VXLAN configuration

These sections describe VXLAN configuration tasks:

Configuring the VTI
Head End Replication configuration
VXLAN Routing configuration
Configuring VXLAN Routing with Overlay VRFs
Configuring VXLAN over MLAG
Configuring VXLAN Control Service
Configuring VXLAN Multicast Decapsulation
VXLAN Decapsulation for interface with multiple VRFs
VXLAN Rules Support for Mirror ACLs configuration
Configuring EVPN VXLAN
Displaying VXLAN configuration
Displaying VXLAN Bridging and Routing Support

Configuring the VTI

Configuring the VTI enables VXLAN bridging and is a requirement for VXLAN Routing. The following sections describe the steps required to enabling VXLAN bridging by bringing up the VXLAN line protocol. VXLAN Routing configuration describes the additional steps required to enable VXLAN routing.

Instantiating the VTI and VXLAN configuration Mode

The interface vxlan command places the switch in VXLAN-interface configuration mode for modifying the specified VXLAN Tunnel Interface (VTI). The command also instantiates the interface if it was not previously created.

VXLAN interface configuration mode is not a group change mode; running-config is changed immediately after commands are executed. The exit command does not affect the configuration.

Example

These commands create VXLAN tunnel interface 1, place the switch in VXLAN-interface configuration mode, and display parameters of the new VTI.

switch(config)# interface vxlan 1
switch(config-if-Vx1)# show active
interface Vxlan1
   vxlan udp-port 4789
switch(config-if-Vx1)#

Assigning an IP address to the VTEP

The vxlan source-interface command specifies the loopback interface from which the VTEP derives the source address (IP) that it uses when exchanging VXLAN frames. This address is used by UDP headers to specify source and destination addresses of hosts that send or receive VXLAN encapsulated packets.

There is no default source interface assignment. A valid VXLAN configuration requires the assignment of a loopback interface to the VTEP and the assignment of a valid IP address to the specified interface.

Example

These commands configure VTI 1 to use IP address 10.25.25.3 (interface loopback 15) as the source interface in the encapsulation fields of outbound VXLAN frames.

switch(config)# interface loopback 15
switch(config-if-Lo15)# ip address 10.25.25.3/24
switch(config-if-Lo15)# exit
switch(config)# interface vxlan 1
switch(config-if-Vx1)# vxlan source-interface loopback 15
switch(config-if-Vx1)#  show active
interface Vxlan1
   vxlan source-interface Loopback15
   vxlan udp-port 4789
switch(config-if-Vx1)#

Assigning a UDP Port to the VTEP

Packets bridged to the VTI from a VLAN are encapsulated with a VXLAN header, then sent through a pre-configured UDP port. Packets that arrive through this port are assumed to be VXLAN encapsulated and sent to the bridging domain of the recipient VLAN as determined by the VNI in the VXLAN header and the VNI-VLAN map.

The vxlan udp-port command associates a UDP port with the configuration mode VXLAN Interface (VTI). By default, UDP port 4789 is associated with the VTI.

Note: UDP port 4789 is reserved by convention for VXLAN usage. Under most typical applications, this parameter should be set to the default value.

Examples

This command associates UDP port 5500 with interface vxlan 1.

switch(config)# interface vxlan 1
switch(config-if-Vx1)# vxlan udp-port 5500
switch(config-if-Vx1)# show active
interface Vxlan1
   vxlan udp-port 5500
switch(config-if-Vx1)#

This command resets the interface vxlan 1 UDP port association of 4789.

switch(config-if-Vx1)# no vxlan udp-port
switch(config-if-Vx1)# show active
interface Vxlan1
   vxlan udp-port 4789
switch(config-if-Vx1)#

Assigning a VNI to a VLAN

When a VLAN bridges a packet to the VTI, the packet is encapsulated with a VXLAN header that includes the VNI associated with the VLAN. Packets that arrive on the VTI’s UDP socket are bridged to the VLAN that is associated with the VNI specified by the VXLAN header that encapsulates the packet.

The VTI requires a one-to-one correspondence between specified VLANs and VNI values. commands that assign a new VNI to a previously configured VLAN replace existing VLAN assignment statements in running-config. commands that attempt to assign a VNI value to a second VLAN generate a CLI error.

The vxlan vlan vni command associates a VLAN ID with a Virtual Network Identifier (VNI).

Example

These commands associate vlan 100 to vni 100 and vlan 200 to vni 10.10.200.

switch(config)# interface vxlan 1
switch(config-if-Vx1)# vxlan vlan 100 vni 100
switch(config-if-Vx1)# vxlan vlan 200 vni 10.10.200
switch(config-if-Vx1)# show active
interface Vxlan1
   vxlan udp-port 4789
   vxlan vlan 200 vni 658120
   vxlan vlan 100 vni 100
switch(config-if-Vx1)# vxlan vni notation dotted
switch(config-if-Vx1)# show active
interface Vxlan1
   vxlan udp-port 4789
   vxlan vlan 100 vni 0.0.100
   vxlan vlan 200 vni 10.10.200
switch(config-if-Vx1)#

Verifying the VXLAN configuration

The show interface vxlan 1 displays the configuration and connection status of the VXLAN.

Example

This command indicates that the VXLAN line protocol status is up.

switch(config-if-Vx1)# show interface vxlan 1
Vxlan1 is up, line protocol is up (connected)
  Hardware is vxlan
  Source interface is Loopback15 and is active with 10.25.25.3
  Static vlan to vni mapping is
    [100, 0.0.100]    [200, 10.10.200]
switch(config-if-Vx1)#

Head End Replication configuration

Head-end replication is a data distribution method that supports broadcast, unknown unicast traffic over VXLANs by replicating BUM data locally for transmission to the set of remote VTEPs specified by a flood list. This data flooding facilitates remote MAC address learning through the forwarding of data with unknown MAC addresses.

Each vxlan flood vtep statement in running-config associates a set of VTEP addresses to an access VNI. A default flood list is also configurable that applies to all VNIs for which a flood list is not configured.

The VTEP flood list is created and modified through the vxlan flood vtep command.

Examples

These commands create a default vxlan head-end replication flood list.

switch(config)# interface vxlan 1
switch(config-if-Vx1)# vxlan flood vtep 10.1.1.1 10.1.1.2
switch(config-if-Vx1)# show active
 interface Vxlan1
   vxlan flood vtep 10.1.1.1 10.1.1.2
   vxlan udp-port 4789
switch(config-if-Vx1)#

These commands create VXLAN head-end replication flood lists for the VNIs accessed through vlan 101 and vlan 102.

switch(config-if-Vx1)# vxlan vlan 101-102 flood vtep 11.1.1.1 11.1.1.2 11.1.1.3
switch(config-if-Vx1)# show active
 interface Vxlan1
   vxlan flood vtep 10.1.1.1 10.1.1.2
   vxlan vlan 101 flood vtep 11.1.1.1 11.1.1.2 11.1.1.3
   vxlan vlan 102 flood vtep 11.1.1.1 11.1.1.2 11.1.1.3
   vxlan udp-port 4789
switch(config-if-Vx1)#

Implementing VXLAN Routing

VXLAN routing is enabled by creating a VLAN Interface (SVI) on a VLAN that is associated to a VNI. In the figure below, VXLAN routing is enabled on Switch A by configuring a VLAN interface with an IP address of 10.10.10.1. Packets from Devices A-1 and B-2 that have destinations other than 10.10.10.0/28 are VXLAN-bridged to the default gateway (10.10.10.1), then routed from Switch A.

Note: For R and R2 series Arista platforms, VXLAN routing must be enabled in hardware with the hardware tcam profile vxlan-routing command. This command will cause a brief data-plane interruption. It should be run while the switch is in maintenance mode, or in an interval when a brief data-plane interruption is acceptable.

switch(config)# hardware tcam profile vxlan-routing
switch(config)#

Note: For Trident2 and some Tomahawk platforms, VXLAN routing requires that recirculation channels be configured with the command channel-group recirculation.

switch(config)#channel-group recirculation 1
switch(config)#

Example

These commands configure Switch A to perform VXLAN routing. The example includes OSPF routing that is used for underlay routing.

switch-A(config)# route-map VXLANvlan permit 10
switch-A(config-route-map-VXLANvlan)# match interface loopb5
switch-A(config-route-map-VXLANvlan)# exit
switch-A(config)# route-map VXLANvlan permit 20
switch-A(config-route-map-VXLANvlan)# match interface vlan 100
switch-A(config-route-map-VXLANvlan)# exit
switch-A(config)# router ospf 1
switch-A(config-router-ospf)# redistribute connected route-map VXLANvlan
switch-A(config-router-ospf)# exit
switch-A(config)# interface loopback 5
switch-A(config-if-Lo5)# ip address 10.25.25.3/24
switch-A(config-if-Lo5)# exit
switch-A(config)# interface vxlan 1
switch-A(config-if-Vx1)# vxlan source-interface loopback 5
switch-A(config-if-Vx1)# vxlan vlan 100 vni 10000
switch-A(config)# interface vlan 100
switch-A(config-if-Vl100)# ip address 10.10.10.1/28
switch-A(config-if-Vl100)# exit

Configuring Direct VXLAN Routing

Figure Implementing VXLAN Routing , VXLAN routing is enabled on Switch A only; Switch B supports VXLAN bridging. Traffic from Switch B devices to the external routes must go through the core route twice: once as they are bridged to is VXLAN gateway and once when routed to its next hop device.

Direct VXLAN routing with VXLAN enabled addresses this issue by configuring each VTEP with all VLANs. This allows packets to be VXLAN-bridged to a local VTEP and routed to remote VTEPs. Indirect routing scales well but is complex to engineer efficiently, and naked routing provides the same scalability to indirect routing. Direct routing leads to the most efficient traffic flows, with the number of virtual subnets or virtual machines increasing at scale, and is thereby optimal from a data plane viewpoint.

The following sections describe conventions required to implement Direct VXLAN Routing, then presents a direct VXLAN routing implementation.

Configuring VARP addresses

For direct routing, an anycast IP address is used as the gateway address on the SVI for a VLAN on all hardware VTEPs associated with that VLAN.

Examples

These commands configure an IP virtual-router and virtual MAC address.

switch(config)# interface Vlan2417
switch(config-if-Vl2417)# ip address 1.0.4.50/24
switch(config-if-Vl2417)# ip virtual-router address 1.0.4.1
switch(config-if-Vl2417)# ip virtual-router mac-address 00:00:11:11:22:22
switch(config)#

These commands configure an IP virtual address (instead of IP virtual-router address) for the VLAN SVI, and a secondary address on the loopback interface for the virtual VTEP IP. The virtual VTEP IP is the logical VTEP hosting the virtual MAC address.

switch(config)# interface Vlan2417
switch(config-if-Vl2417)# ip address virtual 1.0.4.1/24
switch(config-if-Vl2417)# exit
switch(config)# interface Loopback0
switch(config-if-Lo0)# ip address 1.0.1.1/32
switch(config-if-Lo0)# ip address 1.0.1.2/32 secondary
switch(config-if-Lo0)# ip virtual-router mac-address 00:00:11:11:22:22
switch(config)#

Virtual IP and MAC Addresses

Virtual-router IP addresses can be configured on VLAN interfaces in addition to a primary address. All VTEPs in a direct VXLAN network can be configured with the same virtual router address. This allows devices to use a common IP address as their VXLAN gateway.

The ip address virtual command configures a specified address as the primary IPv4 address and as a virtual IP address for the configuration mode VLAN interface. This results in the virtual MAC address (ip virtual-router mac-address) assignment to the VLAN interface. In large VXLAN networks, using distinct primary IP addresses for each VTEP limits the number addresses on its subnet for connected hosts. Defining a common virtual IP address for all VTEPs and using that their primary addresses conserves subnet addresses

Example

These commands specify a virtual router address of 00:00:00:00:00:48 for the switch and, for vlan 100, a primary address of 10.10.10.10/28 and a virtual IP address of 10.10.10.10.

switch(config)# ip virtual-router mac-address 00:00:00:00:00:48
switch(config)# interface vlan 100
switch(config-if-Vl100)# ip address virtual 10.10.10.10/28
switch(config-if-Vl100)# show active
 interface Vlan100
   ip address virtual 10.10.10.10/28
switch(config-if-Vl100)#

Virtual VTEP configuration

A virtual VTEP address is specified by configuring a secondary address on the loopback interface designated as the VXLAN’s source interface. All VTEPs in the direct routing topology share the same virtual VTEP address.

You must also configure the secondary VTEP IP on the flood-list of the downstream VXLAN VTEPS as shown below.

Example

These commands specify a primary (10.1.1.1) and virtual VTEP address (10.2.2.2).

switch1
switch(config)# interface loopback 5
switch(config-if-Lo5)# ip address 10.1.1.1/24
switch(config-if-Lo5)# ip address 10.2.2.2/24 secondary
switch(config-if-Lo5)# show active
 interface Loopback5
   ip address 10.1.1.1/24
   ip address 10.2.2.2/24 secondary
switch(config-if-Lo5)# exit
switch(config)# interface vxlan 1
switch(config-if-Vx1)# vxlan source-interface loopback 5
switch(config-if-Vx1)# show active
 interface Vxlan1
   vxlan source-interface Loopback5
   vxlan udp-port 4789
   vxlan vlan 100 vni 10000
switch(config-if-Vx1)#

switch2
switch(config)# interface Vxlan1
switch(config-if-Vx1)# vxlan flood vtep 10.1.1.1
switch(config-if-Vx1)# vxlan flood vtep 10.2.2.2

Direct VXLAN Topology

The following figure displays a direct VXLAN topology, where each VTEP is configured with the same set of VNIs, VLAN interfaces, and virtual VTEP address.

Example

These commands configure VXLAN parameters for Switch-A.

switch-A(config)# route-map VXLANvlan permit 10
switch-A(config-route-map-VXLANvlan)# match interface loopb5
switch-A(config-route-map-VXLANvlan)# exit
switch-A(config)# route-map VXLANvlan permit 20
switch-A(config-route-map-VXLANvlan)# match interface vlan 100
switch-A(config-route-map-VXLANvlan)# exit
switch-A(config)# router ospf 1
switch-A(config-router-ospf)# redistribute connected route-map VXLANvlan
switch-A(config-router-ospf)# exit
switch-A(config)# ip virtual-router mac-address 00:00:00:00:00:48
switch-A(config)# interface loopback 5
switch-A(config-if-Lo5)# ip address 10.1.1.3/24
switch-A(config-if-Lo5)# ip address 10.1.1.10/24 secondary
switch-A(config-if-Lo5)# exit
switch-A(config)# interface vxlan 1
switch-A(config-if-Vx1)# vxlan source-interface loopback 5
switch-A(config-if-Vx1)# vxlan vlan 100 vni 10000
switch-A(config)# interface vlan 100
switch-A(config-if-Vl100)# ip address virtual 10.10.10.10/28
switch-A(config-if-Vl100)# exit

Configuring VXLAN VTEP Counters

The VXLAN VTEP counters feature enables a device to count VXLAN packets received and sent by the device on a per VTEP basis. Specifically, it enables the device to count bytes and packets that are getting encapsulated and decapsulated as they are passing through.

The counters are logically split up in the two VXLAN directions. Encapsulated on the device and directed to the core, “encap” counters count packets coming from the edge. Decapsulated on the device and heading towards the edge, “decap” counters count packets coming from the core.

To be able to count VXLAN packets the device has to support VXLAN and have a VXLAN interface correctly configured.

Examples

This command configures the enabling of VXLAN VTEP counters for encap.
```
switch(config)# hardware counter feature vtep encap
switch(config)#
```

This command configures the disabling of VXLAN VTEP counters for encap.

switch(config)# no hardware counter feature vtep encap
switch(config)#

This commands configures the enabling of VXLAN VTEP counters for decap.

switch(config)# hardware counter feature vtep decap
switch(config)#

This commands configures the disabling of VXLAN VTEP counters for decap.

switch(config)# no hardware counter feature vtep decap
switch(config)#

VXLAN Auto Flood-List Construction

With the introduction of wireless Access Points (APs), VXLAN flood-lists learned from the data-plane is added to or removed from the flood-lists created in the control-plane. When a VXLAN packet is received on a new VNI from a VTEP, it is added to the dynamic flood-list for that VNI and the flood-list is merged with flood-lists from other sources. When all MACs behind a remote VTEP have been removed through aging, for example, the remote VTEP is removed from all dynamic VXLAN flood-lists.

To restrict VTEPs from being added to dynamic flood-lists, when VXLAN traffic is received from untrusted sources, use the vxlan learn-restrict command. MAC learning is disabled from the specified IP ranges. The learning restrictions is placed on all platforms including APs.

VXLAN configuration for Learning Data-plane Flood-lists

The following example is applicable to all platforms.

These commands enable VXLAN flood-lists learning from data-plane.

switch(config)# interface VXLAN1
switch(config-if-Vx1)# vxlan flood vtep learned data-plane

The following example restricts learning from VTEPs not in a prefix range.

switch(config-if-Vx1)# vxlan learn-restrict vtep <prefixes>

The following example restricts learning to VTEPs with IP in range.

switch(config-if-Vx1)# vxlan learn-restrict vtep 1.1.1.1/24

The following command shows the VXLAN flood-lists programmed in hardware.

switch(config)# switch(config)#show vxlan flood vtep

The following command shows the dynamic VXLAN flood-lists.

switch(config)# switch(config)#show l2Rib input vxlan-dynamic

The following command shows the VXLAN flood-lists sent to platform.

switch(config)# switch(config)#show l2Rib output floodset

The following command shows the VXLAN learning restrictions for all VLANs.

switch(config)# switch(config)#show vxlan learn-restrict vtep

The following command shows the VXLAN learning counters for all VLANs.

switch(config)# switch(config)#show vxlan counters learn-restrict all

Configuring VXLAN Routing with Overlay VRFs

VXLAN SVIs configured in non-default VRFs are supported with VXLAN routing using overlay VRFs. Overlay SVIs are configured in non-default VRFs but underlay SVIs, which provide IP connectivity between VTEPs, must remain in the default VRF. VXLAN routing is deployable by allowing users to configure separate overlay routing domains using VRFs per tenant, thereby allowing support for overlapping IP addresses in the overlay. This provides separation between overlay and underlay traffic, including simpler and cleaner protocol configuration, without using complicated route-maps to control distribution of prefixes to peers in the overlay VRFs and underlay SVIs. IPv4 based VXLAN routing is currently supported.

Configuring VXLAN over MLAG

VTI configuration must be identical on each MLAG peer for them to act as a single VTEP.

The following VTI elements must be configured identically on both MLAG peers:

VLAN-VNI Mappings

Configure identical VLAN to VNI mappings on both MLAG peers using the vxlan vlan vni command.

Example

These commands associate vlan 100 to vni 100 and vlan 200 to vni 10.10.200.

switch(config)# interface vxlan 1
switch(config-if-Vx1)# vxlan vlan 100 vni 100
switch(config-if-Vx1)# vxlan vlan 200 vni 10.10.200
switch(config-if-Vx1)#

VTEP IP Address of the Source Loopback Interface

Configure the same VTEP IP address for the source loopback interface on both MLAG peers using the vxlan source-interface command.

Example

These commands configure a primary VTEP address.

switch(config)# interface loopback 5
switch(config-if-Lo5)# ip address 10.1.1.1/24
switch(config-if-Lo5)# exit
switch(config)# interface vxlan 1
switch(config-if-Vx1)# vxlan source-interface loopback 5
switch(config-if-Vx1)#

Flood VTEP List

Configure the same VTEP flood list on both MLAG peers using the vxlan flood vtep command.

Example

These commands create a default VXLAN head-end replication flood list.

switch(config)# interface vxlan 1
switch(config-if-Vx1)# vxlan flood vtep 10.1.1.1 10.1.1.2
switch(config-if-Vx1)#

OSPF configuration

If OSPF is in use, configure the OSPF router ID using the router-id (OSPFv2) command to prevent the switch from using the common VTEP IP address as the router ID.

Example

These commands assign 10.0.0.1 as the OSPFv2 router ID.

switch(config)# router ospf 100
switch(config-router-ospf)# router-id 10.0.0.1
switch(config-router-ospf)#

Configuring VXLAN Control Service

The VXLAN Control Service (VCS) provides a mechanism by which hardware VTEPs share states between each other in order to establish VXLAN tunnels, without the need for a multicast control plane. This feature enables the use of a VCS client.

Examples

These commands connect a switch to the VCS running on CVX. The server host IP address is the management IP address of the CVX controller or the IP address that CVX is listening on for client connections.
```
switch(config)# management cvx
switch(config-mgmt-cvx)# server host 172.27.6.248
switch(config-mgmt-cvx)# no shutdown
switch(config-mgmt-cvx)#
```
These commands configure the VXLAN interface, except for the multicast group configuration, in order to learn from the controller.
```
switch(config)# interface vxlan 1
switch(config-if-Vx1)# vxlan controller-client
switch(config-if-Vx1)#
```

Configuring VXLAN Multicast Decapsulation

VXLAN multicast decapsulation enables VTEPs that support Head End Replication (HER). Multicast encapsulated Broadcast/Unknown/Multicast (BUM) packets terminate VTEPs from remote VTEPs that do not support HER.

Examples

These commands enable VXLAN multicast decapsulation.

switch(config)# interface vxlan 1
switch(config-config-if-Vx1)# vxlan multicast-group decap 230.1.1.1
switch(config-config-if-Vx1)#

These commands disable VXLAN multicast decapsulation.

switch(config)# interface vxlan 1
switch(config-config-if-Vx1)# no vxlan multicast-group decap 230.1.1.1
switch(config-config-if-Vx1)#

VXLAN Decapsulation for interface with multiple VRFs

Please refer to the following security advisory after the eos software upgrade for a network that leverages VXLAN decapsulation on an interface that carries traffic for multiple VRFs.

https://www.arista.com/en/support/advisories-notices/security-advisory/11995-security-advisory-55

VXLAN Rules Support for Mirror ACLs configuration

VXLAN rules support for mirror ACLs configuration permit VXLAN deep inspection rules to be specified in the mirroring ACLs when the switch is operating in normal mode.

Examples

The following are examples of VXLAN rules specified in mirroring ACLs.

These commands permit all VXLAN traffic (udp protocol and destination port 4789).

switch(config)# ip access-list miracl
switch(config-acl-miracl)# permit VXLAN any any
switch(config-acl-miracl)#

These commands permit VXLAN traffic with vni 1001 only.

switch(config)# ip access-list miracl
switch(config-acl-miracl)# permit vxlan any any vni 1001 0x000000
switch(config-acl-miracl)#

These commands deny VXLAN traffic with vni 0x1000 through 0x100f.

switch(config)# ip access-list miracl
switch(config-acl-miracl)# permit vxlan any any vni 0x1000 0x100f
switch(config-acl-miracl)#

Configuring EVPN VXLAN

Supported configurations

Static EVPN VXLAN configuration
VXLAN Bridging and Routing configuration
EVPN VXLAN All Active Multihoming
EVPN VXLAN Single-Active Multihoming
VARP and Virtual VTEP with VXLAN Routing
Overlay Multicast using VXLAN Underlay Multicast Tree
Bridging Over EVPN IPv6 VXLAN Underlay

Static EVPN VXLAN configuration

switch(config)# service routing protocols model multi-agent
switch(config)# interface Loopback0
switch(config-if-Lo0)# ip address 172.16.1.1/32
!
switch(config)# interface VXLAN1
switch(config-if-Vx1)# VXLAN source-interface Loopback0
switch(config-if-Vx1)# VXLAN udp-port 4789
switch(config-if-Vx1)# VXLAN vrf test vni 12345
!
switch(config)# ip routing vrf test
switch(config)# Ipv6 unicast-routing vrf test
!
switch(config)# ip route vrf test 192.168.1.0/24 vtep 10.1.1.2 vni 20000 router-mac-address 00:00:78:01:00:00
switch(config)# ipv6 route vrf test 1:0:5::0/64 vtep 10.1.1.2 vni 30000 router-mac-address 00:00:80:01:00:00

VXLAN Bridging and Routing configuration

switch(config)# interface Loopback0
switch(config-if-Lo0)# ip address 172.16.1.1/32
!
switch(config)# ip virtual-router mac-address 00:02:03:04:05:06
!

switch(config)# ip routing
!
switch(config)# interface VXLAN1
switch(config-if-Vx1)# VXLAN source-interface Loopback0
switch(config-if-Vx1)# VXLAN udp-port 65330
switch(config-if-Vx1)# VXLAN vlan 300 vni 945438
switch(config-if-Vx1)# VXLAN vlan 200 vni 654677
switch(config-if-Vx1)# VXLAN flood vtep 172.16.1.2 172.16.1.3 172.16.1.1

EVPN VXLAN All Active Multi-homing

Activate Multi-homing in an EVPN environment by assigning an ethernet segment identifier to the participating ethernet or Port Channel interfaces.

switch(config)# interface ethernet1
switch(config-if-Et1)# evpn ethernet-segment
switch(config-evpn-es)# identifier 00aa:bbbb:cccc:dddd:eeee
switch(config-evpn-es)# route-target import 12:23:34:45:56:67

The optional designated-forwarder election hold-time command configures a wait time before selecting the designated forwarder and allow potential forwarders a chance to advertise the EVPN ethernet segment (type 4) routes. The default hold time is three (3) seconds, as specified in section 8.5 of RFC7432 [1].

section 7.6 of RFC7432 [1] describes the ES import route target configured in the example.It can be set to any MAC address, but for each ethernet segment every participating interface in the network must use the same ES import route target. A suggested value is the MAC address of the CE connected to the multi-homing PEs through this interface.

A VXLAN has awareness of the STP state. When an interface used as an ethernet segment does not have a forwarding state, eos considers the interface to be inactive. For a VLAN-based service, the port must be in a forwarding state on that VLAN. For a VLAN-aware bundle service, if the interface does not forward traffic on any VLAN in a bundle, EVPN discards every VLAN in the bundle. eos enables this feature by default.

Auto-generating ESIs for the PE Router

The feature, Auto Type 1 ESI, supports auto-generating of the ESI for the PE router based on the multi-homing CE LACP system MAC and LACP port key. All routes with the ESI use the auto-generated value when linking the multi-homing CE and PE using LACP to connect to the same ES.

The feature, Auto ES-Import RT provides the capability to automatically derive the ES-Import RT value used for Type 4 ethernet Segment Route advertisement from the upper six (6) octets within the nine (9) octets in the associated ESI.

Configuring an Auto ES Identifier

Use the following commands to add the capability to auto-derive the Type 1 ESI:

switch(config)# interface Po1
            switch(config-Po1)# evpn ethernet-segment
            switch(config-evpn-es)# identifier auto lacp

Configuring an Auto ES-Import RT

Use the following commands to add this feature to the switch configuration:

switch(config-router-bgp)# address-family evpn
            switch(config-router-bgp-af)# route type ethernet-segment route-target auto

The ES-Import RT now automatically generates all ethernet Segments based on the upper six (6) octets within the ESI nine (9) octets value.

EVPN VXLAN Single-Active Multihoming

Multi-homing allows in an EVPN environment by assigning an ethernet segment identifier or a single Customer Edge (CE) to the participating multiple Provider Edge (PE). The default mode of operation is All-active. Introduced in the eos 4.26.0F for VXLAN, singe-active is another mode of operation in which only one PE per VLAN accepts traffic for that ethernet segment.

Single-active multihoming is useful for:

Manually controlled traffic flows
Prioritizing links over others
Connecting separate CE devices to a single ethernet segment
Connecting a CE that does not support link aggregation to multiple PEs.

To configure single-active multi-homing, use the redundancy single-active command on a physical ethernet or aggregate Port-channel interface.

switch(config)# interface ethernet1
switch(config-if-Et1)# evpn ethernet-segment
switch(config-evpn-es)# identifier 0123:0123:0123:0123:0123
switch(config-evpn-es)# route-target import 12:34:12:34:12:34
switch(config-evpn-es)# redundancy single-active

When don't preempt mode is enabled, a flag bit is included with preference value. Each VLAN specifies high/low rule with preference-based DF election. The default election rule is high and the default preference is 32767 from 0 to 65535.

interface Port-Channel1
   switchport mode trunk
   switchport trunk allowed vlan 100-200
   evpn ethernet-segment
      identifier 0123:0123:0123:0123:0123
      route-target import 12:34:12:34:12:34
      redundancy single-active
      designated-forwarder election algorithm preference 10000 [dont-preempt]

router bgp 10
   vlan 100
      designated-forwarder election preference rule low
      ...
   vlan-aware-bundle red
      designated-forwarder election preference rule low
      vlan 120-140
      ...

Show commands

show bgp evpn instance command takes the name of a configured EVPN instance to limit the output for that instance.

switch# show bgp evpn instance vlan 10
EVPN instance: VLAN 10
  Route distinguisher: 10.255.0.0:10
  Route target import: Route-Target-AS:64500:10
  Route target export: Route-Target-AS:64500:10
  Service interface: VLAN-based
  Local IP address: 10.255.0.0
  Encapsulation type: VXLAN
  Local ethernet segment:
    ESI: 0011:1111:1111:1111:1111
      Interface: ethernet6
      Mode: single-active
      State: up
      ES-Import RT: 00:01:00:01:00:01
      DF election algorithm: preference
      Designated forwarder: 10.255.0.0
      Non-Designated forwarder: 10.255.0.1

Each ethernet segment shows the modes, single-active or all-active, the DF election algorithm, the elected designated forwarder and all other candidate forwarders.

When a port/VLAN is inactive, it is not shown by show vlan command. It is possible to see configured but inactive VLANs in show vlan configured command.

switch# show vlan configured
VLAN  Name                         	Status	Ports
----- -------------------------------- --------- -------------------------------
1 	default                      	active	Et1, Et2, Et4, Et5, Et6
10	VLAN0010                     	active	Et6, Vx1
11	VLAN0011                     	active	Et6#, Vx1

# indicates a port on which traffic is currently being blocked

show bgp evpn detail command shows the EVPN routes contributing to the multihoming state of a device with route-type ethernet-segment and any other appropriate filters.

switch# show bgp evpn route-type ethernet-segment esi 0011:1111:1111:1111:1111 detail
BGP routing table information for VRF default
Router identifier 0.0.0.1, local AS number 300
BGP routing table entry for ethernet-segment 0011:1111:1111:1111:1111 10.255.0.0, Route Distinguisher: 10.255.0.0:1
 Paths: 1 available
  Local
	- from - (0.0.0.0)
  	Origin IGP, metric -, localpref -, weight 0, valid, local, best
  	Extended Community: TunnelEncap:tunnelTypeVXLAN EvpnEsImportRt:00:01:00:01:00:01 
DF Election: Preference 200
BGP routing table entry for ethernet-segment 0011:1111:1111:1111:1111 10.255.0.1, Route Distinguisher: 10.255.0.1:1
 Paths: 1 available
  303 301
	10.255.0.1 from 10.0.0.2 (0.0.1.1)
  	Origin IGP, metric -, localpref 100, weight 0, valid, external, best
  	Extended Community: TunnelEncap:tunnelTypeVXLAN EvpnEsImportRt:00:01:00:01:00:01 
DF Election: Preference 100

Limitations

Single-active multihoming with MPLS is not supported.
Single-active redundancy is currently only supported on trunk ports. Access ports will not drop traffic when inactive.
Designated forwarder can not be reset in non-revertive mode.

VARP and Virtual VTEP with VXLAN Routing

interface Loopback0
   ip address 172.16.1.1/32
   ip address 20.0.0.1/32 secondary
!
ip virtual-router mac-address 00:02:03:04:05:06
!
ip routing
!
interface Vlan200
   ipv6 address 2000:0:0:41::2/64
   ip address virtual 1.0.7.1/24
   ipv6 virtual-router address 2000:0:0:41::1
!
interface VXLAN1
   VXLAN source-interface Loopback0
   VXLAN udp-port 65330
   VXLAN vlan 300 vni 945438
   VXLAN vlan 200 vni 654677
   VXLAN flood vtep 172.16.1.2 172.16.1.3 172.16.1.1 20.0.0.1

Overlay Multicast using VXLAN Underlay Multicast Tree

To inject a source route, configure the ip multicast source route export command on the incoming interface.

switch(config)# interface Vlan10
switch(config-Vl10)# ip pim sparse-mode
switch(config-Vl10)# ip multicast source route export

To redistribute the source routes in the MRIB via BGP while running multi-agent protocol model, configure the redistribute attached-host command for the IPv4 multicast address-family. Activate the neighbor to establish a BGP connection.

switch(config-router-bgp)# address-family ipv4 multicast
switch(config-router-bgp-af)# neighbor 3.0.0.2 activate
switch(config-router-bgp-af)# redistribute attached-host

To redistribute the source routes in the URIB via BGP while running ribd protocol model, configure the redistribute attached-host command under the router bgp mode.

switch(config-router-bgp)# redistribute attached-host

This following is a sample configuration for a VTEP for the setup above using multi-agent protocol model.

switch(config)# service routing protocol model multi-agent

switch(config)# ip pim rp-address 15.15.15.15 225.1.1.1/32

switch(config)# interface Loopback0
switch(config-if-Lo0)# ip address 1.1.1.1/32

switch(config)# interface VXLAN1
switch(config-if-Vx1)# VXLAN source-interface Loopback0
switch(config-if-Vx1)# VXLAN vlan10 vni 10000

! Interface to the underlay
switch(config)# interface ethernet1
switch(config-if-Et1)# ip address 3.0.0.1/24
switch(config-if-Et1)# ip pim sparse-mode

switch(config)# interface vlan10
switch(config-if-Vl10)# ip address 10.1.1.1/24
switch(config-if-Vl10)# ip pim sparse-mode
switch(config-if-Vl10)# ip multicast source route export

switch(config)# router bgp 10
switch(config-router-bgp)# router-id 0.0.0.2

switch(config-router-bgp)# address-family ipv4 multicast
switch(config-router-bgp-af)# neighbor 3.0.0.2 activate
switch(config-router-bgp-af)# redistribute attached-host

This following is a sample configuration for a VTEP for the setup above using the ribd protocol model.

switch(config)# service routing protocol model ribd

switch(config)# ip pim rp-address 15.15.15.15 225.1.1.1/32

switch(config)# interface Loopback0
switch(config-if-Lo0)# ip address 1.1.1.1/32

switch(config)# interface VXLAN1
switch(config-if-Vx1)# VXLAN source-interface Loopback0
switch(config-if-Vx1)# VXLAN vlan10 vni 10000

! Interface to the underlay
switch(config)# interface ethernet1
switch(config-if-Et1)# ip address 3.0.0.1/24

switch(config-if-Et1)# ip pim sparse-mode

switch(config)# interface vlan10
switch(config-if-Vl1)# ip address 10.1.1.1/24
switch(config-if-Vl1)# ip pim sparse-mode
switch(config-if-Vl1)# ip multicast source route export

switch(config)# router bgp 10
switch(config-router-bgp)# router-id 0.0.0.2
switch(config-router-bgp)# redistribute attached-host

Bridging Over EVPN IPv6 VXLAN Underlay

The following example configuration is for VXLAN bridging over EVPN IPv6 VXLAN underlay.

switch(config)# interface loopback 0
switch(config-if-Lo0)# ip address 20001::100/128
!
switch(config)# vlan 10
switch(config-vlan-10)#
switch(config)# vlan 20
switch(config-vlan-20)#
!
switch(config)# hardware tcam 
switch(config-tcam)# system profile VXLAN-v6-underlay
!
switch(config)# interface ethernet1
switch(config-if-Et1)# switchport access vlan 10
switch(config)# interface ethernet2
switch(config-if-Et2) #switchport access vlan 20
!
switch(config)# interface vxlan 1
switch(config-if-Vx1)# vxlan source-interface loopback 0
switch(config-if-Vx1)# vxlan encapsulation ipv6
switch(config-if-Vx1)# vxlan vlan 10 vni 10
switch(config-if-Vx1)# vxlan vlan 20 vni 20
!

Displaying VXLAN configuration

The following section describes the commands that control the display format of VNIs and the commands that list VXLAN configuration and transmission information.

Configuring VNI Display Format

The vxlan vni notation dotted command configures the switch to display VNIs in dotted decimal notation. VNI values range from 1 to 16777215 in decimal notation and from 0.0.1 to 255.255.255 in dotted decimal notation.

The command affects the VNI number display in all show commands, including show running-config. commands that include VNI as a parameter may use decimal or dotted decimal notion regardless of the setting of this command. By default, show commands display VNI number in decimal notation.

Examples

These commands configure the switch to display vni numbers in dotted decimal notation, then displays a configuration that includes a VNI setting.

switch(config)# vxlan vni notation dotted
switch(config)# interface vxlan 1
switch(config-if-Vx1)# show active
interface Vxlan1
   vxlan udp-port 4789
   vxlan vlan 333 vni 3.4.5
switch(config-if-Vx1)#

These commands configure the switch to display vni numbers in decimal notation, then displays a configuration that includes a VNI setting.

switch(config)# no vxlan vni notation dotted
switch(config)# interface vxlan 1
switch(config-if-Vx1)# show active
interface Vxlan1
   vxlan udp-port 4789
   vxlan vlan 333 vni 197637
switch(config-if-Vx1)#

MAC Address Table

The MAC address table indicates a MAC address from a device on a remote host by indicating Vx interface as the port that corresponds to the address.

Example

The show mac address-table command displays a MAC address table that includes entries of devices from remote hosts by specifying Vx1 as the corresponding port.

switch> show mac address-table
          Mac Address Table
------------------------------------------------------------------

Vlan    Mac Address       Type        Ports      Moves   Last Move
----    -----------       ----        -----      -----   ---------
   1    0050.5682.6725    DYNAMIC     Et16       1       0:02:01 ago
   1    0050.568e.58e9    DYNAMIC     Et23       2       0:08:53 ago
   1    0050.56a0.474a    DYNAMIC     Et16       1       0:18:04 ago
  51    0000.0051.0004    DYNAMIC     Et5        1       12 days, 1:02:44 ago
  51    0000.0051.0005    DYNAMIC     Et5        1       12 days, 1:02:44 ago
  51    0000.0051.0101    DYNAMIC     Vx1        1       12 days, 0:17:30 ago
  51    0000.0051.0102    DYNAMIC     Vx1        1       12 days, 0:17:30 ago
  61    0000.0061.0005    DYNAMIC     Et5        1       12 days, 1:02:44 ago
Total Mac Addresses for this criterion: 8

          Multicast Mac Address Table
------------------------------------------------------------------

Vlan    Mac Address       Type        Ports
----    -----------       ----        -----
Total Mac Addresses for this criterion: 0
switch>

VXLAN MAC Address Table

VXLAN MAC address table entries correlate MAC addresses accessible through remote VTEPs with the local VLAN and the IP address of the VTEP through which the addressed device is accessed. The VTI uses this table when constructing the VXLAN encapsulation to specify the destination IP address of the recipient VTEP and the VNI segment through which the device’s remote VLAN is accessed.

The show vxlan address-table command displays the VXLAN MAC address table.

Example

This command displays the VXLAN address table.

switch> show vxlan address-table
          vxlan Mac Address Table
----------------------------------------------------------------------

Vlan  Mac Address     Type     Prt  Vtep             Moves   Last Move
----  -----------     ----     ---  ----             -----   ---------
  51  0000.0051.0101  DYNAMIC  Vx1  10.25.2.12       1       4 days, 0:37:14 ago
  51  0000.0051.0102  DYNAMIC  Vx1  10.25.2.12       1       4 days, 0:37:14 ago
  51  0000.0051.0103  DYNAMIC  Vx1  10.25.2.12       1       4 days, 0:37:14 ago
  51  0000.0051.0104  DYNAMIC  Vx1  10.25.2.12       1       4 days, 0:37:14 ago
  51  0000.0051.0105  DYNAMIC  Vx1  10.25.2.12       1       4 days, 0:37:14 ago
  61  0000.0061.0103  DYNAMIC  Vx1  10.25.2.12       1       4 days, 0:37:14 ago
  61  0000.0061.0104  DYNAMIC  Vx1  10.25.2.12       1       4 days, 0:37:14 ago
  61  0000.0061.0105  DYNAMIC  Vx1  10.25.2.12       1       4 days, 0:37:14 ago
switch>

VXLAN MAC Address Table

The show vxlan vtep command displays information about remote VTEPs that the configured VTI has discovered and with whom it has exchanged packets.

Example

These commands display the VTEPs that have exchanged data with the configured VTI.

switch> show vxlan vtep
Remote vteps for Vxlan1:
10.52.2.12
Total number of remote vteps:  1
switch>

VXLAN Counters

The clear vxlan counters command resets the VXLAN counters. The show vxlan counters command displays the VXLAN counters.

Example

This command displays the VXLAN counters

switch> show vxlan counters software
encap_bytes:3452284
encap_pkts:27841
encap_read_err:1
encap_discard_runt:0
encap_discard_vlan_range:0
encap_discard_vlan_map:0
encap_send_err:0
encap_timeout:1427
decap_bytes_total:382412426
decap_pkts_total:2259858
decap_bytes:0
decap_pkts:0
decap_runt:0
decap_pkt_filter:45128
decap_bytes_filter:5908326
decap_discard_vxhdr:0
decap_discard_vlan_map:2214730
decap_timeout:0
decap_sock_err:1
switch>

Displaying VXLAN Bridging and Routing Support

All show commands applicable to prior VXLAN implementations on R2 series are also available on R3 series for VXLAN debugging.

The show interfaces VXLAN command displays operational status and configuration information of the specified VXLAN.

switch(config)# show interfaces VXLAN 1
VXLAN1 is up, line protocol is up (connected)
  Hardware is VXLAN
  Source interface is Loopback0 and is active with 172.16.1.1
  Replication/Flood Mode is headend with Flood List Source: CLI
  Remote MAC learning via Datapath
  VNI mapping to VLANs
  Static VLAN to VNI mapping is
    [100, 100]
  Note: All Dynamic VLANs used by VCS are internal VLANs.
        Use 'show VXLAN vni' for details.
  Static VRF to VNI mapping is not configured
  Headend replication flood vtep list is:
   100 172.16.1.2 10.1.1.1
  MLAG Shared Router MAC is 0000.0000.0000
  VTEP address mask is Non

The show arp command displays all ARP tables on the configured VXLAN.

switch(config)# show arp interface VXLAN 1
Address         Age (sec)  Hardware Addr   Interface
192.168.10.1              -  0000.abab.abab  Vlan100, VXLAN1

The show arp interface summary command displays a summary of all ARP tables on the configured VXLAN.

switch(config)# show arp interface VXLAN 1 summary
Total: 1
Static: 1
Dynamic: 0
Not learned: 0

The show VXLAN counters software command displays the VXLAN software counters.

switch(config)# show VXLAN counters software
Rx bytes for encapsulation                           :  0
Rx pkts for encapsulation                            :  0
Rx high priority bytes for encapsulation             :  0
Rx high priority pkts for encapsulation              :  0
Rx low priority bytes for encapsulation              :  0
Rx low priority pkts for encapsulation               :  0
…..

switch(config)# show VXLAN vni
VNI to VLAN Mapping for VXLAN1
VNI       VLAN       Source       Interface         802.1Q Tag
--------- ---------- ------------ ----------------- ----------
100       100        static       ethernet2/1       untagged
                                  VXLAN1            100

Note: * indicates a Dynamic VLAN

The show VXLAN vtep command displays information about remote VTEPs that the configured VTI has discovered and with whom it has exchanged packets.

switch(config)# show VXLAN vtep
Remote VTEPS for VXLAN1:
10.1.1.1
Total number of remote VTEPS:  1

switch(config)# show platform fap VXLAN vtep encapsulation
Tunnel Type: R(VXLAN-Routing), B(VXLAN-Bridging)
D - ECMP is divergent across switching chips
 ------------------------------------------------------------------------------------------------------------
|                                                   VTEP Table                                               |
|------------------------------------------------------------------------------------------------------------|
|                        FEC                            |                        EEDB                        |
|------------------------------------------------------------------------------------------------------------|
|  Destination  | Ecmp|  Fec|Tunnel|Tunnel|  Arp|SIP|TTL| Cmd |     Destination    | VID |   MAC / CPU Code  |
|               |Index|Index| Index| Type |Index|Idx|   |     |                    |     |                   |
|------------------------------------------------------------------------------------------------------------|
|       10.1.1.1|  -  |353900| 16382|     B|65536|  0| 64|ROUTE| Et1/1              |1006 | 00:00:aa:aa:aa:aa |
|       10.1.1.1|  -  |353901| 16383|     R|65536|  0| 64|ROUTE| Et1/1              |1006 | 00:00:aa:aa:aa:aa |

switch(config)# show cpu counters queue | grep VXLAN
CoppSystemVXLANEncap              0          0          0          0
CoppSystemVXLANVtepLearn          0          0          0          0
CoppSystemVXLANEncap              0          0          0          0
CoppSystemVXLANVtepLearn          0          0          0          0

switch(config)# show platform fap VXLAN mapping vni
    VNI      | VSI
-------------+------
         100 |  100

switch# show platform pkt | egrep -i "VXLAN|vni"
rxpacllog 0 rxracllog 0 rxvteplearn 0 rxVXLAN_encap 0
rx_VXLANbfd 0 rxcfm 0
rxvteprestore_drop 0 rxVXLAN_encap_drop 0 rxmpc_nodev 0 rx_VXLANbfderr 0 rx_nonVXLAN_arp_drop 0
fab.rxVXLAN_decaperr 0 rx_macsecproxyerr 0 rx_macsecproxy_prune 0
CpuCodeVXLANVtepLearn:  0
CpuCodeVXLANEncapRequired:      0
CpuCodeVXLANArp:        0
CpuCodeVXLANUnknownVtepArp:     0
     VXLAN :  sys_port   -1 traffic_class 0 fdma - fapid 0 sflow_cookie 0 mark4 0000 mark6 0000 D
VXLAN vni hashtable:
h: 201, i: 0, vni: 100, vlanid: 100
VXLAN enabled vlans: 100,

use the

switch# show cpu counters VXLAN l2 ecmp
VTEP Group     Member VTEP IP     ECMP    ECMP      Member    Next Level
ID                         	Size    FEC ID    FEC ID    FEC ID
-------------------------------------------------------------------------
1        	172.16.1.2        2       1  	 91752    353907
                10.1.1.1                   	   91753    353908

EOS 4.34.0F User Manual

VXLAN configuration

Configuring the VTI

Instantiating the VTI and VXLAN configuration Mode

Assigning an IP address to the VTEP

Assigning a UDP Port to the VTEP

Assigning a VNI to a VLAN

Verifying the VXLAN configuration

Head End Replication configuration

VXLAN Routing configuration

Implementing VXLAN Routing

Configuring Direct VXLAN Routing

Configuring VARP addresses

Virtual IP and MAC Addresses

Virtual VTEP configuration

Direct VXLAN Topology

Configuring VXLAN VTEP Counters

VXLAN Auto Flood-List Construction

VXLAN configuration for Learning Data-plane Flood-lists

Configuring VXLAN Routing with Overlay VRFs

Configuring VXLAN over MLAG

VLAN-VNI Mappings

VTEP IP Address of the Source Loopback Interface

Flood VTEP List

OSPF configuration

Configuring VXLAN Control Service

Configuring VXLAN Multicast Decapsulation

VXLAN Decapsulation for interface with multiple VRFs

VXLAN Rules Support for Mirror ACLs configuration

Configuring EVPN VXLAN

Static EVPN VXLAN configuration

VXLAN Bridging and Routing configuration

EVPN VXLAN All Active Multi-homing

Auto-generating ESIs for the PE Router

Configuring an Auto ES Identifier

Configuring an Auto ES-Import RT

EVPN VXLAN Single-Active Multihoming

Show commands

Limitations

VARP and Virtual VTEP with VXLAN Routing

Overlay Multicast using VXLAN Underlay Multicast Tree

Bridging Over EVPN IPv6 VXLAN Underlay

Displaying VXLAN configuration

Configuring VNI Display Format

MAC Address Table

VXLAN MAC Address Table

VXLAN MAC Address Table

VXLAN Counters

Displaying VXLAN Bridging and Routing Support