HPE VSR1000 Vxlan Configuration Manual
HPE VSR1000 Vxlan Configuration Manual

HPE VSR1000 Vxlan Configuration Manual

Virtual services router
Table of Contents

Advertisement

HPE VSR1000 Virtual Services Router
VXLAN Configuration Guide
Part number: 5200-3163
Software version: VSR1000_HPE-CMW710-E0518-X64
Document version: 5W100-20170314

Advertisement

Table of Contents
loading

Summary of Contents for HPE VSR1000

  • Page 1 HPE VSR1000 Virtual Services Router VXLAN Configuration Guide Part number: 5200-3163 Software version: VSR1000_HPE-CMW710-E0518-X64 Document version: 5W100-20170314...
  • Page 2 © Copyright 2017 Hewlett Packard Enterprise Development LP The information contained herein is subject to change without notice. The only warranties for Hewlett Packard Enterprise products and services are set forth in the express warranty statements accompanying such products and services. Nothing herein should be construed as constituting an additional warranty. Hewlett Packard Enterprise shall not be liable for technical or editorial errors or omissions contained herein.
  • Page 3: Table Of Contents

    Contents VXLAN overview ·····························································································   VXLAN network model ··········································································································· ····························   VXLAN packet format ··········································································································· ·····························   Working mechanisms ············································································································ ·····························   VXLAN tunnel establishment and assignment ····················································································· ······ 3   Assignment of traffic to VXLANs ······························································································· ················· 3   MAC learning ··················································································································...
  • Page 4 Configuring ENDP ·························································································   Overview ······················································································································ ····································   Working mechanism ······························································································································· ·· 57   ENDP timers ··················································································································· ·························   ENDP authentication ··········································································································· ·····················   Configuration restrictions and guidelines ····················································································· ···················· 58   Configuring ENDP ·············································································································· ······························   Configuring the VTEP as an ENDS ··········································································································  ...
  • Page 5 Support and other resources ······································································   Accessing Hewlett Packard Enterprise Support ·················································································· ·········· 100   Accessing updates ············································································································· ····························   Websites ······················································································································ ··························   Customer self repair ·········································································································· ·····················   Remote support ······························································································································· ······· 101   Documentation feedback ········································································································ ··············· 101  ...
  • Page 6: Vxlan Overview

    The transport edge devices are VXLAN tunnel endpoints (VTEP). They can be servers that host VMs or independent network devices. An HPE VTEP uses VSIs and VXLAN tunnels to provide VXLAN services. • VSI—A virtual switch instance is a virtual Layer 2 switched domain. Each VSI provides switching services only for one VXLAN.
  • Page 7: Vxlan Packet Format

    Figure 1 VXLAN network model VSI/VXLAN 10 VSI/VXLAN 10 VSI/VXLAN 20 VSI/VXLAN 20 VXLAN tunnel Overlay network VTEP 2 VTEP 1 Site 2 Server Transport network Site 1 Server Underlay network VXLAN packet format As shown in Figure 2, a VTEP encapsulates a frame in the following headers: •...
  • Page 8: Working Mechanisms

    Working mechanisms The VTEP uses the following process to forward an inter-site frame: Discovers remote VTEPs, establishes VXLAN tunnels, and assigns the VXLAN tunnels to VXLANs. Assigns the frame to its matching VXLAN if the frame is sent between sites. Performs MAC learning on the VXLAN's VSI.
  • Page 9: Traffic Forwarding

    The VTEP can also u se VXLAN IS-IS in the c ontrol plane to advertise lo cal MAC reach ability information to remote sites and learn MAC reachability information from remote sites. A VSI's MAC address table includes the following types of MAC address entries: •...
  • Page 10 Figure 3 Inter-site unicast Flood The VTEP floods a broadcast, multicast, or unknown unicast frame to all site-facing interfaces and VXLAN tunnels in the VXLAN, except for the incoming interface. VXLAN supports the following modes for flood traffic: • Unicast mode—Also called head-end replication. The source VTEP replicates the flood frame, and then sends one replica to the destination IP address of each VXLAN tunnel in the VXLAN.
  • Page 11 Figure 4 Unicast mode VM 1 VM 2 VM 3 Transport network Replicate and Server 1 encapsulate VM 7 GE1/0/1 VXLAN tunnel VM 8 GE1/0/1 GE1/0/2 VTEP 1 VTEP 2 VM 9 VM 4 Server 3 VM 5 VTEP 3 VM 6 Server 2 VM 10...
  • Page 12: Arp Flood Suppression

    Figure 6 Flood proxy mode ARP flood suppression ARP flood su ppression reduces ARP request broadcasts by ena bling the VTEP to reply to AR P requests on behalf of VMs. As shown in Figure 7, this feature snoops ARP packets to populate the ARP flood suppression table with local and remote MAC addresses.
  • Page 13: Vxlan Ip Gateways

    Figure 7 ARP flood suppression ARP flood suppression uses the following workflow: VM 1 sends an ARP request to obtain the MAC address of VM 7. VTEP 1 creates a suppression entry for VM 1, and floods the ARP request in the VXLAN. VTEP 2 and VTEP 3 de-encapsulate the ARP request.
  • Page 14: Configuring Basic Vxlan Features

    Configuring basic VXLAN features VXLAN configuration task list Tasks at a glance Remarks (Required.) Creating a VXLAN on a VSI (Required.) Configuring a VXLAN tunnel To extend a VXLAN to remote (Required.) Assigning a VXLAN tunnel to a VXLAN sites, you must assign VXLAN tunnels to the VXLAN.
  • Page 15: Configuring A Vxlan Tunnel

    Step Command Remarks By default, no VXLANs exist. Create a VXLAN and You can create only one VXLAN on a vxlan vxlan-id enter VXLAN view. VSI. The VXLAN ID must be unique for each VSI. Configuring a VXLAN tunnel You can manually configure a VXLAN tunnel or configure ENDP to automatically establish a VXLAN tunnel.
  • Page 16: Assigning A Vxlan Tunnel To A Vxlan

    Assigning a VXLAN tunnel to a VXLAN To provide Layer 2 connectivity for a VXLAN between two sites, you must assign the VXLAN tunnel between the sites to the VXLAN. You can assign multiple VXLAN tunnels to a VXLAN, and configure a VXLAN tunnel to trunk multiple VXLANs.
  • Page 17: Managing Mac Address Entries

    Managing MAC address entries With VXLAN, local MAC addresses are learned dynamically. You can log MAC changes, but you cannot manually add local MAC addresses. Remote-MAC address entries include the following types: • Manually created static entries. • Dynamic entries learned in the data plane. •...
  • Page 18: Disabling Remote-Mac Address Learning

    Step Command Remarks Enter system view. system-view By default, VXLAN VSIs do not have static remote-MAC address entries. mac-address static mac-address Add a static remote For the setting to take effect, make interface tunnel tunnel-number vsi entry. sure the VSI's VXLAN has been vsi-name created and specified on the VXLAN tunnel.
  • Page 19: Confining Unknown-Unicast Floods To The Local Site

    Confining unknown-unicast floods to the local site By default, the VTEP floods unknown unicast frames received from the local site to the follo wing interfaces in the frame's VXLAN: • All site-facing interfaces except for the incoming interface. • All VXLAN tunnel interfaces. To confine unknown-unicast floods to site-facing interfaces for a VXLAN: Step Command...
  • Page 20: Enabling Arp Flood Suppression

    • VLAN tag check—The device checks the inner Ethernet header of each VXLAN packet for 802.1Q VLAN tags. If the header contains 802.1Q VLAN tags, the device drops the packet. To configure VXLAN packet check: Step Command Remarks Enter system view. system-view Enable the VTEP to drop VXLAN By default, the VTEP does not...
  • Page 21: Enabling Packet Statistics For A Layer 3 Interface

    Enabling packet statistics for a Layer 3 interface Step Command Remarks Enter system view. system-view • Enter Layer 3 Ethernet interface view: interface interface-type interface-number Enter interface view. • Enter Layer 3 aggregate interface view: interface route-aggregation interface-number By default, the packet statistics feature is disabled for Layer 3 interfaces that act as ACs.
  • Page 22: Unicast-Mode Vxlan Configuration Example

    Task Command reset l2vpn statistics ac [ interface interface-type Clear packet statistics on ACs. interface-number ] NOTE: For more information about the display interface tunnel command, see tunneling commands in Layer 3—IP Services Command Reference. Unicast-mode VXLAN configuration example Network requirements As shown in Figure •...
  • Page 23 [RouterA-vsi-vpna-vxlan-10] quit [RouterA-vsi-vpna] quit # Assign an IP address to Loopback 0. The IP address will be used as the source IP address of the VXLAN tunnels to Router B and Router C. [RouterA] interface loopback 0 [RouterA-Loopback0] ip address 1.1.1.1 255.255.255.255 [RouterA-Loopback0] quit # Create a VXLAN tunnel to Router B.
  • Page 24 [RouterB] interface tunnel 3 mode vxlan [RouterB-Tunnel3] source 2.2.2.2 [RouterB-Tunnel3] destination 3.3.3.3 [RouterB-Tunnel3] quit # Assign Tunnel 2 and Tunnel 3 to VXLAN 10. [RouterB] vsi vpna [RouterB-vsi-vpna] vxlan 10 [RouterB-vsi-vpna-vxlan-10] tunnel 2 [RouterB-vsi-vpna-vxlan-10] tunnel 3 [RouterB-vsi-vpna-vxlan-10] quit [RouterB-vsi-vpna] quit # Map GigabitEthernet 1/0/1 to the VSI vpna.
  • Page 25: Verifying The Configuration

    [RouterC-GigabitEthernet1/0/1] xconnect vsi vpna [RouterC-GigabitEthernet1/0/1] quit Verifying the configuration Verify the VXLAN settings on the VTEPs. This example uses Router A. # Verify that the VXLAN tunnel interfaces on the VTEP are up. [RouterA] display interface tunnel 1 Tunnel1 Current state: UP Line protocol state: UP Description: Tunnel1 Interface Bandwidth: 64 kbps...
  • Page 26 <RouterA> display l2vpn mac-address MAC Address State VSI Name Link ID/Name Aging cc3e-5f9c-6cdb Dynamic vpna Tunnel1 Aging cc3e-5f9c-23dc Dynamic vpna Tunnel2 Aging --- 2 mac address(es) found Verify that VM 1, VM 2, and VM 3 can ping each other. (Details not shown.)
  • Page 27: Configuring Vxlan Ip Gateways

    Configuring VXLAN IP gateways Overview The following are available IP gateway placement designs for VXLANs: • VXLAN IP gateways separated from VTEPs—Use a VXLAN-unaware device as a gateway to the external network for VXLANs. On the gateway, you do not need to configure VXLAN settings.
  • Page 28: Centralized Vxlan Ip Gateway Deployment

    Figure 9 VXLAN IP gateway separated from VTEPs Centralized VXLAN IP gateway deployment As shown in Figure 10, a VTEP acts as a g ateway for VMs i n the VXLANs. Th e VTEP both terminates the VXLANs and performs Layer 3 forwarding for the VMs. Figure 10 Centralized VXLAN IP gateway placement design As shown in Figure...
  • Page 29: Centralized Vxlan Gateway Group Deployment

    VTEP 1 forwards the ARP reply to the VM. The VM learns the MAC address of the gateway, and sends the Layer 3 traffic to the gateway. VTEP 3 removes the VXLAN encapsulation and inner Ethernet header for the traffic, and forwards the traffic to the destination node.
  • Page 30: Distributed Vxlan Ip Gateway Deployment

    Figure 12 Example of centralized VXLAN IP gateway group deployment L3 network Centralized VXLAN IP gateway group Access layer Access layer VXLAN tunnel VTEP VTEP Transport Server Server network Site 1 Site 2 The VTEP group is a virtual gateway that provides services at a group IP address. Access layer VTEPs set up VXLAN tunnels to the group IP address for data traffic forwarding.
  • Page 31 Figure 13 Distributed VXLAN IP gateway placement design Figure 14 shows an example of distributed VXLAN IP gateway deployment. This section uses this figure to describe the forwarding p rocesses for intra-VXLAN traffic, inter-VXLAN traffic, and traffic from a VXLAN to an external netwo rk. In these p rocesses, VTEPs use dynami cally learned ARP entries.
  • Page 32 Intra-VXLAN traffic forwarding between sites As shown in Figure 14, the network uses the following process to forward traffic in a VXLAN between sites (for example, from VM 1 to VM 4 in VXLAN 10): VM 1 sends an ARP request to obtain the MAC address of VM 4. GW 1 performs the following operations: a.
  • Page 33: Configuration Prerequisites

    b. Replaces the sender MAC address in the request with the MAC address of VSI-interface 20 on GW 2, and then sends the reply to GW 1. GW 1 de-encapsulates the ARP request and creates an ARP entry for VM 5. The entry contains VM 5's IP address 20.1.1.12, the MAC address of VSI-interface 20 on GW 2, and the incoming tunnel interface.
  • Page 34: Configuring A Centralized Vxlan Ip Gateway Group

    Configuring a centralized VXLAN IP gateway group Configuring a VTEP group Make sure the member VTEPs use the same VXLAN settings. Configure a VTEP group on a member VTEP: Step Command Remarks Enter system view. system-view By default, no VSI interfaces exist. Create a VSI interface and You must create the same VSI interface vsi-interface...
  • Page 35: Specifying A Vtep Group As The Gateway For An Access Layer Vtep

    Specifying a VTEP group as the gateway for an access layer VTEP Before you specify a VTEP group on an access layer VTEP, perform the following tasks on the VTEP: • Configure VSIs and VXLANs. • Set up VXLAN tunnels to remote sites and the VTEP group, and assign the tunnels to VXLANs. To specify a VTEP group as the gateway for an access layer VTEP: Step Command...
  • Page 36: Configuring A Vsi Interface

    Step Command Remarks • Enable local proxy ARP on an IPv4 gateway: By default, local proxy ARP and local ND proxy are disabled. Enable local proxy local-proxy-arp enable [ ip-range startIP to endIP ] ARP or local ND For more information about the commands, proxy.
  • Page 37: Enabling Packet Statistics For A Vsi Interface

    Enabling packet statistics for a VSI interface To enable packet statistics for a VSI and its associated VSI interface, enable packet statistics for the VSI by using the statistics enable command. The statistics enable command takes effect only if the VSI inter face is associated with only one VSI.
  • Page 38 Figure 15 Network diagram Configuration procedure On VM 1 and VM 2, specify 10.1.1.1 as the gateway address. (Details not shown.) Configure IP addresses and unicast routing settings: # Assign IP addresses to interfaces, as shown in Figure 15. (Details not shown.) # Configure OSPF on all transport network routers (Routers A through D).
  • Page 39 # Assign Tunnel 1 and Tunnel 2 to VXLAN 10. [RouterA] vsi vpna [RouterA-vsi-vpna] vxlan 10 [RouterA-vsi-vpna-vxlan-10] tunnel 1 [RouterA-vsi-vpna-vxlan-10] tunnel 2 [RouterA-vsi-vpna-vxlan-10] quit [RouterA-vsi-vpna] quit # Map GigabitEthernet 1/0/1 to the VSI vpna. [RouterA] interface gigabitethernet 1/0/1 [RouterA-GigabitEthernet1/0/1] xconnect vsi vpna [RouterA-GigabitEthernet1/0/1] quit Configure Router B: # Enable L2VPN.
  • Page 40 [RouterB] vsi vpna [RouterB-vsi-vpna] gateway vsi-interface 1 [RouterB-vsi-vpna] quit Configure Router C: # Enable L2VPN. <RouterC> system-view [RouterC] l2vpn enable # Create the VSI vpna and VXLAN 10. [RouterC] vsi vpna [RouterC-vsi-vpna] vxlan 10 [RouterC-vsi-vpna-vxlan-10] quit [RouterC-vsi-vpna] quit # Assign an IP address to Loopback 0. The IP address will be used as the source IP address of the VXLAN tunnels to Router A and Router B.
  • Page 41 Maximum transmission unit: 64000 Internet protocol processing: Disabled Output queue - Urgent queuing: Size/Length/Discards 0/100/0 Output queue - Protocol queuing: Size/Length/Discards 0/500/0 Output queue - FIFO queuing: Size/Length/Discards 0/75/0 Last clearing of counters: Never Tunnel source 2.2.2.2, destination 1.1.1.1 Tunnel protocol/transport UDP_VXLAN/IP Last 300 seconds input rate: 0 bytes/sec, 0 bits/sec, 0 packets/sec Last 300 seconds output rate: 0 bytes/sec, 0 bits/sec, 0 packets/sec Input: 0 packets, 0 bytes, 0 drops...
  • Page 42: Distributed Vxlan Ipv4 Gateway Configuration Example

    Tunnel2 0x5000002 Manual Disabled Tunnel3 0x5000003 Manual Disabled # Verify that Router B has created ARP entries for the VMs. [RouterB] display arp Type: S-Static D-Dynamic O-Openflow M-Multiport I-Invalid IP address MAC address SVID Interface Aging Type 20.1.1.5 000c-29c1-5e46 -- GE1/0/1 10.1.1.11 0000-1234-0001 --...
  • Page 43 Figure 16 Network diagram VSI-int1 10.1.1.1/24 VSI-int1 20.1.1.1/24 sub 10.1.1.1/24 VSI-int2 20.1.1.1/24 sub 10.1.2.1/24 10.1.1.11 VM 1 Loop0 Loop0 Transport 1.1.1.1/32 3.3.3.3/32 network Server 1 20.1.1.12 GE1/0/2 GE1/0/1 GE1/0/2 GE1/0/2 GE1/0/1 GE1/0/1 11.1.1.1/24 11.1.1.4/24 13.1.1.4/24 13.1.1.3/24 VM 3 GE1/0/3 GE1/0/3 Router D Server 3 Router A...
  • Page 44 # Assign an IP address to Loopback 0. The IP address will be used as the source IP address of the VXLAN tunnels to Router B and Router C. [RouterA] interface loopback 0 [RouterA-Loopback0] ip address 1.1.1.1 255.255.255.255 [RouterA-Loopback0] quit # Create a VXLAN tunnel to Router B.
  • Page 45 [RouterA-Vsi-interface1] local-proxy-arp enable [RouterA-Vsi-interface1] quit # Create VSI-interface 2 and assign the interface an IP address. The IP address will be used as the gateway address for VXLAN 20. [RouterA] interface vsi-interface 2 [RouterA-Vsi-interface2] ip address 10.1.2.1 255.255.255.0 # Specify VSI-interface 2 as a distributed gateway and enable local proxy ARP on the interface. [RouterA-Vsi-interface2] distributed-gateway local [RouterA-Vsi-interface2] local-proxy-arp enable [RouterA-Vsi-interface2] quit...
  • Page 46 [RouterA] interface vsi-interface 1 [RouterA-Vsi-interface1] ip policy-based-route vxlan10 [RouterA-Vsi-interface1] quit [RouterA] interface vsi-interface 2 [RouterA-Vsi-interface2] ip policy-based-route vxlan20 [RouterA-Vsi-interface2] quit Configure Router B: # Enable L2VPN. <RouterB> system-view [RouterB] l2vpn enable # Create the VSI vpna and VXLAN 10. [RouterB] vsi vpna [RouterB-vsi-vpna] vxlan 10 [RouterB-vsi-vpna-vxlan-10] quit [RouterB-vsi-vpna] quit...
  • Page 47 [RouterB-vsi-vpnb] vxlan 20 [RouterB-vsi-vpnb-vxlan-20] tunnel 2 [RouterB-vsi-vpnb-vxlan-20] quit [RouterB-vsi-vpnb] quit # Assign Tunnel 3 to VXLAN 30. [RouterB] vsi vpnc [RouterB-vsi-vpnc] vxlan 30 [RouterB-vsi-vpnc-vxlan-30] tunnel 3 [RouterB-vsi-vpnc-vxlan-30] quit [RouterB-vsi-vpnc] quit # Create VSI-interface 1 and assign the interface an IP address. [RouterB] interface vsi-interface 1 [RouterB-Vsi-interface1] ip address 10.1.1.2 255.255.255.0 [RouterB-Vsi-interface1] quit...
  • Page 48 [RouterC-vsi-vpnb] quit # Assign an IP address to Loopback 0. The IP address will be used as the source IP address of the VXLAN tunnels to Router A and Router B. [RouterC] interface loopback 0 [RouterC-Loopback0] ip address 3.3.3.3 255.255.255.255 [RouterC-Loopback0] quit # Create a VXLAN tunnel to Router A.
  • Page 49 # Assign a secondary IP address to VSI-interface 1. The IP address will be used as the gateway address for VXLAN 30. [RouterC] interface vsi-interface 1 [RouterC-Vsi-interface1] ip address 20.1.1.1 255.255.255.0 sub [RouterC-Vsi-interface1] quit # Specify VSI-interface 1 as the gateway interface for the VSI vpnb. Assign subnet 20.1.1.0/24 to the VSI.
  • Page 50 Current state: UP Line protocol state: UP Description: Vsi-interface1 Interface Bandwidth: 1000000 kbps Maximum transmission unit: 1500 Internet address: 10.1.1.1/24 (primary) IP packet frame type: Ethernet II, hardware address: 0011-2200-0102 IPv6 packet frame type: Ethernet II, hardware address: 0011-2200-0102 Physical: Unknown, baudrate: 1000000 kbps Last clearing of counters: Never Last 300 seconds input rate: 0 bytes/sec, 0 bits/sec, 0 packets/sec Last 300 seconds output rate: 0 bytes/sec, 0 bits/sec, 0 packets/sec...
  • Page 51 Verify the configuration on the border gateway Router B: # Verify that the VXLAN tunnel interfaces are up on Router B. [RouterB] display interface tunnel 2 Tunnel2 Current state: UP Line protocol state: UP Description: Tunnel2 Interface Bandwidth: 64 kbps Maximum transmission unit: 64000 Internet protocol processing: Disabled Output queue - Urgent queuing: Size/Length/Discards 0/100/0...
  • Page 52: Distributed Vxlan Ipv6 Gateway Configuration Example

    MAC Learning : Enabled MAC Table Limit Drop Unknown Flooding : Enabled Gateway interface : VSI-interface 1 VXLAN ID : 10 Tunnels: Tunnel Name Link ID State Type Flood proxy Tunnel1 0x5000001 Manual Disabled Tunnel2 0x5000002 Manual Disabled # Verify that Router B has created ARP entries for the VMs. [RouterB] display arp Type: S-Static D-Dynamic...
  • Page 53 • Manually establish VXLAN tunnels and assign the tunnels to the VXLANs. • Configure distributed VXLAN IP gateways on Router A and Router C to forward traffic between VXLANs. • Configure Router B as a border gateway to forward traffic between the VXLANs and the WAN connected to Router E.
  • Page 54 [RouterA-Loopback0] ip address 1.1.1.1 255.255.255.255 [RouterA-Loopback0] quit # Create a VXLAN tunnel to Router B. The tunnel interface name is Tunnel 1. [RouterA] interface tunnel 1 mode vxlan [RouterA-Tunnel1] source 1.1.1.1 [RouterA-Tunnel1] destination 2.2.2.2 [RouterA-Tunnel1] quit # Create a VXLAN tunnel to Router C. The tunnel interface name is Tunnel 2. [RouterA] interface tunnel 2 mode vxlan [RouterA-Tunnel2] source 1.1.1.1 [RouterA-Tunnel2] destination 3.3.3.3...
  • Page 55 [RouterA-vsi-vpnb] gateway vsi-interface 1 [RouterA-vsi-vpnb] gateway subnet 4::1 64 [RouterA-vsi-vpnb] quit # Configure an IPv6 static route. Set the destination address to 3::/64 and the next hop to 1::2. [RouterA] ipv6 route-static 3:: 64 1::2 Configure Router B: # Enable L2VPN. <RouterB>...
  • Page 56 # Create VSI-interface 1 and assign the interface IPv6 addresses. [RouterB] interface vsi-interface 1 [RouterB-Vsi-interface1] ipv6 address 1::2/64 [RouterB-Vsi-interface1] ipv6 address 4::2/64 [RouterB-Vsi-interface1] quit # Specify VSI-interface 1 as the gateway interface for the VSI vpna. [RouterB] vsi vpna [RouterB-vsi-vpna] gateway vsi-interface 1 [RouterB-vsi-vpna] quit # Specify VSI-interface 2 as the gateway interface for the VSI vpnb.
  • Page 57 [RouterC-vsi-vpna] quit #Assign Tunnel 1 and Tunnel 3 to VXLAN 20. [RouterC] vsi vpnb [RouterC-vsi-vpnb] vxlan 20 [RouterC-vsi-vpnb-vxlan-20] tunnel 1 [RouterC-vsi-vpnb-vxlan-20] tunnel 3 [RouterC-vsi-vpnb-vxlan-20] quit [RouterC-vsi-vpnb] quit # Map GigabitEthernet 1/0/1 to the VSI vpnb. [RouterC] interface gigabitethernet 1/0/1 [RouterC-GigabitEthernet1/0/1] xconnect vsi vpnb [RouterC-GigabitEthernet1/0/1] quit # Create VSI-interface 1 and assign the interface two IPv6 anycast addresses.
  • Page 58 Output queue - FIFO queuing: Size/Length/Discards 0/75/0 Last clearing of counters: Never Tunnel source 1.1.1.1, destination 3.3.3.3 Tunnel protocol/transport UDP_VXLAN/IP Last 300 seconds input rate: 0 bytes/sec, 0 bits/sec, 0 packets/sec Last 300 seconds output rate: 0 bytes/sec, 0 bits/sec, 0 packets/sec Input: 0 packets, 0 bytes, 0 drops Output: 0 packets, 0 bytes, 0 drops # Verify that VSI-interface 1 is up.
  • Page 59 GE1/0/1 VSI Name: vpnb VSI Index VSI State : Up : 1500 Bandwidth Broadcast Restrain Multicast Restrain Unknown Unicast Restrain: - MAC Learning : Enabled MAC Table Limit Drop Unknown Flooding : Enabled Gateway Interface : VSI-interface 1 VXLAN ID : 20 Tunnels: Tunnel Name...
  • Page 60 Interface : Vsi1 Token: Invalid Verify the configuration on the border gateway Router B: # Verify that the VXLAN tunnel interfaces are up on Router B. [RouterB] display interface tunnel 2 Tunnel2 Current state: UP Line protocol state: UP Description: Tunnel2 Interface Bandwidth: 64 kbps Maximum transmission unit: 64000 Internet protocol processing: Disabled...
  • Page 61 Unknown Unicast Restrain: - MAC Learning : Enabled MAC Table Limit Drop Unknown Flooding : Enabled Gateway interface : VSI-interface 1 VXLAN ID : 10 Tunnels: Tunnel Name Link ID State Type Flood proxy Tunnel1 0x5000001 Manual Disabled Tunnel2 0x5000002 Manual Disabled # Verify that Router B has created neighbor entries for the VMs.
  • Page 62: Configuring Endp

    Configuring ENDP Overview Enhanced Neighbor Discovery Protocol (ENDP ) dynamically discovers VTEPs and e stablishes VXLAN tunnels. Working mechanism ENDP supports multiple VXLAN networks. ENDP uses network IDs to uniquely identify VXLANs. VTEPs can discover each other if they have the same network ID. ENDP uses the client/server model.
  • Page 63: Endp Authentication

    The ENDC adds the regi ster timer setting to each register packet. The ENDS reco rds this timer setting when it adds the ENDC to the ENDC datab ase. If no reg ister update is received from the ENDC before five times the timer is reached, ENDS removes the ENDC. ENDP authentication ENDP authentication prevents malicious registration with an ENDS in an insecure network.
  • Page 64: Configuring The Vtep As An Endc

    Configuring the VTEP as an ENDC Step Command Remarks Enter system view. system-view Create an NVE tunnel interface tunnel interface and enter tunnel By default, no tunnel interfaces exist. tunnel-number mode nve interface view. Assign a network ID to the By default, no network ID is assigned to network-id network-id tunnel interface.
  • Page 65: Endp Configuration Example

    ENDP configuration example Network requirements As shown in Figure • Configure unicast-mode VXLANs on Router A, Router B, and Router C to provide Layer 2 connectivity for the VMs across different sites. • Configure ENDP to automatically set up VXLAN tunnels. •...
  • Page 66 [RouterA] l2vpn enable # Specify VXLAN 11111 as the reserved VXLAN for VXLAN IS-IS. [RouterA] reserved vxlan 11111 NOTE: The reserved VXLAN must be the same across VTEPs. # Create the VSI vpna and VXLAN 10000. [RouterA] vsi vpna [RouterA-vsi-vpna] vxlan 10000 [RouterA-vsi-vpna-vxlan-10000] quit [RouterA-vsi-vpna] quit # Create the VSI vpnb and VXLAN 10001.
  • Page 67 [RouterA-GigabitEthernet1/0/1.2] vlan-type dot1q vid 3 [RouterA-GigabitEthernet1/0/1.2] xconnect vsi vpnb [RouterA-GigabitEthernet1/0/1.2] quit # Create GigabitEthernet 1/0/1.3, and configure the subinterface to terminate VLAN 4. Map the subinterface to the VSI vpnc. [RouterA] interface gigabitethernet 1/0/1.3 [RouterA-GigabitEthernet1/0/1.3] vlan-type dot1q vid 4 [RouterA-GigabitEthernet1/0/1.3] xconnect vsi vpnc [RouterA-GigabitEthernet1/0/1.3] quit # Create GigabitEthernet 1/0/1.4, and configure the subinterface to terminate VLAN 5.
  • Page 68 # Create GigabitEthernet 1/0/1.1, and configure the subinterface to terminate VLAN 2. Map the subinterface to the VSI vpna. [RouterB] interface gigabitethernet 1/0/1.1 [RouterB-GigabitEthernet1/0/1.1] vlan-type dot1q vid 2 [RouterB-GigabitEthernet1/0/1.1] xconnect vsi vpna [RouterB-GigabitEthernet1/0/1.1] quit # Create GigabitEthernet 1/0/1.2, and configure the subinterface to terminate VLAN 3. Map the subinterface to the VSI vpnb.
  • Page 69: Verifying The Configuration

    [RouterC-GigabitEthernet1/0/1.1] xconnect vsi vpna [RouterC-GigabitEthernet1/0/1.1] quit # Create GigabitEthernet 1/0/1.2, and configure the subinterface to terminate VLAN 5. Map the subinterface to the VSI vpnb. [RouterC] interface gigabitethernet 1/0/1.2 [RouterC-GigabitEthernet1/0/1.2] vlan-type dot1q vid 5 [RouterC-GigabitEthernet1/0/1.2] xconnect vsi vpnb [RouterC-GigabitEthernet1/0/1.2] quit # Start the VXLAN IS-IS process.
  • Page 70 Output queue - FIFO queuing: Size/Length/Discards 0/75/0 Tunnel source 1.1.1.1 , destination 2.2.2.2 Tunnel protocol/transport UDP_VXLAN/IP Last 300 seconds input rate: 0 bytes/sec, 0 bits/sec, 0 packets/sec Last 300 seconds output rate: 0 bytes/sec, 0 bits/sec, 0 packets/sec Input: 0 packets, 0 bytes, 0 drops Output: 0 packets, 0 bytes, 0 drops Tunnel 2 Current state: UP...
  • Page 71 VSI Index VSI State : Up : 1500 Bandwidth Broadcast Restrain Multicast Restrain Unknown Unicast Restrain: - MAC Learning : Enabled MAC Table Limit Drop Unknown MAC Flood : Enabled Arp Restrain : Disabled VXLAN ID : 10001 Tunnels: Tunnel Name Link ID State Type...
  • Page 72 MAC Table Limit Drop Unknown MAC Flood : Enabled Arp Restrain : Disabled VXLAN ID : 10003 Tunnels: Tunnel Name Link ID State Type Flood proxy Tunnel2 0x5000002 Auto Disabled ACs: Link ID State GigabitEthernet1/0/1.4 # Verify that the VTEP has learned the MAC addresses of remote VMs to the VSIs. [RouterA] display l2vpn mac-address MAC Address State...
  • Page 73 LSP ID Seq num Checksum Holdtime Length Overload ----------------------------------------------------------------------------- 0001.0000.0000.0000-00* 0x00000003 0xc614 1043 0003.0000.0000.0000-00 0x00000002 0x770b 1010 0003.0000.0000.0001-00 0x00000001 0x1d67 1010 Flags: *-Self LSP, +-Self LSP(Extended) # Verify that VXLAN IS-IS has learned the MAC addresses of remote VMs. [RouterA] display vxlan isis remote-mac MAC Flags: A-MAC has been received by an active tunnel interface C-MAC conflict with local dynamic MAC F-MAC has been flushed to the remote MAC address table...
  • Page 74: Configuring Vxlan Is-Is

    Configuring VXLAN IS-IS Use VXLAN I S-IS to automate VXLAN tunnel a ssignment, host route syn chronization, and MAC reachability information synchronization between VTEPs. VXLAN IS-IS configuration task list Tasks at a glance Remarks (Required.) Specifying a reserved VXLAN for VXLAN IS-IS (Required.) Enabling automatic VXLAN tunnel assignment and Perform a minimum of one information synchronization:...
  • Page 75: Enabling Mac Advertisement Through Vxlan Is-Is

    Step Command Remarks By default, the VXLAN IS-IS process does not exist. Enter VXLAN IS-IS view. vxlan-isis The VTEP creates the VXLAN IS-IS process if it has not been created. Enable VXLAN By default, VXLAN autonegotiation is negotiate-vni enable autonegotiation. disabled.
  • Page 76: Enabling Host Route Mac Learning

    Step Command Remarks Enter system view. system-view By default, the VXLAN IS-IS process Enter VXLAN IS-IS view. vxlan-isis does not exist. Enable local-host route By default, local-host route proxy is local-host proxy enable proxy. disabled. Enabling host route MAC learning Host route MAC learning enables the VTEP to learn remote MAC ad dresses from re ceived remote-host routes.
  • Page 77: Configuring The Ded Priority And Csnp Interval

    VTEPs send their adja cency hold tim e in hello packets to up date the adj acencies with their neighbors. A VTEP removes the adjacency with a neighbor if it does not receive a hello packet from the neighbor before the timer expires. The maximum adjacency hold time is 65535 seconds.
  • Page 78 Table 2 VXLAN IS-IS LSP timers LSP timer Functionality Tuning guidelines Sets the minimum interval for Increase the interval to reduce transmitting LSPs out of an interface. LSP traffic in the network. Minimum LSP transmit interval You can also set the number of LSPs Decrease the interval for quick that can be sent at each interval.
  • Page 79: Enabling Adjacency Change Logging

    Step Command Remarks Enter system view. system-view Enter VXLAN IS-IS vxlan-isis view. The default refresh interval is 900 Set the LSP refresh seconds. To avoid unnecessary timer lsp-refresh seconds interval. age-outs, set the LSP refresh interval to a lower value than the LSP lifetime. Enabling adjacency change logging Adjacency change logging enables the VXLAN IS-IS process to send a log message t o the...
  • Page 80: Increasing The Maximum Number Of Mac Entries In An Lsp

    Step Command Remarks The default restart interval is 300 seconds. A GR process fails if the VXLAN IS-IS process fails to complete LSDB Set the GR restart graceful-restart interval synchronization before the restart interval interval. interval expires. When the GR fails, the peer VTEP removes the VXLAN IS-IS adjacency with the local VTEP.
  • Page 81: Vxlan Is-Is Configuration Example

    Task Command Display VXLAN IS-IS information for display vxlan isis tunnel [ tunnel-number ] tunnel interfaces. display vxlan isis local-host [ ipv6 ] [ vxlan-id vxlan-id ] Display local-host routes. [ count ] Display remote-host routes advertised display vxlan isis remote-host [ ipv6 ] [ vxlan-id vxlan-id ] through VXLAN IS-IS.
  • Page 82: Configuration Procedure

    Figure 19 Network diagram Configuration procedure Configure IP addresses and routing settings: # Assign IP addresses to interfaces, as shown in Figure 3. (Details not shown.) # Configure OSPF on all transport network routers (Routers A through D). (Details not shown.) Configure Router A: # Enable L2VPN.
  • Page 83 [RouterA-vsi-vpnc] quit # Create the VSI vpnd and VXLAN 10003. [RouterA] vsi vpnd [RouterA-vsi-vpnd] vxlan 10003 [RouterA-vsi-vpnd-vxlan-10003] quit [RouterA-vsi-vpnd] quit # Assign an IP address to Loopback 0. The IP address will be used as the source IP address of the VXLAN tunnels to Router B and Router C.
  • Page 84 [RouterA-vxlan-isis] negotiate-vni enable [RouterA-vxlan-isis] mac-synchronization enable [RouterA-vxlan-isis] quit Configure Router B: # Enable L2VPN. <RouterB> system-view [RouterB] l2vpn enable # Specify VXLAN 11111 as the reserved VXLAN for VXLAN IS-IS. [RouterB] reserved vxlan 11111 # Create the VSI vpna and VXLAN 10000. [RouterB] vsi vpna [RouterB-vsi-vpna] vxlan 10000 [RouterB-vsi-vpna-vxlan-10000] quit...
  • Page 85 [RouterB-vxlan-isis] negotiate-vni enable [RouterB-vxlan-isis] mac-synchronization enable [RouterB-vxlan-isis] quit Configure Router C: # Enable L2VPN. <RouterC> system-view [RouterC] l2vpn enable # Specify VXLAN 11111 as the reserved VXLAN for VXLAN IS-IS. [RouterC] reserved vxlan 11111 # Create the VSI vpna and VXLAN 10002. [RouterC] vsi vpna [RouterC-vsi-vpna] vxlan 10002 [RouterC-vsi-vpna-vxlan-10002] quit...
  • Page 86: Verifying The Configuration

    [RouterC-vxlan-isis] negotiate-vni enable [RouterC-vxlan-isis] mac-synchronization enable [RouterC-vxlan-isis] quit Verifying the configuration Verify the configuration on the VTEPs. This example uses Router A. # Verify that all VXLAN tunnel interfaces are up. [RouterA] display interface tunnel Tunnel1 Current state: UP Line protocol state: UP Description: Tunnel1 Interface Bandwidth: 64 kbps Maximum transmission unit: 64000...
  • Page 87 VSI State : Up : 1500 Bandwidth Broadcast Restrain Multicast Restrain Unknown Unicast Restrain: - MAC Learning : Enabled MAC Table Limit Drop Unknown MAC Flood : Enabled Arp Restrain : Disabled VXLAN ID : 10000 Tunnels: Tunnel Name Link ID State Type Flood proxy...
  • Page 88 Drop Unknown MAC Flood : Enabled Arp Restrain : Disabled VXLAN ID : 10002 Tunnels: Tunnel Name Link ID State Type Flood proxy Tunnel2 0x5000002 Auto Disabled ACs: Link ID State GE1/0/1.3 VSI Name: vpnd VSI Index VSI State : Up : 1500 Bandwidth Broadcast Restrain...
  • Page 89 Hold time: 6s Neighbour DED priority: 64 Uptime: 00:27:44 System ID: 0003.0000.0000 Link interface: Tunnel2 Circuit ID: 0003.0000.0000.0001 State: Up Hold time: 6s Neighbour DED priority: 64 Uptime: 00:20:33 # Verify that the VXLAN IS-IS LSDB is populated correctly. [RouterA] display vxlan isis lsdb Link state database information for VXLAN ISIS (Tunnel 1) LSP ID Seq num...
  • Page 90 Interface: Tunnel2 Flags: AF # Verify that VXLAN IS-IS has learned remote VXLAN information. [RouterA] display vxlan isis remote-vxlan VXLAN Flags: S-VXLAN supported at the local end F-Association between VXLAN and Tunnels has been flushed to L2VPN VXLAN ID: 10000 Flags: FS Tunnel: 1 VXLAN ID: 10001...
  • Page 91: Configuring The Vtep As An Ovsdb Vtep

    Configuring the VTEP as an OVSDB VTEP Overview An HPE ne twork virtualization controller can use the Ope n vSwitch Databa se (OVSDB) management protocol to deploy and manage VXLANs on VTEPs. To work with a controller, you must configure the VTEP as an OVSDB VTEP.
  • Page 92: Configuration Prerequisites

    Tasks at a glance (Required.) Specifying a global source address for VXLAN tunnels (Required.) Specifying a VTEP access port (Optional.) Enabling flood proxy on multicast VXLAN tunnels Configuration prerequisites Before you configure the VTEP as an OVSDB VTEP , enable L2 VPN by usin g the l2vpn enable command.
  • Page 93: Configuring Passive Ssl Connection Settings

    Step Command Remarks By default, SSL uses the CA certificate file in the PKI domain. If the specified CA certificate file (Optional.) Specify a CA does not exist, the device obtains ovsdb server bootstrap certificate file for SSL. a self-signed certificate from the ca-certificate ca-filename controller.
  • Page 94: Configuring Passive Tcp Connection Settings

    Configuring passive TCP connection settings Step Command Remarks Enter system view. system-view By default, the device does not listen for TCP connection requests. Enable the device to ovsdb server ptcp [ port You can specify only one port to listen for TCP connection port-number ] listen for OVSDB TCP connection requests.
  • Page 95: Specifying A Vtep Access Port

    Step Command Remarks Specify a global source By default, no global source address is tunnel global source-address address for VXLAN specified for VXLAN tunnels. ip-address tunnels. Specifying a VTEP access port For the controller to manage a site-facing interface, you must specify the interface as a VTEP access port.
  • Page 96 Figure 21 Network diagram Configuration procedure Configure IP addresses and unicast routing settings: # Assign IP addresses to interfaces, as shown in Figure 5. (Details not shown.) # Configure OSPF on all transport network routers (Routers A through D). (Details not shown.) Configure Router A: # Enable L2VPN.
  • Page 97 [RouterB] ovsdb server tcp 10.0.2.15 port 6632 # Enable the OVSDB server. [RouterB] ovsdb server enable # Enable the OVSDB VTEP service. [RouterB] vtep enable # Assign an IP address to Loopback 0. Specify the IP address as the global source address for VXLAN tunnels.
  • Page 98: Flood Proxy Vxlan Configuration Example

    Output queue - Urgent queuing: Size/Length/Discards 0/100/0 Output queue - Protocol queuing: Size/Length/Discards 0/500/0 Output queue - FIFO queuing: Size/Length/Discards 0/75/0 Last clearing of counters: Never Tunnel source 1.1.1.1, destination 2.2.2.2 Tunnel protocol/transport UDP_VXLAN/IP Last 300 seconds input rate: 0 bytes/sec, 0 bits/sec, 0 packets/sec Last 300 seconds output rate: 0 bytes/sec, 0 bits/sec, 0 packets/sec Input: 0 packets, 0 bytes, 0 drops Output: 0 packets, 0 bytes, 0 drops...
  • Page 99 • Use the MAC address entries issued by the controller to direct traffic forwarding on Router A, Router B, and Router C. Figure 22 Network diagram Configuration procedure Configure IP addresses and unicast routing settings: # Assign IP addresses to interfaces, as shown in Figure 6.
  • Page 100 [RouterA-GigabitEthernet1/0/2] quit # Disable remote-MAC address learning. [RouterA] vxlan tunnel mac-learning disable # Enable flood proxy on multicast VXLAN tunnels. [RouterA] vxlan tunnel flooding-proxy Configure Router B: # Enable L2VPN. <RouterB> system-view [RouterB] l2vpn enable # Configure active TCP connection settings. [RouterB] ovsdb server tcp ip 10.0.2.15 port 6632 # Enable the OVSDB server.
  • Page 101 [RouterC-LoopBack0] quit [RouterC] tunnel global source-address 3.3.3.3 # Specify site-facing interface GigabitEthernet 1/0/1 as a VTEP access port. [RouterC] interface gigabitethernet 1/0/1 [RouterC-GigabitEthernet1/0/1] vtep access port [RouterC-GigabitEthernet1/0/1] quit # Disable source MAC check on transport-facing interface GigabitEthernet 1/0/2. [RouterC] interface gigabitethernet 1/0/2 [RouterC-GigabitEthernet1/0/2] undo mac-address static source-check enable [RouterC-GigabitEthernet1/0/2] quit # Disable remote-MAC address learning.
  • Page 102 Unknown Unicast Restrain: - MAC Learning : Enabled MAC Table Limit Drop Unknown Flooding : Enabled Statistics : Disabled VXLAN ID : 10 Tunnels: Tunnel Name Link ID State Type Flood proxy Tunnel1 0x5000001 Manual Disabled Tunnel2 0x5000002 Manual Disabled Tunnel3 0x5000003 Manual...
  • Page 103: Document Conventions And Icons

    Document conventions and icons Conventions This section describes the conventions used in the documentation. Command conventions Convention Description Bold text represents commands and keywords that you enter literally as shown. Boldface Italic text represents arguments that you replace with actual values. Italic Square brackets enclose syntax choices (keywords or arguments) that are optional.
  • Page 104: Network Topology Icons

    Network topology icons Convention Description Represents a generic network device, such as a router, switch, or firewall. Represents a routing-capable device, such as a router or Layer 3 switch. Represents a generic switch, such as a Layer 2 or Layer 3 switch, or a router that supports Layer 2 forwarding and other Layer 2 features.
  • Page 105: Support And Other Resources

    Support and other resources Accessing Hewlett Packard Enterprise Support • For live assistance, go to the Contact Hewlett Packard Enterprise Worldwide website: www.hpe.com/assistance • To access documentation and support services, go to the Hewlett Packard Enterprise Support Center website: www.hpe.com/support/hpesc Information to collect •...
  • Page 106: Websites

    Documentation feedback Hewlett Packard Enterprise is committed to providing documentation that meets your needs. To help us improve the documentation, send any errors, suggestions, or comments to Do cumentation Feedback (docsfeedback@hpe.com). When submitting your feedback, include the document title,...
  • Page 107 part number, edition, and publication date located on the front cover of the document. For online help content, include the product name, product version, help edition, and publication date located on the legal notices page.
  • Page 108: Index

    Index VXLAN (unicast mode), VXLAN basics, address VXLAN ENDP, 57, 58, 60 OSVDB VTEP global VXLAN tunnel source VXLAN IP gateway, 22, 32 address, VXLAN IP gateway (centralized), 28, 32 VXLAN MAC address entry management, VXLAN IP gateway (distributed), adjacency VXLAN IPv4 gateway (distributed), VXLAN IS-IS adjacency change logging, VXLAN IPv6 gateway (distributed),...
  • Page 109 VXLAN, VXLAN traffic forwarding flood process, 4, 5 VXLAN ENDP, format VXLAN IP gateway, VXLAN packet format, VXLAN IS-IS, forwarding VXLAN traffic forwarding, VXLAN tunnel assignment, enable frame VXLAN automatic tunnel assignment, VXLAN local flood (unknown-unicast enabling frames), 14, 14 flood proxy on multicast VXLAN tunnels, OSVDB VTEP, gateway...
  • Page 110 VXLAN IS-IS configuration, 69, 76 VXLAN IPv4 gateway configuration (distributed), VXLAN IS-IS LSP MAC entries max, VXLAN IPv6 gateway configuration VXLAN IS-IS parameter tuning, (distributed), VXLAN VSI interface configuration, VXLAN Layer 3 interface > VSI mapping, VXLAN VTEP IP gateway group VXLAN VSI interface configuration, configuration, VXLAN VTEP IP gateway group configuration,...
  • Page 111 VXLAN IS-IS parameter tuning, VXLAN IP gateway (separated from VTEP), VXLAN local flood (unknown-unicast VXLAN IP gateway configuration, frames), VXLAN IP gateway configuration VXLAN network model, (centralized), 28, 32 VXLAN overview, VXLAN IP gateway configuration (distributed), VXLAN OVSDB VTEP configuration, VXLAN IPv4 gateway configuration (distributed), maintaining...
  • Page 112 controller connection setup restrictions, configuring OVSDB VTEP, flood proxy on multicast VXLAN tunnels, configuring OVSDB VTEP (unicast-mode VXLAN), flood proxy VXLAN configuration, configuring VXLAN (multicast mode), protocols and standards, configuring VXLAN (unicast mode), server enable, configuring VXLAN basics, SSL connection settings configuration (active), configuring VXLAN ENDP, 58, 60...
  • Page 113 enabling VXLAN local MAC change OVSDB controller connection, logging, specifying enabling VXLAN packet statistics (Layer 3 OSVDB VTEP access port, interface), OSVDB VTEP global VXLAN tunnel source enabling VXLAN packet statistics (VSI), address, increasing VXLAN IS-IS LSP MAC entries VXLAN IS-IS reserved VXLAN, max, maintaining VXLAN, OVSDB SSL connection settings configuration...
  • Page 114 VXLAN LSP timers, OSVDB VTEP global VXLAN tunnel source address, tunneling OVSDB controller connection setup, OSVDB VTEP global VXLAN tunnel source address, OVSDB server enable, VXLAN automatic tunnel assignment, OVSDB SSL connection settings configuration (active), VXLAN basic configuration, OVSDB SSL connection settings configuration VXLAN ENDP configuration, (passive), VXLAN IS-IS configuration,...
  • Page 115 host route MAC learning, OVSDB SSL connection settings configuration (active), how it works, OVSDB SSL connection settings configuration IP gateway, (passive), IP gateway (centralized), OVSDB TCP connection settings configuration IP gateway (distributed), (active), IP gateway (separated from VTEP), OVSDB TCP connection settings configuration IP gateway configuration, 22, 32 (passive),...

Table of Contents