This feature snoops ARP packets to populate the ARP flood suppression table with local and remote MAC addresses. If an ARP request has a matching entry, the VTEP replies to the request on behalf of the VM. If no match is found, the VTEP floods the request to both local and remote sites.

Examples

# Enable ARP flood suppression for VSI vsi1.

<Sysname> system-view

[Sysname] vsi vsi1

[Sysname-vsi-vsi1] arp suppression enable

Related commands

display arp suppression vsi

reset arp suppression vsi

arp suppression mode

Use arp suppression mode to set the ARP flood suppression mode.

Use undo arp suppression mode to restore the default.

Syntax

arp suppression mode { proxy-reply | unicast-forward } [ mismatch-discard ]

undo arp suppression mode

Default

If ARP flood suppression is enabled, the default ARP flood suppression mode is proxy reply. In proxy reply mode, the device broadcasts the ARP requests that are not targeted at the device and do not match any ARP flood suppression entries.

Views

VSI view

Predefined user roles

network-admin

Parameters

proxy-reply: Specifies proxy reply mode. If an ARP request is not targeted at the device and matches an ARP flood suppression entry, the device replies to the ARP request on behalf of the target IP address. The ARP reply carries the following information:

· Sender IP address—Target IP address in the ARP request.

· Sender MAC address—MAC address in the matching ARP flood suppression entry.

· Source MAC address—MAC address in the matching ARP flood suppression entry.

unicast-forward: Specifies unicast forwarding mode. If an ARP request is not targeted at the device and matches an ARP flood suppression entry, the device acts as follows:

1. Replaces the target MAC address and destination MAC address in the ARP request with the MAC address in the entry.

2. Unicasts the ARP request.

mismatch-discard: Specifies mismatch discarding mode. In this mode, the device discards an ARP request that is not targeted at the device and does not match any ARP flood suppression entry. If you do not specify this keyword, the device will broadcast such an ARP request.

Usage guidelines

The device does not forward ARP requests in proxy reply mode, which decreases system resource consumption. Unicast forwarding mode reduces the ARP entry learning errors caused by the delay in refreshing ARP flood suppression entries at the expense of high system resource usage.

Examples

# Enable ARP flood suppression and set its mode to unicast forwarding on VSI vsi1.

<Sysname> system-view

[Sysname] vsi vsi1

[Sysname-vsi-vsi1] arp suppression enable

[Sysname-vsi-vsi1] arp suppression mode unicast-forward

Related commands

arp suppression enable

description

Use description to configure a description for a VSI.

Use undo description to restore the default.

Syntax

description text

undo description

Default

A VSI does not have a description.

Views

VSI view

Predefined user roles

network-admin

Parameters

text: Specifies a description, a case-sensitive string of 1 to 80 characters.

Examples

# Configure a description for VSI vpn1.

<Sysname> system-view

[Sysname] vsi vpn1

[Sysname-vsi-vpn1] description vsi for vpn1

Related commands

display l2vpn vsi

display arp suppression vsi

Use display arp suppression vsi to display ARP flood suppression entries.

Syntax

display arp suppression vsi [ name vsi-name ] [ slot slot-number ] [ count ]

Views

Any view

Predefined user roles

network-admin

network-operator

Parameters

name vsi-name: Specifies a VSI by its name, a case-sensitive string of 1 to 31 characters. If you do not specify a VSI, this command displays entries for all VSIs.

slot slot-number: Specifies an IRF member device by its member ID. If you do not specify a member device, this command displays entries on the master device.

count: Displays the number of ARP flood suppression entries that match the command.

Examples

# Display ARP flood suppression entries.

<Sysname> display arp suppression vsi

IP address MAC address VSI name Link ID Aging(min)

1.1.1.2 000f-e201-0101 vsi1 0x70000 14

1.1.1.3 000f-e201-0202 vsi1 0x80000 18

1.1.1.4 000f-e201-0203 vsi2 0x90000 10

# Display the number of ARP flood suppression entries.

<Sysname> display arp suppression vsi count

Total entries: 3

Table 1 Command output

Field	Description
Link ID	Link ID that uniquely identifies an AC or a VXLAN tunnel on a VSI.
Aging	Remaining lifetime (in minutes) of the ARP flood suppression entry. When the timer expires, the entry is deleted.

Related commands

arp suppression enable

reset arp suppression vsi

display ipv6 nd suppression vsi

Use display ipv6 nd suppression vsi to display ND flood suppression entries.

Syntax

display ipv6 nd suppression vsi [ name vsi-name ] [ slot slot-number ] [ count ]

Views

Any view

Predefined user roles

network-admin

network-operator

Parameters

name vsi-name: Specifies a VSI by its name, a case-sensitive string of 1 to 31 characters. If you do not specify a VSI, this command displays entries for all VSIs.

slot slot-number: Specifies an IRF member device by its member ID. If you do not specify a member device, this command displays entries on the master device.

count: Displays the number of ND flood suppression entries that match the command.

Examples

# Display ND flood suppression entries.

<Sysname> display ipv6 nd suppression vsi

IPv6 address MAC address VSI name Link ID Aging (min)

1000::2 000f-e201-0101 vsi1 0x70000 5

1000::3 000f-e201-0202 vsi1 0x80000 5

1000::4 000f-e201-0203 vsi2 0x90000 5

# Display the number of ND flood suppression entries.

<Sysname> display ipv6 nd suppression vsi count

Total entries: 3

Table 2 Command output

Field	Description
Link ID	Link ID that uniquely identifies an AC or a VXLAN tunnel on a VSI.
Aging (min)	Remaining lifetime (in minutes) of the ND flood suppression entry. When the timer expires, the entry is deleted.

Related commands

ipv6 nd suppression enable

reset ipv6 nd suppression vsi

display l2vpn forwarding ac

Use display l2vpn forwarding ac to display L2VPN AC forwarding information.

Syntax

display l2vpn forwarding ac [ vsi vsi-name ] [ slot slot-number ] [ verbose ]

Views

Any view

Predefined user roles

network-admin

network-operator

Parameters

vsi vsi-name: Displays L2VPN forwarding information for a VSI. The vsi-name argument specifies the VSI name, a case-sensitive string of 1 to 31 characters. If you do not specify a VSI, this command displays L2VPN forwarding information for all VSIs.

slot slot-number: Specifies an IRF member device by its member ID. If you do not specify a member device, this command displays L2VPN forwarding information for the master device.

verbose: Displays detailed information. If you do not specify this keyword, the command displays brief information.

Examples

# Display brief AC forwarding information for all VSIs.

<Sysname> display l2vpn forwarding ac

Total number of VSIs: 1

Total number of ACs: 1 up, 0 down

AC VSI Name Link ID State

BAGG1 srv1 1 0x1 Up

Table 3 Command output

Field	Description
Total number of VSIs	Total number of VSIs, including VSIs that are not bound to any ACs.
AC	AC type: Layer 2 interface and Ethernet service instance.
Link ID	Link ID of the AC in the VSI.
State	AC state, up or down.

# Display detailed AC forwarding information for all VSIs.

<Sysname> display l2vpn forwarding ac verbose

VSI Name: vpls2

Interface: 25GE1/0/3 Service Instance: 4

Link ID : 1

Access Mode : VLAN

State : UP

Encapsulation : s-vid 10

Type : Manual

On-Demand Entry Flushing : Removed

Table 4 Command output

Field	Description
Service Instance	Ethernet service instance ID. This field is displayed only when the AC is an Ethernet service instance on a Layer 2 interface.
Link ID	Link ID of the AC in the VSI.
Access Mode	AC access mode: · VLAN. · Ethernet.
State	AC state.
Encapsulation	Frame match criterion of the Ethernet service instance.
Type	Ethernet service instance type: · Dynamic (MAC-based)—Dynamic Ethernet service instance in MAC-based traffic match mode. · Dynamic (VLAN-based)—Dynamic Ethernet service instance in VLAN-based traffic match mode. · Manual—Static Ethernet service instance in VLAN-based traffic match mode.
On-Demand Entry Flushing	On-demand entry flushing state: · Flushed—The AC forwarding information has been issued to the hardware. · Removed—The AC forwarding information has been removed from the hardware. This field is not displayed if on-demand entry flushing is not configured for the AC.

display l2vpn mac-address

Use display l2vpn mac-address to display MAC address entries for VSIs.

Syntax

display l2vpn mac-address [ vsi vsi-name ] [ dynamic ] [ count | verbose ]

Views

Any view

Predefined user roles

network-admin

network-operator

Parameters

vsi vsi-name: Specifies a VSI name, a case-sensitive string of 1 to 31 characters. If you do not specify a VSI, this command displays MAC address entries for all VSIs.

dynamic: Specifies dynamic MAC address entries learned in the data plane. If you do not specify this keyword, the command displays all MAC address entries, including:

· Dynamic remote- and local-MAC entries.

· Remote-MAC entries advertised through BGP EVPN.

· Manually added static remote- and local-MAC entries.

count: Displays the number of MAC address entries.

verbose: Displays detailed information about MAC address entries.

Usage guidelines

If you do not specify the count or verbose keyword, this command displays brief information about MAC address entries.

Examples

# Display brief information about MAC address entries for all VSIs.

<Sysname> display l2vpn mac-address

MAC Address State VSI Name Link ID/Name Aging

0000-0000-000b Static vpn1 Tunnel10 NotAging

0000-0000-000c Dynamic vpn1 Tunnel60 Aging

0000-0000-000d Dynamic vpn1 Tunnel99 Aging

--- 3 mac address(es) found ---

# Display the total number of MAC address entries in all VSIs.

<Sysname> display l2vpn mac-address count

3 mac address(es) found

Table 5 Command output

Field	Description
State	Entry state: · Dynamic—Local- or remote-MAC entry dynamically learned in the data plane. · Static—Static local- and remote-MAC entry. · EVPN—Remote-MAC entry advertised through BGP EVPN. · OpenFlow—Remote-MAC entry issued by a remote controller through OpenFlow. · Security—MAC entry configured or learned by port security.
Link ID/Name	For a local MAC address, this field displays the name of the interface that hosts the Ethernet service instance for the MAC address. For a remote MAC address, this field displays the tunnel interface name.
Aging	Entry aging state: · Aging. · NotAging.

# Display detailed information about MAC address entries for all VSIs.

<Sysname> display l2vpn mac-address verbose

MAC Address : 0000-0000-000b

VSI Name : vpn1

VXLAN ID : 123

Interface : 25GE1/0/1

Link ID : 1

State : Dynamic

Aging : Aging

Table 6 Command output

Field	Description
Interface	For a local MAC address, this field displays the name of the interface that hosts the Ethernet service instance for the MAC address. For a remote MAC address, this field displays the tunnel interface name.
Link ID	Link ID that uniquely identifies an AC or a VXLAN tunnel on a VSI.
State	Entry state: · Dynamic—Local- or remote-MAC entry dynamically learned in the data plane. · Static—Static local- or remote-MAC entry. · EVPN—Remote-MAC entry advertised through BGP EVPN. · OpenFlow—Remote-MAC entry issued by a remote controller through OpenFlow. · Security—MAC entry configured or learned by port security.
Aging	Entry aging state: · Aging. · NotAging.

Related commands

reset l2vpn mac-address

display l2vpn mac-address mac-move

Use display l2vpn mac-address mac-move to display MAC move records for VSIs.

Syntax

display l2vpn mac-address mac-move [ slot slot-number ]

Views

Any view

Predefined user roles

network-admin

network-operator

Parameters

slot slot-number: Specifies an IRF member device by its member ID. If you do not specify a member device, this command displays MAC move records on the master device.

Usage guidelines

When a MAC address frequently moves between two interfaces, Layer 2 loops might occur in the network. To discover and locate loops, you can view the MAC address move records.

This command displays the MAC move events that have occurred on VSIs since startup of the device. The MAC move records with the same MAC address, VSI name, source port, and current port are considered to be one record.

An IRF member device can generate a maximum of 200 MAC address move records.

Examples

# Display MAC move records for all VSIs.

<Sysname> display l2vpn mac-address mac-move

MAC address : 0000-4900-03e7 VSI name : 3

Current port: 25GE1/0/1 srv2 Source port: 25GE1/0/2 srv3

Last time : 2019-02-19 20:44:15 Move count : 1

--- 1 MAC address moving records found ---

Table 7 Command output

Field	Description
Current port	Interface to which the MAC address was moved. For a PEX, this field is displayed only when the specified card hosts the current interface.
Source port	Interface from which the MAC address was moved. For a PEX, this field is displayed only when the specified card hosts the source interface.
Last time	Last time when the MAC address was moved.
Move count	Number of times that the MAC address has moved.

‌

display l2vpn service-instance

Use display l2vpn service-instance to display information about Ethernet service instances.

Syntax

display l2vpn service-instance [ interface interface-type interface-number [ service-instance instance-id ] ] [ verbose ]

Views

Any view

Predefined user roles

network-admin

network-operator

Parameters

interface interface-type interface-number: Specifies a Layer 2 Ethernet interface or Layer 2 aggregate interface by its interface type and number. If you do not specify an interface, this command displays Ethernet service instance information for all Layer 2 Ethernet interfaces and Layer 2 aggregate interfaces.

service-instance instance-id: Specifies an Ethernet service instance by its ID in the range of 1 to 4096. If you do not specify an Ethernet service instance, this command displays information about all Ethernet service instances on the specified Layer 2 Ethernet interface or Layer 2 aggregate interface.

verbose: Displays detailed information about Ethernet service instances. If you do not specify this keyword, the command displays brief information about Ethernet service instances.

Examples

# Display brief information about all Ethernet service instances.

<Sysname> display l2vpn service-instance

Total number of service-instances: 1, 0 up, 1 down

Total number of ACs: 1, 0 up, 1 down

Interface SrvID Owner LinkID State Type

BAGG1 1 1 1 Down VSI

Table 8 Command output

Field	Description
Total number of ACs	Total number of attachment circuits (ACs) and the number of ACs in each state (up or down).
Interface	Name of a Layer 2 Ethernet interface or Layer 2 aggregate interface.
SrvID	Ethernet service instance ID.
Owner	VSI name. This field is empty if an Ethernet service instance is not mapped to any VSI.
LinkID	Ethernet service instance's link ID on the VSI.
State	Ethernet service instance state: · Up. · Down.
Type	L2VPN type of the Ethernet service instance: · VSI. · VPWS.

# Display detailed information about all Ethernet service instances on Twenty-FiveGigE 1/0/1.

<Sysname> display l2vpn service-instance interface twenty-fivegige 1/0/1 verbose

Interface: 25GE1/0/1

Service Instance: 1

Type : Manual

Encapsulation : s-vid 16

VSI Name : vsi10

Link ID : 1

State : Up

Statistics : Enabled

Input Statistics:

Octets :0

Packets :0

Errors : 0

Discards: 0

Output Statistics:

Octets :0

Packets :0

Errors : 0

Discards: 0

Table 9 Command output

Field	Description
Interface	Name of a Layer 2 Ethernet interface or Layer 2 aggregate interface.
Service Instance	Ethernet service instance ID.
Type	Type and traffic match mode of the Ethernet service instance: · Dynamic (MAC-based)—Dynamic Ethernet service instance in MAC-based traffic match mode. · Dynamic (VLAN-based)—Dynamic Ethernet service instance in VLAN-based traffic match mode. · Manual—Static Ethernet service instance in VLAN-based traffic match mode.
Encapsulation	Frame match criterion of the Ethernet service instance. If the Ethernet service instance does not contain a match criterion, the command does not display this field.
Link ID	Ethernet service instance's link ID on the VSI.
State	Ethernet service instance state: · Up. · Blocked. · Down.
E-Tree Mode	Role of the AC in EVPN E-tree in the EVPN VPLS or EVPN VPLS over SRv6 network: · root. · leaf.
End.Dx2 SID	End.DX2 SID assigned to the AC in the EVPN VPLS over SRv6 network. This field displays a hyphen (-) if the AC is not assigned any End.DX2 SID.
End.Dx2l SID	End.Dx2l SID assigned to the AC in the EVPN VPLS over SRv6 network. This field displays a hyphen (-) if the AC is not assigned any End.Dx2l SID.
Statistics	Packet statistics state: · Enabled—The packet statistics feature is enabled for the Ethernet service instance. · Disabled—The packet statistics feature is disabled for the Ethernet service instance.
Input Statistics	Incoming traffic statistics: · Octets—Number of incoming bytes. · Packets—Number of incoming packets. · Errors—Number of error packets. · Discards—Number of dropped packets.
Output Statistics	Outgoing traffic statistics: · Octets—Number of outgoing bytes. · Packets—Number of outgoing packets. · Errors—Number of error packets. · Discards—Number of dropped packets.

Related commands

service-instance

display l2vpn vsi

Use display l2vpn vsi to display information about VSIs.

Syntax

display l2vpn vsi [ name vsi-name | evpn-vxlan | vxlan ] [ count | verbose ]

Views

Any view

Predefined user roles

network-admin

network-operator

Parameters

name vsi-name: Specifies a VSI by its name, a case-sensitive string of 1 to 31 characters.

evpn-vxlan: Specifies VSIs of EVPN VXLAN.

vxlan: Specifies VSIs of VXLAN.

count: Displays VSI state statistics.

verbose: Displays detailed information about VSIs. If you do not specify this keyword, the command displays brief information about VSIs.

Usage guidelines

If you do not specify a VSI or network type, this command displays information about all VSIs.

Examples

# Display brief information about all VSIs.

<Sysname> display l2vpn vsi

Total number of VSIs: 2, 1 up, 1 down, 0 admin down

VSI Name VSI Index MTU State

vpls1 0 1500 Up

vpls2 1 1500 Down

# Display state statistics about all VSIs.

<Sysname> display l2vpn vsi count

Total number of VSIs: 1, 1 up, 0 down, 0 admin down

Table 10 Command output

Field	Description
State	VSI state: · Up—The VSI is up. · Down—The VSI is down. · Admin down—The VSI has been manually shut down by using the shutdown command.

Field

Description

State

VSI state:

· Up—The VSI is up.

· Down—The VSI is down.

· Admin down—The VSI has been manually shut down by using the shutdown command.

# Display detailed information about all VSIs of EVPN VXLAN.

<Sysname> display l2vpn vsi evpn-vxlan verbose

VSI Name: vpna

VSI Index : 0

VSI Description : vsi for vxlan10

VSI State : Up

MTU : -

Bandwidth : Unlimited

Broadcast Restrain : -

Multicast Restrain : -

Unknown Unicast Restrain: -

MAC Learning : Enabled

MAC Table Limit : -

MAC Learning rate : -

Drop Unknown : -

PW Redundancy Mode : Slave

Flooding : Enabled

ESI : 0000.0000.0000.0000.0000

Redundancy Mode : All-active

Statistics : Enabled

Input statistics :

Octets : 0

Packets : 0

Errors : 0

Discards : 0

Output statistics:

Octets : 0

Packets : 0

Errors : 0

Discards : 0

Input Rate :

Bytes per second : 0

Packets per second : 0

Output Rate :

Bytes per second : 0

Packets per second : 0

Gateway Interface : VSI-interface 100

VXLAN ID : 10

EVPN Encapsulation : VXLAN

Tunnels:

Tunnel Name Link ID State Type Flood proxy

Tunnel1 0x5000001 Up Manual Disabled

Tunnel2 0x5000002 Up Manual Disabled

ACs:

AC Link ID State Type

BAGG1 srv1 0x1 Down Manual

Statistics: Disabled

Table 11 Command output

Field	Description
VSI Description	Description of the VSI. If the VSI does not have a description, the command does not display this field.
VSI State	VSI state: · Up—The VSI is up. · Down—The VSI is down. · Administratively down—The VSI has been manually shut down by using the shutdown command.
MTU	MTU on the VSI.
Diffserv Mode	DiffServ mode.
Bandwidth	Bandwidth limit in kbps. If no bandwidth limit is set for the VSI, Unlimited is displayed.
Broadcast Restrain	Broadcast restraint bandwidth (in kbps).
Multicast Restrain	Multicast restraint bandwidth (in kbps).
Unknown Unicast Restrain	Unknown unicast restraint bandwidth (in kbps).
MAC Learning	State of the MAC learning feature.
MAC Table Limit	This field is not supported in the current software version. Maximum number of MAC address entries on the VSI.
MAC Learning rate	This field is not supported in the current software version. MAC address entry learning rate of the VSI.
Drop Unknown	This field is not supported in the current software version. Action on source MAC-unknown frames received after the maximum number of MAC entries is reached.
PW Redundancy Mode	PW redundancy operation mode: · Slave—Master/slave mode and the local PE operates as the slave node. · Master—Master/slave mode and the local PE operates as the master node. · Independent—Independent mode.
DSCP	DSCP value of outgoing VXLAN packets.
Service Class	Service class value of outgoing VXLAN packets.
Flooding	State of the VSI's flooding feature: · Enabled—Flooding is enabled on the VSI. · Disabled—Flooding is disabled on the VSI.
ESI	This field is not supported in the current software version. ESI assigned to the VSI.
Redundancy Mode	This field is not supported in the current software version. ES redundancy mode for the VSI: · A—All-active mode. · S—Single-active mode.
Statistics	Packet statistics state: · Enabled—The packet statistics feature is enabled for the VSI. · Disabled—The packet statistics feature is disabled for the VSI.
Input statistics	Incoming traffic statistics: · Octets—Number of incoming bytes. · Packets—Number of incoming packets. · Errors—Number of error packets. · Discards—Number of discarded packets.
Output statistics	Outgoing traffic statistics: · Octets—Number of outgoing bytes. · Packets—Number of outgoing packets. · Errors—Number of error packets. · Discards—Number of discarded packets.
Input Rate	Incoming traffic rate for the VSI, in Bps and pps.
Output Rate	Outgoing traffic rate for the VSI, in Bps and pps.
Gateway Interface	VSI interface name.
EVPN Encapsulation	EVPN encapsulation type, which can only be VXLAN.
State	Tunnel state: · Up—The tunnel is operating correctly. · Down—The tunnel interface is down.
Type	Tunnel assignment method: · Auto—The tunnel was automatically assigned to the VXLAN: ¡ For an EVPN network, VXLAN tunnels are automatically assigned to VXLANs. · Manual—The tunnel was manually assigned to the VXLAN.
Flood proxy	This field is not supported in the current software version. Flood proxy state.
ACs	ACs that are bound to the VSI.
Link ID	AC's link ID on the VSI.
State	AC state: · Up. · Down.
Type	Type and traffic match mode of the Ethernet service instance: · Dynamic (MAC-based)—Dynamic Ethernet service instance in MAC-based traffic match mode. · Dynamic (VLAN-based)—Dynamic Ethernet service instance in VLAN-based traffic match mode. · Manual—Static Ethernet service instance in VLAN-based traffic match mode.
Statistics	State of AC traffic statistics: · Enabled. · Disabled.

display vxlan tunnel

Use display vxlan tunnel to display VXLAN tunnel information for VXLANs.

Syntax

display vxlan tunnel [ vxlan-id vxlan-id ]

Views

Any view

Predefined user roles

network-admin

network-operator

Parameters

vxlan-id: Specifies a VXLAN ID in the range of 0 to 16777215. If you do not specify a VXLAN, this command displays VXLAN tunnel information for all VXLANs.

Examples

# Display VXLAN tunnel information for all VXLANs.

<Sysname> display vxlan tunnel

Total number of VXLANs: 1

VXLAN ID: 10, VSI name: vpna, Total tunnels: 2 (2 up, 0 down, 0 defect, 0 blocked)

Tunnel name Link ID State Type Flood proxy

Tunnel1 0x5000001 Up Manual Disabled

Tunnel2 0x5000002 Up Manual Disabled

# Display VXLAN tunnel information for VXLAN 10.

<Sysname> display vxlan tunnel vxlan-id 10

VXLAN ID: 10, VSI name: vpna, Total tunnels: 2 (2 up, 0 down, 0 defect, 0 blocked)

Tunnel name Link ID State Type Flood proxy

Tunnel1 0x5000001 Up Manual Disabled

Tunnel2 0x5000002 Up Manual Disabled

Table 12 Command output

Field	Description
Link ID	Tunnel's link ID in the VXLAN.
State	Tunnel state: · Up—The tunnel is operating correctly. · Blocked—The tunnel is a backup tunnel. Its tunnel interface is up, but the tunnel is blocked because the primary tunnel is operating correctly. · Down—The tunnel interface is down.
Type	Tunnel assignment method: · Auto—The tunnel was automatically assigned to the VXLAN: ¡ For an EVPN network, VXLAN tunnels are automatically assigned to VXLANs. · Manual—The tunnel was manually assigned to the VXLAN.
Flood proxy	This field is not supported in the current software version. Flood proxy state.

Related commands

tunnel

vxlan

encapsulation

Use encapsulation to configure a frame match criterion for an Ethernet service instance.

Use undo encapsulation to restore the default.

Syntax

encapsulation s-vid vlan-id

encapsulation untagged

undo encapsulation

Default

An Ethernet service instance does not contain a frame match criterion.

Views

Ethernet service instance view

Predefined user roles

network-admin

Parameters

s-vid: Matches frames that are tagged with the specified outer 802.1Q VLAN IDs.

vlan-id: Specifies an 802.1Q VLAN ID in the range of 1 to 4094.

untagged: Matches any frames that do not have an 802.1Q VLAN tag.

Usage guidelines

An Ethernet service instance can contain only one match criterion. To change the match criterion, first execute the undo encapsulation command to remove the original criterion.

When you remove the match criterion in an Ethernet service instance, the mapping between the service instance and the VSI is removed automatically.

Examples

# Configure Ethernet service instance 1 on Twenty-FiveGigE 1/0/1 to match frames that have an outer 802.1Q VLAN ID of 111.

<Sysname> system-view

[Sysname] interface twenty-fivegige 1/0/1

[Sysname-Twenty-FiveGigE1/0/1] service-instance 1

[Sysname-Twenty-FiveGigE1/0/1-srv1] encapsulation s-vid 111

Related commands

display l2vpn service-instance

flooding disable (VSI view)

Use flooding disable to disable flooding for a VSI.

Use undo flooding disable to enable flooding for a VSI.

Syntax

flooding disable { all | { broadcast | unknown-multicast | unknown-unicast } * } [ all-direction ]

undo flooding disable

Default

Flooding is enabled for a VSI.

Views

VSI view

Predefined user roles

network-admin

Parameters

all: Specifies broadcast, unknown unicast, and unknown multicast traffic.

broadcast: Specifies broadcast traffic.

unknown-multicast: Specifies unknown multicast traffic.

unknown-unicast: Specifies unknown unicast traffic.

all-direction: Disables flooding traffic received from an AC, VXLAN tunnel interface/PW to any other ACs and VXLAN tunnel interfaces/PWs of the same VSI. If you do not specify this keyword, the command only disables flooding traffic received from ACs to VXLAN tunnel interfaces/PWs of the VSI.

Usage guidelines

By default, the device floods broadcast, unknown unicast, and unknown multicast frames received from the local site to the following interfaces in the frame's VXLAN:

· All site-facing interfaces except for the incoming interface.

· All VXLAN tunnel interfaces.

When receiving broadcast, unknown unicast, and unknown multicast frames on VXLAN tunnel interfaces, the device floods the frames to all site-facing interfaces in the frames' VXLAN.

To confine a kind of flood traffic, use this command to disable flooding for that kind of flood traffic on the VSI bound to the VXLAN.

Examples

# Disable flooding of local broadcast traffic to remote sites for VSI vsi1.

<Sysname> system-view

[Sysname] vsi vsi1

[Sysname-vsi-vsi1] flooding disable broadcast

ipv6 nd suppression enable

Use ipv6 nd suppression enable to enable ND flood suppression.

Use undo ipv6 nd suppression enable to disable ND flood suppression.

Syntax

ipv6 nd suppression enable [ no-broadcast ]

undo ipv6 nd suppression enable

Default

ND flood suppression is disabled.

Views

VSI view

Predefined user roles

network-admin

Parameters

no-broadcast: Disables the device from flooding the ND requests that do not match any ND flood suppression entry.

Usage guidelines

ND flood suppression reduces ND request multicasts by enabling the VTEP to reply to ND requests on behalf of user terminals.

This feature snoops ND packets to populate the ND flood suppression table with local and remote MAC addresses. If an ND request has a matching entry, the VTEP replies to the request on behalf of the user terminal. If no match is found, the VTEP floods the request to both local and remote sites.

Examples

# Enable ND flood suppression for VSI vsi1.

<Sysname> system-view

[Sysname] vsi vsi1

[Sysname-vsi-vsi1] ipv6 nd suppression enable

Related commands

display ipv6 nd suppression vsi

reset ipv6 nd suppression vsi

ipv6 nd suppression mode

Use ipv6 nd suppression mode to set the ND flood suppression mode.

Use undo ipv6 nd suppression mode to restore the default.

Syntax

ipv6 nd suppression mode { proxy-reply | unicast-forward } [ mismatch-discard ]

undo ipv6 nd suppression mode

Default

If ND flood suppression is enabled, the default ND flood suppression mode is proxy reply. In proxy reply mode, the device broadcasts the NS packets that are not targeted at the device and do not match any ND flood suppression entries.

Views

VSI view

Predefined user roles

network-admin

Parameters

proxy-reply: Specifies proxy reply mode. If an NS packet is not targeted at the device and matches an ND flood suppression entry, the device replies to the NS packet on behalf of the target IP address. The replied NA packet carries the following information:

· Sender IP address—Target IP address in the NS packet.

· Source MAC address—MAC address in the matching ND flood suppression entry.

unicast-forward: Specifies unicast forwarding mode. If an NS packet is not targeted at the device and matches an ND flood suppression entry, the device acts as follows:

1. Replaces the destination MAC address in the NS packet with the MAC address in the entry.

2. Unicasts the NS packet.

mismatch-discard: Specifies mismatch discarding mode. In this mode, the device discards an NS packet that is not targeted at the device and does not match any ND flood suppression entry. If you do not specify this keyword, the device will broadcast such an NS packet.

Usage guidelines

The device does not forward NS packets in proxy reply mode, which decreases system resource consumption. Unicast forwarding mode reduces the ND entry learning errors caused by the delay in refreshing ND flood suppression entries at the expense of high system resource usage.

Examples

# Enable ND flood suppression and set its mode to unicast forwarding on VSI vsi1.

<Sysname> system-view

[Sysname] vsi vsi1

[Sysname-vsi-vsi1] ipv6 nd suppression enable

[Sysname-vsi-vsi1] nd suppression mode unicast-forward

Related commands

ipv6 nd suppression enable

l2vpn enable

Use l2vpn enable to enable L2VPN.

Use undo l2vpn enable to disable L2VPN.

Syntax

l2vpn enable

undo l2vpn enable

Default

L2VPN is disabled.

Views

System view

Predefined user roles

network-admin

Usage guidelines

You must enable L2VPN before you can configure L2VPN settings.

Examples

# Enable L2VPN.

<Sysname> system-view

[Sysname] l2vpn enable

l2vpn statistics interval

Use l2vpn statistics interval to set the L2VPN statistics collection interval.

Use undo l2vpn statistics interval to restore the default.

Syntax

l2vpn statistics interval interval

undo l2vpn statistics interval

Default

The L2VPN statistics collection interval is 15 minutes.

Views

System view

Predefined user roles

network-admin

Parameters

interval: Sets the L2VPN statistics collection interval in seconds, in the range of 30 to 65535.

Examples

# Set the L2VPN statistics collection interval to 30 seconds.

<Sysname> system-view

[Sysname] l2vpn statistics interval 30

mac-address static vsi

Use mac-address static vsi to add a static MAC address entry for a VXLAN VSI.

Use undo mac-address static vsi to remove a static MAC address entry for a VXLAN VSI.

Syntax

mac-address static mac-address { interface interface-type interface-number service-instance instance-id | interface tunnel tunnel-number } vsi vsi-name

undo mac-address static [ mac-address ] [ interface interface-type interface-number service-instance instance-id | interface tunnel tunnel-number ] vsi vsi-name

Default

VXLAN VSIs do not have static MAC address entries.

Views

System view

Predefined user roles

network-admin

Parameters

mac-address: Specifies a MAC address in H-H-H format. Do not specify a multicast MAC address or an all-zeros MAC address. You can omit the consecutive zeros at the beginning of each segment. For example, you can enter f-e2-1 for 000f-00e2-0001.

interface interface-type interface-number service-instance instance-id: Specifies an AC. The interface-type interface-number argument specifies the interface by its type and number. The instance-id argument specifies the Ethernet service instance by its ID in the range of 1 to 4096. This option applies to local MAC addresses.

interface tunnel tunnel-number: Specifies a VXLAN tunnel interface by its tunnel interface number. The tunnel interface must already exist. This option applies to remote MAC addresses.

vsi vsi-name: Specifies a VSI name, a case-sensitive string of 1 to 31 characters.

Usage guidelines

A local MAC address is the MAC address of a VM in the local site. Local MAC entries include manually added entries and dynamically learned entries.

A remote MAC address is the MAC address of a VM in a remote site. Remote MAC entries include manually added MAC entries, dynamically learned MAC entries, and MAC entries advertised through BGP EVPN.

When you add a local MAC address entry, make sure the specified Ethernet service instance has been mapped to the VSI. When you add a remote MAC address entry, make sure the VSI's VXLAN has been specified on the VXLAN or VXLAN-DCI tunnel.

Do not configure static remote-MAC entries for tunnels that are automatically established by using EVPN.

· EVPN re-establishes tunnels if the transport-facing interface goes down and then comes up. If you have configured static remote-MAC entries, the entries are deleted when the tunnels are re-established.

· EVPN re-establishes tunnels if you perform configuration rollback. If the tunnel IDs change during tunnel re-establishment, configuration rollback fails, and static remote-MAC entries on the tunnels cannot be restored.

The undo mac-address static vsi vsi-name command removes all static MAC address entries for a VSI.

Examples

# Add MAC address 000f-e201-0101 to VSI vsi1. Specify Tunnel-interface 1 as the outgoing interface.

<Sysname> system-view

[Sysname] mac-address static 000f-e201-0101 interface tunnel 1 vsi vsi1

# Add MAC address 000f-e201-0102 of Ethernet service instance 1 to VSI vsi1. Specify Twenty-FiveGigE 1/0/1 as the outgoing interface.

<Sysname> system-view

[Sysname] mac-address static 000f-e201-0102 interface twenty-fivegige 1/0/1 service-instance 1 vsi vsi1

Related commands

vxlan tunnel mac-learning disable

mac-based ac

Use mac-based ac to enable MAC-based traffic match mode for dynamic Ethernet service instances on an interface.

Use undo mac-based ac to disable MAC-based traffic match mode for dynamic Ethernet service instances on an interface.

Syntax

mac-based ac

undo mac-based ac

Default

MAC-based traffic match mode is disabled for dynamic Ethernet service instances. Dynamic Ethernet service instances use VLAN-based traffic match mode.

Views

Layer 2 aggregate interface view

Layer 2 Ethernet interface view

Predefined user roles

network-admin

Usage guidelines

The 802.1X or MAC authentication feature can use the authorization VSI, the guest VSI, the Auth-Fail VSI, and the critical VSI to control the access of users to network resources. When assigning a user to a VSI, 802.1X or MAC authentication sends the VXLAN feature the VSI information and the user's access information, including access interface, VLAN, and MAC address. Then the VXLAN feature creates a dynamic Ethernet service instance for the user and maps it to the VSI.

A dynamic Ethernet service instance supports the following traffic match modes:

· VLAN-based mode—Matches frames by VLAN ID.

· MAC-based mode—Matches frames by VLAN ID and source MAC address.

To use MAC-based traffic match mode for dynamic Ethernet service instances, you must enable MAC authentication or 802.1X authentication that uses MAC-based access control.

This command takes effect only on dynamic Ethernet service instances. Static Ethernet service instances created by using the service-instance command match traffic only by the VLAN IDs specified by using the encapsulation command.

You cannot change the traffic match mode when dynamic Ethernet service instances already exist on an interface.

Examples

# Enable MAC-based traffic match mode for dynamic Ethernet service instances on Twenty-FiveGigE 1/0/1.

<Sysname> system-view

[Sysname] interface twenty-fivegige 1/0/1

[Sysname-Twenty-FiveGigE1/0/1] mac-based ac

Related commands

display l2vpn service-instance

overlay oam enable

Use overlay oam enable to enable overlay OAM.

Use undo overlay oam enable to disable overlay OAM.

Syntax

overlay oam enable

undo overlay oam enable

Default

Overlay OAM is disabled.

Views

System view

Predefined user roles

network-admin

Usage guidelines

You must enable overlay OAM on the tunnel destination device for a VXLAN tunnel before you can use the ping vxlan or tracert vxlan command to test reachability of the VXLAN tunnel on the tunnel source device. To specify the -r 3 parameter in the ping vxlan or tracert vxlan command on the tunnel source device, you must also enable overlay OAM on the tunnel source device.

Examples

# Enable overlay OAM.

<Sysname> system-view

[Sysname] overlay oam enable

Related commands

ping vxlan

tracert vxlan

reserved vxlan

Use reserved vxlan to specify a reserved VXLAN.

Use undo reserved vxlan to restore the default.

Syntax

reserved vxlan vxlan-id

undo reserved vxlan

Default

No VXLAN has been reserved.

Views

System view

Predefined user roles

network-admin

Parameters

vxlan-id: Specifies a VXLAN ID in the range of 0 to 16777215.

Usage guidelines

You can specify only one reserved VXLAN on the VTEP. The reserved VXLAN cannot be the VXLAN created on any VSI.

The reserved VXLAN ID cannot be the same as the remote VXLAN ID specified by using the mapping vni command.

Examples

# Specify VXLAN 10000 as the reserved VXLAN.

<Sysname> system-view

[Sysname] reserved vxlan 10000

Related commands

mapping vni (EVPN Command Reference)

reset arp suppression vsi

Use reset arp suppression vsi to clear ARP flood suppression entries on VSIs.

Syntax

reset arp suppression vsi [ name vsi-name ]

Views

User view

Predefined user roles

network-admin

Parameters

name vsi-name: Specifies a VSI by its name, a case-sensitive string of 1 to 31 characters. If you do not specify a VSI, this command clears ARP flood suppression entries on all VSIs.

Examples

# Clear ARP flood suppression entries on all VSIs.

<Sysname> reset arp suppression vsi

This command will delete all entries. Continue? [Y/N]:y

Related commands

arp suppression enable

display arp suppression vsi

reset ipv6 nd suppression vsi

Use reset ipv6 nd suppression vsi to clear ND flood suppression entries on VSIs.

Syntax

reset ipv6 nd suppression vsi [ name vsi-name ]

Views

User view

Predefined user roles

network-admin

Parameters

name vsi-name: Specifies a VSI by its name, a case-sensitive string of 1 to 31 characters. If you do not specify a VSI, this command clears ND flood suppression entries on all VSIs.

Examples

# Clear ND flood suppression entries on all VSIs.

<Sysname> reset ipv6 nd suppression vsi

This command will delete all entries. Continue? [Y/N]:y

Related commands

display ipv6 nd suppression vsi

ipv6 nd suppression enable

reset l2vpn mac-address

Use reset l2vpn mac-address to clear dynamic MAC address entries on VSIs.

Syntax

reset l2vpn mac-address [ vsi vsi-name ]

Views

User view

Predefined user roles

network-admin

Parameters

vsi vsi-name: Specifies a VSI by its name, a case-sensitive string of 1 to 31 characters. If you do not specify a VSI, this command clears all dynamic MAC address entries on all VSIs.

Usage guidelines

Use this command when the number of dynamic MAC address entries reaches the limit or the device learns incorrect MAC addresses.

Examples

# Clear the dynamic MAC address entries on VSI vpn1.

<Sysname> reset l2vpn mac-address vsi vpn1

Related commands

display l2vpn mac-address vsi

reset l2vpn mac-address mac-move

Use reset l2vpn mac-address mac-move to clear MAC move records for all VSIs.

Syntax

reset l2vpn mac-address mac-move

Views

User view

Predefined user roles

network-admin

Examples

# Clear MAC move records for all VSIs.

<Sysname> reset l2vpn mac-address mac-move

Related commands

display l2vpn mac-address mac-move

reset l2vpn statistics ac

Use reset l2vpn statistics ac to clear packet statistics on ACs.

Syntax

reset l2vpn statistics ac [ interface interface-type interface-number service-instance instance-id ]

Views

User view

Predefined user roles

network-admin

Parameters

interface interface-type interface-number: Specifies an interface by its type and number.

service-instance instance-id: Specifies an Ethernet service instance ID in the range of 1 to 4096.

Usage guidelines

If you do not specify any parameters, this command clears packet statistics on all ACs.

Examples

# Clear packet statistics for Ethernet service instance 1 on Twenty-FiveGigE 1/0/1.

<Sysname> reset l2vpn statistics ac interface twenty-fivegige 1/0/1 service-instance 1

Related commands

display l2vpn interface

display l2vpn service-instance verbose

statistics enable (Ethernet service instance view)

reset l2vpn statistics vsi

Use reset l2vpn statistics vsi to clear packet statistics on VSIs.

Syntax

reset l2vpn statistics vsi [ name vsi-name ]

Views

User view

Predefined user roles

network-admin

Parameters

name vsi-name: Specifies a VSI by its name, a case-sensitive string of 1 to 31 characters. If you do not specify a VSI, this command clears packet statistics on all VSIs.

Examples

# Clear packet statistics on all VSIs.

<Sysname> reset l2vpn statistics vsi

Related commands

statistics enable (VSI view)

selective-flooding mac-address

Use selective-flooding mac-address to enable selective flood for a MAC address.

Use undo selective-flooding mac-address to disable selective flood for a MAC address.

Syntax

selective-flooding mac-address mac-address

undo selective-flooding mac-address mac-address

Default

Selective flood is disabled for all MAC addresses.

Views

VSI view

Predefined user roles

network-admin

Parameters

mac-address: Specifies a MAC address. The MAC address cannot be all Fs.

Usage guidelines

This command excludes a remote unicast or multicast MAC address from the remote flood suppression done by using the flooding disable command. The VTEP will flood the frames destined for the specified MAC address to remote sites when floods are confined to the local site.

Examples

# Enable selective flood for 000f-e201-0101 on VSI vsi1.

<Sysname> system-view

[Sysname] vsi vsi1

[Sysname-vsi-vsi1] selective-flooding mac-address 000f-e201-0101

Related commands

flooding disable (VSI view)

service-instance

Use service-instance to create an Ethernet service instance and enter its view, or enter the view of an existing Ethernet service instance.

Use undo service-instance to delete an Ethernet service instance.

Syntax

service-instance instance-id

undo service-instance instance-id

Default

No Ethernet service instances exist.

Views

Layer 2 aggregate interface view

Layer 2 Ethernet interface view

Predefined user roles

network-admin

Parameters

instance-id: Specifies an Ethernet service instance ID in the range of 1 to 4096.

Examples

# On Layer 2 Ethernet interface Twenty-FiveGigE 1/0/1, create Ethernet service instance 1 and enter Ethernet service instance view.

<Sysname> system-view

[Sysname] interface twenty-fivegige 1/0/1

[Sysname-Twenty-FiveGigE1/0/1] service-instance 1

[Sysname-Twenty-FiveGigE1/0/1-srv1]

Related commands

display l2vpn service-instance

shutdown

Use shutdown to shut down a VSI.

Use undo shutdown to bring up a VSI.

Syntax

shutdown

undo shutdown

Default

VSIs are up.

Views

VSI view

Predefined user roles

network-admin

Usage guidelines

Use this command to temporarily disable a VSI to provide Layer 2 switching services. The shutdown action does not change settings on the VSI. You can continue to configure the VSI. After you bring up the VSI again, the VSI provides services based on the latest settings.

Examples

# Shut down VSI vpn1.

<Sysname> system-view

[Sysname] vsi vpn1

[Sysname-vsi-vpn1] shutdown

Related commands

display l2vpn vsi

statistics enable (Ethernet service instance view)

Use statistics enable to enable packet statistics for an Ethernet service instance.

Use undo statistics enable to disable packet statistics for an Ethernet service instance.

Syntax

statistics enable

undo statistics enable

Default

The packet statistics feature is disabled for an Ethernet service instance.

Views

Ethernet service instance view

Predefined user roles

network-admin

Usage guidelines

For this command to take effect, you must configure a frame match criterion for the Ethernet service instance and map it to a VSI. If you modify the frame match criterion or VSI mapping, packet statistics of the instance is cleared.

Examples

# Enable packet statistics for Ethernet service instance 200 on Twenty-FiveGigE 1/0/1.

<Sysname> system-view

[Sysname] interface twenty-fivegige 1/0/1

[Sysname-Twenty-FiveGigE1/0/1] service-instance 200

[Sysname-Twenty-FiveGigE1/0/1-srv200] statistics enable

Related command

display l2vpn service-instance verbose

reset l2vpn statistics ac

statistics enable (VSI view)

Use statistics enable to enable packet statistics for a VSI.

Use undo statistics enable to disable packet statistics for a VSI.

Syntax

statistics enable

undo statistics enable

Default

The packet statistics feature is disabled for a VSI.

Views

VSI view

Predefined user roles

network-admin

Examples

# Enable packet statistics for VSI vsi1.

<Sysname> system-view

[Sysname] vsi vsi1

[Sysname-vsi-vsi1] statistics enable

Related commands

display l2vpn vsi verbose

reset l2vpn statistics vsi

tunnel

Use tunnel to assign VXLAN tunnels to a VXLAN.

Use undo tunnel to remove VXLAN tunnels from a VXLAN.

Syntax

tunnel { tunnel-number [ backup-tunnel tunnel-number ] | all }

undo tunnel { tunnel-number | all }

Default

A VXLAN does not contain VXLAN tunnels.

Views

VXLAN view

Predefined user roles

network-admin

Parameters

tunnel-number: Specifies a tunnel interface number. The value range for this argument is 0 to 9214. The tunnel interface must already exist. The tunnel must be a VXLAN tunnel.

backup-tunnel tunnel-number: Specifies a backup tunnel by its tunnel interface number in the range of 0 to 9214. The tunnel must be a VXLAN tunnel.

all: Specifies all VXLAN tunnels.

Usage guidelines

This command assigns a VXLAN tunnel to a VXLAN to provide Layer 2 connectivity for the VXLAN between two sites. In unicast mode, the system floods unknown unicast, multicast, and broadcast traffic to each tunnel in the VXLAN.

You can assign multiple VXLAN tunnels to a VXLAN, and configure a VXLAN tunnel to trunk multiple VXLANs.

To assign a pair of primary and backup VXLAN tunnels to the VXLAN, specify the backup-tunnel tunnel-number option. When the primary VXLAN tunnel is operating correctly, the backup VXLAN tunnel does not forward traffic. When the primary VXLAN tunnel goes down, traffic is switched to the backup VXLAN tunnel.

If you assign VXLAN tunnels to a VXLAN one by one, you cannot remove all the VXLAN tunnels by using the undo tunnel all command. If you assign all VXLAN tunnels to a VXLAN by using the tunnel all command, you cannot remove the VXLAN tunnels one by one. You can only use the undo tunnel all command to remove all the VXLAN tunnels.

As a best practice, use the tunnel all command only when batch VXLAN tunnel assignment is necessary.

Examples

# Assign VXLAN tunnels 1 and 2 to VXLAN 10000.

<Sysname> system-view

[Sysname] vsi vpna

[Sysname-vsi-vpna] vxlan 10000

[Sysname-vsi-vpna-vxlan-10000] tunnel 1

[Sysname-vsi-vpna-vxlan-10000] tunnel 2

Related commands

display vxlan tunnel

tunnel global source-address

Use tunnel global source-address to specify a global source address for VXLAN tunnels.

Use undo tunnel global source-address to restore the default.

Syntax

tunnel global source-address { ipv4-address | ipv6 ipv6-address }

undo tunnel global source-address [ ipv6 ]

Default

No global source address is specified for VXLAN tunnels.

Views

System view

Predefined user roles

network-admin

Parameters

ipv4-address: Specifies an IPv4 address.

ipv6 ipv6-address: Specifies an IPv6 address. If you do not specify the ipv6 keyword when using the undo form of the command, the global IPv4 address is deleted.

Usage guidelines

A VXLAN tunnel uses the global source address if you do not specify a source interface or source address for the tunnel.

The global source address takes effect only on VXLAN tunnels.

IPv4 VXLAN tunnels use the global IPv4 source address. IPv6 VXLAN tunnels use the global IPv6 source address.

Examples

# Specify 1.1.1.1 as the global source address for VXLAN tunnels.

<Sysname> system-view

[Sysname] tunnel global source-address 1.1.1.1

vsi

Use vsi to create a VSI and enter its view, or enter the view of an existing VSI.

Use undo vsi to delete a VSI.

Syntax

vsi vsi-name

undo vsi vsi-name

Default

No VSIs exist.

Views

System view

Predefined user roles

network-admin

Parameters

vsi-name: Specifies a VSI name, a case-sensitive string of 1 to 31 characters.

Usage guidelines

A VSI acts as a virtual switch to provide Layer 2 switching services for a VXLAN on a VTEP. A VSI has all functions of a physical Ethernet switch, including source MAC address learning, MAC address aging, and flooding.

A VSI can provide services only for one VXLAN.

Examples

# Create VSI vxlan10 and enter VSI view.

<Sysname> system-view

[Sysname] vsi vxlan10

[Sysname-vsi-vxlan10]

Related commands

display l2vpn vsi

vxlan

Use vxlan to create a VXLAN and enter its view, or enter the view of an existing VXLAN.

Use undo vxlan to restore the default.

Syntax

vxlan vxlan-id

undo vxlan

Default

No VXLANs exist.

Views

VSI view

Predefined user roles

network-admin

Parameters

vxlan-id: Specifies a VXLAN ID in the range of 0 to 16777215.

Usage guidelines

You can create only one VXLAN for a VSI. The VXLAN ID for each VSI must be unique.

Examples

# Create VXLAN 10000 for VSI vpna and enter VXLAN view.

<Sysname> system-view

[Sysname] vsi vpna

[Sysname-vsi-vpna] vxlan 10000

[Sysname-vsi-vpna-vxlan-10000]

Related commands

vsi

vxlan default-decapsulation

Use vxlan default-decapsulation to enable default IPv4 VXLAN decapsulation.

Use undo vxlan default-decapsulation to disable default IPv4 VXLAN decapsulation.

Syntax

vxlan default-decapsulation source interface interface-type interface-number

undo vxlan default-decapsulation source interface

Default

Default IPv4 VXLAN decapsulation is disabled.

Views

System view

Predefined user roles

network-admin

Parameters

source interface interface-type interface-number: Specifies an interface by its type and number.

Usage guidelines

If an IPv4 VXLAN tunnel is configured on only one VTEP of a pair of VTEPs, the IPv4 VXLAN tunnel is a unidirectional tunnel to the VTEP not configured with the tunnel. In this situation, that VTEP drops the VXLAN packets received from the unidirectional VXLAN tunnel. For a VTEP to receive VXLAN packets from a unidirectional IPv4 VXLAN tunnel, enable default IPv4 VXLAN decapsulation on the interface whose IPv4 address is the tunnel destination address. The VTEP will decapsulate all the VXLAN packets destined for the IPv4 address of that interface.

This command takes effect only when the specified interface has an IPv4 address.

Default IPv4 VXLAN decapsulation does not take effect on bidirectional VXLAN tunnels. If you remove the one-way communication issue for an IPv4 VXLAN tunnel by configuring the tunnel on both the local and remote VTEPs, this feature no longer takes effect on that tunnel.

Examples

# Enable default IPv4 VXLAN decapsulation.

<Sysname> system-view

[Sysname] vxlan default-decapsulation source interface twenty-fivegige 1/0/1

vxlan ipv6 default-decapsulation

Use vxlan ipv6 default-decapsulation to enable default IPv6 VXLAN decapsulation.

Use undo vxlan ipv6 default-decapsulation to disable default IPv6 VXLAN decapsulation.

Syntax

vxlan ipv6 default-decapsulation source interface interface-type interface-number

undo vxlan ipv6 default-decapsulation source interface

Default

Default IPv6 VXLAN decapsulation is disabled.

Views

System view

Predefined user roles

network-admin

Parameters

source interface interface-type interface-number: Specifies an interface by its type and number.

Usage guidelines

If an IPv6 VXLAN tunnel is configured on only one VTEP of a pair of VTEPs, the IPv6 VXLAN tunnel is a unidirectional tunnel to the VTEP not configured with the tunnel. In this situation, that VTEP drops the VXLAN packets received from the unidirectional VXLAN tunnel. For a VTEP to receive VXLAN packets from a unidirectional IPv6 VXLAN tunnel, enable default IPv6 VXLAN decapsulation on the interface whose IPv6 address is the tunnel destination address. The VTEP will decapsulate all the VXLAN packets destined for the IPv6 address of that interface.

This command takes effect only when the specified interface has an IPv6 address.

Default IPv6 VXLAN decapsulation does not take effect on bidirectional VXLAN tunnels. If you remove the one-way communication issue for an IPv6 VXLAN tunnel by configuring the tunnel on both the local and remote VTEPs, this feature no longer takes effect on that tunnel.

Examples

# Enable default IPv6 VXLAN decapsulation.

<Sysname> system-view

[Sysname] vxlan ipv6 default-decapsulation source interface twenty-fivegige 1/0/1

vxlan local-mac report

Use vxlan local-mac report to enable local-MAC logging.

Use undo vxlan local-mac report to disable local-MAC logging.

Syntax

vxlan local-mac report

undo vxlan local-mac report

Default

Local-MAC logging is disabled.

Views

System view

Predefined user roles

network-admin

Usage guidelines

When the local-MAC logging feature is enabled, the VXLAN module immediately sends a log message with its local MAC addresses to the information center. When a local MAC address is added or removed, a log message is also sent to the information center to notify the local-MAC change.

With the information center, you can set log message filtering and output rules, including output destinations. For more information about configuring the information center, see System Management Configuration Guide.

Examples

# Enable local-MAC logging.

<Sysname> system-view

[Sysname] vxlan local-mac report

vxlan mapping-ecn enable

Use vxlan mapping-ecn enable to enable VXLAN ECN.

Use undo vxlan mapping-ecn enable to disable VXLAN ECN.

Syntax

vxlan mapping-ecn enable

undo vxlan mapping-ecn enable

Default

VXLAN ECN is disabled.

Views

System view

Predefined user roles

network-admin

Usage guidelines

Explicit Congestion Notification (ECN) is an end-to-end network congestion notification mechanism that allows the network to not drop packets when congestion occurs. You can apply ECN to VXLAN or EVPN VXLAN networks. When decapsulating a VXLAN packet, the device will map the ECN field in the outer IP header of the VXLAN packet to the ECN field in the inner IP header of the packet. When encapsulating a VXLAN packet, the device will map the ECN field in the IP header of the original packet to the ECN field in the outer IP header of the VXLAN packet. This ensures that the ECN fields of the inner and outer IP headers remain consistent in order to prevent packet loss when congestion occurs in the VXLAN network.

When multiple devices form an IRF fabric, the VXLAN ECN feature is not supported on the IRF fabric.

Examples

# Enable VXLAN ECN.

<Sysname> system-view

[Sysname] vxlan mapping-ecn enable

vxlan tunnel mac-learning disable

Use vxlan tunnel mac-learning disable to disable remote-MAC address learning.

Use undo vxlan tunnel mac-learning disable to enable remote-MAC address learning.

Syntax

vxlan tunnel mac-learning disable

undo vxlan tunnel mac-learning disable

Default

Remote-MAC address learning is enabled.

Views

System view

Predefined user roles

network-admin

Usage guidelines

When network attacks occur, use this command to prevent the device from learning incorrect remote MAC addresses in the data plane.

Examples

# Disable remote-MAC address learning.

<Sysname> system-view

[Sysname] vxlan tunnel mac-learning disable

vxlan udp-port

Use vxlan udp-port to set the destination UDP port number for VXLAN packets.

Use undo vxlan udp-port to restore the default.

Syntax

vxlan udp-port port-number

undo vxlan udp-port

Default

The destination UDP port number is 4789 for VXLAN packets.

Views

System view

Predefined user roles

network-admin

Parameters

port-number: Specifies a UDP port number in the range of 1 to 65535. As a best practice, specify a port number in the range of 1024 to 65535 to avoid conflict with well-known ports.

Usage guidelines

You must configure the same destination UDP port number on all VTEPs in a VXLAN.

Examples

# Set the destination UDP port number to 6666 for VXLAN packets.

<Sysname> system-view

[Sysname] vxlan udp-port 6666

vxlan vlan-based

Use vxlan vlan-based to enable VLAN-based VXLAN assignment.

Use undo vxlan vlan-based to disable VLAN-based VXLAN assignment.

Syntax

vxlan vlan-based

undo vxlan vlan-based

Default

VLAN-based VXLAN assignment is disabled.

Views

System view

Predefined user roles

network-admin

Usage guidelines

When you use Ethernet service instances as ACs, you can assign customer traffic to a VXLAN by using one of the following methods:

· Ethernet service instance-to-VSI mapping—This method uses the frame match criterion of an Ethernet service instance to match a list of VLANs on a site-facing Layer 2 interface. The VTEP assigns customer traffic to a VXLAN by mapping the Ethernet service instance to a VSI.

· VLAN-based VXLAN assignment—This method maps a VLAN to a VXLAN. When a VLAN is mapped to a VXLAN and VLAN-based VXLAN assignment is enabled, the device automatically performs the following operations:

a. Creates an Ethernet service instance that uses the VLAN ID as its instance ID on each interface in the VLAN. The matching outer VLAN ID of the Ethernet service instances is the VLAN ID.

b. Maps the Ethernet service instances to the VSI of the VXLAN.

Do not configure both Ethernet service instance-to-VSI mapping and VLAN-based VXLAN assignment.

Examples

# Enable VLAN-based VXLAN assignment.

<Sysname> system-view

[Sysname] vxlan vlan-based

vxlan vni

Use vxlan vni to map a VLAN to a VXLAN.

Use undo vxlan vni to remove the VXLAN mapping for a VLAN.

Syntax

vxlan vni vxlan-id

undo vxlan vni

Default

A VLAN is not mapped to a VXLAN.

Views

VLAN view

Predefined user roles

network-admin

Parameters

vxlan-id: Specifies a VXLAN ID. The value range for this argument is 1 to 16777215.

Usage guidelines

Before you map VLANs to VXLANs, enable VLAN-based VXLAN assignment by using the vxlan vlan-based command.

You cannot map VLAN 1 to any VXLAN.

Do not map a VLAN to the L3 VXLAN ID of EVPN.

If you map a VLAN to a nonexistent VXLAN, the configuration takes effect after the VXLAN is created.

Examples

# Map VLAN 10 to VXLAN 100.

<Sysname> system-view

[Sysname] vlan 10

[Sysname-vlan10] vxlan vni 100

Related commands

vxlan vlan-based

xconnect vsi

Use xconnect vsi to map an AC to a VSI.

Use undo xconnect vsi to restore the default.

Syntax

xconnect vsi vsi-name [ access-mode vlan | microsegment microsegment-id | on-demand ]

undo xconnect vsi

Default

An AC is not mapped to any VSI.

Views

Ethernet service instance view

Predefined user roles

network-admin

Parameters

vsi-name: Specifies the VSI name, a case-sensitive string of 1 to 31 characters.

access-mode: Specifies an access mode. The default access mode is VLAN.

vlan: Specifies the VLAN access mode.

microsegment microsegment-id: Specifies a microsegment ID in the range of 1 to 65535. If the AC is not associated with a microsegment, do not specify this option.

on-demand: Enables conversational learning for forwarding entries of the AC. This feature enables the device to issue AC forwarding entries to the hardware on demand. If you do not specify this keyword, the device issues AC forwarding entries to the hardware in real time.

Usage guidelines

To monitor the status of an AC, associate it with track entries.

To configure this command for an Ethernet service instance, you must first use the encapsulation command to add a traffic match criterion to the service instance.

For traffic that matches the AC, the system uses the VSI's MAC address table to make a forwarding decision.

The access mode determines how a VTEP processes the 802.1Q VLAN tags in the inner Ethernet frames assigned to the VSI.

· VLAN access mode—Ethernet frames received from or sent to the local site must contain 802.1Q VLAN tags. In the current software version, only this mode is supported.

¡ For an Ethernet frame received from the local site, the VTEP removes all its 802.1Q VLAN tags before forwarding the frame.

¡ For an Ethernet frame destined for the local site, the VTEP adds 802.1Q VLAN tags to the frame before forwarding the frame.

In VLAN access mode, VXLAN packets sent between VXLAN sites do not contain 802.1Q VLAN tags. VXLAN can provide Layer 2 connectivity for different 802.1Q VLANs between sites. You can use different 802.1Q VLANs to provide the same service in different sites.

When you map an AC to a VSI, you can associate the AC with a microsegment. You can associate multiple ACs with the same microsegment. For more information about microsegments, see Security Configuration Guide.

Examples

# On Twenty-FiveGigE 1/0/1, configure Ethernet service instance 200 to match frames with an outer 802.1Q VLAN tag of 200, and map the instance to VSI vpn1.

<Sysname> system-view

[Sysname] vsi vpn1

[Sysname-vsi-vpn1] quit

[Sysname] interface twenty-fivegige 1/0/1

[Sysname-Twenty-FiveGigE1/0/1] service-instance 200

[Sysname-Twenty-FiveGigE1/0/1-srv200] encapsulation s-vid 200

[Sysname-Twenty-FiveGigE1/0/1-srv200] xconnect vsi vpn1

Related commands

display l2vpn service-instance

encapsulation

vsi

23-VXLAN Command Reference

Basic VXLAN commands

arp suppression enable

display arp suppression vsi

display l2vpn forwarding ac

flooding disable (VSI view)

mac-address static vsi

statistics enable (Ethernet service instance view)

vxlan

vxlan default-decapsulation

vxlan ipv6 default-decapsulation

vxlan local-mac report

Intelligent Terminal Products

Product Support Services

Technical Service Solutions

Resource Center

Policy

Online Help

Become a Partner

Partner Policy & Program

Global Learning

Partner Sales Resources

Service Business

News & Events

Contact Us