP uses VSIs and VXLAN tunnels to provide VXLAN services.

· VSI—A virtual switch instance is a virtual Layer 2 switched domain. Each VSI provides switching services only for one VXLAN. VSIs learn MAC addresses and forward frames independently of one another. User terminals in different sites have Layer 2 connectivity if they are in the same VXLAN.

· VXLAN tunnel—Logical point-to-point tunnels between VTEPs over the transport network. Each VXLAN tunnel can trunk multiple VXLANs.

VTEPs encapsulate VXLAN traffic in the VXLAN, outer UDP, and outer IP headers. The devices in the transport network forward VXLAN traffic only based on the outer IP header.

Figure 1 VXLAN network model

VXLAN packet format

As shown in Figure 2, a VTEP encapsulates a frame in the following headers:

· 8-byte VXLAN header—VXLAN information for the frame.

? Flags—If the I bit is 1, the VXLAN ID is valid. If the I bit is 0, the VXLAN ID is invalid. All other bits are reserved and set to 0.

? 24-bit VXLAN ID—Identifies the VXLAN of the frame. It is also called the virtual network identifier (VNI).

· 8-byte outer UDP header for VXLAN—The default VXLAN destination UDP port number is 4789.

· 20-byte outer IP header—Valid addresses of VTEPs or VXLAN multicast groups on the transport network. Devices in the transport network forward VXLAN packets based on the outer IP header.

Figure 2 VXLAN packet format

Working mechanisms

The VTEP uses the following process to forward an inter-site frame:

1. Assigns the frame to its matching VXLAN if the frame is sent between sites.

2. Performs MAC learning on the VXLAN's VSI.

3. Forwards the frame through VXLAN tunnels.

This section describes this process in detail. For intra-site frames in a VSI, the system performs typical Layer 2 forwarding, and it processes 802.1Q VLAN tags as described in "Access modes of VSIs."

Assignment of traffic to VXLANs

Traffic from the local site to a remote site

The VTEP uses the following methods to assign customer frames to a VXLAN:

· Ethernet service instance-to-VSI mapping—The VTEP uses an Ethernet service instance to match a list of VLANs on a site-facing Layer 2 interface. The VTEP assigns customer traffic to a VXLAN by mapping the Ethernet service instance to a VSI.

· VLAN-based VXLAN assignment—The VTEP maps a VLAN to a VXLAN and assigns all frames of the VLAN to the VXLAN.

An Ethernet service instance is identical to an attachment circuit (AC) in L2VPN.

As shown in Figure 3, Ethernet service instance 1 matches VLAN 2 and is mapped to VSI A (VXLAN 10). When a frame from VLAN 2 arrives, the VTEP assigns the frame to VXLAN 10, and looks up VSI A's MAC address table for the outgoing interface.

Figure 3 Identifying traffic from the local site

Traffic from a remote site to the local site

When a frame arrives at a VXLAN tunnel, the VTEP uses the VXLAN ID in the frame to identify its VXLAN.

MAC learning

The VTEP performs source MAC learning on the VSI as a Layer 2 switch.

· For traffic from the local site to the remote site, the VTEP learns the source MAC address before VXLAN encapsulation.

· For traffic from the remote site to the local site, the VTEP learns the source MAC address after removing the VXLAN header.

A VSI's MAC address table includes the following types of MAC address entries:

· Local MAC—Dynamic MAC entries learned from the local site. The outgoing interfaces are site-facing interfaces on which the MAC addresses are learned. VXLAN does not support manual local-MAC entries.

· Remote MAC—MAC entries learned from a remote site. The outgoing interfaces for the MAC addresses are VXLAN tunnel interfaces.

? Static—Manually added MAC entries.

? Dynamic—MAC entries learned in the data plane from incoming traffic on VXLAN tunnels. The learned MAC addresses are contained in the inner Ethernet header.

? BGP EVPN—MAC entries advertised through BGP EVPN. For more information, see EVPN Configuration Guide.

? OpenFlow—MAC entries issued by a remote controller through OpenFlow. For more information, see OpenFlow Configuration Guide.

? OVSDB—MAC entries issued by a remote controller through OVSDB.

The following shows the priority order of different types of remote MAC address entries:

a. Static MAC address entries, and MAC address entries issued by a remote controller through OpenFlow or OVSDB. These types of entries have the same priority and overwrite each other.

b. MAC address entries advertised through BGP EVPN.

c. Dynamic MAC address entries.

Access modes of VSIs

The access mode of a VSI determines how the VTEP processes the 802.1Q VLAN tags in the Ethernet frames.

VLAN access mode

If an Ethernet service instance has the encapsulation untagged frame match criterion, the VTEP can forward untagged frames received from the local site on that instance. The VTEP does not add 802.1Q VLAN tags to frames sent to the local site on the instance.

If other frame match criterion is configured on the Ethernet service instance, Ethernet frames received from or sent to the local site must contain 802.1Q VLAN tags.

· For an Ethernet frame received from the local site, the VTEP removes all its 802.1Q VLAN tags before forwarding the frame.

· For an Ethernet frame destined for the local site, the VTEP adds 802.1Q VLAN tags to the frame before forwarding the frame.

In VLAN access mode, the frame match criterion cannot be encapsulation default on an Ethernet service instance.

In this mode, VXLAN packets sent between sites do not contain 802.1Q VLAN tags. You can use different 802.1Q VLANs to provide the same service in different sites.

Ethernet access mode

The VTEP does not process the 802.1Q VLAN tags of Ethernet frames received from or sent to the local site.

· For an Ethernet frame received from the local site, the VTEP forwards the frame with the 802.1Q VLAN tags intact.

· For an Ethernet frame destined for the local site, the VTEP forwards the frame without adding 802.1Q VLAN tags.

In Ethernet access mode, VXLAN packets sent between VXLAN sites contain 802.1Q VLAN tags. You must use the same VLAN to provide the same service between sites.

Traffic forwarding

This section describes the Layer 2 forwarding processes. For information about Layer 3 forwarding, see "Configuring VXLAN IP gateways."

The VTEP uses the following processes to forward traffic at Layer 2:

· Unicast process—Applies to destination-known unicast traffic.

· Flood process—Applies to multicast, broadcast, and unknown unicast traffic.

When the VTEP forwards VXLAN traffic, it processes the 802.1Q tag in the inner Ethernet header depending on the VSI access mode (VLAN or Ethernet mode). In VLAN access mode, sites can use different VLANs to provide the same service. For more information, see "Access modes of VSIs."

Unicast

The following process (see Figure 4) applies to a known unicast frame between sites:

1. The source VTEP encapsulates the Ethernet frame in the VXLAN/UDP/IP header.

In the outer IP header, the source IP address is the source VTEP's VXLAN tunnel source IP address. The destination IP address is the VXLAN tunnel destination IP address.

2. The source VTEP forwards the encapsulated packet out of the outgoing VXLAN tunnel interface found in the VSI's MAC address table.

3. The intermediate transport devices (P devices) forward the frame to the destination VTEP by using the outer IP header.

4. The destination VTEP removes the headers on top of the inner Ethernet frame. It then performs MAC address table lookup in the VXLAN's VSI to forward the frame out of the matching outgoing interface.

Figure 4 Inter-site unicast

‌

Flood

The VTEP floods a broadcast, multicast, or unknown unicast frame to all site-facing interfaces and VXLAN tunnels in the VXLAN, except for the incoming interface.

VXLAN supports the following modes for flood traffic:

· Unicast mode—Also called head-end replication. The source VTEP replicates the flood frame, and then sends one replica to the destination IP address of each VXLAN tunnel in the VXLAN. See Figure 5.

· Multicast mode—Also called tandem replication. The source VTEP sends the flood frame in a multicast VXLAN packet destined for a multicast group address. Transport network devices replicate and forward the packet to remote VTEPs based on their multicast forwarding entries. See Figure 6.

Each destination VTEP floods the inner Ethernet frame to all the site-facing interfaces in the VXLAN. To avoid loops, the destination VTEPs do not flood the frame to VXLAN tunnels.

Figure 5 Unicast mode

Figure 6 Multicast mode

ARP and ND flood suppression

ARP or ND flood suppression reduces ARP request broadcasts or ND request multicasts by enabling the VTEP to reply to ARP or ND requests on behalf of user terminals.

As shown in Figure 7, this feature snoops ARP or ND packets to populate the ARP or ND flood suppression table with local and remote MAC addresses. If an ARP or ND request has a matching entry, the VTEP replies to the request on behalf of the user terminal. If no match is found, the VTEP floods the request to both local and remote sites.

Figure 7 ARP flood suppression

The following uses ARP flood suppression as an example to explain the flood suppression workflow:

1. Terminal 1 sends an ARP request to obtain the MAC address of Terminal 7.

2. VTEP 1 creates a suppression entry for Terminal 1, and floods the ARP request in the VXLAN.

3. VTEP 2 and VTEP 3 de-encapsulate the ARP request. The VTEPs create a suppression entry for Terminal 1, and broadcast the request in the local site.

4. Terminal 7 sends an ARP reply.

5. VTEP 2 creates a suppression entry for Terminal 7 and forwards the ARP reply to VTEP 1.

6. VTEP 1 de-encapsulates the ARP reply, creates a suppression entry for Terminal 7, and forwards the ARP reply to Terminal 1.

7. Terminal 4 sends an ARP request to obtain the MAC address of Terminal 1 or Terminal 7.

8. VTEP 1 creates a suppression entry for Terminal 4 and replies to the ARP request.

9. Terminal 10 sends an ARP request to obtain the MAC address of Terminal 1.

10. VTEP 3 creates a suppression entry for Terminal 10 and replies to the ARP request.

VXLAN IP gateways

A VXLAN IP gateway provides Layer 3 forwarding services for user terminals in VXLANs. A VXLAN IP gateway can be an independent device or be collocated with a VTEP. For more information about VXLAN IP gateway placement, see "Configuring VXLAN IP gateways."

Protocols and standards

RFC 7348, Virtual eXtensible Local Area Network (VXLAN): A Framework for Overlaying Virtualized Layer 2 Networks over Layer 3 Networks

Configuring basic VXLAN features

Configuration restrictions and guidelines

For VXLANs to operate correctly, follow the restrictions and guidelines in this section.

Hardware compatibility restrictions

When you configure VXLANs, follow these hardware restrictions:

· VXLAN transport-facing interfaces and IRF physical interfaces must be on the following modules:

? The LSQM1SRP8X2QE0 MPU.

? FD interface modules.

? FE interface modules.

? SG interface modules.

· VXLAN site-facing interfaces must be on the following modules:

? LSQM1SRP8X2QE0 MPU.

? EC interface modules.

? FD interface modules.

? FE interface modules.

? SC interface modules:

- LSQM2GP24TSSC0.

- LSQM2GP44TSSC0.

- LSQM2GT24PTSSC0.

- LSQM2GT24TSSC0.

- LSQM2GT48SC0.

- LSQM3GP44TSSC0.

- LSQM4GV48SC0.

? SG interface modules.

· Make sure VXLAN tunnels use the same VLAN interface for forwarding if they share a transport-facing interface on the LSQM1SRP8X2QE0 MPU.

Feature compatibility requirements

When you use VXLAN in conjunction with other features, follow these restrictions and guidelines:

· Do not configure EVI or MPLS settings on VXLANs. For more information about EVI and MPLS, see EVI Configuration Guide and MPLS Configuration Guide.

· Do not use VXLAN together with inclusion of user IP addresses in MAC authentication requests. For more information about including user IP addresses in MAC authentication requests, see MAC authentication in Security Configuration Guide.

· When you configure a site-facing interface that has VXLAN Ethernet service instances, follow these restrictions and guidelines:

? The interface does not support multicast forwarding for the traffic that does not match any Ethernet service instance.

? Do not configure QinQ on the interface. For more information about QinQ, see Layer 2—LAN Switching Configuration Guide.

? Disable the spanning tree protocol by using the undo stp enable command on the interface to ensure interoperation between the VTEP and local site.

? The interface does not support transparent transmission of VXLAN packets if it is configured with the mac-based ac command or its Ethernet service instances use any two of the following criteria:

- encapsulation s-vid vlan-id-list [ only-tagged ]

- encapsulation s-vid vlan-id-list c-vid { vlan-id-list | all }

- encapsulation c-vid vlan-id-list

For other configuration restrictions and guidelines, see "Mapping a static Ethernet service instance to a VSI."

· Do not set the priority trust mode to dscp on any VXLAN transport-facing interfaces. For more information about the priority trust mode of an interface, see ACL and QoS Configuration Guide.

· VTEPs of a multicast-mode VXLAN cannot transparently forward protocol packets (such as ARP or ND packets, and multicast protocol packets) that are received from the local site to remote sites.

· For a multicast-mode VXLAN to forward traffic correctly, do not configure VXLANs or VXLAN tunnels on transport network devices.

· VTEPs do not support load sharing of multicast, broadcast, or unknown-unicast traffic by ECMP routes.

· VXLAN does not support processing frames that have more than two VLAN tags.

VXLAN configuration task list

Tasks at a glance	Remarks
(Required.) Creating a VXLAN on a VSI	N/A
(Required.) Configuring a VXLAN tunnel	N/A
(Required.) Assigning VXLAN tunnels to a VXLAN	To extend a VXLAN to remote sites, you must assign VXLAN tunnels to the VXLAN.
(Required.) Mapping customer frames to a VSI	Perform this task to assign customer traffic to VXLANs.
(Optional.) Managing MAC address entries	N/A
(Optional.) Configuring a multicast-mode VXLAN	By default, the VTEP floods VXLAN traffic in unicast mode. If the network is multicast dense, configure the VTEP to flood VXLAN traffic in multicast mode.
(Optional.) Disabling flooding for a VSI	N/A
(Optional.) Setting the destination UDP port number of VXLAN packets	N/A
(Optional.) Configuring VXLAN packet check	Perform this task to check 802.1Q VLAN tags in the inner Ethernet header of incoming VXLAN packets.
(Optional.) Enabling ARP flood suppression	N/A
(Optional.) Enabling ND flood suppression	N/A
(Optional.) Disabling remote ARP or ND learning for VXLANs	N/A
(Optional.) Enabling VXLAN packet statistics	N/A

Creating a VXLAN on a VSI

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enable L2VPN.	l2vpn enable	By default, L2VPN is disabled.
3. Create a VSI and enter VSI view.	vsi vsi-name	By default, no VSIs exist.
4. (Optional.) Configure a VSI description.	description text	By default, a VSI does not have a description.
5. Enable the VSI.	undo shutdown	By default, a VSI is enabled.
6. (Optional.) Set the MTU for the VSI.	mtu size	The default MTU is 1500 bytes for a VSI.
7. (Optional.) Enable MAC address learning for the VSI.	mac-learning enable	By default, MAC address learning is enabled for a VSI. The device does not support disabling MAC address learning for a VXLAN VSI. The undo mac-learning enable command does not take effect on VXLAN VSIs.
8. Create a VXLAN and enter VXLAN view.	vxlan vxlan-id	By default, no VXLANs exist. You can create only one VXLAN on a VSI. The VXLAN ID must be unique for each VSI.

Configuring a VXLAN tunnel

This task provides basic VXLAN tunnel configuration. For more information about tunnel configuration and commands, see Layer 3—IP Services Configuration Guide and Layer 3—IP Services Command Reference.

Make sure the following VXLAN tunnels are not associated with the same VXLAN when they have the same tunnel destination IP address:

· A VXLAN tunnel automatically created by EVPN.

· A manually created VXLAN tunnel.

For more information about EVPN, see EVPN Configuration Guide.

To configure a VXLAN tunnel:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Create a VXLAN tunnel interface and enter tunnel interface view.	interface tunnel tunnel-number mode vxlan	By default, no tunnel interfaces exist. The endpoints of a tunnel must use the same tunnel mode.
3. Specify a source IP address or source interface for the tunnel.	source { ipv4-address \| interface-type interface-number }	IMPORTANT: Do not perform this step if you are using OVSDB for VXLAN tunnel management. By default, no source IP address or source interface is specified for a tunnel. This step specifies the source IP address in the outer IP header of tunneled VXLAN packets. If an interface is specified, its primary IP address is used. For a multicast-mode VXLAN, the source IP address cannot be a loopback interface's address, and the source interface cannot be a loopback interface.
4. Specify a destination IP address for the tunnel.	destination ipv4-address	By default, no destination IP address is specified for a tunnel. Specify the remote VTEP's IP address. This IP address will be the destination IP address in the outer IP header of tunneled VXLAN packets. As a best practice, do not configure multiple VXLAN tunnels to use the same source and destination IP addresses.
5. (Optional.) Enable BFD on the tunnel.	tunnel bfd enable destination-mac mac-address	By default, BFD is disabled on a tunnel. For BFD sessions to come up, you must reserve a VXLAN by using the reserved vxlan command. Do not use BFD together with uRPF. When uRPF is enabled, BFD sessions cannot come up. For more information about uRPF, see Security Configuration Guide.
6. (Optional.) Return to system view.	quit	N/A
7. (Optional.) Specify the reserved VXLAN.	reserved vxlan vxlan-id	By default, no VXLAN has been reserved. You can specify only one reserved VXLAN on the VTEP. The reserved VXLAN cannot be the VXLAN created on any VSI. The reserved VXLAN ID cannot be the same as the remote VXLAN ID specified by using the mapping vni command. For more information about the mapping vni command, see EVPN Command Reference.

Assigning VXLAN tunnels to a VXLAN

Overview

To provide Layer 2 connectivity for a VXLAN between two sites, you must assign the VXLAN tunnel between the sites to the VXLAN.

You can assign multiple VXLAN tunnels to a VXLAN, and configure a VXLAN tunnel to trunk multiple VXLANs. For a unicast-mode VXLAN, the system floods unknown unicast, multicast, and broadcast traffic to each tunnel associated with the VXLAN.

Configuration restrictions and guidelines:

When you assign VXLAN tunnels to a VXLAN, follow these restrictions and guidelines:

· To assign a pair of primary and backup VXLAN tunnels to the VXLAN, specify the backup-tunnel tunnel-number option when you execute the tunnel command. When the primary VXLAN tunnel is operating correctly, the backup VXLAN tunnel does not forward traffic. When the primary VXLAN tunnel goes down, traffic is switched to the backup VXLAN tunnel.

· To enable IPoE relay agent on a VXLAN tunnel, specify the relay-agent ipoe keyword when you execute the tunnel command. The device will use the VXLAN tunnel to send IPoE packets received from the associated VXLAN to the remote VTEP.

Typically, IPoE relay agent is used on DPs in the forwarding-control separation solution. For a DP to send control traffic (IPoE packets) to a CP, you must enable IPoE relay agent on the VXLAN tunnel between the DP and the CP.

The forwarding-control separation solution cannot be used together with ARP/ND attack protection or DHCP/DHCPv6 attack protection (DHCP/DHCPv6 snooping trusted ports for example).

IMPORTANT:

VXLAN-DCI tunnels do not support IPoE relay agent.

The following restrictions apply to a VXLAN tunnel enabled with IPoE relay agent:

? On the CP and the DP, the VSI interfaces associated with the same VXLAN must use the same MAC address.

? You must use the undo mac-address static source-check enable command on all transport-facing interfaces.

? The device does not support DHCP or DHCPv6 features when IPoE relay agent is enabled.

? Follow these restrictions and guidelines when you configure the VSI associated with a VXLAN tunnel enabled with IPoE relay agent:

- The VSI uses ARP and ND entries issued by the CP. It does not support ARP/ND learning or ARP-/ND-related features, including ARP/ND flood suppression, ARP/ND detection, local proxy ARP, and local ND proxy.

- If the corresponding VXLAN is associated with multiple VXLAN tunnels, the VSI forwards ARP/ND and DHCP/DHCPv6 broadcast traffic over all these VXLAN tunnels.

- Collection of VSI outgoing traffic statistics is not supported.

- The Ethernet service instances of the VSI support only the encapsulation s-vid vlan-id [ only-tagged ] and encapsulation s-vid { vlan-id | vlan-id-list } c-vid { vlan-id-list | all } criteria.

Configuration procedure

To assign VXLAN tunnels to a VXLAN:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enter VSI view.	vsi vsi-name	N/A
3. Enter VXLAN view.	vxlan vxlan-id	N/A
4. Assign VXLAN tunnels to the VXLAN.	tunnel { tunnel-number [ backup-tunnel tunnel-number \| relay-agent ipoe ] \| all }	By default, a VXLAN does not contain any VXLAN tunnels. For full Layer 2 connectivity in the VXLAN, make sure the VXLAN contains the VXLAN tunnel between each pair of sites in the VXLAN.

Mapping customer frames to a VSI

Restrictions and guidelines for different mapping methods

VLAN-based VXLAN assignment is mutually exclusive with the manually created Ethernet service instances and the Ethernet service instances automatically created for 802.1X or MAC authentication VSI assignment. To create these Ethernet service instances, you must first disable VLAN-based VXLAN assignment by using the undo vxlan vlan-based command. To enable VLAN-based VXLAN assignment, you must first delete all these Ethernet service instances.

Mapping a static Ethernet service instance to a VSI

A static Ethernet service instance matches a list of VLANs on a site-facing interface. The VTEP assigns customer traffic from the VLANs to a VXLAN by mapping the Ethernet service instance to a VSI.

For a VSI that uses Ethernet access mode, you can manipulate the VLAN tags of incoming and outgoing traffic in its Ethernet service instance. The VLAN tag processing rules include adding VLAN tags, replacing VLAN tags, and removing VLAN tags. For information about the restrictions and guidelines for configuring VLAN tag processing rules, see the rewrite inbound tag and rewrite outbound tag commands in VXLAN Command Reference.

Configuration restrictions and guidelines

An Ethernet service instance can contain only one match criterion. To change the match criterion, you must remove the original criterion first. When you remove the match criterion in an Ethernet service instance, the mapping between the service instance and the VSI is removed automatically.

If an Ethernet service instance contains the encapsulation default match criterion, traffic is matched as follows:

· The service instance matches any frames if it is the only instance on the interface.

· The service instance matches frames that do not match any other service instance if multiple instances exist on the interface.

Do not use VLAN mapping on an interface that has an Ethernet service instance matching multiple inner or outer VLANs. Any violation results in incorrect packet forwarding. To recover the service, you must delete the collision configuration and reboot the module that hosts the interface. For more information about VLAN mappings, see Layer 2—LAN Switching Configuration Guide.

For correct traffic processing, do not use the outer VLAN specified with the encapsulation command to provide any other services, including Layer 2 and Layer 3 services.

On PEXs in an IRF 3.1 system, Ethernet service instances support only the encapsulation s-vid vlan-id criterion. For more information about PEXs, see IRF 3.1 configuration in Virtual Technologies Configuration Guide.

To match frames from a VLAN correctly, make sure you have created the VLAN and assigned the interface to the VLAN. If the default, tagged, or untagged criterion is used, you must assign the interface to its default VLAN.

To match untagged frames when the VLAN access mode is used, you must use the encapsulation untagged command.

You must specify the Ethernet access mode if you set the match criterion to default or tagged or configure the match criterion as matching multiple outer or inner VLANs.

If you do not specify an access mode, the default VLAN access mode is used.

If an Ethernet service instance is configured to match multiple outer VLANs, the following restrictions apply:

· The Ethernet service instance can match only tagged packets.

· The interface that hosts the Ethernet service instance does not support 802.1X, MAC authentication, or port security. For more information, see Security Configuration Guide.

If you have configured VLAN tag processing rules on an Ethernet service instance, do not configure DHCP settings on the Ethernet service instance or on the interface that hosts the Ethernet service instance. For more information about DHCP, see Layer 3—IP Services Configuration Guide.

MAC authentication is supported on an interface only when the Ethernet service instances on that interface use the encapsulation s-vid vlan-id [ only-tagged ] criterion.

Configuration procedure

To map a static Ethernet service instance to a VSI:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enter Layer 2 Ethernet interface view or Layer 2 aggregate interface view.	· interface interface-type interface-number · interface bridge-aggregation interface-number	N/A
3. Configure the port link type.	port link-type { access \| trunk \| hybrid }	The default port link type is access.
4. Assign the interface to VLANs.	· Access link type: port access vlan vlan-id · Trunk link type: port trunk permit vlan { vlan-id-list \| all } · Hybrid link type: port hybrid vlan vlan-id-list { tagged \| untagged }	Make sure you have created the VLANs.
5. Create an Ethernet service instance and enter Ethernet service instance view.	service-instance instance-id	By default, no Ethernet service instances exist.
6. Configure a frame match criterion.	· Match frames that do not match any other service instance on the interface: encapsulation default · Match any 802.1Q tagged or untagged frames: encapsulation { tagged \| untagged } · Match frames tagged with the specified inner 802.1Q VLAN IDs: encapsulation c-vid { vlan-id \| vlan-id-list } · Match frames tagged with the specified outer 802.1Q VLAN IDs: encapsulation s-vid { vlan-id \| vlan-id-list } [ only-tagged ] · Match frames tagged with the specified outer and inner 802.1Q VLAN IDs: encapsulation s-vid { vlan-id \| vlan-id-list } c-vid { vlan-id-list \| all }	By default, an Ethernet service instance does not contain a frame match criterion.
7. (Optional.) Configure the VLAN tag processing rule for incoming traffic.	rewrite inbound tag { nest { c-vid vlan-id \| s-vid vlan-id [ c-vid vlan-id ] } \| remark { { 1-to-1 \| 2-to-1 } { c-vid vlan-id \| s-vid vlan-id } \| { 1-to-2 \| 2-to-2 } s-vid vlan-id c-vid vlan-id } \| strip { c-vid \| s-vid [ c-vid ] } } [ symmetric ]	By default, VLAN tags of incoming traffic are not processed.
8. (Optional.) Configure the VLAN tag processing rule for outgoing traffic.	rewrite outbound tag { nest { c-vid vlan-id \| s-vid vlan-id [ c-vid vlan-id ] } \| remark { { 1-to-1 \| 2-to-1 } { c-vid vlan-id \| s-vid vlan-id } \| { 1-to-2 \| 2-to-2 } s-vid vlan-id c-vid vlan-id } \| strip { c-vid \| s-vid [ c-vid ] } }	By default, VLAN tags of outgoing traffic are not processed.
9. Map the Ethernet service instance to a VSI.	xconnect vsi vsi-name [ access-mode { ethernet \| vlan } ] [ track track-entry-number&<1-3> ]	By default, an Ethernet service instance is not mapped to any VSI.

Mapping dynamic Ethernet service instances to VSIs

The 802.1X or MAC authentication feature can use the authorization VSI, the guest VSI, the Auth-Fail VSI, and the critical VSI to control the access of users to network resources. When assigning a user to a VSI, 802.1X or MAC authentication sends the VXLAN feature the VSI information and the user's access information, including access interface, VLAN, and MAC address. Then the VXLAN feature creates a dynamic Ethernet service instance for the user and maps it to the VSI. For more information about 802.1X authentication and MAC authentication, see Security Configuration Guide.

A dynamic Ethernet service instance supports the MAC-based traffic match mode that matches frames by source MAC address.

Configuration restrictions and guidelines

To use MAC-based traffic match mode for dynamic Ethernet service instances, you must enable MAC authentication or 802.1X authentication that uses MAC-based access control.

To use dynamic Ethernet service instances, follow these restrictions and guidelines:

· The site-facing interfaces must be on the following modules:

? The LSQM1SRP8X2QE0 MPU.

? FD interface modules.

? FE interface modules.

? SG interface modules.

· If two users in different VLANs use the same MAC address, they cannot access VXLANs simultaneously through an interface configured with the mac-based ac command.

· The link type of site-facing interfaces must be access or trunk.

· A site-facing interface can forward only untagged packets if it receives packets that do not carry VLAN tags or packets that carry the VLAN tag of the PVID.

· A dynamic Ethernet service instance supports only the frame match criterion configured by using the encapsulation s-vid vlan-id [ only-tagged ] command.

· Packets with the same source MAC address can match only one dynamic Ethernet service instance on an interface.

· Dynamic Ethernet service instances cannot be created on member ports of a Layer 2 aggregation group.

Configuration procedure

The device automatically creates a dynamic Ethernet service instance for an 802.1X or MAC authentication user and maps the Ethernet service instance to a VSI in the following conditions:

· The user is assigned to the guest VSI, Auth-Fail VSI, or critical VSI configured on the device.

· A remote AAA server issues an authorization VSI to the user.

For a dynamic Ethernet service instance to match traffic by source MAC address, enable MAC-based traffic match mode for the dynamic Ethernet service instance.

To enable MAC-based traffic match mode for dynamic Ethernet service instances on an interface:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enter Layer 2 Ethernet interface view or Layer 2 aggregate interface view.	· interface interface-type interface-number · interface bridge-aggregation interface-number	N/A
3. Enable MAC-based traffic match mode for dynamic Ethernet service instances on the interface.	mac-based ac	By default, MAC-based traffic match mode is disabled for dynamic Ethernet service instances.

Configuring VLAN-based VXLAN assignment

VLAN-based VXLAN assignment enables the device to assign all traffic of a VLAN to a VXLAN. If you enable this feature and map a VLAN to a VXLAN, the device automatically performs the following operations:

1. Creates an Ethernet service instance that uses the VLAN ID as its instance ID on each interface in the VLAN. The matching outer VLAN ID of the Ethernet service instances is the VLAN ID.

2. Maps the Ethernet service instances to the VSI of the VXLAN.

Configuration restrictions and guidelines

If you map a VLAN to a VXLAN, the VTEP cannot perform non-VXLAN Layer 2 forwarding in the VLAN. The VLAN interface of the VLAN cannot perform Layer 3 forwarding, either.

The Ethernet service instance creation or deletion time is affected by the number of VLANs mapped to a VXLAN and the number of trunk ports assigned to the VLANs. The more the number, the longer the time. During the AC creation or deletion time, other operations are queued.

Configuration prerequisites

Use the vxlan command to create the VXLAN to which VLANs are mapped.

Configuration procedure

To configure VLAN-based VXLAN assignment:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enable VLAN-based VXLAN assignment.	vxlan vlan-based	By default, VLAN-based VXLAN assignment is disabled.
3. Create a VLAN and enter VLAN view.	vlan vlan-id	By default, a system-defined VLAN exists. The VLAN is VLAN 1. Do not specify VLAN 1 for VLAN-based VXLAN assignment.
4. Map the VLAN to a VXLAN.	vxlan vni vxlan-id	By default, a VLAN is not mapped to a VXLAN. Do not map a VLAN to the L3 VXLAN ID of EVPN.

Managing MAC address entries

With VXLAN, local MAC addresses are learned dynamically. You can log local MAC addresses and local-MAC changes, but you cannot manually add local MAC addresses.

Remote-MAC address entries include the following types:

· Manually created static entries.

· Dynamic entries learned in the data plane.

· Entries advertised through BGP EVPN.

· Entries issued by a remote controller through OpenFlow or OVSDB.

Enabling local-MAC logging

When the local-MAC logging feature is enabled, the VXLAN module immediately sends a log message that contains its learned local MAC addresses to the information center. When a local MAC address is learned or removed, a log message is also sent to the information center to notify the local-MAC change.

With the information center, you can set log message filtering and output rules, including output destinations. For more information about configuring the information center, see Network Management and Monitoring Configuration Guide.

To enable local-MAC logging:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enable local-MAC logging.	vxlan local-mac report	By default, local-MAC logging is disabled.

Configuring static remote-MAC address entries

Do not configure static remote-MAC entries for VXLAN tunnels that are automatically established by using EVPN.

· EVPN re-establishes VXLAN tunnels if the transport-facing interface goes down and then comes up. If you have configured static remote-MAC entries, the entries are deleted when the tunnels are re-established.

· EVPN re-establishes VXLAN tunnels if you perform configuration rollback. If the tunnel IDs change during tunnel re-establishment, configuration rollback fails, and static remote-MAC entries on the tunnels cannot be restored.

For more information about EVPN, see EVPN Configuration Guide.

To configure a static remote-MAC address entry:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Add a static remote-MAC address entry.	mac-address static mac-address interface tunnel tunnel-number vsi vsi-name	By default, VXLAN VSIs do not have static remote-MAC address entries. For the setting to take effect, make sure the VXLAN tunnel has been assigned to the VSI's VXLAN.

Step

Command

Remarks

1. Enter system view.

system-view

N/A

2. Add a static remote-MAC address entry.

mac-address static mac-address interface tunnel tunnel-number vsi vsi-name

By default, VXLAN VSIs do not have static remote-MAC address entries.

For the setting to take effect, make sure the VXLAN tunnel has been assigned to the VSI's VXLAN.

Disabling remote-MAC address learning

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Disable remote-MAC address learning.	vxlan tunnel mac-learning disable	By default, remote-MAC address learning is enabled. When network attacks occur, disable remote-MAC address learning to prevent the device from learning incorrect remote MAC addresses. You can manually add static remote-MAC address entries.

Step

Command

Remarks

1. Enter system view.

system-view

N/A

2. Disable remote-MAC address learning.

vxlan tunnel mac-learning disable

By default, remote-MAC address learning is enabled.

When network attacks occur, disable remote-MAC address learning to prevent the device from learning incorrect remote MAC addresses. You can manually add static remote-MAC address entries.

Enabling software-based MAC learning on an interface

This feature is applicable to SDN networks.

To reduce broadcast traffic in an SDN network, the controller synchronizes the MAC addresses that each VTEP learns among all VTEPs. On a VTEP, an interface can learn MAC addresses in hardware or software.

· In hardware-based learning mode, the software periodically obtains new MAC addresses from the hardware and advertises the MAC addresses to the controller.

· In software-based learning mode, the software instantly issues new MAC addresses to the hardware and the controller as soon as they are learned.

Software-based MAC learning shortens the interval at which the VTEP advertises MAC address reachability information to the controller. However, this mode is resource intensive. When you use this mode, you must fully understand its impact on the device performance.

Software-based MAC learning consumes more resources than the hardware learning method. As a best practice to ensure device performance, do not enable software-based MAC learning if MAC addresses change frequently in the network.

To enable software-based MAC learning on an interface:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enter interface view.	· Enter Layer 2 Ethernet interface view: interface interface-type interface-number · Enter Layer 2 aggregate interface view: interface bridge-aggregation interface-number	N/A
3. Enable software-based MAC learning on the interface.	l2vpn mac-address software-learning enable	By default, software-based MAC learning is disabled on an interface.

Configuring a multicast-mode VXLAN

A multicast-mode VXLAN supports the following multicast methods:

· PIM—VTEPs and transport network devices run PIM to generate multicast forwarding entries. On a VTEP, you can use the IP address of a loopback interface as the source IP address for multicast VXLAN packets. If the VTEP has multiple transport-facing interfaces, PIM dynamically selects the outgoing interfaces for multicast VXLAN packets.

· IGMP host—VTEPs and transport network devices run PIM and IGMP to generate multicast forwarding entries.

? Transport-facing interfaces of VTEPs act as IGMP hosts.

? Transport network devices connected to a VTEP run IGMP.

? All transport network devices run PIM.

On a VTEP, you must use the IP address of the transport-facing interface as the source IP address for multicast VXLAN packets. If the VTEP has multiple transport-facing interfaces, multicast VXLAN packets are sent to the transport network through the interface that provides the source IP address for multicast VXLAN packets.

VTEPs in a multicast-mode VXLAN can use different multicast methods.

For a multicast-mode VXLAN to flood traffic, you must perform the following tasks in addition to multicast-mode configuration:

· Enable IP multicast routing on all VTEPs and transport network devices.

· Configure a multicast routing protocol on transport network devices. A VTEP can be both a multicast source and multicast group member. As a best practice, use BIDIR-PIM.

· Enable IGMP on transport network devices that are connected to an IGMP host-enabled VTEP.

Configuring a VTEP using the PIM method

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enter VSI view.	vsi vsi-name	N/A
3. Enter VXLAN view.	vxlan vxlan-id	N/A
4. Assign a multicast group address for flood traffic, and specify a source IP address for multicast VXLAN packets.	group group-address source source-address	By default, a VXLAN uses unicast mode for flood traffic. No multicast group address or source IP address is specified for multicast VXLAN packets. You must assign all VTEPs in a multicast-mode VXLAN to the same multicast group. You can specify the IP address of a loopback interface as the source IP address for multicast VXLAN packets. For multicast traffic to be forwarded correctly, you must use the source IP address of an up VXLAN tunnel as the source IP address for multicast VXLAN packets.
5. Enter interface view.	interface interface-type interface-number	Enable PIM on the loopback interface and all transport-facing interfaces.
6. Enable PIM.	· Enable PIM-SM pim sm · Enable PIM-DM pim dm	By default, PIM is disabled on an interface.

Configuring a VTEP using the IGMP host method

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enter VSI view.	vsi vsi-name	N/A
3. Enter VXLAN view.	vxlan vxlan-id	N/A
4. Assign a multicast group address for flood traffic, and specify a source IP address for multicast VXLAN packets.	group group-address source source-address	By default, a VXLAN uses unicast mode for flood traffic. No multicast group address or source IP address is specified for multicast VXLAN packets. You must assign all VTEPs in a multicast-mode VXLAN to the same multicast group. You must specify the IP address of the transport-facing interface as the source IP address for multicast VXLAN packets.
5. Enter the view of the transport-facing interface.	interface interface-type interface-number	N/A
6. Enable the IGMP host feature.	igmp host enable	By default, the IGMP host feature is disabled on an interface. The IGMP host feature enables the interface to send IGMP reports in response to IGMP queries before it can receive traffic from the multicast group. The igmp host enable command takes effect after you execute the multicast routing command.

Disabling flooding for a VSI

By default, the VTEP floods broadcast, unknown unicast, and unknown multicast frames received from the local site to the following interfaces in the frame's VXLAN:

· All site-facing interfaces except for the incoming interface.

· All VXLAN and VXLAN-DCI tunnel interfaces.

When receiving broadcast, unknown unicast, and unknown multicast frames on VXLAN tunnel interfaces, the device floods the frames to all site-facing interfaces in the frames' VXLAN.

To confine a kind of flood traffic, disable flooding for that kind of flood traffic on the VSI bound to the VXLAN.

To disable flooding for a VSI:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enter VSI view.	vsi vsi-name	N/A
3. Disable flooding for the VSI.	flooding disable { all \| { broadcast \| unknown-multicast \| unknown-unicast } * } [ all-direction \| dci ]	By default, flooding is enabled for a VSI. To disable flooding only to VXLAN-DCI tunnel interfaces, specify the dci keyword. To disable flooding to both VXLAN tunnel interfaces and VXLAN-DCI tunnel interfaces, do not specify the dci keyword.
4. (Optional.) Enable selective flood for a MAC address.	selective-flooding mac-address mac-address	By default, selective flood is disabled. Use this feature to exclude a remote MAC address from the remote flood suppression done by using the flooding disable command. The VTEP will flood the frames destined for the specified MAC address to remote sites when floods are confined to the local site.

Setting the destination UDP port number of VXLAN packets

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Set a destination UDP port for VXLAN packets.	vxlan udp-port port-number	By default, the destination UDP port number is 4789 for VXLAN packets. You must configure the same destination UDP port number on all VTEPs in a VXLAN.

Step

Command

Remarks

1. Enter system view.

system-view

N/A

2. Set a destination UDP port for VXLAN packets.

vxlan udp-port port-number

By default, the destination UDP port number is 4789 for VXLAN packets.

You must configure the same destination UDP port number on all VTEPs in a VXLAN.

Configuring VXLAN packet check

The device checks the inner Ethernet header of each VXLAN packet for 802.1Q VLAN tags. If the header contains 802.1Q VLAN tags, the device drops the packet.

If a remote VTEP uses the Ethernet access mode, its VXLAN packets might contain 802.1Q VLAN tags. To prevent the local VTEP from dropping the VXLAN packets, do not execute the vxlan invalid-vlan-tag discard command on the local VTEP.

The access mode is configurable by using the xconnect vsi command.

To configure VXLAN packet check:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enable the VTEP to drop VXLAN packets that have 802.1Q VLAN tags in the inner Ethernet header.	vxlan invalid-vlan-tag discard	By default, the VTEP does not check the inner Ethernet header for 802.1Q VLAN tags.

Enabling ARP flood suppression

Use ARP flood suppression to reduce ARP request broadcasts.

The aging timer is fixed at 25 minutes for ARP flood suppression entries. If the suppression table is full, the VTEP stops learning new entries. For the VTEP to learn new entries, you must wait for old entries to age out, or use the reset arp suppression command to clear the table.

If the flooding disable command is executed on a VSI that is enabled with ARP flood suppression, follow these restrictions and guidelines:

· As a best practice, set the MAC aging timer to a higher value than the aging timer for ARP flood suppression entries on all VTEPs. This setting prevents the traffic blackhole that occurs when a MAC address entry ages out before its ARP flood suppression entry ages out.

· You must use the mac-address static command to manually add remote MAC address entries on each VTEP.

· If user terminals obtain IP addresses through DHCP, for the VSI to flood DHCP requests, you must perform the following tasks on VTEPs:

? Execute the dhcp snooping trust command to configure ACs in the VSI as DHCP snooping trusted interfaces.

? Execute the dhcp snooping trust tunnel command to configure VXLAN tunnel interfaces in the VSI as DHCP snooping trusted interfaces.

For more information about DHCP snooping, see Layer 3—IP Services Configuration Guide.

To set the MAC aging timer, use the mac-address timer command.

If the VLAN access mode is used, do not configure the encapsulation s-vid vlan-id criterion to match the PVID of a site-facing interface. If the criterion matches the PVID and ARP requests match ARP flood suppression entries, the device removes the VLAN tags of the ARP responses sent to user terminals. As a result, user terminals that require ARP responses to be VLAN-tagged cannot learn ARP information.

When you configure ARP flood suppression on a multicast-mode VXLAN, follow these restrictions and guidelines:

· Make sure ARP flood suppression is enabled or disabled across the VTEPs in the VXLAN.

· Do not enable ARP flood suppression if the VXLAN contains third-party VTEPs.

To enable ARP flood suppression:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enter VSI view.	vsi vsi-name	N/A
3. Enable ARP flood suppression.	arp suppression enable	By default, ARP flood suppression is disabled.

Enabling ND flood suppression

Configuration restrictions and guidelines

The LSQM1SRP8X2QE0 MPU does not support ND flood suppression.

Configuration procedure

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enter VSI view.	vsi vsi-name	N/A
3. Enable ND flood suppression.	ipv6 nd suppression enable	By default, ND flood suppression is disabled.

Disabling remote ARP or ND learning for VXLANs

By default, the device learns ARP or ND information of remote user terminals from packets received on VXLAN tunnel interfaces. To save resources on VTEPs in an SDN transport network, you can temporarily disable remote ARP or ND learning when the controller and VTEPs are synchronizing entries. After the entry synchronization is completed, enable remote ARP or ND learning.

As a best practice, disable remote ARP or ND learning for VXLANs only when the controller and VTEPs are synchronizing entries.

To disable remote ARP or ND learning for VXLANs:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Disable remote ARP learning for VXLANs.	vxlan tunnel arp-learning disable	By default, remote ARP learning is enabled for VXLANs.
3. Disable remote ND learning for VXLANs.	vxlan tunnel nd-learning disable	By default, remote ND learning is enabled for VXLANs.

Enabling VXLAN packet statistics

You can collect packet statistics for a VXLAN VSI or AC.

Enabling packet statistics for a VSI

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enter VSI view.	vsi vsi-name	N/A
3. Enable packet statistics for the VSI.	statistics enable	By default, the packet statistics feature is disabled for all VSIs.
4. (Optional.) Display packet statistics for VSIs.	display l2vpn vsi verbose	This command is available in any view.

Enabling packet statistics for an Ethernet service instance

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enter interface view.	· Enter Layer 2 Ethernet interface view: interface interface-type interface-number · Enter Layer 2 aggregate interface view: interface bridge-aggregation interface-number	N/A
3. Enter Ethernet service instance view.	service-instance instance-id	N/A
4. Enable packet statistics for the Ethernet service instance.	statistics enable	By default, the packet statistics feature is disabled for all Ethernet service instances. For the statistics enable command to take effect, you must configure a frame match criterion for the Ethernet service instance and map it to a VSI. If you modify the frame match criterion or VSI mapping, packet statistics of the instance are cleared.
5. (Optional.) Display packet statistics for Ethernet service instances.	display l2vpn service-instance [ interface interface-type interface-number [ service-instance instance-id ] ] [ verbose ]	This command is available in any view.

Enabling packet statistics for Ethernet service instances of a VLAN

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enter VLAN view.	vlan vlan-id	N/A
3. Enable packet statistics for Ethernet service instances of the VLAN.	ac statistics enable	By default, packet statistics are disabled for Ethernet service instances of a VLAN. This feature enables packet statistics for the Ethernet service instances automatically created for VLAN-based VXLAN assignment. Before you enable this feature, you must use the vxlan vlan-based command to enable VLAN-based VXLAN assignment.

Displaying and maintaining VXLANs

Execute display commands in any view and reset commands in user view.

Task	Command
(In standalone mode.) Display ARP flood suppression entries on VSIs.	display arp suppression vsi [ name vsi-name ] [ slot slot-number ] [ count ]
(In IRF mode.) Display ARP flood suppression entries on VSIs.	display arp suppression vsi [ name vsi-name ] [ chassis chassis-number slot slot-number ] [ count ]
Display MAC address entries for VSIs.	display l2vpn mac-address [ vsi vsi-name ] [ dynamic ] [ count \| verbose ]
Display information about Ethernet service instances.	display l2vpn service-instance [ interface interface-type interface-number [ service-instance instance-id ] ] [ verbose ]
Display information about VSIs.	display l2vpn vsi [ name vsi-name ] [ verbose ]
Display information about the multicast groups that contain IGMP host-enabled interfaces.	display igmp host group [ group-address \| interface interface-type interface-number ] [ verbose ]
Display information about tunnel interfaces.	display interface [ tunnel [ number ] ] [ brief [ description \| down ] ]
(In standalone mode.) Display ND flood suppression entries on VSIs.	display ipv6 nd suppression vsi [ name vsi-name ] [ slot slot-number ] [ count ]
(In IRF mode.) Display ND flood suppression entries on VSIs.	display ipv6 nd suppression vsi [ name vsi-name ] [ chassis chassis-number slot slot-number ] [ count ]
Display VXLAN tunnel information for VXLANs.	display vxlan tunnel [ vxlan vxlan-id ]
Clear ARP flood suppression entries on VSIs.	reset arp suppression vsi [ name vsi-name ]
Clear ND flood suppression entries on VSIs.	reset ipv6 nd suppression vsi [ name vsi-name ]
Clear dynamic MAC address entries on VSIs.	reset l2vpn mac-address [ vsi vsi-name ]
Clear packet statistics on VSIs.	reset l2vpn statistics vsi [ name vsi-name ]
Clear packet statistics on ACs.	reset l2vpn statistics ac [ interface interface-type interface-number service-instance instance-id ]

NOTE:

For more information about the display interface tunnel command, see tunneling commands in Layer 3—IP Services Command Reference.

VXLAN configuration examples

Unicast-mode VXLAN configuration example

Network requirements

As shown in Figure 8:

· Configure VXLAN 10 as a unicast-mode VXLAN on Switch A, Switch B, and Switch C to provide Layer 2 connectivity for the VMs across the network sites.

· Manually establish VXLAN tunnels and assign the tunnels to VXLAN 10.

· Enable remote-MAC address learning.

Figure 8 Network diagram

‌

Configuration procedure

1. Configure IP addresses and unicast routing settings:

# Assign IP addresses to interfaces, as shown in Figure 8. (Details not shown.)

# Configure OSPF on all transport network switches (Switches A through D). (Details not shown.)

2. Configure Switch A:

# Enable L2VPN.

<SwitchA> system-view

[SwitchA] l2vpn enable

# Create VSI vpna and VXLAN 10.

[SwitchA] vsi vpna

[SwitchA-vsi-vpna] vxlan 10

[SwitchA-vsi-vpna-vxlan-10] quit

[SwitchA-vsi-vpna] quit

# Assign an IP address to Loopback 0. The IP address will be used as the source IP address of the VXLAN tunnels to Switch B and Switch C.

[SwitchA] interface loopback 0

[SwitchA-Loopback0] ip address 1.1.1.1 255.255.255.255

[SwitchA-Loopback0] quit

# Create a VXLAN tunnel to Switch B. The tunnel interface name is Tunnel 1.

[SwitchA] interface tunnel 1 mode vxlan

[SwitchA-Tunnel1] source 1.1.1.1

[SwitchA-Tunnel1] destination 2.2.2.2

[SwitchA-Tunnel1] quit

# Create a VXLAN tunnel to Switch C. The tunnel interface name is Tunnel 2.

[SwitchA] interface tunnel 2 mode vxlan

[SwitchA-Tunnel2] source 1.1.1.1

[SwitchA-Tunnel2] destination 3.3.3.3

[SwitchA-Tunnel2] quit

# Assign Tunnel 1 and Tunnel 2 to VXLAN 10.

[SwitchA] vsi vpna

[SwitchA-vsi-vpna] vxlan 10

[SwitchA-vsi-vpna-vxlan-10] tunnel 1

[SwitchA-vsi-vpna-vxlan-10] tunnel 2

[SwitchA-vsi-vpna-vxlan-10] quit

[SwitchA-vsi-vpna] quit

# On Ten-GigabitEthernet 1/0/1, create Ethernet service instance 1000 to match VLAN 2.

[SwitchA] interface ten-gigabitethernet 1/0/1

[SwitchA-Ten-GigabitEthernet1/0/1] port link-type trunk

[SwitchA-Ten-GigabitEthernet1/0/1] port trunk permit vlan 2

[SwitchA-Ten-GigabitEthernet1/0/1] service-instance 1000

[SwitchA-Ten-GigabitEthernet1/0/1-srv1000] encapsulation s-vid 2

# Map Ethernet service instance 1000 to VSI vpna.

[SwitchA-Ten-GigabitEthernet1/0/1-srv1000] xconnect vsi vpna

[SwitchA-Ten-GigabitEthernet1/0/1-srv1000] quit

[SwitchA-Ten-GigabitEthernet1/0/1] quit

3. Configure Switch B:

# Enable L2VPN.

<SwitchB> system-view

[SwitchB] l2vpn enable

# Create VSI vpna and VXLAN 10.

[SwitchB] vsi vpna

[SwitchB-vsi-vpna] vxlan 10

[SwitchB-vsi-vpna-vxlan-10] quit

[SwitchB-vsi-vpna] quit

# Assign an IP address to Loopback 0. The IP address will be used as the source IP address of the VXLAN tunnels to Switch A and Switch C.

[SwitchB] interface loopback 0

[SwitchB-Loopback0] ip address 2.2.2.2 255.255.255.255

[SwitchB-Loopback0] quit

# Create a VXLAN tunnel to Switch A. The tunnel interface name is Tunnel 2.

[SwitchB] interface tunnel 2 mode vxlan

[SwitchB-Tunnel2] source 2.2.2.2

[SwitchB-Tunnel2] destination 1.1.1.1

[SwitchB-Tunnel2] quit

# Create a VXLAN tunnel to Switch C. The tunnel interface name is Tunnel 3.

[SwitchB] interface tunnel 3 mode vxlan

[SwitchB-Tunnel3] source 2.2.2.2

[SwitchB-Tunnel3] destination 3.3.3.3

[SwitchB-Tunnel3] quit

# Assign Tunnel 2 and Tunnel 3 to VXLAN 10.

[SwitchB] vsi vpna

[SwitchB-vsi-vpna] vxlan 10

[SwitchB-vsi-vpna-vxlan-10] tunnel 2

[SwitchB-vsi-vpna-vxlan-10] tunnel 3

[SwitchB-vsi-vpna-vxlan-10] quit

[SwitchB-vsi-vpna] quit

# On Ten-GigabitEthernet 1/0/1, create Ethernet service instance 1000 to match VLAN 2.

[SwitchB] interface ten-gigabitethernet 1/0/1

[SwitchB-Ten-GigabitEthernet1/0/1] port link-type trunk

[SwitchB-Ten-GigabitEthernet1/0/1] port trunk permit vlan 2

[SwitchB-Ten-GigabitEthernet1/0/1] service-instance 1000

[SwitchB-Ten-GigabitEthernet1/0/1-srv1000] encapsulation s-vid 2

# Map Ethernet service instance 1000 to VSI vpna.

[SwitchB-Ten-GigabitEthernet1/0/1-srv1000] xconnect vsi vpna

[SwitchB-Ten-GigabitEthernet1/0/1-srv1000] quit

[SwitchB-Ten-GigabitEthernet1/0/1] quit

4. Configure Switch C:

# Enable L2VPN.

<SwitchC> system-view

[SwitchC] l2vpn enable

# Create VSI vpna and VXLAN 10.

[SwitchC] vsi vpna

[SwitchC-vsi-vpna] vxlan 10

[SwitchC-vsi-vpna-vxlan-10] quit

[SwitchC-vsi-vpna] quit

# Assign an IP address to Loopback 0. The IP address will be used as the source IP address of the VXLAN tunnels to Switch A and Switch B.

[SwitchC] interface loopback 0

[SwitchC-Loopback0] ip address 3.3.3.3 255.255.255.255

[SwitchC-Loopback0] quit

# Create a VXLAN tunnel to Switch A. The tunnel interface name is Tunnel 1.

[SwitchC] interface tunnel 1 mode vxlan

[SwitchC-Tunnel1] source 3.3.3.3

[SwitchC-Tunnel1] destination 1.1.1.1

[SwitchC-Tunnel1] quit

# Create a VXLAN tunnel to Switch B. The tunnel interface name is Tunnel 3.

[SwitchC] interface tunnel 3 mode vxlan

[SwitchC-Tunnel3] source 3.3.3.3

[SwitchC-Tunnel3] destination 2.2.2.2

[SwitchC-Tunnel3] quit

# Assign Tunnel 1 and Tunnel 3 to VXLAN 10.

[SwitchC] vsi vpna

[SwitchC-vsi-vpna] vxlan 10

[SwitchC-vsi-vpna-vxlan-10] tunnel 1

[SwitchC-vsi-vpna-vxlan-10] tunnel 3

[SwitchC-vsi-vpna-vxlan-10] quit

[SwitchC-vsi-vpna] quit

# On Ten-GigabitEthernet 1/0/1, create Ethernet service instance 1000 to match VLAN 2.

[SwitchC] interface ten-gigabitethernet 1/0/1

[SwitchC-Ten-GigabitEthernet1/0/1] port link-type trunk

[SwitchC-Ten-GigabitEthernet1/0/1] port trunk permit vlan 2

[SwitchC-Ten-GigabitEthernet1/0/1] service-instance 1000

[SwitchC-Ten-GigabitEthernet1/0/1-srv1000] encapsulation s-vid 2

# Map Ethernet service instance 1000 to VSI vpna.

[SwitchC-Ten-GigabitEthernet1/0/1-srv1000] xconnect vsi vpna

[SwitchC-Ten-GigabitEthernet1/0/1-srv1000] quit

[SwitchC-Ten-GigabitEthernet1/0/1] quit

Verifying the configuration

1. Verify the VXLAN settings on the VTEPs. This example uses Switch A.

# Verify that the VXLAN tunnel interfaces on the VTEP are up.

[SwitchA] display interface tunnel 1

Tunnel1

Current state: UP

Line protocol state: UP

Description: Tunnel1 Interface

Bandwidth: 64kbps

Maximum transmission unit: 1464

Internet protocol processing: Disabled

Last clearing of counters: Never

Tunnel source 1.1.1.1, destination 2.2.2.2

Tunnel protocol/transport UDP_VXLAN/IP

Last 300 seconds input rate: 0 bytes/sec, 0 bits/sec, 0 packets/sec

Last 300 seconds output rate: 0 bytes/sec, 0 bits/sec, 0 packets/sec

Input: 0 packets, 0 bytes, 0 drops

Output: 0 packets, 0 bytes, 0 drops

# Verify that the VXLAN tunnels have been assigned to the VXLAN.

[SwitchA] display l2vpn vsi verbose

VSI Name: vpna

VSI Index : 0

VSI State : Up

MTU : 1500

Bandwidth : -

Broadcast Restrain : -

Multicast Restrain : -

Unknown Unicast Restrain: -

MAC Learning : Enabled

MAC Table Limit : -

MAC Learning rate : -

Drop Unknown : -

Flooding : Enabled

VXLAN ID : 10

Tunnels:

Tunnel Name Link ID State Type Flood proxy

Tunnel1 0x5000001 Up Manual Disabled

Tunnel2 0x5000002 Up Manual Disabled

ACs:

AC Link ID State Type

XGE1/0/1 srv1000 0 Up Manual

# Verify that the VTEP has learned the MAC addresses of remote VMs.

<SwitchA> display l2vpn mac-address

MAC Address State VSI Name Link ID/Name Aging

cc3e-5f9c-6cdb Dynamic vpna Tunnel1 Aging

cc3e-5f9c-23dc Dynamic vpna Tunnel2 Aging

--- 2 mac address(es) found ---

2. Verify that VM 1, VM 2, and VM 3 can ping each other. (Details not shown.)

Multicast-mode VXLAN configuration example

Network requirements

As shown in Figure 9:

· Configure VXLAN 10 as a multicast-mode VXLAN on Switch A, Switch B, and Switch C to provide Layer 2 connectivity for the VMs across the network sites.

· Manually establish VXLAN tunnels and assign the tunnels to VXLAN 10.

· Enable remote-MAC address learning.

Figure 9 Network diagram

‌

Table 1 IP address assignment

Device	Interface	IP address	Device	Interface	IP address
Switch A:			Switch C:
	VLAN-interface 11	11.1.1.1/24		VLAN-interface 13	13.1.1.3/24
Switch D:			Switch E:
	VLAN-interface 11	11.1.1.4/24		VLAN-interface 13	13.1.1.5/24
	VLAN-interface 21	21.1.1.4/24		VLAN-interface 23	23.1.1.5/24
Switch F:			Switch G:
	VLAN-interface 21	21.1.1.6/24		VLAN-interface 12	12.1.1.7/24
	VLAN-interface 22	22.1.1.6/24		VLAN-interface 22	22.1.1.7/24
	VLAN-interface 23	23.1.1.6/24	Switch B:
	Loop 0	6.6.6.6/32		VLAN-interface 12	12.1.1.2/24

Configuration procedure

1. Configure IP addresses and unicast routing settings:

# Assign IP addresses to interfaces, as shown in Figure 9. (Details not shown.)

# Configure OSPF on all transport network switches (Switches A through G). (Details not shown.)

2. Configure Switch A:

# Enable L2VPN.

<SwitchA> system-view

[SwitchA] l2vpn enable

# Enable IP multicast routing.

[SwitchA] multicast routing

[SwitchA-mrib] quit

# Create VSI vpna and VXLAN 10.

[SwitchA] vsi vpna

[SwitchA-vsi-vpna] vxlan 10

[SwitchA-vsi-vpna-vxlan-10] quit

[SwitchA-vsi-vpna] quit

# Assign an IP address to VLAN-interface 11, and enable the IGMP host feature on the interface. This interface's IP address will be the source IP address of VXLAN packets sent by the VTEP.

[SwitchA] interface vlan-interface 11

[SwitchA-Vlan-interface11] ip address 11.1.1.1 24

[SwitchA-Vlan-interface11] igmp host enable

[SwitchA-Vlan-interface11] quit

# Create a VXLAN tunnel to Switch B. The tunnel interface name is Tunnel 1.

[SwitchA] interface tunnel 1 mode vxlan

[SwitchA-Tunnel1] source 11.1.1.1

[SwitchA-Tunnel1] destination 12.1.1.2

[SwitchA-Tunnel1] quit

# Create a VXLAN tunnel to Switch C. The tunnel interface name is Tunnel 2.

[SwitchA] interface tunnel 2 mode vxlan

[SwitchA-Tunnel2] source 11.1.1.1

[SwitchA-Tunnel2] destination 13.1.1.3

[SwitchA-Tunnel2] quit

# Assign Tunnel 1 and Tunnel 2 to VXLAN 10.

[SwitchA] vsi vpna

[SwitchA-vsi-vpna] vxlan 10

[SwitchA-vsi-vpna-vxlan-10] tunnel 1

[SwitchA-vsi-vpna-vxlan-10] tunnel 2

# Configure the multicast group address and source IP address for multicast VXLAN packets.

[SwitchA-vsi-vpna-vxlan-10] group 225.1.1.1 source 11.1.1.1

[SwitchA-vsi-vpna-vxlan-10] quit

[SwitchA-vsi-vpna] quit

# On Ten-GigabitEthernet 1/0/1, create Ethernet service instance 1000 to match VLAN 2.

[SwitchA] interface ten-gigabitethernet 1/0/1

[SwitchA-Ten-GigabitEthernet1/0/1] port link-type trunk

[SwitchA-Ten-GigabitEthernet1/0/1] port trunk permit vlan 2

[SwitchA-Ten-GigabitEthernet1/0/1] service-instance 1000

[SwitchA-Ten-GigabitEthernet1/0/1-srv1000] encapsulation s-vid 2

# Map Ethernet service instance 1000 to VSI vpna.

[SwitchA-Ten-GigabitEthernet1/0/1-srv1000] xconnect vsi vpna

[SwitchA-Ten-GigabitEthernet1/0/1-srv1000] quit

[SwitchA-Ten-GigabitEthernet1/0/1] quit

3. Configure Switch B:

# Enable L2VPN.

<SwitchB> system-view

[SwitchB] l2vpn enable

# Enable IP multicast routing.

[SwitchB] multicast routing

[SwitchB-mrib] quit

# Create VSI vpna and VXLAN 10.

[SwitchB] vsi vpna

[SwitchB-vsi-vpna] vxlan 10

[SwitchB-vsi-vpna-vxlan-10] quit

[SwitchB-vsi-vpna] quit

# Assign an IP address to VLAN-interface 12, and enable the IGMP host feature on the interface. This interface's IP address will be the source IP address of VXLAN packets sent by the VTEP.

[SwitchB] interface vlan-interface 12

[SwitchB-Vlan-interface12] ip address 12.1.1.2 24

[SwitchB-Vlan-interface12] igmp host enable

[SwitchB-Vlan-interface12] quit

# Create a VXLAN tunnel to Switch A. The tunnel interface name is Tunnel 2.

[SwitchB] interface tunnel 2 mode vxlan

[SwitchB-Tunnel2] source 12.1.1.2

[SwitchB-Tunnel2] destination 11.1.1.1

[SwitchB-Tunnel2] quit

# Create a VXLAN tunnel to Switch C. The tunnel interface name is Tunnel 3.

[SwitchB] interface tunnel 3 mode vxlan

[SwitchB-Tunnel3] source 12.1.1.2

[SwitchB-Tunnel3] destination 13.1.1.3

[SwitchB-Tunnel3] quit

# Assign Tunnel 2 and Tunnel 3 to VXLAN 10.

[SwitchB] vsi vpna

[SwitchB-vsi-vpna] vxlan 10

[SwitchB-vsi-vpna-vxlan-10] tunnel 2

[SwitchB-vsi-vpna-vxlan-10] tunnel 3

# Configure the VXLAN multicast group address and the source IP address for VXLAN packets.

[SwitchB-vsi-vpna-vxlan-10] group 225.1.1.1 source 12.1.1.2

[SwitchB-vsi-vpna-vxlan-10] quit

[SwitchB-vsi-vpna] quit

# On Ten-GigabitEthernet 1/0/1, create Ethernet service instance 1000 to match VLAN 2.

[SwitchB] interface ten-gigabitethernet 1/0/1

[SwitchB-Ten-GigabitEthernet1/0/1] port link-type trunk

[SwitchB-Ten-GigabitEthernet1/0/1] port trunk permit vlan 2

[SwitchB-Ten-GigabitEthernet1/0/1] service-instance 1000

[SwitchB-Ten-GigabitEthernet1/0/1-srv1000] encapsulation s-vid 2

# Map Ethernet service instance 1000 to VSI vpna.

[SwitchB-Ten-GigabitEthernet1/0/1-srv1000] xconnect vsi vpna

[SwitchB-Ten-GigabitEthernet1/0/1-srv1000] quit

[SwitchB-Ten-GigabitEthernet1/0/1] quit

4. Configure Switch C:

# Enable L2VPN.

<SwitchC> system-view

[SwitchC] l2vpn enable

# Enable IP multicast routing.

[SwitchC] multicast routing

[SwitchC-mrib] quit

# Create VSI vpna and VXLAN 10.

[SwitchC] vsi vpna

[SwitchC-vsi-vpna] vxlan 10

[SwitchC-vsi-vpna-vxlan-10] quit

[SwitchC-vsi-vpna] quit

# Assign an IP address to VLAN-interface 13, and enable the IGMP host feature on the interface. This interface's IP address will be the source IP address of VXLAN packets sent by the VTEP.

[SwitchC] interface vlan-interface 13

[SwitchC-Vlan-interface13] ip address 13.1.1.3 24

[SwitchC-Vlan-interface13] igmp host enable

[SwitchC-Vlan-interface13] quit

# Create a VXLAN tunnel to Switch A. The tunnel interface name is Tunnel 1.

[SwitchC] interface tunnel 1 mode vxlan

[SwitchC-Tunnel1] source 13.1.1.3

[SwitchC-Tunnel1] destination 11.1.1.1

[SwitchC-Tunnel1] quit

# Create a VXLAN tunnel to Switch B. The tunnel interface name is Tunnel 3.

[SwitchC] interface tunnel 3 mode vxlan

[SwitchC-Tunnel3] source 13.1.1.3

[SwitchC-Tunnel3] destination 12.1.1.2

[SwitchC-Tunnel3] quit

# Assign Tunnel 1 and Tunnel 3 to VXLAN 10.

[SwitchC] vsi vpna

[SwitchC-vsi-vpna] vxlan 10

[SwitchC-vsi-vpna-vxlan-10] tunnel 1

[SwitchC-vsi-vpna-vxlan-10] tunnel 3

# Configure the multicast group address and source IP address for VXLAN multicast packets.

[SwitchC-vsi-vpna-vxlan-10] group 225.1.1.1 source 13.1.1.3

[SwitchC-vsi-vpna-vxlan-10] quit

[SwitchC-vsi-vpna] quit

# On Ten-GigabitEthernet 1/0/1, create Ethernet service instance 1000 to match VLAN 2.

[SwitchC] interface ten-gigabitethernet 1/0/1

[SwitchC-Ten-GigabitEthernet1/0/1] port link-type trunk

[SwitchC-Ten-GigabitEthernet1/0/1] port trunk permit vlan 2

[SwitchC-Ten-GigabitEthernet1/0/1] service-instance 1000

[SwitchC-Ten-GigabitEthernet1/0/1-srv1000] encapsulation s-vid 2

# Map Ethernet service instance 1000 to VSI vpna.

[SwitchC-Ten-GigabitEthernet1/0/1-srv1000] xconnect vsi vpna

[SwitchC-Ten-GigabitEthernet1/0/1-srv1000] quit

[SwitchC-Ten-GigabitEthernet1/0/1] quit

5. Configure Switch D:

# Enable IP multicast routing.

<SwitchD> system-view

[SwitchD] multicast routing

[SwitchD-mrib] quit

# Enable IGMP and PIM-SM on VLAN-interface 11.

[SwitchD] interface vlan-interface 11

[SwitchD-Vlan-interface11] igmp enable

[SwitchD-Vlan-interface11] pim sm

[SwitchD-Vlan-interface11] quit

# Enable PIM-SM on VLAN-interface 21.

[SwitchD] interface vlan-interface 21

[SwitchD-Vlan-interface21] pim sm

[SwitchD-Vlan-interface21] quit

# Enable BIDIR-PIM.

[SwitchD] pim

[SwitchD-pim] bidir-pim enable

[SwitchD-pim] quit

6. Configure Switch E:

# Enable IP multicast routing.

<SwitchE> system-view

[SwitchE] multicast routing

[SwitchE-mrib] quit

# Enable IGMP and PIM-SM on VLAN-interface 13.

[SwitchE] interface vlan-interface 13

[SwitchE-Vlan-interface13] igmp enable

[SwitchE-Vlan-interface13] pim sm

[SwitchE-Vlan-interface13] quit

# Enable PIM-SM on VLAN-interface 23.

[SwitchE] interface vlan-interface 23

[SwitchE-Vlan-interface23] pim sm

[SwitchE-Vlan-interface23] quit

# Enable BIDIR-PIM.

[SwitchE] pim

[SwitchE-pim] bidir-pim enable

[SwitchE-pim] quit

7. Configure Switch F:

# Enable IP multicast routing.

<SwitchF> system-view

[SwitchF] multicast routing

[SwitchF-mrib] quit

# Enable PIM-SM on VLAN-interface 21, VLAN-interface 22, and VLAN-interface 23.

[SwitchF] interface vlan-interface 21

[SwitchF-Vlan-interface21] pim sm

[SwitchF-Vlan-interface21] quit

[SwitchF] interface vlan-interface 22

[SwitchF-Vlan-interface22] pim sm

[SwitchF-Vlan-interface22] quit

[SwitchF] interface vlan-interface 23

[SwitchF-Vlan-interface23] pim sm

[SwitchF-Vlan-interface23] quit

[SwitchF] interface loopback 0

[SwitchF-LoopBack0] pim sm

[SwitchF-LoopBack0] quit

# Enable BIDIR-PIM.

[SwitchF] pim

[SwitchF-pim] bidir-pim enable

# Configure VLAN-interface 22 as a candidate-BSR, and configure Loopback 0 as a candidate-RP for BIDIR-PIM.

[SwitchF-pim] c-bsr 22.1.1.6

[SwitchF-pim] c-rp 6.6.6.6 bidir

[SwitchF-pim] quit

8. Configure Switch G:

# Enable IP multicast routing.

<SwitchG> system-view

[SwitchG] multicast routing

[SwitchG-mrib] quit

# Enable IGMP and PIM-SM on VLAN-interface 12.

[SwitchG] interface vlan-interface 12

[SwitchG-Vlan-interface12] igmp enable

[SwitchG-Vlan-interface12] pim sm

[SwitchG-Vlan-interface12] quit

# Enable PIM-SM on VLAN-interface 22.

[SwitchG] interface vlan-interface 22

[SwitchG-Vlan-interface22] pim sm

[SwitchG-Vlan-interface22] quit

# Enable BIDIR-PIM.

[SwitchG] pim

[SwitchG-pim] bidir-pim enable

[SwitchG-pim] quit

Verifying the configuration

1. Verify the VXLAN settings on the VTEPs. This example uses Switch A.

# Verify that the VXLAN tunnel interfaces on the VTEP are up.

[SwitchA] display interface tunnel 1

Tunnel1

Current state: UP

Line protocol state: UP

Description: Tunnel1 Interface

Bandwidth: 64kbps

Maximum transmission unit: 1464

Internet protocol processing: Disabled

Last clearing of counters: Never

Tunnel source 11.1.1.1, destination 12.1.1.2

Tunnel protocol/transport UDP_VXLAN/IP

Last 300 seconds input rate: 0 bytes/sec, 0 bits/sec, 0 packets/sec

Last 300 seconds output rate: 0 bytes/sec, 0 bits/sec, 0 packets/sec

Input: 0 packets, 0 bytes, 0 drops

Output: 0 packets, 0 bytes, 0 drops

# Verify that the VXLAN tunnels have been assigned to the VXLAN.

[SwitchA] display l2vpn vsi verbose

VSI Name: vpna

VSI Index : 0

VSI State : Up

MTU : 1500

Bandwidth : -

Broadcast Restrain : -

Multicast Restrain : -

Unknown Unicast Restrain: -

MAC Learning : Enabled

MAC Table Limit : -

MAC Learning rate : -

Drop Unknown : -

Flooding : Enabled

VXLAN ID : 10

Tunnels:

Tunnel Name Link ID State Type Flood proxy

Tunnel1 0x5000001 Up Manual Disabled

Tunnel2 0x5000002 Up Manual Disabled

MTunnel0 0x6000000 Up Auto Disabled

ACs:

AC Link ID State Type

XGE1/0/1 srv1000 0 Up Manual

# Verify that the VTEP has learned the MAC addresses of remote VMs.

<SwitchA> display l2vpn mac-address

MAC Address State VSI Name Link ID/Name Aging

cc3e-5f9c-6cdb Dynamic vpna Tunnel1 Aging

cc3e-5f9c-23dc Dynamic vpna Tunnel2 Aging

--- 2 mac address(es) found ---

# Verify that the VTEP has joined the VXLAN multicast group on VLAN-interface 11.

<SwitchA> display igmp host group

IGMP host groups in total: 1

Vlan-interface11(11.1.1.1):

IGMP host groups in total: 1

Group address Member state Expires

225.1.1.1 Idle Off

2. Verify that VM 1, VM 2, and VM 3 can ping each other. (Details not shown.)

Configuring VXLAN IP gateways

Overview

The following are available IP gateway placement designs for VXLANs:

· VXLAN IP gateways separated from VTEPs—Use a VXLAN-unaware device as a gateway to the external network for VXLANs. On the gateway, you do not need to configure VXLAN settings.

· VXLAN IP gateways collocated with VTEPs—Include the following placement designs:

? Centralized VXLAN IP gateway deployment—Use one VTEP to provide Layer 3 forwarding for VXLANs. Typically, the gateway-collocated VTEP connects to other VTEPs and the external network. To use this design, make sure the IP gateway has sufficient bandwidth and processing capability. Centralized VXLAN IP gateways provide services only for IPv4 networks.

? Centralized VXLAN gateway group deployment—Use one VTEP group that contains redundant centralized VXLAN IP gateways to provide reliable gateway services for VXLANs.

? Distributed VXLAN IP gateway deployment—Deploy one VXLAN IP gateway on each VTEP to provide Layer 3 forwarding for VXLANs at their respective sites. This design distributes the Layer 3 traffic load across VTEPs. However, its configuration is more complex than the centralized VXLAN IP gateway design. Distributed gateways can provide services for both IPv4 and IPv6 networks.

In a collocation design, the VTEPs use virtual Layer 3 VSI interfaces as gateway interfaces to provide services for VXLANs.

VXLAN IP gateways separated from VTEPs

As shown in Figure 10, an independent VXLAN IP gateway connects a Layer 3 network to a VTEP. User terminals send Layer 3 traffic in Layer 2 frames to the gateway through VXLAN tunnels. When the tunneled VXLAN packets arrive, the VTEP terminates the VXLANs and forwards the inner frames to the gateway. In this gateway placement design, the VTEP does not perform Layer 3 forwarding for VXLANs.

Figure 10 VXLAN IP gateway separated from VTEPs

Centralized VXLAN IP gateway deployment

As shown in Figure 11, a VTEP acts as a gateway for user terminals in the VXLANs. The VTEP both terminates the VXLANs and performs Layer 3 forwarding for the user terminals.

Figure 11 Centralized VXLAN IP gateway placement design

As shown in Figure 12, the network uses the following process to forward Layer 3 traffic from the user terminal at 10.1.1.11 to the Layer 3 network:

1. The user terminal sends an ARP request to obtain the MAC address of the gateway (VTEP 3) at 10.1.1.1.

2. VTEP 1 floods the ARP request to all remote VTEPs.

3. VTEP 3 de-encapsulates the ARP request, creates an ARP entry for the user terminal, and sends an ARP reply to the user terminal.

4. VTEP 1 forwards the ARP reply to the user terminal.

5. The user terminal learns the MAC address of the gateway, and sends the Layer 3 traffic to the gateway.

6. VTEP 3 removes the VXLAN encapsulation and inner Ethernet header for the traffic, and forwards the traffic to the destination node.

Inter-VXLAN forwarding is the same as this process except for the last step. At the last step of inter-VLAN forwarding, the gateway replaces the source-VXLAN encapsulation with the destination-VXLAN encapsulation, and then forwards the traffic.

Figure 12 Example of centralized VXLAN IP gateway deployment

Centralized VXLAN gateway group deployment

As shown in Figure 13, a VTEP group uses redundant centralized VXLAN IP gateways to provide reliable gateway services for user terminals in the VXLANs. All member VTEPs in the group participate in Layer 3 forwarding and load share traffic between the Layer 3 network and the VXLANs. This design distributes processing among multiple VTEPs and prevents single points of failure.

Figure 13 Example of centralized VXLAN IP gateway group deployment

The VTEP group is a virtual gateway that provides services at a group IP address. Access layer VTEPs set up VXLAN tunnels to the group IP address for data traffic forwarding. Each VTEP in the group automatically uses its member IP address to set up tunnels to the other member VTEPs and access layer VTEPs. The tunnels are used to transmit protocol packets and synchronize ARP entries.

Distributed VXLAN IP gateway deployment

As shown in Figure 14, each site's VTEP acts as a gateway to perform Layer 3 forwarding for the VXLANs of the local site. A VTEP acts as a border gateway to the Layer 3 network for the VXLANs.

Figure 14 Distributed VXLAN IP gateway placement design

Figure 15 shows an example of distributed VXLAN IP gateway deployment. VSI interfaces are created on each distributed VXLAN IP gateway and the border gateway as gateway interfaces. The same VSI interface uses the same IP address on the distributed VXLAN IP gateways. You must enable one of the following features on a distributed VXLAN IP gateway:

· ARP or ND flood suppression. The gateway performs Layer 2 forwarding based on MAC address entries and performs Layer 3 forwarding based on ARP or ND entries.

· Local proxy ARP or local ND proxy. The gateway performs Layer 3 forwarding based on ARP or ND entries. The following sections use distributed VXLAN IP gateways enabled with the local proxy ARP or local ND proxy feature to describe the forwarding processes for intra-VXLAN traffic, inter-VXLAN traffic, and traffic from a VXLAN to an external network.

A distributed VXLAN IP gateway can generate ARP or ND entries by a variety of methods. The following sections use dynamically learned ARP or ND entries to describe the forwarding processes.

Figure 15 Example of distributed VXLAN IP gateway deployment

Intra-VXLAN traffic forwarding between sites

As shown in Figure 15, the network uses the following process to forward traffic in a VXLAN between sites (for example, from Terminal 1 to Terminal 4 in VXLAN 10):

1. Terminal 1 sends an ARP request to obtain the MAC address of Terminal 4.

2. GW 1 performs the following operations:

a. Creates an ARP entry for Terminal 1 and replies with the MAC address of VSI-interface 10 (the gateway interface for VXLAN 10).

b. Replaces the sender MAC address of the ARP request with the MAC address of VSI-interface 10, and then floods the request to all remote VTEPs.

3. Terminal 1 creates an ARP entry for Terminal 4. The MAC address in the entry is the MAC address of VSI-interface 10 on GW 1.

4. GW 2 (the VTEP for Terminal 4) performs the following operations:

a. De-encapsulates the ARP request and creates an ARP entry for Terminal 1. The entry contains Terminal 1's IP address (10.1.1.11), the MAC address of VSI-interface 10 on GW 1, and the incoming tunnel interface.

b. Replaces the sender MAC address of the request with the MAC address of VSI-interface 10 on GW 2, and then floods the request to the local site in VXLAN 10.

5. Terminal 4 creates an ARP entry for Terminal 1, and then sends a reply to GW 2. The MAC address in the ARP entry is the MAC address of VSI-interface 10 on GW 2.

6. GW 2 performs the following operations:

a. Creates an ARP entry for Terminal 4.

b. Replaces the sender MAC address of the request with the MAC address of VSI-interface 10 on GW 2, and sends the reply to GW 1.

7. GW 1 de-encapsulates the ARP request and creates an ARP entry for Terminal 4. The entry contains Terminal 4's IP address (10.1.1.12), the MAC address of VSI-interface 10 on GW 2, and the incoming tunnel interface.

8. For subsequent traffic between Terminal 1 and Terminal 4, GW 1 and GW 2 use their respective ARP tables to make the forwarding decision.

Inter-VXLAN traffic forwarding between sites

As shown in Figure 15, the network uses the following process to forward traffic between VXLANs (for example, from Terminal 1 in VXLAN 10 to Terminal 5 in VXLAN 20):

1. Terminal 1 sends an ARP request to obtain the MAC address of the gateway at 10.1.1.1.

2. GW 1 creates an ARP entry for Terminal 1 and replies with the MAC address of VSI-interface 10 (the gateway interface for VXLAN 10).

3. Terminal 1 sends the packet destined for Terminal 5 to GW 1.

4. GW 1 sends an ARP request to the local site and remote sites to obtain the MAC address of Terminal 5. In the ARP request, the sender IP address is 20.1.1.1, and the sender MAC address is the MAC address of VSI-interface 20 on GW 1.

5. GW 2 performs the following operations:

a. De-encapsulates the ARP request and creates an ARP entry for Terminal 1. The entry contains Terminal 1's IP address (20.1.1.1), the MAC address of VSI-interface 20 on GW 1, and the incoming tunnel interface.

b. Replaces the sender MAC address of the request with the MAC address of VSI-interface 20 on GW 2, and then floods the request to the local site in VXLAN 20.

6. Terminal 5 creates an ARP entry for GW 2, and then sends a reply to GW 2. The entry contains the IP address (20.1.1.1) and MAC address of VSI-interface 20 on GW 2).

7. GW 2 performs the following operations:

a. Creates an ARP entry for Terminal 5.

b. Replaces the sender MAC address in the request with the MAC address of VSI-interface 20 on GW 2, and then sends the reply to GW 1.

8. GW 1 de-encapsulates the ARP request and creates an ARP entry for Terminal 5. The entry contains Terminal 5's IP address 20.1.1.12, the MAC address of VSI-interface 20 on GW 2, and the incoming tunnel interface.

9. For subsequent traffic between Terminal 1 and Terminal 5, GW 1 and GW 2 use their respective ARP tables to make the forwarding decision.

VXLAN-to-external network traffic forwarding

As shown in Figure 15, the network uses the following process to forward traffic from a VXLAN to the Layer 3 network (for example, from Terminal 1 to the host at 50.1.1.1):

1. Terminal 1 sends an ARP request to obtain the MAC address of the gateway at 10.1.1.1.

2. GW 1 creates an ARP entry for Terminal 1 and replies with the MAC address of VSI-interface 10 (the gateway interface for VXLAN 10).

3. Terminal 1 sends a packet destined for the host to GW 1.

4. GW 1 performs the following operations:

a. Searches the IP routing policies or routing table for the next hop. In this example, the next hop for the packet is 10.1.1.2 (the border gateway).

b. Floods an ARP request to the local and remote sites in VXLAN 10 to obtain the MAC address of 10.1.1.2.

5. The border gateway de-encapsulates the ARP request, creates an ARP entry for GW 1, and tunnels a reply to GW 1.

6. GW 1 de-encapsulates the ARP reply and creates an ARP entry for 10.1.1.2.

7. GW 1 sends the packet destined for the host to the border gateway.

8. The border gateway de-encapsulates the packet and forwards it to the host.

Configuration restrictions and guidelines

Hardware compatibility

VXLAN transport-facing interfaces must be on the following modules:

· FD interface modules.

· FE interface modules.

· SG interface modules.

You can use the modules described in "Hardware compatibility restrictions" to provide site-facing interfaces, except for the LSQM1SRP8X2QE0 MPU.

Software compatibility

Do not configure centralized gateway settings and centralized gateway group settings together on a device.

VXLAN IP gateways cannot work with the super VLAN and private VLAN features. For more information about super VLAN and private VLAN, see Layer 2—LAN Switching Configuration Guide.

VXLAN IP gateways support only Ethernet service instances that use VLAN access mode and one of the following criteria:

· encapsulation s-vid vlan-id.

· encapsulation untagged.

· encapsulation s-vid vlan-id c-vid vlan-id.

When using this criterion, an Ethernet service instance can communicate only with local Ethernet service instances that use the same criterion (including matching VLANs). When the device communicates with a remote VTEP, the inner Ethernet header of VXLAN packets contains the inner 802.1Q VLAN tag.

A VSI interface only supports the protocols in the following table:

Protocol	Reference
Telnet	N/A
TFTP	N/A
DHCP	Layer 3—IP Services Configuration Guide
ARP
ND
RADIUS	Security Configuration Guide
SSH	Security Configuration Guide
NTP	Network Management and Monitoring Configuration Guide
SNMP
NETCONF

Site-facing interface module requirements

A VSI does not support the VXLAN IP gateway feature if the VSI is mapped to an Ethernet service instance that meets the following requirements:

· The Ethernet service instance matches both outer and inner VLANs.

· The interface that hosts the Ethernet service instance is on any of the following modules:

? EC interface modules.

? SC interface modules:

- LSQM2GP24TSSC0.

- LSQM2GP44TSSC0.

- LSQM2GT24PTSSC0.

- LSQM2GT24TSSC0.

- LSQM2GT48SC0.

- LSQM3GP44TSSC0.

- LSQM4GV48SC0.

For the VSIs associated with the Ethernet service instances on the previous interface modules, ACL packet filtering is not supported on a gateway interface shared by multiple of these VSIs. For more information about ACL packet filtering, see ACL and QoS Configuration Guide.

For correct VXLAN Layer 3 forwarding, do not associate Layer 3 Ethernet interfaces or Layer 3 aggregate interfaces configured with member ports on these interface modules to any VPN instances by using the ip binding vpn-instance command. For more information about VPN instance configuration, see MPLS Configuration Guide.

If the device performs VXLAN Layer 3 forwarding for traffic received by the previous interface modules, the traffic cannot be forwarded out of the AC where it is received.

VLAN tags are added to the inner Ethernet frames of VXLAN packets for Layer 3 forwarding if the packets are received by the previous interface modules and the outgoing interfaces of the packets are on the following modules:

· FD interface modules.

· FE interface modules.

· SG interface modules:

Configuration prerequisites

Before you configure a centralized or distributed VXLAN IP gateway, you must perform the following tasks on VTEPs:

· Create VSIs and VXLANs.

· Configure VXLAN tunnels and assign them to VXLANs.

Configuring a centralized VXLAN IP gateway

Configuration restrictions and guidelines

Do not execute the local-proxy-arp enable command on a centralized VXLAN IP gateway.

Configuration procedure

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Create a VSI interface and enter VSI interface view.	interface vsi-interface vsi-interface-id	By default, no VSI interfaces exist.
3. Assign an IPv4 address to the VSI interface.	ip address ip-address { mask \| mask-length }	By default, no IPv4 address is assigned to a VSI interface.
4. Return to system view.	quit	N/A
5. Enter VSI view.	vsi vsi-name	N/A
6. Specify a gateway interface for the VSI.	gateway vsi-interface vsi-interface-id	By default, no gateway interface is specified for a VSI.

Configuring a centralized VXLAN IP gateway group

Make sure the member VTEPs in a VTEP group use the same VXLAN settings.

To configure a VTEP group on a member VTEP:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Create a VSI interface and enter VSI interface view.	interface vsi-interface vsi-interface-id	By default, no VSI interfaces exist. You must create the same VSI interface on all VTEPs in the VTEP group.
3. Assign an IP address to the VSI interface.	ip address ip-address { mask \| mask-length }	By default, no IP address is assigned to a VSI interface. You must assign the same IP address to the VSI interface on each VTEP in the VTEP group.
4. Assign a MAC address to the VSI interface.	mac-address mac-address	The default MAC address of VSI interfaces is the bridge MAC address + 1. You must assign the same MAC address to the VSI interface on each VTEP in the VTEP group.
5. Return to system view.	quit	N/A
6. Enter VSI view.	vsi vsi-name	N/A
7. Specify a gateway interface for the VSI.	gateway vsi-interface vsi-interface-id	By default, no gateway interface is specified for a VSI.
8. Return to system view.	quit	N/A
9. Assign the local VTEP to a VTEP group and specify the member IP address for the VTEP.	vtep group group-ip member local member-ip	By default, a VTEP is not assigned to any VTEP group. Perform this task on all member VTEPs in the VTEP group. The IP address specified by the member-ip argument must already exist on the local VTEP. You must configure a routing protocol to advertise the IP address in the transport network. Member VTEPs in a VTEP group cannot use the group IP address or share an IP address.
10. Specify all the other VTEPs in the VTEP group.	vtep group group-ip member remote member-ip&<1-8>	By default, no VTEP group is specified. Perform this task on all member VTEPs in the VTEP group.

Configuring a distributed VXLAN IP gateway

Configuration restrictions and guidelines

On a distributed VXLAN IP gateway, you must execute the undo mac-address static source-check enable command on all transport-facing ports.

IPv4 or IPv6 addresses of remote ARP or ND entries cannot be pinged by the distributed VXLAN IP gateway that learns the ARP or ND entries.

Make sure a VSI interface uses the same MAC address to provide service on distributed VXLAN IP gateways connected to IPv4 sites. Make sure a VSI interface uses different link-local addresses to provide service on distributed VXLAN IP gateways connected to both IPv4 and IPv6 sites.

If both ARP flood suppression and local proxy ARP are enabled on a distributed VXLAN IP gateway, only local proxy ARP takes effect. As a best practice, do not use these features together on distributed VXLAN IP gateways. For more information about ARP flood suppression, see "Enabling ARP flood suppression."

Configuration prerequisites

For a VXLAN that requires access to the external network, specify the VXLAN's VSI interface on the border gateway as the next hop by using one of the following methods:

· Configure a static route.

· Configure a routing policy, and apply the policy by using the apply default-next-hop or apply next-hop command. For more information about configuring routing policies, see routing policy configuration in Layer 3—IP Routing Configuration Guide.

Configuration procedure

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Create a VSI interface and enter VSI interface view.	interface vsi-interface vsi-interface-id	By default, no VSI interfaces exist.
3. Assign an IPv4 or IPv6 address to the VSI interface.	· Assign an IPv4 address: ip address ip-address { mask \| mask-length } [ sub ] · Assign an IPv6 address: See IPv6 basics in Layer 3—IP Services Configuration Guide.	By default, no IPv4 or IPv6 address is assigned to a VSI interface. This interface will be used as a gateway for VXLANs. On an IPv4 network, you can assign one primary IP address and multiple secondary IP addresses. On an IPv6 network, you can assign multiple IPv6 addresses.
4. Specify the VSI interface as a distributed gateway.	distributed-gateway local	By default, a VSI interface is not a distributed gateway.
5. Enable local proxy ARP or local ND proxy.	· Enable local proxy ARP on an IPv4 gateway: local-proxy-arp enable [ ip-range startIP to endIP ] · Enable local ND proxy on an IPv6 gateway: local-proxy-nd enable	By default, local proxy ARP and local ND proxy are disabled. For more information about the commands, see Layer 3—IP Services Command Reference.
6. Return to system view.	quit	N/A
7. (Optional.) Enable dynamic ARP entry synchronization for distributed VXLAN IP gateways.	arp distributed-gateway dynamic-entry synchronize	By default, dynamic ARP entry synchronization is disabled for distributed VXLAN IP gateways. When local proxy ARP is enabled on distributed VXLAN IP gateways, enable this feature for all gateways to have the same ARP entries. A controller or the EVPN feature can also synchronize ARP entries among distributed VXLAN IP gateways. When you use a controller or EVPN, do not enable this feature.
8. (Optional.) Enable dynamic ND entry synchronization for distributed VXLAN IP gateways.	ipv6 nd distributed-gateway dynamic-entry synchronize	By default, dynamic ND entry synchronization is disabled for distributed VXLAN IP gateways. When local ND proxy is enabled on distributed VXLAN IP gateways, each gateway learns ND information independently. A gateway does not forward ND packets destined for it to other gateways. For distributed VXLAN IP gateways to have the same ND entries, you must enable dynamic ND entry synchronization. A controller or the EVPN feature can also synchronize ND entries among distributed VXLAN IP gateways. When you use a controller or the EVPN feature, do not enable dynamic ND entry synchronization.
9. Enter VSI view.	vsi vsi-name	N/A
10. Specify the VSI interface as the gateway interface for the VSI.	gateway vsi-interface vsi-interface-id	By default, no gateway interface is specified for a VSI.
11. Assign a subnet to the VSI.	gateway subnet { ipv4-address wildcard-mask \| ipv6-address prefix-length }	By default, no subnet exists on a VSI. You must configure this command on VSIs that share a gateway interface. This command enables the VSI interface to identify the VSI of a packet. You can assign a maximum of eight IPv4 and IPv6 subnets to a VSI. Make sure these subnets are on the same network as one of the IP addresses on the gateway interface. For VSIs that share a gateway interface, the subnets must be unique. If you remove the gateway interface from the VSI, the VSI's subnet settings are automatically deleted.

Adding a static ARP entry

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Add a static local-ARP entry.	arp static ip-address mac-address vsi-interface vsi-interface-id interface-type interface-number service-instance instance-id vsi vsi-name [ vpn-instance vpn-instance-name ]	By default, no static local-ARP entries exist. For more information about this command, see ARP commands in Layer 3—IP Services Command Reference.
3. Add a static remote-ARP entry.	arp static ip-address mac-address vsi-interface vsi-interface-id tunnel number vsi vsi-name [ vpn-instance vpn-instance-name ]	By default, no static remote-ARP entries exist. For more information about this command, see ARP commands in Layer 3—IP Services Command Reference.

Configuring a VSI interface

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enter VSI interface view.	interface vsi-interface vsi-interface-id	N/A
3. Assign a MAC address to the VSI interface.	mac-address mac-address	The default MAC address of VSI interfaces is the bridge MAC address + 1.
4. Configure the description of the VSI interface.	description text	The default description of a VSI interface is interface-name plus Interface (for example, Vsi-interface100 Interface).
5. Set the MTU for the VSI interface.	mtu size	The default MTU of VSI interfaces is 1444 bytes.
6. Set the expected bandwidth for the VSI interface.	bandwidth bandwidth-value	The default expected bandwidth (in kbps) equals the interface baud rate divided by 1000.
7. Restore the default settings on the interface.	default	N/A
8. Set an ARP packet sending rate limit for the VSI interface.	arp send-rate pps	By default, the ARP packet sending rate is not limited for a VSI interface.
9. Bring up the interface.	undo shutdown	By default, a VSI interface is up.

Displaying and maintaining VXLAN IP gateway

Execute display commands in any view.

Task	Command
Display information about VSI interfaces.	display interface [ vsi-interface [ vsi-interface-id ] ] [ brief [ description \| down ] ]

VXLAN IP gateway configuration examples

Centralized VXLAN IP gateway configuration example

Network requirements

As shown in Figure 16:

· Configure VXLAN 10 as a unicast-mode VXLAN on Switch A, Switch B, and Switch C to provide connectivity for the VMs across the network sites.

· Configure a centralized VXLAN IP gateway on Switch B to provide gateway services for VXLAN 10.

· Manually establish VXLAN tunnels and assign the tunnels to VXLAN 10.

· Enable remote-MAC address learning.

Figure 16 Network diagram

‌

Configuration procedure

1. On VM 1 and VM 2, specify 10.1.1.1 as the gateway address. (Details not shown.)

2. Configure IP addresses and unicast routing settings:

# Assign IP addresses to interfaces, as shown in Figure 16. (Details not shown.)

# Configure OSPF on all transport network switches (Switches A through D). (Details not shown.)

# Configure OSPF to advertise routes to networks 10.1.1.0/24 and 20.1.1.0/24 on Switch B and Switch E. (Details not shown.)

3. Configure Switch A:

# Enable L2VPN.

<SwitchA> system-view

[SwitchA] l2vpn enable

# Create VSI vpna and VXLAN 10.

[SwitchA] vsi vpna

[SwitchA-vsi-vpna] vxlan 10

[SwitchA-vsi-vpna-vxlan-10] quit

[SwitchA-vsi-vpna] quit

# Assign an IP address to Loopback 0. The IP address will be used as the source IP address of the VXLAN tunnels to Switch B and Switch C.

[SwitchA] interface loopback 0

[SwitchA-Loopback0] ip address 1.1.1.1 255.255.255.255

[SwitchA-Loopback0] quit

# Create a VXLAN tunnel to Switch B. The tunnel interface name is Tunnel 1.

[SwitchA] interface tunnel 1 mode vxlan

[SwitchA-Tunnel1] source 1.1.1.1

[SwitchA-Tunnel1] destination 2.2.2.2

[SwitchA-Tunnel1] quit

# Create a VXLAN tunnel to Switch C. The tunnel interface name is Tunnel 2.

[SwitchA] interface tunnel 2 mode vxlan

[SwitchA-Tunnel2] source 1.1.1.1

[SwitchA-Tunnel2] destination 3.3.3.3

[SwitchA-Tunnel2] quit

# Assign Tunnel 1 and Tunnel 2 to VXLAN 10.

[SwitchA] vsi vpna

[SwitchA-vsi-vpna] vxlan 10

[SwitchA-vsi-vpna-vxlan-10] tunnel 1

[SwitchA-vsi-vpna-vxlan-10] tunnel 2

[SwitchA-vsi-vpna-vxlan-10] quit

[SwitchA-vsi-vpna] quit

# On Ten-GigabitEthernet 1/0/1, create Ethernet service instance 1000 to match VLAN 2.

[SwitchA] interface ten-gigabitethernet 1/0/1

[SwitchA-Ten-GigabitEthernet1/0/1] port link-type trunk

[SwitchA-Ten-GigabitEthernet1/0/1] port trunk permit vlan 2

[SwitchA-Ten-GigabitEthernet1/0/1] service-instance 1000

[SwitchA-Ten-GigabitEthernet1/0/1-srv1000] encapsulation s-vid 2

# Map Ethernet service instance 1000 to VSI vpna.

[SwitchA-Ten-GigabitEthernet1/0/1-srv1000] xconnect vsi vpna

[SwitchA-Ten-GigabitEthernet1/0/1-srv1000] quit

[SwitchA-Ten-GigabitEthernet1/0/1] quit

4. Configure Switch B:

# Enable L2VPN.

<SwitchB> system-view

[SwitchB] l2vpn enable

# Create VSI vpna and VXLAN 10.

[SwitchB] vsi vpna

[SwitchB-vsi-vpna] vxlan 10

[SwitchB-vsi-vpna-vxlan-10] quit

[SwitchB-vsi-vpna] quit

# Assign an IP address to Loopback 0. The IP address will be used as the source IP address of the VXLAN tunnels to Switch A and Switch C.

[SwitchB] interface loopback 0

[SwitchB-Loopback0] ip address 2.2.2.2 255.255.255.255

[SwitchB-Loopback0] quit

# Create a VXLAN tunnel to Switch A. The tunnel interface name is Tunnel 2.

[SwitchB] interface tunnel 2 mode vxlan

[SwitchB-Tunnel2] source 2.2.2.2

[SwitchB-Tunnel2] destination 1.1.1.1

[SwitchB-Tunnel2] quit

# Create a VXLAN tunnel to Switch C. The tunnel interface name is Tunnel 3.

[SwitchB] interface tunnel 3 mode vxlan

[SwitchB-Tunnel3] source 2.2.2.2

[SwitchB-Tunnel3] destination 3.3.3.3

[SwitchB-Tunnel3] quit

# Assign Tunnel 2 and Tunnel 3 to VXLAN 10.

[SwitchB] vsi vpna

[SwitchB-vsi-vpna] vxlan 10

[SwitchB-vsi-vpna-vxlan-10] tunnel 2

[SwitchB-vsi-vpna-vxlan-10] tunnel 3

[SwitchB-vsi-vpna-vxlan-10] quit

[SwitchB-vsi-vpna] quit

# Create VSI-interface 1 and assign the interface an IP address. The IP address will be used as the gateway address for VXLAN 10.

[SwitchB] interface vsi-interface 1

[SwitchB-Vsi-interface1] ip address 10.1.1.1 255.255.255.0

[SwitchB-Vsi-interface1] quit

# Specify VSI-interface 1 as the gateway interface for VSI vpna.

[SwitchB] vsi vpna

[SwitchB-vsi-vpna] gateway vsi-interface 1

[SwitchB-vsi-vpna] quit

5. Configure Switch C:

# Enable L2VPN.

<SwitchC> system-view

[SwitchC] l2vpn enable

# Create VSI vpna and VXLAN 10.

[SwitchC] vsi vpna

[SwitchC-vsi-vpna] vxlan 10

[SwitchC-vsi-vpna-vxlan-10] quit

[SwitchC-vsi-vpna] quit

# Assign an IP address to Loopback 0. The IP address will be used as the source IP address of the VXLAN tunnels to Switch A and Switch B.

[SwitchC] interface loopback 0

[SwitchC-Loopback0] ip address 3.3.3.3 255.255.255.255

[SwitchC-Loopback0] quit

# Create a VXLAN tunnel to Switch A. The tunnel interface name is Tunnel 1.

[SwitchC] interface tunnel 1 mode vxlan

[SwitchC-Tunnel1] source 3.3.3.3

[SwitchC-Tunnel1] destination 1.1.1.1

[SwitchC-Tunnel1] quit

# Create a VXLAN tunnel to Switch B. The tunnel interface name is Tunnel 3.

[SwitchC] interface tunnel 3 mode vxlan

[SwitchC-Tunnel3] source 3.3.3.3

[SwitchC-Tunnel3] destination 2.2.2.2

[SwitchC-Tunnel3] quit

# Assign Tunnel 1 and Tunnel 3 to VXLAN 10.

[SwitchC] vsi vpna

[SwitchC-vsi-vpna] vxlan 10

[SwitchC-vsi-vpna-vxlan-10] tunnel 1

[SwitchC-vsi-vpna-vxlan-10] tunnel 3

[SwitchC-vsi-vpna-vxlan-10] quit

[SwitchC-vsi-vpna] quit

# On Ten-GigabitEthernet 1/0/1, create Ethernet service instance 1000 to match VLAN 2.

[SwitchC] interface ten-gigabitethernet 1/0/1

[SwitchC-Ten-GigabitEthernet1/0/1] port link-type trunk

[SwitchC-Ten-GigabitEthernet1/0/1] port trunk permit vlan 2

[SwitchC-Ten-GigabitEthernet1/0/1] service-instance 1000

[SwitchC-Ten-GigabitEthernet1/0/1-srv1000] encapsulation s-vid 2

# Map Ethernet service instance 1000 to VSI vpna.

[SwitchC-Ten-GigabitEthernet1/0/1-srv1000] xconnect vsi vpna

[SwitchC-Ten-GigabitEthernet1/0/1-srv1000] quit

[SwitchC-Ten-GigabitEthernet1/0/1] quit

Verifying the configuration

1. Verify the VXLAN IP gateway settings on Switch B:

# Verify that the VXLAN tunnel interfaces are up on Switch B.

[SwitchB] display interface tunnel 2

Tunnel2

Current state: UP

Line protocol state: UP

Description: Tunnel1 Interface

Bandwidth: 64kbps

Maximum transmission unit: 1464

Internet protocol processing: Disabled

Last clearing of counters: Never

Tunnel source 2.2.2.2, destination 1.1.1.1

Tunnel protocol/transport UDP_VXLAN/IP

Last 300 seconds input rate: 0 bytes/sec, 0 bits/sec, 0 packets/sec

Last 300 seconds output rate: 0 bytes/sec, 0 bits/sec, 0 packets/sec

Input: 0 packets, 0 bytes, 0 drops

Output: 0 packets, 0 bytes, 0 drops

# Verify that VSI-interface 1 is up.

[SwitchB] display interface vsi-interface 1

Vsi-interface1

Current state: UP

Line protocol state: UP

Description: Vsi-interface100 Interface

Bandwidth: 1000000kbps

Maximum transmission unit: 1444

Internet address: 10.1.1.1/24 (primary)

IP packet frame type: Ethernet II, hardware address: 0011-2200-0102

IPv6 packet frame type: Ethernet II, hardware address: 0011-2200-0102

Physical: Unknown, baudrate: 1000000 kbps

Last clearing of counters: Never

Last 300 seconds input rate: 0 bytes/sec, 0 bits/sec, 0 packets/sec

Last 300 seconds output rate: 0 bytes/sec, 0 bits/sec, 0 packets/sec

Input: 0 packets, 0 bytes, 0 drops

Output: 0 packets, 0 bytes, 0 drops

# Verify that the VXLAN tunnels have been assigned to the VXLAN, and VSI-interface 1 is the gateway interface of VSI vpna.

[SwitchB] display l2vpn vsi verbose

VSI Name: vpna

VSI Index : 0

VSI State : Up

MTU : 1500

Bandwidth : -

Broadcast Restrain : -

Multicast Restrain : -

Unknown Unicast Restrain: -

MAC Learning : Enabled

MAC Table Limit : -

MAC Learning rate : -

Drop Unknown : -

Flooding : Enabled

Gateway interface : VSI-interface 1

VXLAN ID : 10

Tunnels:

Tunnel Name Link ID State Type Flood proxy

Tunnel2 0x5000002 Up Manual Disabled

Tunnel3 0x5000003 Up Manual Disabled

# Verify that Switch B has created ARP entries for the VMs.

[SwitchB] display arp

Type: S-Static D-Dynamic O-Openflow R-Rule M-Multiport I-Invalid

IP address MAC address VLAN/VSI Interface/Link ID Aging Type

20.1.1.5 000c-29c1-5e46 -- Vlan20 19 D

10.1.1.11 0000-1234-0001 0 Tunnel2 20 D

10.1.1.12 0000-1234-0002 0 Tunnel3 19 D

# Verify that Switch B has created FIB entries for the VMs.

[SwitchB] display fib 10.1.1.11

Destination count: 1 FIB entry count: 1

Flag:

U:Usable G:Gateway H:Host B:Blackhole D:Dynamic S:Static

R:Relay F:FRR

Destination/Mask Nexthop Flag OutInterface/Token Label

10.1.1.11/32 10.1.1.11 UH Vsi100 Null

2. Verify that the VMs can access the WAN:

# Verify that VM 1 and VM 2 can ping each other. (Details not shown.)

# Verify that VM 1, VM 2, and VLAN-interface 20 (20.1.1.5) on Switch E can ping each other. (Details not shown.)

Centralized VXLAN IP gateway group configuration example

Network requirements

As shown in Figure 17:

· Configure VXLAN 10 as a unicast-mode VXLAN on Switch A, Switch B, and Switch C.

· Manually establish VXLAN tunnels and assign the tunnels to VXLAN 10.

· Assign Switch B and Switch C to a VTEP group to provide gateway services for VXLAN 10.

Figure 17 Network diagram

‌

Configuration procedure

1. On VM 1, specify 10.1.1.1 as the gateway address. (Details not shown.)

2. Configure IP addresses and unicast routing settings:

# Assign IP addresses to interfaces, as shown in Figure 17. (Details not shown.)

# Configure OSPF on all transport network switches (Switches A through D). (Details not shown.)

3. Configure Switch A:

# Enable L2VPN.

<SwitchA> system-view

[SwitchA] l2vpn enable

# Create VSI vpna and VXLAN 10.

[SwitchA] vsi vpna

[SwitchA-vsi-vpna] vxlan 10

[SwitchA-vsi-vpna-vxlan-10] quit

[SwitchA-vsi-vpna] quit

# Assign an IP address to Loopback 0. The IP address will be used as the source IP address of the VXLAN tunnel to the VTEP group.

[SwitchA] interface loopback 0

[SwitchA-Loopback0] ip address 1.1.1.1 255.255.255.255

[SwitchA-Loopback0] quit

# Create a VXLAN tunnel to the VTEP group. The tunnel interface name is Tunnel 1.

[SwitchA] interface tunnel 1 mode vxlan

[SwitchA-Tunnel1] source 1.1.1.1

[SwitchA-Tunnel1] destination 2.2.2.2

[SwitchA-Tunnel1] quit

# Assign Tunnel 1 to VXLAN 10.

[SwitchA] vsi vpna

[SwitchA-vsi-vpna] vxlan 10

[SwitchA-vsi-vpna-vxlan-10] tunnel 1

[SwitchA-vsi-vpna-vxlan-10] quit

[SwitchA-vsi-vpna] quit

# On Ten-GigabitEthernet 1/0/1, create Ethernet service instance 1000 to match VLAN 2.

[SwitchA] interface ten-gigabitethernet 1/0/1

[SwitchA-Ten-GigabitEthernet1/0/1] port link-type trunk

[SwitchA-Ten-GigabitEthernet1/0/1] port trunk permit vlan 2

[SwitchA-Ten-GigabitEthernet1/0/1] service-instance 1000

[SwitchA-Ten-GigabitEthernet1/0/1-srv1000] encapsulation s-vid 2

# Map Ethernet service instance 1000 to VSI vpna.

[SwitchA-Ten-GigabitEthernet1/0/1-srv1000] xconnect vsi vpna

[SwitchA-Ten-GigabitEthernet1/0/1-srv1000] quit

[SwitchA-Ten-GigabitEthernet1/0/1] quit

# Specify the VTEP group 2.2.2.2 and its member VTEPs at 3.3.3.3 and 4.4.4.4.

[SwitchA] vtep group 2.2.2.2 member remote 3.3.3.3 4.4.4.4

4. Configure Switch B:

# Enable L2VPN.

<SwitchB> system-view

[SwitchB] l2vpn enable

# Create VSI vpna and VXLAN 10.

[SwitchB] vsi vpna

[SwitchB-vsi-vpna] vxlan 10

[SwitchB-vsi-vpna-vxlan-10] quit

[SwitchB-vsi-vpna] quit

# Assign IP address 2.2.2.2/32 to Loopback 0. The IP address will be used as the IP address of the VTEP group.

[SwitchB] interface loopback 0

[SwitchB-Loopback0] ip address 2.2.2.2 255.255.255.255

[SwitchB-Loopback0] quit

# Assign an IP address to Loopback 1. The IP address will be used as the member IP address of the VTEP.

[SwitchB] interface loopback 1

[SwitchB-Loopback1] ip address 3.3.3.3 255.255.255.255

[SwitchB-Loopback1] quit

# Create a VXLAN tunnel to Switch A. The tunnel source IP address is 2.2.2.2, and the tunnel interface name is Tunnel 2.

[SwitchB] interface tunnel 2 mode vxlan

[SwitchB-Tunnel2] source 2.2.2.2

[SwitchB-Tunnel2] destination 1.1.1.1

[SwitchB-Tunnel2] quit

# Assign Tunnel 2 to VXLAN 10.

[SwitchB] vsi vpna

[SwitchB-vsi-vpna] vxlan 10

[SwitchB-vsi-vpna-vxlan-10] tunnel 2

[SwitchB-vsi-vpna-vxlan-10] quit

[SwitchB-vsi-vpna] quit

# Create VSI-interface 1 and assign the interface an IP address. The IP address will be used as the gateway address for VXLAN 10. Assign a MAC address to the interface.

[SwitchB] interface vsi-interface 1

[SwitchB-Vsi-interface1] ip address 10.1.1.1 255.255.255.0

[SwitchB-Vsi-interface1] mac-address 2-2-2

[SwitchB-Vsi-interface1] quit

# Specify VSI-interface 1 as the gateway interface for VSI vpna.

[SwitchB] vsi vpna

[SwitchB-vsi-vpna] gateway vsi-interface 1

[SwitchB-vsi-vpna] quit

# Assign the local VTEP to the VTEP group 2.2.2.2, and specify the member IP address of the local VTEP.

[SwitchB] vtep group 2.2.2.2 member local 3.3.3.3

# Specify the other member VTEP Switch C.

[SwitchB] vtep group 2.2.2.2 member remote 4.4.4.4

5. Configure Switch C:

# Enable L2VPN.

<SwitchC> system-view

[SwitchC] l2vpn enable

# Create VSI vpna and VXLAN 10.

[SwitchC] vsi vpna

[SwitchC-vsi-vpna] vxlan 10

[SwitchC-vsi-vpna-vxlan-10] quit

[SwitchC-vsi-vpna] quit

# Assign IP address 2.2.2.2/32 to Loopback 0. The IP address will be used as the IP address of the VTEP group.

[SwitchC] interface loopback 0

[SwitchC-Loopback0] ip address 2.2.2.2 255.255.255.255

[SwitchC-Loopback0] quit

# Assign an IP address to Loopback 1. The IP address will be used as the member IP address of the VTEP.

[SwitchC] interface loopback 1

[SwitchC-Loopback1] ip address 4.4.4.4 255.255.255.255

[SwitchC-Loopback1] quit

# Create a VXLAN tunnel to Switch A. The tunnel source IP address is 2.2.2.2, and the tunnel interface name is Tunnel 2.

[SwitchC] interface tunnel 2 mode vxlan

[SwitchC-Tunnel2] source 2.2.2.2

[SwitchC-Tunnel2] destination 1.1.1.1

[SwitchC-Tunnel2] quit

# Assign Tunnel 2 to VXLAN 10.

[SwitchC] vsi vpna

[SwitchC-vsi-vpna] vxlan 10

[SwitchC-vsi-vpna-vxlan-10] tunnel 2

[SwitchC-vsi-vpna-vxlan-10] quit

[SwitchC-vsi-vpna] quit

# Create VSI-interface 1 and assign the interface an IP address. The IP address will be used as the gateway address for VXLAN 10. Assign a MAC address to the interface.

[SwitchC] interface vsi-interface 1

[SwitchC-Vsi-interface1] ip address 10.1.1.1 255.255.255.0

[SwitchC-Vsi-interface1] mac-address 2-2-2

[SwitchC-Vsi-interface1] quit

# Specify VSI-interface 1 as the gateway interface for VSI vpna.

[SwitchC] vsi vpna

[SwitchC-vsi-vpna] gateway vsi-interface 1

[SwitchC-vsi-vpna] quit

# Assign the local VTEP to the VTEP group 2.2.2.2, and specify the member IP address of the local VTEP.

[SwitchC] vtep group 2.2.2.2 member local 4.4.4.4

# Specify the other member VTEP Switch B.

[SwitchC] vtep group 2.2.2.2 member remote 3.3.3.3

Distributed VXLAN IPv4 gateway configuration example

Network requirements

As shown in Figure 18:

· Configure VXLAN 10, VXLAN 20, and VXLAN 30 as unicast-mode VXLANs on Switch A, Switch B, and Switch C to provide connectivity for the VMs across the network sites.

· Manually establish VXLAN tunnels and assign the tunnels to the VXLANs.

· Configure distributed VXLAN IP gateways on Switch A and Switch C to forward traffic between the VXLANs.

· Configure Switch B as a border gateway to forward traffic between the VXLANs and the WAN connected to Switch E.

Figure 18 Network diagram

‌

Configuration procedure

1. On VM 1, VM 2, and VM 3, specify 10.1.1.1, 10.1.2.1, and 20.1.1.1 as the gateway address, respectively. (Details not shown.)

2. Configure IP addresses and unicast routing settings:

# Assign IP addresses to interfaces, as shown in Figure 18. (Details not shown.)

# Configure OSPF on all transport network switches (Switches A through D). (Details not shown.)

# Configure OSPF to advertise routes to networks 10.1.1.0/24, 10.1.2.0/24, 20.1.1.0/24, and 25.1.1.0/24 on Switch B and Switch E. (Details not shown.)

# Use the undo mac-address static source-check enable command to disable the static source check feature on the transport-facing interfaces on Switch A and Switch C. (Details not shown.)

3. Configure Switch A:

# Enable L2VPN.

<SwitchA> system-view

[SwitchA] l2vpn enable

# Create VSI vpna and VXLAN 10.

[SwitchA] vsi vpna

[SwitchA-vsi-vpna] vxlan 10

[SwitchA-vsi-vpna-vxlan-10] quit

[SwitchA-vsi-vpna] quit

# Create VSI vpnb and VXLAN 20.

[SwitchA] vsi vpnb

[SwitchA-vsi-vpnb] vxlan 20

[SwitchA-vsi-vpnb-vxlan-20] quit

[SwitchA-vsi-vpnb] quit

# Create VSI vpnc and VXLAN 30.

[SwitchA] vsi vpnc

[SwitchA-vsi-vpnc] vxlan 30

[SwitchA-vsi-vpnc-vxlan-30] quit

[SwitchA-vsi-vpnc] quit

# Assign an IP address to Loopback 0. The IP address will be used as the source IP address of the VXLAN tunnels to Switch B and Switch C.

[SwitchA] interface loopback 0

[SwitchA-Loopback0] ip address 1.1.1.1 255.255.255.255

[SwitchA-Loopback0] quit

# Create a VXLAN tunnel to Switch B. The tunnel interface name is Tunnel 1.

[SwitchA] interface tunnel 1 mode vxlan

[SwitchA-Tunnel1] source 1.1.1.1

[SwitchA-Tunnel1] destination 2.2.2.2

[SwitchA-Tunnel1] quit

# Create a VXLAN tunnel to Switch C. The tunnel interface name is Tunnel 2.

[SwitchA] interface tunnel 2 mode vxlan

[SwitchA-Tunnel2] source 1.1.1.1

[SwitchA-Tunnel2] destination 3.3.3.3

[SwitchA-Tunnel2] quit

# Assign Tunnel 1 and Tunnel 2 to VXLAN 10.

[SwitchA] vsi vpna

[SwitchA-vsi-vpna] vxlan 10

[SwitchA-vsi-vpna-vxlan-10] tunnel 1

[SwitchA-vsi-vpna-vxlan-10] tunnel 2

[SwitchA-vsi-vpna-vxlan-10] quit

[SwitchA-vsi-vpna] quit

# Assign Tunnel 1 and Tunnel 2 to VXLAN 20.

[SwitchA] vsi vpnb

[SwitchA-vsi-vpnb] vxlan 20

[SwitchA-vsi-vpnb-vxlan-20] tunnel 1

[SwitchA-vsi-vpnb-vxlan-20] tunnel 2

[SwitchA-vsi-vpnb-vxlan-20] quit

[SwitchA-vsi-vpnb] quit

# Assign Tunnel 2 to VXLAN 30.

[SwitchA] vsi vpnc

[SwitchA-vsi-vpnc] vxlan 30

[SwitchA-vsi-vpnc-vxlan-30] tunnel 2

[SwitchA-vsi-vpnc-vxlan-30] quit

[SwitchA-vsi-vpnc] quit

# On Ten-GigabitEthernet 1/0/1, create Ethernet service instance 1000 to match VLAN 2.

[SwitchA] interface ten-gigabitethernet 1/0/1

[SwitchA-Ten-GigabitEthernet1/0/1] port link-type trunk

[SwitchA-Ten-GigabitEthernet1/0/1] port trunk permit vlan 2

[SwitchA-Ten-GigabitEthernet1/0/1] service-instance 1000

[SwitchA-Ten-GigabitEthernet1/0/1-srv1000] encapsulation s-vid 2

# Map Ethernet service instance 1000 to VSI vpna.

[SwitchA-Ten-GigabitEthernet1/0/1-srv1000] xconnect vsi vpna

[SwitchA-Ten-GigabitEthernet1/0/1-srv1000] quit

[SwitchA-Ten-GigabitEthernet1/0/1] quit

# On Ten-GigabitEthernet 1/0/3, create Ethernet service instance 1000 to match VLAN 3.

[SwitchA] interface ten-gigabitethernet 1/0/3

[SwitchA-Ten-GigabitEthernet1/0/3] port link-type trunk

[SwitchA-Ten-GigabitEthernet1/0/3] port trunk permit vlan 3

[SwitchA-Ten-GigabitEthernet1/0/3] service-instance 1000

[SwitchA-Ten-GigabitEthernet1/0/3-srv1000] encapsulation s-vid 3

# Map Ethernet service instance 1000 to VSI vpnb.

[SwitchA-Ten-GigabitEthernet1/0/3-srv1000] xconnect vsi vpnb

[SwitchA-Ten-GigabitEthernet1/0/3-srv1000] quit

[SwitchA-Ten-GigabitEthernet1/0/3] quit

# Create VSI-interface 1 and assign the interface an IP address and a MAC address. The IP address will be used as the gateway address for VXLAN 10.

[SwitchA] interface vsi-interface 1

[SwitchA-Vsi-interface1] ip address 10.1.1.1 255.255.255.0

[SwitchA-Vsi-interface1] mac-address 1-1-1

# Specify VSI-interface 1 as a distributed gateway and enable local proxy ARP on the interface.

[SwitchA-Vsi-interface1] distributed-gateway local

[SwitchA-Vsi-interface1] local-proxy-arp enable

[SwitchA-Vsi-interface1] quit

# Create VSI-interface 2 and assign the interface an IP address and a MAC address. The IP address will be used as the gateway address for VXLAN 20.

[SwitchA] interface vsi-interface 2

[SwitchA-Vsi-interface2] ip address 10.1.2.1 255.255.255.0

[SwitchA-Vsi-interface2] mac-address 2-2-2

# Specify VSI-interface 1 as a distributed gateway and enable local proxy ARP on the interface.

[SwitchA-Vsi-interface2] distributed-gateway local

[SwitchA-Vsi-interface2] local-proxy-arp enable

[SwitchA-Vsi-interface2] quit

# Enable dynamic ARP entry synchronization for distributed VXLAN IP gateways.

[SwitchA] arp distributed-gateway dynamic-entry synchronize

# Specify VSI-interface 1 as the gateway interface for VSI vpna. Assign subnet 10.1.1.0/24 to the VSI.

[SwitchA] vsi vpna

[SwitchA-vsi-vpna] gateway vsi-interface 1

[SwitchA-vsi-vpna] gateway subnet 10.1.1.0 0.0.0.255

[SwitchA-vsi-vpna] quit

# Specify VSI-interface 2 as the gateway interface for VSI vpnb.

[SwitchA] vsi vpnb

[SwitchA-vsi-vpnb] gateway vsi-interface 2

[SwitchA-vsi-vpnb] quit

# Assign a secondary IP address to VSI-interface 1. The IP address will be used as the gateway address for VXLAN 30.

[SwitchA] interface vsi-interface 1

[SwitchA-Vsi-interface1] ip address 20.1.1.1 255.255.255.0 sub

[SwitchA-Vsi-interface1] quit

# Specify VSI-interface 1 as the gateway interface for VSI vpnc. Assign subnet 20.1.1.0/24 to the VSI.

[SwitchA] vsi vpnc

[SwitchA-vsi-vpnc] gateway vsi-interface 1

[SwitchA-vsi-vpnc] gateway subnet 20.1.1.0 0.0.0.255

[SwitchA-vsi-vpnc] quit

# Configure a routing policy for VXLAN 10. Set the policy name to vxlan10, and set the default next hop to 10.1.1.2 (VSI-interface 1 on Switch B).

[SwitchA] acl advanced 3000

[SwitchA-acl-ipv4-adv-3000] rule 0 permit ip

[SwitchA-acl-ipv4-adv-3000] quit

[SwitchA] policy-based-route vxlan10 permit node 5

[SwitchA-pbr-vxlan10-5] if-match acl 3000

[SwitchA-pbr-vxlan10-5] apply default-next-hop 10.1.1.2

[SwitchA-pbr-vxlan10-5] quit

# Configure a routing policy for VXLAN 20. Set the policy name to vxlan20, and set the default next hop to 10.1.2.2 (VSI-interface 2 on Switch B).

[SwitchA] policy-based-route vxlan20 permit node 5

[SwitchA-pbr-vxlan20-5] if-match acl 3000

[SwitchA-pbr-vxlan20-5] apply default-next-hop 10.1.2.2

[SwitchA-pbr-vxlan20-5] quit

# Apply policies vxlan10 and vxlan20 to VSI-interface 1 and VSI-interface 2, respectively.

[SwitchA] interface vsi-interface 1

[SwitchA-Vsi-interface1] ip policy-based-route vxlan10

[SwitchA-Vsi-interface1] quit

[SwitchA] interface vsi-interface 2

[SwitchA-Vsi-interface2] ip policy-based-route vxlan20

[SwitchA-Vsi-interface2] quit

4. Configure Switch B:

# Enable L2VPN.

<SwitchB> system-view

[SwitchB] l2vpn enable

# Create VSI vpna and VXLAN 10.

[SwitchB] vsi vpna

[SwitchB-vsi-vpna] vxlan 10

[SwitchB-vsi-vpna-vxlan-10] quit

[SwitchB-vsi-vpna] quit

# Create VSI vpnb and VXLAN 20.

[SwitchB] vsi vpnb

[SwitchB-vsi-vpnb] vxlan 20

[SwitchB-vsi-vpnb-vxlan-20] quit

[SwitchB-vsi-vpnb] quit

# Create VSI vpnc and VXLAN 30.

[SwitchB] vsi vpnc

[SwitchB-vsi-vpnc] vxlan 30

[SwitchB-vsi-vpnc-vxlan-30] quit

[SwitchB-vsi-vpnc] quit

# Assign an IP address to Loopback 0. The IP address will be used as the source IP address of the VXLAN tunnels to Switch A and Switch C.

[SwitchB] interface loopback 0

[SwitchB-Loopback0] ip address 2.2.2.2 255.255.255.255

[SwitchB-Loopback0] quit

# Create a VXLAN tunnel to Switch A. The tunnel interface name is Tunnel 2.

[SwitchB] interface tunnel 2 mode vxlan

[SwitchB-Tunnel2] source 2.2.2.2

[SwitchB-Tunnel2] destination 1.1.1.1

[SwitchB-Tunnel2] quit

# Create a VXLAN tunnel to Switch C. The tunnel interface name is Tunnel 3.

[SwitchB] interface tunnel 3 mode vxlan

[SwitchB-Tunnel3] source 2.2.2.2

[SwitchB-Tunnel3] destination 3.3.3.3

[SwitchB-Tunnel3] quit

# Assign Tunnel 2 to VXLAN 10.

[SwitchB] vsi vpna

[SwitchB-vsi-vpna] vxlan 10

[SwitchB-vsi-vpna-vxlan-10] tunnel 2

[SwitchB-vsi-vpna-vxlan-10] quit

[SwitchB-vsi-vpna] quit

# Assign Tunnel 2 to VXLAN 20.

[SwitchB] vsi vpnb

[SwitchB-vsi-vpnb] vxlan 20

[SwitchB-vsi-vpnb-vxlan-20] tunnel 2

[SwitchB-vsi-vpnb-vxlan-20] quit

[SwitchB-vsi-vpnb] quit

# Assign Tunnel 3 to VXLAN 30.

[SwitchB] vsi vpnc

[SwitchB-vsi-vpnc] vxlan 30

[SwitchB-vsi-vpnc-vxlan-30] tunnel 3

[SwitchB-vsi-vpnc-vxlan-30] quit

[SwitchB-vsi-vpnc] quit

# Create VSI-interface 1 and assign the interface an IP address.

[SwitchB] interface vsi-interface 1

[SwitchB-Vsi-interface1] ip address 10.1.1.2 255.255.255.0

[SwitchB-Vsi-interface1] quit

# Create VSI-interface 2 and assign the interface an IP address.

[SwitchB] interface vsi-interface 2

[SwitchB-Vsi-interface2] ip address 10.1.2.2 255.255.255.0

[SwitchB-Vsi-interface2] quit

# Create VSI-interface 3 and assign the interface an IP address.

[SwitchB] interface vsi-interface 3

[SwitchB-Vsi-interface3] ip address 20.1.1.2 255.255.255.0

[SwitchB-Vsi-interface3] quit

# Specify VSI-interface 1 as the gateway interface for VSI vpna.

[SwitchB] vsi vpna

[SwitchB-vsi-vpna] gateway vsi-interface 1

[SwitchB-vsi-vpna] quit

# Specify VSI-interface 2 as the gateway interface for VSI vpnb.

[SwitchB] vsi vpnb

[SwitchB-vsi-vpnb] gateway vsi-interface 2

[SwitchB-vsi-vpnb] quit

# Specify VSI-interface 3 as the gateway interface for VSI vpnc.

[SwitchB] vsi vpnc

[SwitchB-vsi-vpnc] gateway vsi-interface 3

[SwitchB-vsi-vpnc] quit

5. Configure Switch C:

# Enable L2VPN.

<SwitchC> system-view

[SwitchC] l2vpn enable

# Create VSI vpna and VXLAN 10.

[SwitchC] vsi vpna

[SwitchC-vsi-vpna] vxlan 10

[SwitchC-vsi-vpna-vxlan-10] quit

[SwitchC-vsi-vpna] quit

# Create VSI vpnb and VXLAN 20.

[SwitchC] vsi vpnb

[SwitchC-vsi-vpnb] vxlan 20

[SwitchC-vsi-vpnb-vxlan-20] quit

[SwitchC-vsi-vpnb] quit

# Create VSI vpnc and VXLAN 30.

[SwitchC] vsi vpnc

[SwitchC-vsi-vpnc] vxlan 30

[SwitchC-vsi-vpnc-vxlan-30] quit

[SwitchC-vsi-vpnc] quit

# Assign an IP address to Loopback 0. The IP address will be used as the source IP address of the VXLAN tunnels to Switch A and Switch B.

[SwitchC] interface loopback 0

[SwitchC-Loopback0] ip address 3.3.3.3 255.255.255.255

[SwitchC-Loopback0] quit

# Create a VXLAN tunnel to Switch A. The tunnel interface name is Tunnel 1.

[SwitchC] interface tunnel 1 mode vxlan

[SwitchC-Tunnel1] source 3.3.3.3

[SwitchC-Tunnel1] destination 1.1.1.1

[SwitchC-Tunnel1] quit

# Create a VXLAN tunnel to Switch B. The tunnel interface name is Tunnel 3.

[SwitchC] interface tunnel 3 mode vxlan

[SwitchC-Tunnel3] source 3.3.3.3

[SwitchC-Tunnel3] destination 2.2.2.2

[SwitchC-Tunnel3] quit

# Assign Tunnel 1 to VXLAN 10.

[SwitchC] vsi vpna

[SwitchC-vsi-vpna] vxlan 10

[SwitchC-vsi-vpna-vxlan-10] tunnel 1

[SwitchC-vsi-vpna-vxlan-10] quit

[SwitchC-vsi-vpna] quit

# Assign Tunnel 1 to VXLAN 20.

[SwitchC] vsi vpnb

[SwitchC-vsi-vpnb] vxlan 20

[SwitchC-vsi-vpnb-vxlan-20] tunnel 1

[SwitchC-vsi-vpnb-vxlan-20] quit

[SwitchC-vsi-vpnb] quit

# Assign Tunnel 1 and Tunnel 3 to VXLAN 30.

[SwitchC] vsi vpnc

[SwitchC-vsi-vpnc] vxlan 30

[SwitchC-vsi-vpnc-vxlan-30] tunnel 1

[SwitchC-vsi-vpnc-vxlan-30] tunnel 3

[SwitchC-vsi-vpnc-vxlan-30] quit

[SwitchC-vsi-vpnc] quit

# On Ten-GigabitEthernet 1/0/1, create Ethernet service instance 1000 to match VLAN 4.

[SwitchC] interface ten-gigabitethernet 1/0/1

[SwitchC-Ten-GigabitEthernet1/0/1] port link-type trunk

[SwitchC-Ten-GigabitEthernet1/0/1] port trunk permit vlan 4

[SwitchC-Ten-GigabitEthernet1/0/1] service-instance 1000

[SwitchC-Ten-GigabitEthernet1/0/1-srv1000] encapsulation s-vid 4

# Map Ethernet service instance 1000 to VSI vpnc.

[SwitchC-Ten-GigabitEthernet1/0/1-srv1000] xconnect vsi vpnc

[SwitchC-Ten-GigabitEthernet1/0/1-srv1000] quit

[SwitchC-Ten-GigabitEthernet1/0/1] quit

# Create VSI-interface 1 and assign the interface an IP address and a MAC address. The IP address will be used as the gateway address for VXLAN 10.

[SwitchC] interface vsi-interface 1

[SwitchC-Vsi-interface1] ip address 10.1.1.1 255.255.255.0

[SwitchC-Vsi-interface1] mac-address 1-1-1

# Specify VSI-interface 1 as a distributed gateway and enable local proxy ARP on the interface.

[SwitchC-Vsi-interface1] distributed-gateway local

[SwitchC-Vsi-interface1] local-proxy-arp enable

[SwitchC-Vsi-interface1] quit

# Create VSI-interface 2 and assign the interface an IP address and a MAC address. The IP address will be used as the gateway address for VXLAN 20.

[SwitchC] interface vsi-interface 2

[SwitchC-Vsi-interface2] ip address 10.1.2.1 255.255.255.0

[SwitchC-Vsi-interface2] mac-address 2-2-2

# Specify VSI-interface 2 as a distributed gateway and enable local proxy ARP on the interface.

[SwitchC-Vsi-interface2] distributed-gateway local

[SwitchC-Vsi-interface2] local-proxy-arp enable

[SwitchC-Vsi-interface2] quit

# Enable dynamic ARP entry synchronization for distributed VXLAN IP gateways.

[SwitchC] arp distributed-gateway dynamic-entry synchronize

# Specify VSI-interface 1 as the gateway interface for VSI vpna. Assign subnet 10.1.1.0/24 to the VSI.

[SwitchC] vsi vpna

[SwitchC-vsi-vpna] gateway vsi-interface 1

[SwitchC-vsi-vpna] gateway subnet 10.1.1.0 0.0.0.255

[SwitchC-vsi-vpna] quit

# Specify VSI-interface 2 as the gateway interface for VSI vpnb.

[SwitchC] vsi vpnb

[SwitchC-vsi-vpnb] gateway vsi-interface 2

[SwitchC-vsi-vpnb] quit

# Assign a secondary IP address to VSI-interface 1. The IP address will be used as the gateway address for VXLAN 30.

[SwitchC] interface vsi-interface 1

[SwitchC-Vsi-interface1] ip address 20.1.1.1 255.255.255.0 sub

[SwitchC-Vsi-interface1] quit

# Specify VSI-interface 1 as the gateway interface for VSI vpnc. Assign subnet 20.1.1.0/24 to the VSI.

[SwitchC] vsi vpnc

[SwitchC-vsi-vpnc] gateway vsi-interface 1

[SwitchC-vsi-vpnc] gateway subnet 20.1.1.0 0.0.0.255

[SwitchC-vsi-vpnc] quit

# Configure a routing policy for the VXLANs. Set the policy name to vxlan, and set the default next hop to 20.1.1.2 (VSI-interface 1 on Switch B).

[SwitchC] acl advanced 3000

[SwitchC-acl-ipv4-adv-3000] rule 0 permit ip

[SwitchC-acl-ipv4-adv-3000] quit

[SwitchC] policy-based-route vxlan permit node 5

[SwitchC-pbr-vxlan-5] if-match acl 3000

[SwitchC-pbr-vxlan-5] apply default-next-hop 20.1.1.2

[SwitchC-pbr-vxlan-5] quit

# Apply the policy vxlan to VSI-interface 1.

[SwitchC] interface vsi-interface1

[SwitchC-Vsi-interface1] ip policy-based-route vxlan

[SwitchC-Vsi-interface1] quit

Verifying the configuration

1. Verify the VXLAN IP gateway settings on Switch A:

# Verify that the VXLAN tunnel interfaces are up on Switch A.

[SwitchA] display interface tunnel 2

Tunnel2

Current state: UP

Line protocol state: UP

Description: Tunnel2 Interface

Bandwidth: 64 kbps

Maximum transmission unit: 1464

Internet protocol processing: Disabled

Last clearing of counters: Never

Tunnel source 1.1.1.1, destination 3.3.3.3

Tunnel protocol/transport UDP_VXLAN/IP

Last 300 seconds input rate: 0 bytes/sec, 0 bits/sec, 0 packets/sec

Last 300 seconds output rate: 0 bytes/sec, 0 bits/sec, 0 packets/sec

Input: 0 packets, 0 bytes, 0 drops

Output: 0 packets, 0 bytes, 0 drops

# Verify that VSI-interface 1 is up.

[SwitchA] display interface vsi-interface 1

Vsi-interface1

Current state: UP

Line protocol state: UP

Description: Vsi-interface1 Interface

Bandwidth: 1000000 kbps

Maximum transmission unit: 1444

Internet address: 10.1.1.1/24 (primary)

IP packet frame type: Ethernet II, hardware address: 0001-0001-0001

IPv6 packet frame type: Ethernet II, hardware address: 0001-0001-0001

Physical: Unknown, baudrate: 1000000 kbps

Last clearing of counters: Never

Last 300 seconds input rate: 0 bytes/sec, 0 bits/sec, 0 packets/sec

Last 300 seconds output rate: 0 bytes/sec, 0 bits/sec, 0 packets/sec

Input: 0 packets, 0 bytes, 0 drops

Output: 0 packets, 0 bytes, 0 drops

# Verify that the VXLAN tunnels have been assigned to VXLAN 10, and VSI-interface 1 is the gateway interface for VSI vpna.

[SwitchA] display l2vpn vsi name vpna verbose

VSI Name: vpna

VSI Index : 0

VSI State : Up

MTU : 1500

Bandwidth : -

Broadcast Restrain : -

Multicast Restrain : -

Unknown Unicast Restrain: -

MAC Learning : Enabled

MAC Table Limit : -

MAC Learning rate : -

Drop Unknown : -

Flooding : Enabled

Gateway Interface : VSI-interface 1

VXLAN ID : 10

Tunnels:

Tunnel Name Link ID State Type Flood proxy

Tunnel1 0x5000001 Up Manual Disabled

Tunnel2 0x5000002 Up Manual Disabled

ACs:

AC Link ID State Type

XGE1/0/1 srv1000 0 Up Manual

# Verify that Switch A has created ARP entries for the VMs.

[SwitchA] display arp

Type: S-Static D-Dynamic O-Openflow R-Rule M-Multiport I-Invalid

IP address MAC address VLAN/VSI Interface/Link ID Aging Type

11.1.1.4 000c-29c1-5e46 11 Vlan11 19 D

10.1.1.2 3c8c-400d-867a 0 Tunnel1 20 D

10.1.1.11 0cda-41b5-cf09 0 0 20 D

10.1.2.2 3c8c-400d-867a 1 Tunnel1 20 D

10.1.2.11 0cda-41b5-cf89 1 0 20 D

20.1.1.12 0001-0001-0001 2 Tunnel2 19 D

2. Verify the configuration on the border gateway Switch B:

# Verify that the VXLAN tunnel interfaces are up on Switch B.

[SwitchB] display interface tunnel 2

Tunnel2

Current state: UP

Line protocol state: UP

Description: Tunnel2 Interface

Bandwidth: 64 kbps

Maximum transmission unit: 1464

Internet protocol processing: Disabled

Last clearing of counters: Never

Tunnel source 2.2.2.2, destination 1.1.1.1

Tunnel protocol/transport UDP_VXLAN/IP

Last 300 seconds input rate: 0 bytes/sec, 0 bits/sec, 0 packets/sec

Last 300 seconds output rate: 0 bytes/sec, 0 bits/sec, 0 packets/sec

Input: 0 packets, 0 bytes, 0 drops

Output: 0 packets, 0 bytes, 0 drops

# Verify that VSI-interface 1 is up.

[SwitchB] display interface vsi-interface 1

Vsi-interface1

Current state: UP

Line protocol state: UP

Description: Vsi-interface1 Interface

Bandwidth: 1000000 kbps

Maximum transmission unit: 1444

Internet address: 10.1.1.2/24 (primary)

IP packet frame type: Ethernet II, hardware address: 0011-2200-0102

IPv6 packet frame type: Ethernet II, hardware address: 0011-2200-0102

Physical: Unknown, baudrate: 1000000 kbps

Last clearing of counters: Never

Last 300 seconds input rate: 0 bytes/sec, 0 bits/sec, 0 packets/sec

Last 300 seconds output rate: 0 bytes/sec, 0 bits/sec, 0 packets/sec

Input: 0 packets, 0 bytes, 0 drops

Output: 0 packets, 0 bytes, 0 drops

# Verify that the VXLAN tunnels have been assigned to VXLAN 10, and VSI-interface 1 is the gateway interface for VSI vpna.

[SwitchB] display l2vpn vsi name vpna verbose

VSI Name: vpna

VSI Index : 0

VSI State : Up

MTU : 1500

Bandwidth : -

Broadcast Restrain : -

Multicast Restrain : -

Unknown Unicast Restrain: -

MAC Learning : Enabled

MAC Table Limit : -

MAC Learning rate : -

Drop Unknown : -

Flooding : Enabled

Gateway interface : VSI-interface 1

VXLAN ID : 10

Tunnels:

Tunnel Name Link ID State Type Flood proxy

Tunnel1 0x5000001 Up Manual Disabled

Tunnel2 0x5000002 Up Manual Disabled

# Verify that Switch B has created ARP entries for the VMs.

[SwitchB] display arp

Type: S-Static D-Dynamic O-Openflow R-Rule M-Multiport I-Invalid

IP address MAC address VLAN/VSI Interface/Link ID Aging Type

12.1.1.4 0000-fc00-00ab 12 Vlan12 14 D

25.1.1.5 4431-9234-24bb 20 Vlan20 17 D

10.1.1.1 0001-0001-0001 0 Tunnel2 17 D

10.1.1.11 0001-0001-0001 0 Tunnel2 20 D

20.1.1.1 0002-0002-0002 1 Tunnel3 17 D

20.1.1.12 0002-0002-0002 1 Tunnel3 20 D

# Verify that Switch B has created FIB entries for the VMs.

[SwitchB] display fib 10.1.1.11

Destination count: 1 FIB entry count: 1

Flag:

U:Usable G:Gateway H:Host B:Blackhole D:Dynamic S:Static

R:Relay F:FRR

Destination/Mask Nexthop Flag OutInterface/Token Label

10.1.1.11/32 10.1.1.11 UH Vsi1 Null

[SwitchB] display fib 20.1.1.12

Destination count: 1 FIB entry count: 1

Flag:

U:Usable G:Gateway H:Host B:Blackhole D:Dynamic S:Static

R:Relay F:FRR

Destination/Mask Nexthop Flag OutInterface/Token Label

20.1.1.12/32 20.1.1.12 UH Vsi3 Null

3. Verify that the network connectivity for VMs meets the requirements:

# Verify that VM1, VM 2, and VM 3 can ping each other. (Details not shown.)

# Verify that VM 1, VM 2, and VM 3 can ping VLAN-interface 20 (25.1.1.5) on Switch E for WAN access. (Details not shown.)

Distributed VXLAN IPv6 gateway configuration example

Network requirements

As shown in Figure 19:

· Configure VXLAN 10 and VXLAN 20 as unicast-mode VXLANs on Switch A, Switch B, and Switch C to provide connectivity for the VMs across the network sites.

· Manually establish VXLAN tunnels and assign the tunnels to the VXLANs.

· Configure distributed VXLAN IP gateways on Switch A and Switch C to forward traffic between the VXLANs.

· Configure Switch B as a border gateway to forward traffic between the VXLANs and the WAN connected to Switch E.

Figure 19 Network diagram

‌

Configuration procedure

1. On VM 1 and VM 2, specify 1::1 and 4::1 as the gateway address, respectively. (Details not shown.)

2. Configure IP addresses and unicast routing settings:

# Assign IP addresses to interfaces, as shown in Figure 19. (Details not shown.)

# Configure OSPF on all transport network switches (switches A through D). (Details not shown.)

# Configure OSPFv3 to advertise routes to networks 1::/64, 4::/64, and 3::/64 on Switch B and Switch E. (Details not shown.)

# Use the undo mac-address static source-check enable command to disable the static source check feature on the transport-facing interfaces on Switch A and Switch C. (Details not shown.)

3. Configure Switch A:

# Enable L2VPN.

<SwitchA> system-view

[SwitchA] l2vpn enable

# Create VSI vpna and VXLAN 10.

[SwitchA] vsi vpna

[SwitchA-vsi-vpna] vxlan 10

[SwitchA-vsi-vpna-vxlan-10] quit

[SwitchA-vsi-vpna] quit

# Create VSI vpnb and VXLAN 20.

[SwitchA] vsi vpnb

[SwitchA-vsi-vpnb] vxlan 20

[SwitchA-vsi-vpnb-vxlan-20] quit

[SwitchA-vsi-vpnb] quit

# Assign an IP address to Loopback 0. The IP address will be used as the source IP address of the VXLAN tunnels to Switch B and Switch C.

[SwitchA] interface loopback 0

[SwitchA-Loopback0] ip address 1.1.1.1 255.255.255.255

[SwitchA-Loopback0] quit

# Create a VXLAN tunnel to Switch B. The tunnel interface name is Tunnel 1.

[SwitchA] interface tunnel 1 mode vxlan

[SwitchA-Tunnel1] source 1.1.1.1

[SwitchA-Tunnel1] destination 2.2.2.2

[SwitchA-Tunnel1] quit

# Create a VXLAN tunnel to Switch C. The tunnel interface name is Tunnel 2.

[SwitchA] interface tunnel 2 mode vxlan

[SwitchA-Tunnel2] source 1.1.1.1

[SwitchA-Tunnel2] destination 3.3.3.3

[SwitchA-Tunnel2] quit

# Assign Tunnel 1 and Tunnel 2 to VXLAN 10.

[SwitchA] vsi vpna

[SwitchA-vsi-vpna] vxlan 10

[SwitchA-vsi-vpna-vxlan-10] tunnel 1

[SwitchA-vsi-vpna-vxlan-10] tunnel 2

[SwitchA-vsi-vpna-vxlan-10] quit

[SwitchA-vsi-vpna] quit

# Assign Tunnel 1 and Tunnel 2 to VXLAN 20.

[SwitchA] vsi vpnb

[SwitchA-vsi-vpnb] vxlan 20

[SwitchA-vsi-vpnb-vxlan-20] tunnel 1

[SwitchA-vsi-vpnb-vxlan-20] tunnel 2

[SwitchA-vsi-vpnb-vxlan-20] quit

[SwitchA-vsi-vpnb] quit

# On Ten-GigabitEthernet 1/0/1, create Ethernet service instance 1000 to match VLAN 2.

[SwitchA] interface ten-gigabitethernet 1/0/1

[SwitchA-Ten-GigabitEthernet1/0/1] port link-type trunk

[SwitchA-Ten-GigabitEthernet1/0/1] port trunk permit vlan 2

[SwitchA-Ten-GigabitEthernet1/0/1] service-instance 1000

[SwitchA-Ten-GigabitEthernet1/0/1-srv1000] encapsulation s-vid 2

# Map Ethernet service instance 1000 to VSI vpna.

[SwitchA-Ten-GigabitEthernet1/0/1-srv1000] xconnect vsi vpna

[SwitchA-Ten-GigabitEthernet1/0/1-srv1000] quit

[SwitchA-Ten-GigabitEthernet1/0/1] quit

# Create VSI-interface 1 and assign the interface two IPv6 anycast addresses. The IP addresses will be used as gateway addresses for VXLAN 10 and VXLAN 20.

[SwitchA] interface vsi-interface 1

[SwitchA-Vsi-interface1] ipv6 address 1::1/64 anycast

[SwitchA-Vsi-interface1] ipv6 address 4::1/64 anycast

# Specify VSI-interface 1 as a distributed gateway and enable local ND proxy on the interface.

[SwitchA-Vsi-interface1] distributed-gateway local

[SwitchA-Vsi-interface1] local-proxy-nd enable

[SwitchA-Vsi-interface1] quit

# Enable dynamic ND entry synchronization for distributed VXLAN IP gateways.

[SwitchA] ipv6 nd distributed-gateway dynamic-entry synchronize

# Specify VSI-interface 1 as the gateway interface for VSI vpna. Assign subnet 1::1/64 to the VSI.

[SwitchA] vsi vpna

[SwitchA-vsi-vpna] gateway vsi-interface 1

[SwitchA-vsi-vpna] gateway subnet 1::1 64

[SwitchA-vsi-vpna] quit

# Specify VSI-interface 1 as the gateway interface for VSI vpnb. Assign subnet 4::1/64 to the VSI.

[SwitchA] vsi vpnb

[SwitchA-vsi-vpnb] gateway vsi-interface 1

[SwitchA-vsi-vpnb] gateway subnet 4::1 64

[SwitchA-vsi-vpnb] quit

# Configure an IPv6 static route. Set the destination address to 3::/64 and the next hop to 1::2.

[SwitchA] ipv6 route-static 3:: 64 1::2

4. Configure Switch B:

# Enable L2VPN.

<SwitchB> system-view

[SwitchB] l2vpn enable

# Create VSI vpna and VXLAN 10.

[SwitchB] vsi vpna

[SwitchB-vsi-vpna] vxlan 10

[SwitchB-vsi-vpna-vxlan-10] quit

[SwitchB-vsi-vpna] quit

# Create VSI vpnb and VXLAN 20.

[SwitchB] vsi vpnb

[SwitchB-vsi-vpnb] vxlan 20

[SwitchB-vsi-vpnb-vxlan-20] quit

[SwitchB-vsi-vpnb] quit

# Assign an IP address to Loopback 0. The IP address will be used as the source IP address of the VXLAN tunnels to Switch A and Switch C.

[SwitchB] interface loopback 0

[SwitchB-Loopback0] ip address 2.2.2.2 255.255.255.255

[SwitchB-Loopback0] quit

# Create a VXLAN tunnel to Switch A. The tunnel interface name is Tunnel 2.

[SwitchB] interface tunnel 2 mode vxlan

[SwitchB-Tunnel2] source 2.2.2.2

[SwitchB-Tunnel2] destination 1.1.1.1

[SwitchB-Tunnel2] quit

# Create a VXLAN tunnel to Switch C. The tunnel interface name is Tunnel 3.

[SwitchB] interface tunnel 3 mode vxlan

[SwitchB-Tunnel3] source 2.2.2.2

[SwitchB-Tunnel3] destination 3.3.3.3

[SwitchB-Tunnel3] quit

# Assign Tunnel 2 and Tunnel 3 to VXLAN 10.

[SwitchB] vsi vpna

[SwitchB-vsi-vpna] vxlan 10

[SwitchB-vsi-vpna-vxlan-10] tunnel 2

[SwitchB-vsi-vpna-vxlan-10] tunnel 3

[SwitchB-vsi-vpna-vxlan-10] quit

[SwitchB-vsi-vpna] quit

# Assign Tunnel 2 and Tunnel 3 to VXLAN 20.

[SwitchB] vsi vpnb

[SwitchB-vsi-vpnb] vxlan 20

[SwitchB-vsi-vpnb-vxlan-20] tunnel 2

[SwitchB-vsi-vpnb-vxlan-20] tunnel 3

[SwitchB-vsi-vpnb-vxlan-20] quit

[SwitchB-vsi-vpnb] quit

# Create VSI-interface 1 and assign the interface IPv6 addresses.

[SwitchB] interface vsi-interface 1

[SwitchB-Vsi-interface1] ipv6 address 1::2/64

[SwitchB-Vsi-interface1] ipv6 address 4::2/64

[SwitchB-Vsi-interface1] quit

# Specify VSI-interface 1 as the gateway interface for VSI vpna.

[SwitchB] vsi vpna

[SwitchB-vsi-vpna] gateway vsi-interface 1

[SwitchB-vsi-vpna] quit

# Specify VSI-interface 2 as the gateway interface for VSI vpnb.

[SwitchB] vsi vpnb

[SwitchB-vsi-vpnb] gateway vsi-interface 1

[SwitchB-vsi-vpnb] quit

5. Configure Switch C:

# Enable L2VPN.

<SwitchC> system-view

[SwitchC] l2vpn enable

# Create VSI vpna and VXLAN 10.

[SwitchC] vsi vpna

[SwitchC-vsi-vpna] vxlan 10

[SwitchC-vsi-vpna-vxlan-10] quit

[SwitchC-vsi-vpna] quit

# Create VSI vpnb and VXLAN 20.

[SwitchC] vsi vpnb

[SwitchC-vsi-vpnb] vxlan 20

[SwitchC-vsi-vpnb-vxlan-20] quit

[SwitchC-vsi-vpnb] quit

# Assign an IP address to Loopback 0. The IP address will be used as the source IP address of the VXLAN tunnels to Switch A and Switch B.

[SwitchC] interface loopback 0

[SwitchC-Loopback0] ip address 3.3.3.3 255.255.255.255

[SwitchC-Loopback0] quit

# Create a VXLAN tunnel to Switch A. The tunnel interface name is Tunnel 1.

[SwitchC] interface tunnel 1 mode vxlan

[SwitchC-Tunnel1] source 3.3.3.3

[SwitchC-Tunnel1] destination 1.1.1.1

[SwitchC-Tunnel1] quit

# Create a VXLAN tunnel to Switch B. The tunnel interface name is Tunnel 3.

[SwitchC] interface tunnel 3 mode vxlan

[SwitchC-Tunnel3] source 3.3.3.3

[SwitchC-Tunnel3] destination 2.2.2.2

[SwitchC-Tunnel3] quit

# Assign Tunnel 1 and Tunnel 3 to VXLAN 10.

[SwitchC] vsi vpna

[SwitchC-vsi-vpna] vxlan 10

[SwitchC-vsi-vpna-vxlan-10] tunnel 1

[SwitchC-vsi-vpna-vxlan-10] tunnel 3

[SwitchC-vsi-vpna-vxlan-10] quit

[SwitchC-vsi-vpna] quit

# Assign Tunnel 1 and Tunnel 3 to VXLAN 20.

[SwitchC] vsi vpnb

[SwitchC-vsi-vpnb] vxlan 20

[SwitchC-vsi-vpnb-vxlan-20] tunnel 1

[SwitchC-vsi-vpnb-vxlan-20] tunnel 3

[SwitchC-vsi-vpnb-vxlan-20] quit

[SwitchC-vsi-vpnb] quit

# On Ten-GigabitEthernet 1/0/1, create Ethernet service instance 1000 to match VLAN 4.

[SwitchC] interface ten-gigabitethernet 1/0/1

[SwitchC-Ten-GigabitEthernet1/0/1] port link-type trunk

[SwitchC-Ten-GigabitEthernet1/0/1] port trunk permit vlan 4

[SwitchC-Ten-GigabitEthernet1/0/1] service-instance 1000

[SwitchC-Ten-GigabitEthernet1/0/1-srv1000] encapsulation s-vid 4

# Map Ethernet service instance 1000 to VSI vpnb.

[SwitchC-Ten-GigabitEthernet1/0/1-srv1000] xconnect vsi vpnb

[SwitchC-Ten-GigabitEthernet1/0/1-srv1000] quit

[SwitchC-Ten-GigabitEthernet1/0/1] quit

# Create VSI-interface 1 and assign the interface two IPv6 anycast addresses. The IP addresses will be used as gateway addresses for VXLAN 10 and VXLAN 20.

[SwitchC] interface vsi-interface 1

[SwitchC-Vsi-interface1] ipv6 address 1::1/64 anycast

[SwitchC-Vsi-interface1] ipv6 address 4::1/64 anycast

# Specify VSI-interface 1 as a distributed gateway and enable local ND proxy on the interface.

[SwitchC-Vsi-interface1] distributed-gateway local

[SwitchC-Vsi-interface1] local-proxy-nd enable

[SwitchC-Vsi-interface1] quit

# Enable dynamic ND entry synchronization for distributed VXLAN IP gateways.

[SwitchC] ipv6 nd distributed-gateway dynamic-entry synchronize

# Specify VSI-interface 1 as the gateway interface for VSI vpna. Assign subnet 1::1/64 to the VSI.

[SwitchC] vsi vpna

[SwitchC-vsi-vpna] gateway vsi-interface 1

[SwitchC-vsi-vpna] gateway subnet 1::1 64

[SwitchC-vsi-vpna] quit

# Specify VSI-interface 1 as the gateway interface for VSI vpnb. Assign subnet 4::1/64 to the VSI.

[SwitchC] vsi vpnb

[SwitchC-vsi-vpnb] gateway vsi-interface 1

[SwitchC-vsi-vpnb] gateway subnet 4::1 64

[SwitchC-vsi-vpnb] quit

# Configure an IPv6 static route. Set the destination address to 3::/64 and the next hop to 4::2.

[SwitchC] ipv6 route-static 3:: 64 4::2

Verifying the configuration

1. Verify the distributed VXLAN IP gateway settings on Switch A:

# Verify that the VXLAN tunnel interfaces are up on Switch A.

[SwitchA] display interface tunnel 2

Tunnel2

Current state: UP

Line protocol state: UP

Description: Tunnel2 Interface

Bandwidth: 64kbps

Maximum transmission unit: 1464

Internet protocol processing: Disabled

Last clearing of counters: Never

Tunnel source 1.1.1.1, destination 3.3.3.3

Tunnel protocol/transport UDP_VXLAN/IP

Last 300 seconds input rate: 0 bytes/sec, 0 bits/sec, 0 packets/sec

Last 300 seconds output rate: 0 bytes/sec, 0 bits/sec, 0 packets/sec

Input: 0 packets, 0 bytes, 0 drops

Output: 0 packets, 0 bytes, 0 drops

# Verify that VSI-interface 1 is up.

[SwitchA] display interface vsi-interface 1

Vsi-interface1

Current state: UP

Line protocol state: UP

Description: Vsi-interface1 Interface

Bandwidth: 1000000kbps

Maximum transmission unit: 1444

Internet protocol processing: Disabled

IP packet frame type: Ethernet II, hardware address: 0011-2200-0102

IPv6 packet frame type: Ethernet II, hardware address: 0011-2200-0102

Physical: Unknown, baudrate: 1000000 kbps

Last clearing of counters: Never

Last 300 seconds input rate: 0 bytes/sec, 0 bits/sec, 0 packets/sec

Last 300 seconds output rate: 0 bytes/sec, 0 bits/sec, 0 packets/sec

Input: 0 packets, 0 bytes, 0 drops

Output: 0 packets, 0 bytes, 0 drops

# Verify that the VXLAN tunnels have been assigned to VXLAN 10 and VXLAN 20, and VSI-interface 1 is the gateway interface for the VSIs vpna and vpnb.

[SwitchA] display l2vpn vsi verbose

VSI Name: vpna

VSI Index : 0

VSI State : Up

MTU : 1500

Bandwidth : -

Broadcast Restrain : -

Multicast Restrain : -

Unknown Unicast Restrain: -

MAC Learning : Enabled

MAC Table Limit : -

MAC Learning rate : -

Drop Unknown : -

Flooding : Enabled

Gateway Interface : VSI-interface 1

VXLAN ID : 10

Tunnels:

Tunnel Name Link ID State Type Flood proxy

Tunnel1 0x5000001 Up Manual Disabled

Tunnel2 0x5000002 Up Manual Disabled

ACs:

AC Link ID State Type

XGE1/0/1 srv1000 0 Up Manual

VSI Name: vpnb

VSI Index : 0

VSI State : Up

MTU : 1500

Bandwidth : -

Broadcast Restrain : -

Multicast Restrain : -

Unknown Unicast Restrain: -

MAC Learning : Enabled

MAC Table Limit : -

MAC Learning rate : -

Drop Unknown : -

Flooding : Enabled

Gateway Interface : VSI-interface 1

VXLAN ID : 20

Tunnels:

Tunnel Name Link ID State Type Flood proxy

Tunnel1 0x5000001 Up Manual Disabled

Tunnel2 0x5000002 Up Manual Disabled

# Verify that Switch A has created neighbor entries for the VMs.

[SwitchA] display ipv6 neighbors all

Type: S-Static D-Dynamic O-Openflow R-Rule I-Invalid

IPv6 address Link layer VID Interface State T Age

1::2 3c8c-400d-867a N/A Vsi1 STALE D 7

1::100 0001-0000-0047 N/A Vsi1 STALE D 22

4::400 0002-0000-0047 N/A Vsi1 REACH D 5

FE80::201:FF:FE00:47 0001-0000-0047 N/A Vsi1 REACH D 30

FE80::202:FF:FE00:0 0002-0000-0000 N/A Vsi1 REACH D 27

FE80::202:FF:FE00:47 0002-0000-0047 N/A Vsi1 DELAY D 5

# Verify that Switch A has created FIB entries for the VMs.

[SwitchA] display ipv6 fib 4::400

Destination count: 1 FIB entry count: 1

Flag:

U:Usable G:Gateway H:Host B:Blackhole D:Dynamic S:Static

R:Relay F:FRR

Destination: 4::400 Prefix length: 128

Nexthop : 4::400 Flags: UH

Time stamp : 0x2c Label: Null

Interface : Vsi1 Token: Invalid

[SwitchA] display ipv6 fib 3::300

Destination count: 1 FIB entry count: 1

Flag:

U:Usable G:Gateway H:Host B:Blackhole D:Dynamic S:Static

R:Relay F:FRR

Destination: 3:: Prefix length: 40

Nexthop : 1::2 Flags: USGR

Time stamp : 0x23 Label: Null

Interface : Vsi1 Token: Invalid

2. Verify the configuration on the border gateway Switch B:

# Verify that the VXLAN tunnel interfaces are up on Switch B.

[SwitchB] display interface tunnel 2

Tunnel2

Current state: UP

Line protocol state: UP

Description: Tunnel2 Interface

Bandwidth: 64kbps

Maximum transmission unit: 1464

Internet protocol processing: Disabled

Last clearing of counters: Never

Tunnel source 2.2.2.2, destination 1.1.1.1

Tunnel protocol/transport UDP_VXLAN/IP

Last 300 seconds input rate: 0 bytes/sec, 0 bits/sec, 0 packets/sec

Last 300 seconds output rate: 0 bytes/sec, 0 bits/sec, 0 packets/sec

Input: 0 packets, 0 bytes, 0 drops

Output: 0 packets, 0 bytes, 0 drops

# Verify that VSI-interface 1 is up.

[SwitchB] display interface vsi-interface 1

Vsi-interface1

Current state: UP

Line protocol state: UP

Description: Vsi-interface1 Interface

Bandwidth: 1000000kbps

Maximum transmission unit: 1444

Internet protocol processing: Disabled

IP packet frame type: Ethernet II, hardware address: 0011-2200-0102

IPv6 packet frame type: Ethernet II, hardware address: 0011-2200-0102

Physical: Unknown, baudrate: 1000000 kbps

Last clearing of counters: Never

Last 300 seconds input rate: 0 bytes/sec, 0 bits/sec, 0 packets/sec

Last 300 seconds output rate: 0 bytes/sec, 0 bits/sec, 0 packets/sec

Input: 0 packets, 0 bytes, 0 drops

Output: 0 packets, 0 bytes, 0 drops

# Verify that the VXLAN tunnels have been assigned to VXLAN 10, and VSI-interface 1 is the gateway interface for VSI vpna.

[SwitchB] display l2vpn vsi name vpna verbose

VSI Name: vpna

VSI Index : 0

VSI State : Up

MTU : 1500

Bandwidth : -

Broadcast Restrain : -

Multicast Restrain : -

Unknown Unicast Restrain: -

MAC Learning : Enabled

MAC Table Limit : -

MAC Learning rate : -

Drop Unknown : -

Flooding : Enabled

Gateway interface : VSI-interface 1

VXLAN ID : 10

Tunnels:

Tunnel Name Link ID State Type Flood proxy

Tunnel1 0x5000001 Up Manual Disabled

Tunnel2 0x5000002 Up Manual Disabled

# Verify that Switch B has created neighbor entries for the VMs.

[SwitchB] display ipv6 neighbors all

Type: S-Static D-Dynamic O-Openflow R-Rule I-Invalid

IPv6 address Link layer VID Interface State T Age

3::300 0003-0000-0047 N/A FGE2/0/24 DELAY D 3

FE80::203:FF:FE00:47 0003-0000-0047 N/A FGE2/0/24 STALE D 222

1::100 0001-0000-0047 N/A Vsi1 STALE D 232

4::400 0002-0000-0047 N/A Vsi1 REACH D 3

FE80::201:FF:FE00:0 0001-0000-0000 N/A Vsi1 STALE D 237

FE80::201:FF:FE00:47 0001-0000-0047 N/A Vsi1 STALE D 222

FE80::202:FF:FE00:0 0002-0000-0000 N/A Vsi1 STALE D 345

# Verify that Switch B has created FIB entries for the VMs.

[SwitchB] display ipv6 fib 1::100

Destination count: 1 FIB entry count: 1

Flag:

U:Usable G:Gateway H:Host B:Blackhole D:Dynamic S:Static

R:Relay F:FRR

Destination: 1::100 Prefix length: 128

Nexthop : 1::100 Flags: UH

Time stamp : 0x21 Label: Null

Interface : Vsi1 Token: Invalid

[SwitchB] display ipv6 fib 4::400

Destination count: 1 FIB entry count: 1

Flag:

U:Usable G:Gateway H:Host B:Blackhole D:Dynamic S:Static

R:Relay F:FRR

Destination: 4:: Prefix length: 64

Nexthop : :: Flags: U

Time stamp : 0x19 Label: Null

Interface : Vsi1 Token: Invalid

3. Verify that the network connectivity for the VMs meets the network requirements:

# Verify that VM 1 and VM 2 can ping each other. (Details not shown.)

# Verify that VM 1, VM 2, and VLAN-interface 20 (3::300) on Switch E can ping each other. (Details not shown.)

Configuring VXLAN-DCI

Overview

VXLAN tunnels are used only for intra-data center connection. To provide Layer 2 connectivity between data centers over an IP transport network, you can use VXLAN data center interconnect (VXLAN-DCI) tunnels.

VXLAN-DCI network model

As shown in Figure 20, the VXLAN-DCI network contains edge devices (EDs) located at the edge of the transport network and VTEPs located at the data center sites. VXLAN tunnels are established between VTEPs and EDs, and VXLAN-DCI tunnels are established between EDs. VXLAN-DCI tunnels use VXLAN encapsulation. Each ED de-encapsulates received VXLAN packets and then re-encapsulates them based on the destination before forwarding them through a VXLAN or VXLAN-DCI tunnel.

Figure 20 VXLAN-DCI network model

Working mechanisms

In a VXLAN-DCI network, VTEPs use MAC address entries to perform Layer 2 forwarding for VXLANs, and EDs perform Layer 3 forwarding based on ARP or ND entries.

As shown in Figure 21, a VSI interface uses the same IP address to provide gateway services for a VXLAN on different EDs. Local proxy ARP (for IPv4 sites) or local ND proxy (for IPv6 sites) is enabled on the EDs.

Figure 21 VXLAN-DCI working mechanisms

Intra-VXLAN traffic forwarding between sites

As shown in Figure 21, the network uses the following process to forward traffic in a VXLAN between sites (for example, from Terminal 1 to Terminal 4 in VXLAN 10):

1. Terminal 1 sends an ARP request to obtain the MAC address of Terminal 4.

2. VTEP 1 learns the MAC address of Terminal 1 and floods the ARP request in VXLAN 10.

3. ED 1 performs the following operations:

a. Removes the VXLAN encapsulation of the ARP request.

b. Creates an ARP entry for Terminal 1 and replies with the MAC address of VSI-interface 10 (the gateway interface for VXLAN 10). The ARP reply is sent to VTEP 1.

4. VTEP 1 removes the VXLAN encapsulation of the ARP reply, learns the MAC address of ED 1, and forwards the ARP reply to Terminal 1.

5. Terminal 1 creates an ARP entry for Terminal 4. The MAC address in the entry is the MAC address of VSI-interface 10 on ED 1.

6. ED 1 replaces the sender MAC address of the request with the MAC address of VSI-interface 10 on ED 1, and then floods the request to the remote EDs in VXLAN 10.

7. ED 2 performs the following operations:

a. Removes the VXLAN encapsulation of the ARP request.

b. Creates an ARP entry for Terminal 1. The entry contains Terminal 1's IP address (10.1.1.100), the MAC address of VSI-interface 10 on ED 1, and the incoming VXLAN-DCI tunnel interface.

c. Replaces the sender MAC address of the request with the MAC address of VSI-interface 10 on ED 2, and then floods the request on all VXLAN tunnels of VXLAN 10.

8. VTEP 2 removes the VXLAN encapsulation of the ARP request, learns the MAC address of ED 2, and floods the ARP request to the local site.

9. Terminal 4 creates an ARP entry for Terminal 1, and then sends a reply to VTEP 2. The MAC address in the ARP entry is the MAC address of VSI-interface 10 on ED 2.

10. VTEP 2 looks up the MAC address table and forwards the ARP reply to ED 2.

11. ED 2 performs the following operations:

a. Removes the VXLAN encapsulation of the ARP reply.

b. Creates an ARP entry for Terminal 4

c. Replaces the sender MAC address of the ARP reply with the MAC address of VSI-interface 10 on ED 2, and sends the reply to ED 1.

12. ED 1 performs the following operations:

a. Removes the VXLAN encapsulation of the ARP reply.

b. Creates an ARP entry for Terminal 4. The entry contains Terminal 4's IP address (10.1.1.200), the MAC address of VSI-interface 10 on ED 2, and the incoming VXLAN-DCI tunnel interface.

13. For subsequent traffic between Terminal 1 and Terminal 4, the VTEPs and EDs use their respective MAC address tables and ARP tables to make the forwarding decision.

Inter-VXLAN traffic forwarding between sites

As shown in Figure 21, the network uses the following process to forward traffic between VXLANs (for example, from Terminal 1 in VXLAN 10 to Terminal 5 in VXLAN 20):

1. Terminal 1 sends an ARP request to obtain the MAC address of the gateway at 10.1.1.1.

2. VTEP 1 learns the MAC address of Terminal 1 and floods the ARP request in VXLAN 10.

3. ED 1 performs the following operations:

a. Removes the VXLAN encapsulation of the ARP request.

b. Creates an ARP entry for Terminal 1 and replies with the MAC address of VSI-interface 10 (the gateway interface for VXLAN 10). The ARP reply is sent to VTEP 1.

4. VTEP 1 removes the VXLAN encapsulation of the ARP reply, learns the MAC address of ED 1, and forwards the ARP reply to Terminal 1.

5. Terminal 1 creates an ARP entry for the gateway and sends the packet destined for Terminal 5 to VTEP 1.

6. VTEP 1 looks up the MAC address table and forwards the packet to ED 1.

7. ED 1 performs the following operations:

a. Removes the VXLAN encapsulation of the packet and looks up the routing table based on the destination IP address.

b. Sends an ARP request to the local VTEP and remote ED of VXLAN 20 to obtain the MAC address of Terminal 5. In the ARP request, the sender IP address is 20.1.1.1, and the sender MAC address is the MAC address of VSI-interface 20 on ED 1.

8. ED 2 performs the following operations:

a. Removes the VXLAN encapsulation of the ARP request.

b. Replaces the sender MAC address of the request with the MAC address of VSI-interface 20 on ED 2, and then floods the request on all VXLAN tunnels of VXLAN 20.

9. VTEP 2 removes the VXLAN encapsulation of the ARP request, learns the MAC address of ED 2, and floods the ARP request to the local site.

10. Terminal 5 creates an ARP entry for ED 2 and sends a reply to VTEP 2. The MAC address in the ARP entry is the MAC address of VSI-interface 20 on ED 2.

11. VTEP 2 looks up the MAC address table and forwards the ARP reply to ED 2.

12. ED 2 performs the following operations:

a. Removes the VXLAN encapsulation of the ARP reply.

b. Creates an ARP entry for Terminal 5.

c. Sends a gratuitous ARP packet to ED 1. In the packet, the sender and target IP address is 20.1.1.200, and the sender MAC address is the MAC address of VSI-interface 20 on ED 2.

13. ED 1 performs the following operations:

a. Removes the VXLAN encapsulation of the packet.

b. Creates an ARP entry for Terminal 5. The entry contains Terminal 5's IP address (20.1.1.200), the MAC address of VSI-interface 20 on ED 2, and the incoming VXLAN-DCI tunnel interface.

14. For subsequent traffic between Terminal 1 and Terminal 5, the VTEPs and EDs use their respective MAC address tables and ARP tables to make the forwarding decision.

Configuration restrictions and guidelines

To avoid packet loss, do not use a transport-facing interface to provide services for both VXLAN-DCI tunnels and VXLAN tunnels.

VXLAN-DCI configuration task list

To configure a VXLAN-DCI network, perform the following tasks:

· Configure routing protocols on the transport network for EDs to reach one another.

· Configure routing protocols on EDs and VTEPs for them to reach one another.

· Configure VXLANs on EDs and VTEPs, and set up VXLAN tunnels between EDs and VTEPs.

· Configure VXLAN-DCI on EDs, and set up VXLAN-DCI tunnels between EDs.

Table 2 lists the VXLAN-DCI configuration tasks available on an ED. For more information about basic VXLAN configuration and VXLAN IP gateway configuration, see "Configuring basic VXLAN features" and "Configuring VXLAN IP gateways."

Table 2 VXLAN-DCI configuration task list

Tasks at a glance
(Required.) Creating a VXLAN on a VSI
(Required.) Configuring a VXLAN-DCI tunnel
(Required.) Assigning VXLAN-DCI tunnels to a VXLAN
(Required.) Configuring a VSI interface
(Required.) Specifying a gateway interface for a VSI
(Optional.) Setting the destination UDP port number of VXLAN packets
(Optional.) Configuring VXLAN packet check
(Optional.) Enabling packet statistics for a VSI

Configuring a VXLAN-DCI tunnel

You must specify the tunnel source and destination IP addresses when you manually set up a VXLAN-DCI tunnel between EDs. As a best practice, do not configure the same tunnel source and destination addresses for different VXLAN-DCI tunnels on an ED.

This task provides basic VXLAN-DCI tunnel configuration. For more information about tunnel configuration and commands, see Layer 3—IP Services Configuration Guide and Layer 3—IP Services Command Reference.

To configure a VXLAN-DCI tunnel:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Create a VXLAN-DCI tunnel interface and enter tunnel interface view.	interface tunnel tunnel-number mode vxlan-dci	By default, no tunnel interfaces exist. The endpoints of a tunnel must use the same tunnel mode.
3. Specify a source IP address or source interface for the tunnel.	source { ipv4-address \| interface-type interface-number }	By default, no source IP address or source interface is specified for a tunnel. This step specifies the source IP address in the outer IP header of tunneled VXLAN packets. If an interface is specified, its primary IP address is used.
4. Specify a destination IP address for the tunnel.	destination ipv4-address	By default, no destination IP address is specified for a tunnel. Specify the remote ED's IP address. This IP address will be the destination IP address in the outer IP header of tunneled VXLAN packets.

Assigning VXLAN-DCI tunnels to a VXLAN

To provide connectivity for a VXLAN between two EDs, you must assign the VXLAN-DCI tunnel between the EDs to the VXLAN.

You can assign multiple VXLAN-DCI tunnels to a VXLAN, and configure a VXLAN-DCI tunnel to trunk multiple VXLANs. EDs use the VXLAN ID in VXLAN packets to identify the VXLAN. For a unicast-mode VXLAN, the system floods unknown unicast, multicast, and broadcast traffic to each VXLAN-DCI tunnel associated with the VXLAN.

To assign VXLAN-DCI tunnels to a VXLAN:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enter VSI view.	vsi vsi-name	N/A
3. Enter VXLAN view.	vxlan vxlan-id	N/A
4. Assign VXLAN-DCI tunnels to the VXLAN.	tunnel { tunnel-number \| all }	By default, a VXLAN does not contain any VXLAN-DCI tunnels. For full connectivity in the VXLAN, make sure the VXLAN contains the VXLAN-DCI tunnel between each pair of EDs in the VXLAN.

Configuring a VSI interface

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Create a VSI interface and enter VSI interface view.	interface vsi-interface vsi-interface-id	By default, no VSI interfaces exist.
3. Assign an IPv4 or IPv6 address to the VSI interface.	· Assign an IPv4 address: ip address ip-address { mask \| mask-length } [ sub ] · Assign an IPv6 address: See IPv6 basics in Layer 3—IP Services Configuration Guide.	By default, no IPv4 or IPv6 address is assigned to a VSI interface. This interface will be used as a gateway for VXLANs.
4. Specify the VSI interface as a distributed gateway.	distributed-gateway local	By default, a VSI interface is not a distributed gateway.
5. Enable local proxy ARP or local ND proxy.	· Enable local proxy ARP on an IPv4 gateway: local-proxy-arp enable [ ip-range startIP to endIP ] · Enable local ND proxy on an IPv6 gateway: local-proxy-nd enable	By default, local proxy ARP and local ND proxy are disabled. For more information about the commands, see Layer 3—IP Services Command Reference.
6. Assign a MAC address to the VSI interface.	mac-address mac-address	The default MAC address of VSI interfaces is the bridge MAC address + 1.
7. (Optional.) Configure the description of the VSI interface.	description text	The default description of a VSI interface is interface-name plus Interface (for example, Vsi-interface100 Interface).
8. (Optional.) Set the MTU for the VSI interface.	mtu size	The default MTU of a VSI interface is 1444 bytes.
9. (Optional.) Set the expected bandwidth for the VSI interface.	bandwidth bandwidth-value	The default expected bandwidth (in kbps) equals the interface baud rate divided by 1000.
10. (Optional.) Restore the default settings on the interface.	default	N/A
11. (Optional.) Set an ARP packet sending rate limit for the VSI interface.	arp send-rate pps	By default, the ARP packet sending rate is not limited for a VSI interface.
12. Bring up the interface.	undo shutdown	By default, a VSI interface is up.

Specifying a gateway interface for a VSI

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enter VSI view.	vsi vsi-name	N/A
3. Specify a gateway interface for the VSI.	gateway vsi-interface vsi-interface-id	By default, no gateway interface is specified for a VSI.

Displaying and maintaining VXLAN-DCI

Execute display commands in any view and reset commands in user view.

Task	Command
Display information about VSIs.	display l2vpn vsi [ name vsi-name ] [ verbose ]
Display information about tunnel interfaces.	display interface [ tunnel [ number ] ] [ brief [ description \| down ] ]
Display VXLAN-DCI tunnel information for VXLANs.	display vxlan tunnel [ vxlan-id vxlan-id ]
Clear packet statistics on VSIs.	reset l2vpn statistics vsi [ name vsi-name ]

NOTE:

For more information about the display interface tunnel command, see tunneling commands in Layer 3—IP Services Command Reference.

VXLAN-DCI configuration example

Network requirements

As shown in Figure 22:

· Configure VXLAN 10 and VXLAN 20 as unicast-mode VXLANs on Switch A, Switch B, Switch D, and Switch E to provide connectivity for the VMs across the data center sites.

· Configure Switch A and Switch E as VTEPs, and Switch B and Switch D as EDs.

· Manually establish VXLAN tunnels and VXLAN-DCI tunnels, and assign the tunnels to the VXLANs.

Figure 22 Network diagram

Configuration procedure

1. Configure IP addresses and unicast routing settings:

# Assign IP addresses to interfaces, as shown in Figure 22. (Details not shown.)

# Configure OSPF on Switches A through E. (Details not shown.)

# Configure OSPF to advertise routes to networks 10.1.1.0/24 and 10.1.2.0/24 on Switch B and Switch D. (Details not shown.)

2. Configure Switch A:

# Enable L2VPN.

<SwitchA> system-view

[SwitchA] l2vpn enable

# Create VSI vpna and VXLAN 10.

[SwitchA] vsi vpna

[SwitchA-vsi-vpna] vxlan 10

[SwitchA-vsi-vpna-vxlan-10] quit

[SwitchA-vsi-vpna] quit

# Create VSI vpnb and VXLAN 20.

[SwitchA] vsi vpnb

[SwitchA-vsi-vpnb] vxlan 20

[SwitchA-vsi-vpnb-vxlan-20] quit

[SwitchA-vsi-vpnb] quit

# Assign an IP address to Loopback 0. The IP address will be used as the source IP address of the VXLAN tunnel to Switch B.

[SwitchA] interface loopback 0

[SwitchA-Loopback0] ip address 1.1.1.1 255.255.255.255

[SwitchA-Loopback0] quit

# Create a VXLAN tunnel to Switch B. The tunnel interface name is Tunnel 1.

[SwitchA] interface tunnel 1 mode vxlan

[SwitchA-Tunnel1] source 1.1.1.1

[SwitchA-Tunnel1] destination 2.2.2.2

[SwitchA-Tunnel1] quit

# Assign Tunnel 1 to VXLAN 10.

[SwitchA] vsi vpna

[SwitchA-vsi-vpna] vxlan 10

[SwitchA-vsi-vpna-vxlan-10] tunnel 1

[SwitchA-vsi-vpna-vxlan-10] quit

[SwitchA-vsi-vpna] quit

# Assign Tunnel 1 to VXLAN 20.

[SwitchA] vsi vpnb

[SwitchA-vsi-vpnb] vxlan 20

[SwitchA-vsi-vpnb-vxlan-20] tunnel 1

[SwitchA-vsi-vpnb-vxlan-20] quit

[SwitchA-vsi-vpnb] quit

# On Ten-GigabitEthernet 1/0/1, create Ethernet service instance 1000 to match VLAN 100.

[SwitchA] interface ten-gigabitethernet 1/0/1

[SwitchA-Ten-GigabitEthernet1/0/1] port link-type trunk

[SwitchA-Ten-GigabitEthernet1/0/1] port trunk permit vlan 100

[SwitchA-Ten-GigabitEthernet1/0/1] service-instance 1000

[SwitchA-Ten-GigabitEthernet1/0/1-srv1000] encapsulation s-vid 100

# Map Ethernet service instance 1000 on Ten-GigabitEthernet 1/0/1 to VSI vpna.

[SwitchA-Ten-GigabitEthernet1/0/1-srv1000] xconnect vsi vpna

[SwitchA-Ten-GigabitEthernet1/0/1-srv1000] quit

[SwitchA-Ten-GigabitEthernet1/0/1] quit

# On Ten-GigabitEthernet 1/0/2, create Ethernet service instance 1000 to match VLAN 200.

[SwitchA] interface ten-gigabitethernet 1/0/2

[SwitchA-Ten-GigabitEthernet1/0/2] port link-type trunk

[SwitchA-Ten-GigabitEthernet1/0/2] port trunk permit vlan 200

[SwitchA-Ten-GigabitEthernet1/0/2] service-instance 1000

[SwitchA-Ten-GigabitEthernet1/0/2-srv1000] encapsulation s-vid 200

# Map Ethernet service instance 1000 on Ten-GigabitEthernet 1/0/2 to VSI vpnb.

[SwitchA-Ten-GigabitEthernet1/0/2-srv1000] xconnect vsi vpnb

[SwitchA-Ten-GigabitEthernet1/0/2-srv1000] quit

[SwitchA-Ten-GigabitEthernet1/0/2] quit

3. Configure Switch B:

# Enable L2VPN.

<SwitchB> system-view

[SwitchB] l2vpn enable

# Create VSI vpna and VXLAN 10.

[SwitchB] vsi vpna

[SwitchB-vsi-vpna] vxlan 10

[SwitchB-vsi-vpna-vxlan-10] quit

[SwitchB-vsi-vpna] quit

# Create VSI vpnb and VXLAN 20.

[SwitchB] vsi vpnb

[SwitchB-vsi-vpnb] vxlan 20

[SwitchB-vsi-vpnb-vxlan-20] quit

[SwitchB-vsi-vpnb] quit

# Assign an IP address to Loopback 0. The IP address will be used as the source IP address of the VXLAN tunnel to Switch A and the VXLAN-DCI tunnel to Switch D.

[SwitchB] interface loopback 0

[SwitchB-Loopback0] ip address 2.2.2.2 255.255.255.255

[SwitchB-Loopback0] quit

# Create a VXLAN tunnel to Switch A. The tunnel interface name is Tunnel 1.

[SwitchB] interface tunnel 1 mode vxlan

[SwitchB-Tunnel1] source 2.2.2.2

[SwitchB-Tunnel1] destination 1.1.1.1

[SwitchB-Tunnel1] quit

# Create a VXLAN-DCI tunnel to Switch D. The tunnel interface name is Tunnel 2.

[SwitchB] interface tunnel 2 mode vxlan-dci

[SwitchB-Tunnel2] source 2.2.2.2

[SwitchB-Tunnel2] destination 3.3.3.3

[SwitchB-Tunnel2] quit

# Assign Tunnel 1 and Tunnel 2 to VXLAN 10.

[SwitchB] vsi vpna

[SwitchB-vsi-vpna] vxlan 10

[SwitchB-vsi-vpna-vxlan-10] tunnel 1

[SwitchB-vsi-vpna-vxlan-10] tunnel 2

[SwitchB-vsi-vpna-vxlan-10] quit

[SwitchB-vsi-vpna] quit

# Assign Tunnel 1 and Tunnel 2 to VXLAN 20.

[SwitchB] vsi vpnb

[SwitchB-vsi-vpnb] vxlan 20

[SwitchB-vsi-vpnb-vxlan-20] tunnel 1

[SwitchB-vsi-vpnb-vxlan-20] tunnel 2

[SwitchB-vsi-vpnb-vxlan-20] quit

[SwitchB-vsi-vpnb] quit

# Create VSI-interface 1 and assign the interface an IP address. The IP address will be used as the gateway address for VXLAN 10.

[SwitchB] interface vsi-interface 1

[SwitchB-Vsi-interface1] ip address 10.1.1.1 255.255.255.0

# Specify VSI-interface 1 as a distributed gateway and enable local proxy ARP on the interface.

[SwitchB-Vsi-interface1] distributed-gateway local

[SwitchB-Vsi-interface1] local-proxy-arp enable

[SwitchB-Vsi-interface1] quit

# Create VSI-interface 2 and assign the interface an IP address. The IP address will be used as the gateway address for VXLAN 20.

[SwitchB] interface vsi-interface 2

[SwitchB-Vsi-interface2] ip address 10.1.2.1 255.255.255.0

# Specify VSI-interface 2 as a distributed gateway and enable local proxy ARP on the interface.

[SwitchB-Vsi-interface2] distributed-gateway local

[SwitchB-Vsi-interface2] local-proxy-arp enable

[SwitchB-Vsi-interface2] quit

# Enable dynamic ARP entry synchronization for distributed VXLAN IP gateways.

[SwitchB] arp distributed-gateway dynamic-entry synchronize

# Specify VSI-interface 1 as the gateway interface for VSI vpna.

[SwitchB] vsi vpna

[SwitchB-vsi-vpna] gateway vsi-interface 1

[SwitchB-vsi-vpna] quit

# Specify VSI-interface 2 as the gateway interface for VSI vpnb.

[SwitchB] vsi vpnb

[SwitchB-vsi-vpnb] gateway vsi-interface 2

[SwitchB-vsi-vpnb] quit

4. Configure Switch D:

# Enable L2VPN.

<SwitchD> system-view

[SwitchD] l2vpn enable

# Create VSI vpna and VXLAN 10.

[SwitchD] vsi vpna

[SwitchD-vsi-vpna] vxlan 10

[SwitchD-vsi-vpna-vxlan-10] quit

[SwitchD-vsi-vpna] quit

# Create VSI vpnb and VXLAN 20.

[SwitchD] vsi vpnb

[SwitchD-vsi-vpnb] vxlan 20

[SwitchD-vsi-vpnb-vxlan-20] quit

[SwitchD-vsi-vpnb] quit

# Assign an IP address to Loopback 0. The IP address will be used as the source IP address of the VXLAN-DCI tunnel to Switch B and the VXLAN tunnel to Switch E.

[SwitchD] interface loopback 0

[SwitchD-Loopback0] ip address 3.3.3.3 255.255.255.255

[SwitchD-Loopback0] quit

# Create a VXLAN tunnel to Switch E. The tunnel interface name is Tunnel 1.

[SwitchD] interface tunnel 1 mode vxlan

[SwitchD-Tunnel1] source 3.3.3.3

[SwitchD-Tunnel1] destination 4.4.4.4

[SwitchD-Tunnel1] quit

# Create a VXLAN-DCI tunnel to Switch B. The tunnel interface name is Tunnel 2.

[SwitchD] interface tunnel 2 mode vxlan-dci

[SwitchD-Tunnel2] source 3.3.3.3

[SwitchD-Tunnel2] destination 2.2.2.2

[SwitchD-Tunnel2] quit

#Assign Tunnel 1 and Tunnel 2 to VXLAN 10.

[SwitchD] vsi vpna

[SwitchD-vsi-vpna] vxlan 10

[SwitchD-vsi-vpna-vxlan-10] tunnel 1

[SwitchD-vsi-vpna-vxlan-10] tunnel 2

[SwitchD-vsi-vpna-vxlan-10] quit

[SwitchD-vsi-vpna] quit

# Assign Tunnel 2 to VXLAN 20.

[SwitchD] vsi vpnb

[SwitchD-vsi-vpnb] vxlan 20

[SwitchD-vsi-vpnb-vxlan-20] tunnel 2

[SwitchD-vsi-vpnb-vxlan-20] quit

[SwitchD-vsi-vpnb] quit

# Create VSI-interface 1 and assign the interface an IP address. The IP address will be used as the gateway address for VXLAN 10.

[SwitchD] interface vsi-interface 1

[SwitchD-Vsi-interface1] ip address 10.1.1.1 255.255.255.0

# Specify VSI-interface 1 as a distributed gateway and enable local proxy ARP on the interface.

[SwitchD-Vsi-interface1] distributed-gateway local

[SwitchD-Vsi-interface1] local-proxy-arp enable

[SwitchD-Vsi-interface1] quit

# Create VSI-interface 2 and assign the interface an IP address. The IP address will be used as the gateway address for VXLAN 20.

[SwitchD] interface vsi-interface 2

[SwitchD-Vsi-interface2] ip address 10.1.2.1 255.255.255.0

# Specify VSI-interface 2 as a distributed gateway and enable local proxy ARP on the interface.

[SwitchD-Vsi-interface2] distributed-gateway local

[SwitchD-Vsi-interface2] local-proxy-arp enable

[SwitchD-Vsi-interface2] quit

# Enable dynamic ARP entry synchronization for distributed VXLAN IP gateways.

[SwitchD] arp distributed-gateway dynamic-entry synchronize

# Specify VSI-interface 1 as the gateway interface for VSI vpna.

[SwitchD] vsi vpna

[SwitchD-vsi-vpna] gateway vsi-interface 1

[SwitchD-vsi-vpna] quit

# Specify VSI-interface 2 as the gateway interface for VSI vpnb.

[SwitchD] vsi vpnb

[SwitchD-vsi-vpnb] gateway vsi-interface 2

[SwitchD-vsi-vpnb] quit

5. Configure Switch E:

# Enable L2VPN.

<SwitchE> system-view

[SwitchE] l2vpn enable

# Create VSI vpna and VXLAN 10.

[SwitchE] vsi vpna

[SwitchE-vsi-vpna] vxlan 10

[SwitchE-vsi-vpna-vxlan-10] quit

[SwitchE-vsi-vpna] quit

# Assign an IP address to Loopback 0. The IP address will be used as the source IP address of the VXLAN tunnel to Switch D.

[SwitchE] interface loopback 0

[SwitchE-Loopback0] ip address 4.4.4.4 255.255.255.255

[SwitchE-Loopback0] quit

# Create a VXLAN tunnel to Switch D. The tunnel interface name is Tunnel 1.

[SwitchE] interface tunnel 1 mode vxlan

[SwitchE-Tunnel1] source 4.4.4.4

[SwitchE-Tunnel1] destination 3.3.3.3

[SwitchE-Tunnel1] quit

# Assign Tunnel 1 to VXLAN 10.

[SwitchE] vsi vpna

[SwitchE-vsi-vpna] vxlan 10

[SwitchE-vsi-vpna-vxlan-10] tunnel 1

[SwitchE-vsi-vpna-vxlan-10] quit

[SwitchE-vsi-vpna] quit

# On Ten-GigabitEthernet 1/0/1, create Ethernet service instance 1000 to match VLAN 100.

[SwitchE] interface ten-gigabitethernet 1/0/1

[SwitchE-Ten-GigabitEthernet1/0/1] port link-type trunk

[SwitchE-Ten-GigabitEthernet1/0/1] port trunk permit vlan 100

[SwitchE-Ten-GigabitEthernet1/0/1] service-instance 1000

[SwitchE-Ten-GigabitEthernet1/0/1-srv1000] encapsulation s-vid 100

# Map Ethernet service instance 1000 to VSI vpna.

[SwitchE-Ten-GigabitEthernet1/0/1-srv1000] xconnect vsi vpna

[SwitchE-Ten-GigabitEthernet1/0/1-srv1000] quit

[SwitchE-Ten-GigabitEthernet1/0/1] quit

Verifying the configuration

1. Verify the VXLAN-DCI settings on the EDs. This example uses Switch B.

# Verify that the VXLAN and VXLAN-DCI tunnel interfaces are up on Switch B.

[SwitchB] display interface tunnel

Tunnel1

Current state: UP

Line protocol state: UP

Description: Tunnel1 Interface

Bandwidth: 64 kbps

Maximum transmission unit: 1464

Internet protocol processing: Disabled

Last clearing of counters: Never

Tunnel source 2.2.2.2, destination 1.1.1.1

Tunnel protocol/transport UDP_VXLAN/IP

Last 300 seconds input rate: 0 bytes/sec, 0 bits/sec, 0 packets/sec

Last 300 seconds output rate: 0 bytes/sec, 0 bits/sec, 0 packets/sec

Input: 0 packets, 0 bytes, 0 drops

Output: 0 packets, 0 bytes, 0 drops

Tunnel2

Current state: UP

Line protocol state: UP

Description: Tunnel2 Interface

Bandwidth: 64 kbps

Maximum transmission unit: 1464

Internet protocol processing: Disabled

Last clearing of counters: Never

Tunnel source 2.2.2.2, destination 3.3.3.3

Tunnel protocol/transport UDP_VXLAN_DCI/IP

Last 300 seconds input rate: 0 bytes/sec, 0 bits/sec, 0 packets/sec

Last 300 seconds output rate: 0 bytes/sec, 0 bits/sec, 0 packets/sec

Input: 0 packets, 0 bytes, 0 drops

Output: 0 packets, 0 bytes, 0 drops

# Verify that VSI-interface 1 and VSI-interface 2 are up.

[SwitchB] display interface vsi-interface

Vsi-interface1

Current state: UP

Line protocol state: UP

Description: Vsi-interface1 Interface

Bandwidth: 1000000 kbps

Maximum transmission unit: 1444

Internet address: 10.1.1.1/24 (primary)

IP packet frame type:PKTFMT_ETHNT_2, hardware address: 0011-2200-0102

IPv6 packet frame type:PKTFMT_ETHNT_2, hardware address: 0011-2200-0102

Physical: Unknown, baudrate: 1000000 kbps

Last clearing of counters: Never

Last 300 seconds input rate: 0 bytes/sec, 0 bits/sec, 0 packets/sec

Last 300 seconds output rate: 0 bytes/sec, 0 bits/sec, 0 packets/sec

Input: 0 packets, 0 bytes, 0 drops

Output: 0 packets, 0 bytes, 0 drops

Vsi-interface2

Current state: UP

Line protocol state: UP

Description: Vsi-interface2 Interface

Bandwidth: 1000000 kbps

Maximum transmission unit: 1444

Internet address: 10.1.2.1/24 (primary)

IP packet frame type:PKTFMT_ETHNT_2, hardware address: 0011-3300-0102

IPv6 packet frame type:PKTFMT_ETHNT_2, hardware address: 0011-3300-0102

Physical: Unknown, baudrate: 1000000 kbps

Last clearing of counters: Never

Last 300 seconds input rate: 0 bytes/sec, 0 bits/sec, 0 packets/sec

Last 300 seconds output rate: 0 bytes/sec, 0 bits/sec, 0 packets/sec

Input: 0 packets, 0 bytes, 0 drops

Output: 0 packets, 0 bytes, 0 drops

# Verify that the VXLAN and VXLAN-DCI tunnels have been assigned to VXLAN 10 and VXLAN 20, and the VSI interfaces are the gateway interfaces for their respective VSIs.

[SwitchB] display l2vpn vsi verbose

VSI Name: vpna

VSI Index : 0

VSI State : Up

MTU : 1500

Bandwidth : -

Broadcast Restrain : -

Multicast Restrain : -

Unknown Unicast Restrain: -

MAC Learning : Enabled

MAC Table Limit : -

MAC Learning rate : -

Drop Unknown : -

Flooding : Enabled

Gateway interface : VSI-interface 1

VXLAN ID : 10

Tunnels:

Tunnel Name Link ID State Type Flood proxy

Tunnel1 0x5000001 Up Manual Disabled

Tunnel2 0x5000002 Up Manual Disabled

VSI Name: vpnb

VSI Index : 0

VSI State : Up

MTU : 1500

Bandwidth : -

Broadcast Restrain : -

Multicast Restrain : -

Unknown Unicast Restrain: -

MAC Learning : Enabled

MAC Table Limit : -

MAC Learning rate : -

Drop Unknown : -

Flooding : Enabled

Gateway interface : VSI-interface 2

VXLAN ID : 20

Tunnels:

Tunnel Name Link ID State Type Flood proxy

Tunnel1 0x5000001 Up Manual Disabled

Tunnel2 0x5000002 Up Manual Disabled

# Verify that Switch B has created ARP entries for the VMs.

[SwitchB] display arp

Type: S-Static D-Dynamic O-Openflow R-Rule M-Multiport I-Invalid

IP address MAC address VLAN/VSI Interface/Link ID Aging Type

11.1.1.4 000c-29c1-5e46 N/A Vlan11 19 D

10.1.1.11 0cda-41b5-cf09 0 Tunnel1 20 D

10.1.1.12 0011-4400-0102 0 Tunnel2 20 D

10.1.2.11 0cda-41b5-cf89 1 Tunnel1 20 D

2. Verify that VM 1, VM 2, and VM 3 can ping each other. (Details not shown.)

Configuring the VTEP as an OVSDB VTEP

Overview

An H3C network virtualization controller can use the Open vSwitch Database (OVSDB) management protocol to deploy and manage VXLANs on VTEPs. To work with a controller, you must configure the VTEP as an OVSDB VTEP.

As shown in Figure 23, an OVSDB VTEP stores all of its VXLAN settings in the form of entries in an OVSDB database. The OVSDB database, OVSDB VTEP service, and the controller interact through the OVSDB server. The controller communicates with the OVSDB server through the OVSDB protocol to manage the OVSDB database. The OVSDB VTEP service reads and writes data in the OVSDB database through the OVSDB server.

The OVSDB VTEP service performs the following operations to manage the VXLAN settings on the VTEP:

· Converts data in the OVSDB database into VXLAN configuration and deploys the configuration to the VTEP. For example, create or remove a VXLAN or VXLAN tunnel.

· Adds site-facing interface information and the global source address of VXLAN tunnels to the OVSDB database. The information is reported to the controller by the OVSDB server.

You can configure a VTEP both at the CLI and through a controller. As a best practice, do not manually remove the VXLAN configuration issued by the controller.

Figure 23 OVSDB network model

Protocols and standards

RFC 7047, The Open vSwitch Database Management Protocol

OVSDB VTEP configuration task list

Tasks at a glance
(Required.) Setting up an OVSDB connection to a controller: · Configuring active SSL connection settings · Configuring passive SSL connection settings · Configuring active TCP connection settings · Configuring passive TCP connection settings
(Required.) Enabling the OVSDB server
(Required.) Enabling the OVSDB VTEP service
(Required.) Specifying a global source address for VXLAN tunnels
(Required.) Specifying a VTEP access port
(Optional.) Disabling the ACLs issued by the OVSDB controller

Configuration prerequisites

Before you configure the VTEP as an OVSDB VTEP, enable L2VPN by using the l2vpn enable command. For more information, see MPLS L2VPN commands in MPLS Command Reference.

Before you set up SSL connections to controllers, you must configure SSL as described in Security Configuration Guide.

Setting up an OVSDB connection to a controller

The OVSDB server supports the following types of OVSDB connections:

· Active SSL connection—The OVSDB server initiates an SSL connection to the controller.

· Passive SSL connection—The OVSDB server accepts the SSL connection from the controller.

· Active TCP connection—The OVSDB server initiates a TCP connection to the controller.

· Passive TCP connection—The OVSDB server accepts the TCP connection from the controller.

Configuration restrictions and guidelines

When you set up OVSDB connections, follow these restrictions and guidelines:

· You can set up multiple OVSDB connections. For the device to establish the connections, you must enable the OVSDB server. You must disable and then re-enable the OVSDB server if it has been enabled.

· You must specify the same PKI domain and CA certificate file for all active and passive SSL connections.

· Make sure you have configured the PKI domain before specify it for SSL. For more information about configuring a PKI domain, see Security Configuration Guide.

Configuring active SSL connection settings

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Specify a PKI domain for SSL.	ovsdb server pki domain domain-name	By default, no PKI domain is specified for SSL.
3. (Optional.) Specify a CA certificate file for SSL.	ovsdb server bootstrap ca-certificate ca-filename	By default, SSL uses the CA certificate file in the PKI domain. If the specified CA certificate file does not exist, the device obtains a self-signed certificate from the controller. The obtained file uses the name specified for the ca-filename argument.
4. Set up an active SSL connection.	ovsdb server ssl ip ip-address port port-number	By default, the device does not have active OVSDB SSL connections. You can set up a maximum of eight OVSDB SSL connections.

Configuring passive SSL connection settings

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Specify a PKI domain for SSL.	ovsdb server pki domain domain-name	By default, no PKI domain is specified for SSL.
3. (Optional.) Specify a CA certificate file for SSL.	ovsdb server bootstrap ca-certificate ca-filename	By default, SSL uses the CA certificate file in the PKI domain. If the specified CA certificate file does not exist, the device obtains a self-signed certificate from the controller. The obtained file uses the name specified for the ca-filename argument.
4. Enable the device to listen for SSL connection requests.	ovsdb server pssl [ port port-number ]	By default, the device does not listen for SSL connection requests. You can specify only one port to listen for OVSDB SSL connection requests. Port 6640 is used if you do specify a port when you execute the command.

Configuring active TCP connection settings

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Set up an active TCP connection.	ovsdb server tcp ip ip-address port port-number	By default, the device does not have active OVSDB TCP connections. You can set up a maximum of eight active OVSDB TCP connections.

Step

Command

Remarks

1. Enter system view.

system-view

N/A

2. Set up an active TCP connection.

ovsdb server tcp ip ip-address port port-number

By default, the device does not have active OVSDB TCP connections.

You can set up a maximum of eight active OVSDB TCP connections.

Configuring passive TCP connection settings

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enable the device to listen for TCP connection requests.	ovsdb server ptcp [ port port-number ]	By default, the device does not listen for TCP connection requests. You can specify only one port to listen for OVSDB TCP connection requests. Port 6640 is used if you do specify a port when you execute the command.

Step

Command

Remarks

1. Enter system view.

system-view

N/A

2. Enable the device to listen for TCP connection requests.

ovsdb server ptcp [ port port-number ]

By default, the device does not listen for TCP connection requests.

You can specify only one port to listen for OVSDB TCP connection requests. Port 6640 is used if you do specify a port when you execute the command.

Enabling the OVSDB server

Make sure you have complete OVSDB connection setup before you enable the OVSDB server. If you change OVSDB connection settings after the OVSDB server is enabled, you must disable and then re-enable the OVSDB server for the change to take effect.

To enable the OVSDB server:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enable the OVSDB server.	ovsdb server enable	By default, the OVSDB server is disabled.

Enabling the OVSDB VTEP service

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enable the OVSDB VTEP service.	vtep enable	By default, the OVSDB VTEP service is disabled.

Specifying a global source address for VXLAN tunnels

IMPORTANT:

For correct VXLAN deployment and VTEP management, do not manually specify tunnel-specific source addresses for VXLAN tunnels if OVSDB is used.

The VTEP reports the global VXLAN tunnel source address to the controller for VXLAN tunnel setup.

To specify a global source address for VXLAN tunnels:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Specify a global source address for VXLAN tunnels.	tunnel global source-address ip-address	By default, no global source address is specified for VXLAN tunnels.

Specifying a VTEP access port

For the controller to manage a site-facing interface, you must specify the interface as a VTEP access port.

As a best practice, do not manually configure VXLAN settings on a VTEP access port.

To specify a VTEP access port:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enter interface view.	· Enter Layer 2 Ethernet interface view: interface interface-type interface-number · Enter Layer 2 aggregate interface view: interface bridge-aggregation interface-number	N/A
3. Specify the interface as a VTEP access port.	vtep access port	By default, an interface is not a VTEP access port.

Disabling the ACLs issued by the OVSDB controller

Overview

Perform this task on a VTEP to disable all the ACLs issued by the OVSDB controller in order to save ACL resources on the VTEP.

Configuration procedure

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Disable the ACLs issued by the OVSDB controller.	vtep acl disable	By default, the ACLs issued by the OVSDB controller are enabled on a VTEP.

OVSDB VTEP configuration example

Network requirements

As shown in Figure 24, configure the controller cluster to deploy unicast-mode VXLAN 10 to Switch A, Switch B, and Switch C to provide Layer 2 connectivity for the VMs across the network sites.

Figure 24 Network diagram

‌

Configuration procedure

1. Configure IP addresses and unicast routing settings:

# Assign IP addresses to interfaces, as shown in Figure 24. (Details not shown.)

# Configure OSPF on all transport network switches (Switches A through D). (Details not shown.)

2. Configure Switch A:

# Enable L2VPN.

<SwitchA> system-view

[SwitchA] l2vpn enable

# Configure active SSL connection settings.

[SwitchA] ovsdb server pki domain a

[SwitchA] ovsdb server ssl ip 10.0.2.15 port 6632

# Enable the OVSDB server.

[SwitchA] ovsdb server enable

# Enable the OVSDB VTEP service.

[SwitchA] vtep enable

# Assign an IP address to Loopback 0. Specify the IP address as the global source address for VXLAN tunnels.

[SwitchA] interface loopback 0

[SwitchA-LoopBack0] ip address 1.1.1.1 255.255.255.255

[SwitchA-LoopBack0] quit

[SwitchA] tunnel global source-address 1.1.1.1

# Specify site-facing interface Ten-GigabitEthernet 1/0/1 as a VTEP access port.

[SwitchA] interface ten-gigabitethernet 1/0/1

[SwitchA-Ten-GigabitEthernet1/0/1] vtep access port

[SwitchA-Ten-GigabitEthernet1/0/1] quit

3. Configure Switch B:

# Enable L2VPN.

<SwitchB> system-view

[SwitchB] l2vpn enable

# Configure active SSL connection settings.

[SwitchB] ovsdb server pki domain a

[SwitchB] ovsdb server ssl 10.0.2.15 port 6632

# Enable the OVSDB server.

[SwitchB] ovsdb server enable

# Enable the OVSDB VTEP service.

[SwitchB] vtep enable

# Assign an IP address to Loopback 0. Specify the IP address as the global source address for VXLAN tunnels.

[SwitchB] interface loopback 0

[SwitchB-LoopBack0] ip address 2.2.2.2 255.255.255.255

[SwitchB-LoopBack0] quit

[SwitchB] tunnel global source-address 2.2.2.2

# Specify site-facing interface Ten-GigabitEthernet 1/0/1 as a VTEP access port.

[SwitchB] interface ten-gigabitethernet 1/0/1

[SwitchB-Ten-GigabitEthernet1/0/1] vtep access port

[SwitchB-Ten-GigabitEthernet1/0/1] quit

4. Configure Switch C:

# Enable L2VPN.

<SwitchC> system-view

[SwitchC] l2vpn enable

# Configure active SSL connection settings.

[SwitchC] ovsdb server pki domain a

[SwitchC] ovsdb server ssl ip 10.0.2.15 port 6632

# Enable the OVSDB server.

[SwitchC] ovsdb server enable

# Enable the OVSDB VTEP service.

[SwitchC] vtep enable

# Assign an IP address to Loopback 0. Specify the IP address as the global source address for VXLAN tunnels.

[SwitchC] interface loopback 0

[SwitchC-LoopBack0] ip address 3.3.3.3 255.255.255.255

[SwitchC-LoopBack0] quit

[SwitchC] tunnel global source-address 3.3.3.3

# Specify site-facing interface Ten-GigabitEthernet 1/0/1 as a VTEP access port.

[SwitchC] interface ten-gigabitethernet 1/0/1

[SwitchC-Ten-GigabitEthernet1/0/1] vtep access port

[SwitchC-Ten-GigabitEthernet1/0/1] quit

5. Configure VXLAN settings on the controller. (Details not shown.)

Verifying the configuration

1. Verify the VXLAN settings on the VTEPs. This example uses Switch A.

# Verify that the VXLAN tunnel interfaces on the VTEP are up.

[SwitchA] display interface tunnel 1

Tunnel1

Current state: UP

Line protocol state: UP

Description: Tunnel1 Interface

Bandwidth: 64kbps

Maximum transmission unit: 1464

Internet protocol processing: Disabled

Last clearing of counters: Never

Tunnel source 1.1.1.1, destination 2.2.2.2

Tunnel protocol/transport UDP_VXLAN/IP

Last 300 seconds input rate: 0 bytes/sec, 0 bits/sec, 0 packets/sec

Last 300 seconds output rate: 0 bytes/sec, 0 bits/sec, 0 packets/sec

Input: 0 packets, 0 bytes, 0 drops

Output: 0 packets, 0 bytes, 0 drops

# Verify that the VXLAN tunnels have been assigned to the VXLAN.

[SwitchA] display l2vpn vsi verbose

VSI Name: evpn2014

VSI Index : 0

VSI State : Up

MTU : 1500

Bandwidth : -

Broadcast Restrain : -

Multicast Restrain : -

Unknown Unicast Restrain: -

MAC Learning : Enabled

MAC Table Limit : -

MAC Learning rate : -

Drop Unknown : -

Flooding : Enabled

VXLAN ID : 10

Tunnels:

Tunnel Name Link ID State Type Flood proxy

Tunnel1 0x5000001 Up Manual Disabled

Tunnel2 0x5000002 Up Manual Disabled

ACs:

AC Link ID State Type

XGE1/0/1 srv2 0 Up Manual

# Verify that the VTEP has learned the MAC addresses of remote VMs.

<SwitchA> display l2vpn mac-address

MAC Address State VSI Name Link ID/Name Aging

cc3e-5f9c-6cdb Dynamic evpn2014 Tunnel1 Aging

cc3e-5f9c-23dc Dynamic evpn2014 Tunnel2 Aging

--- 2 mac address(es) found ---

2. Verify that VM 1, VM 2, and VM 3 can ping each other. (Details not shown.)

17-VXLAN Configuration Guide

VXLAN network model

VXLAN packet format

Traffic from the local site to a remote site

Traffic from a remote site to the local site

VLAN access mode

Ethernet access mode

Unicast

ARP and ND flood suppression

VXLAN configuration task list

Configuring a VXLAN tunnel

Assigning VXLAN tunnels to a VXLAN

Mapping customer frames to a VSI

Configuration restrictions and guidelines

Configuration procedure

Configuration restrictions and guidelines

Configuration procedure

Configuration restrictions and guidelines

Configuration prerequisites

Configuration procedure

Managing MAC address entries

Enabling local-MAC logging

Displaying and maintaining VXLANs

VXLAN configuration examples

Unicast-mode VXLAN configuration example

Network requirements

Configuration procedure

Verifying the configuration

Network requirements

Configuration procedure

Verifying the configuration

Configuring VXLAN IP gateways

Overview

VXLAN IP gateways separated from VTEPs

Intra-VXLAN traffic forwarding between sites

Inter-VXLAN traffic forwarding between sites

VXLAN-to-external network traffic forwarding

Displaying and maintaining VXLAN IP gateway

Network requirements

Network requirements

Configuration procedure

Network requirements

Configuration procedure

Verifying the configuration

Network requirements

Configuration procedure

Verifying the configuration

Configuring VXLAN-DCI

VXLAN-DCI network model

Intra-VXLAN traffic forwarding between sites

Inter-VXLAN traffic forwarding between sites

Configuration restrictions and guidelines

Configuring a VXLAN-DCI tunnel

Displaying and maintaining VXLAN-DCI

Overview

Configuration procedure