H3C S5560X-EI Series User manual

H3C S5560X-EI Switch Series
VXLAN Configuration Guide
New H3C Technologies Co., Ltd.
http://www.h3c.com.hk
Software version: Release 1110 series
Document version: 6W102-20171207

Copyright © 2017, New H3C Technologies Co., Ltd. and its licensors
All rights reserved
No part of this manual may be reproduced or transmitted in any form or by any means without prior written
consent of New H3C Technologies Co., Ltd.
Trademarks
H3C, , H3CS, H3CIE, H3CNE,Aolynk, , H3Care, , IRF, NetPilot, Netflow, SecEngine,
SecPath, SecCenter, SecBlade, Comware, ITCMM and HUASAN are trademarks of New H3C Technologies
Co., Ltd.
All other trademarks that may be mentioned in this manual are the property of their respective owners
Notice
The information in this document is subject to change without notice. Every effort has been made in the
preparation of this document to ensure accuracy of the contents, but all statements, information, and
recommendations in this document do not constitute the warranty of any kind, express or implied.

Preface
This configuration guide describes the VXLAN fundamentals and configuration procedures.
This preface includes the following topics about the documentation:
•Audience
•Conventions
•Obtaining documentation
•Technical support
•Documentation feedback
Audience
This documentation is intended for:
•Network planners.
•Field technical support and servicing engineers.
•Network administrators working with the S5560X-EI switch series.
Conventions
The following information describes the conventions used in the documentation.
Command conventions
Convention Description
Boldface Bold text represents commands and keywords that you enter literally as shown.
Italic Italic text represents arguments that you replace with actual values.
[ ] Square brackets enclose syntax choices (keywords or arguments) that are optional.
{ x | y | ... }
Braces enclose a set of required syntax choices separated by vertical bars, from which
you select one.
[ x | y | ... ]
Square brackets enclose a set of optional syntax choices separated by vertical bars,
from which you select one or none.
{ x | y | ... } *
Asterisk marked braces enclose a set of required syntax choices separated by vertical
bars, from which you select a minimum of one.
[ x | y | ... ] *
Asterisk marked square brackets enclose optional syntax choices separated by vertical
bars, from which you select one choice, multiple choices, or none.
&<1-n> The argument or keyword and argument combination before the ampersand (&) sign
can be entered 1 to n times.
# A line that starts with a pound (#) sign is comments.
GUI conventions
Convention Description
Boldface Window names, button names, field names, and menu items are in Boldface. For
example, the New User window opens; click OK.
> Multi-level menus are separated by angle brackets. For example, File > Create >

Convention Description
Folde
r
.
Symbols
Convention Description
WARNING! An alert that calls attention to important information that if not understood or followed
can result in personal injury.
CAUTION: An alert that calls attention to important information that if not understood or followed
can result in data loss, data corruption, or damage to hardware or software.
IMPORTANT: An alert that calls attention to essential information.
NOTE: An alert that contains additional or supplementary information.
TIP: An alert that provides helpful information.
Network topology icons
Convention Description
Represents a generic network device, such as a router, switch, or firewall.
Represents a routing-capable device, such as a router or Layer 3 switch.
Represents a generic switch, such as a Layer 2 or Layer 3 switch, or a router that
supports Layer 2 forwarding and other Layer 2 features.
Represents an access controller, a unified wired-WLAN module, or the access
controller engine on a unified wired-WLAN switch.
Represents an access point.
Represents a wireless terminator unit.
Represents a wireless terminator.
Represents a mesh access point.
Represents omnidirectional signals.
Represents directional signals.
Represents a security product, such as a firewall, UTM, multiservice security
gateway, or load balancing device.
Represents a security module, such as a firewall, load balancing, NetStream, SSL
VPN, IPS, or ACG module.
T
T
T
T





Examples provided in this document
Examples in this document might use devices that differ from your device in hardware model,
configuration, or software version. It is normal that the port numbers, sample output, screenshots,
and other information in the examples differ from what you have on your device.
Obtaining documentation
To access the most up-to-date H3C product documentation, go to the H3C website at
http://www.h3c.com.hk
To obtain information about installation, configuration, and maintenance, click
http://www.h3c.com.hk/Technical_Documents
To obtain software version information such as release notes, click
http://www.h3c.com.hk/Software_Download
Technical support
[e-mail]
http://www.h3c.com.hk
Documentation feedback
You can e-mail your comments about product documentation to [e-mail].
We appreciate your comments.

i
Contents
VXLAN overview··············································································1
VXLAN network model················································································································1
VXLAN packet format ·················································································································2
Working mechanisms··················································································································3
Assignment of traffic to VXLANs·····························································································3
MAC learning ·····················································································································3
Traffic forwarding ················································································································4
Access mode of VSIs···········································································································6
ARP flood suppression················································································································6
VXLAN IP gateways ···················································································································7
Protocols and standards··············································································································7
Configuring basic VXLAN features·······················································8
Configuration restrictions and guidelines·························································································8
VXLAN configuration task list········································································································8
Setting the forwarding mode for VXLANs ························································································9
Creating a VXLAN on a VSI ·········································································································9
Configuring a VXLAN tunnel·········································································································9
Assigning VXLAN tunnels to a VXLAN··························································································10
Mapping ACs to a VSI···············································································································10
Mapping a static Ethernet service instance to a VSI··································································11
Mapping dynamic Ethernet service instances to VSIs································································11
Managing MAC address entries ··································································································12
Configuring static remote-MAC address entries ·······································································12
Disabling remote-MAC address learning·················································································12
Enabling local-MAC change logging ······················································································13
Confining floods to the local site··································································································13
Setting the destination UDP port number of VXLAN packets ·····························································14
Enabling ARP flood suppression ·································································································14
Disabling remote ARP learning for VXLANs···················································································14
Displaying and maintaining VXLANs ····························································································15
Unicast-mode VXLAN configuration example·················································································15
Network requirements ········································································································15
Configuration procedure ·····································································································16
Verifying the configuration···································································································19
Configuring VXLAN IP gateways ·······················································21
Overview································································································································21
VXLAN IP gateways separated from VTEPs············································································21
Centralized VXLAN IP gateway deployment············································································22
Distributed VXLAN IP gateway deployment·············································································23
Configuration prerequisites ········································································································26
Configuring a centralized VXLAN IP gateway·················································································26
Configuring a distributed VXLAN IP gateway ·················································································27
Configuration restrictions and guidelines ················································································27
Configuration prerequisites··································································································27
Configuration procedure ·····································································································27
Configuring a VSI interface ········································································································28
Displaying and maintaining VXLAN IP gateway··············································································29
VXLAN IP gateway configuration examples···················································································29
Centralized VXLAN IP gateway configuration example······························································29
Distributed VXLAN IPv4 gateway configuration example····························································34
Distributed VXLAN IPv6 gateway configuration example····························································43
Index···························································································54

1
VXLAN overview
Virtual eXtensible LAN (VXLAN) is a MAC-in-UDP technology that provides Layer 2 connectivity
between distant network sites across an IP network. VXLAN is typically used in data centers and
campus access networks for multitenant services.
VXLAN provides the following benefits:
•Support for more virtual switched domains than VLANs—Each VXLAN is uniquely
identified by a 24-bit VXLAN ID. The total number of VXLANs can reach 16777216 (224). This
specification makes VXLAN a better choice than 802.1Q VLAN to isolate traffic for user
terminals.
•Easy deployment and maintenance—VXLAN requires deployment only on the edge devices
of the transport network. Devices in the transport network perform typical Layer 3 forwarding.
The device supports only IPv4-based VXLAN. IPv6-based VXLAN is not supported.
VXLAN network model
As shown in Figure 1, a VXLAN is a virtual Layer 2 network (known as the overlay network) built on
top of an existing physical Layer 3 network (known as the underlay network). The overlay network
encapsulates inter-site Layer 2 frames into VXLAN packets and forwards the packets to the
destination along the Layer 3 forwarding paths provided by the underlay network. The underlay
network is transparent to tenants, and geographically dispersed sites of a tenant are merged into a
Layer 2 network.
The transport edge devices assign user terminals to different VXLANs, and then forward traffic
between sites for user terminals by using VXLAN tunnels. Supported user terminals include PCs,
wireless terminals, and user terminals on servers.
The transport edge devices are VXLAN tunnel endpoints (VTEP).
An H3C VTEP uses VSIs and VXLAN tunnels to provide VXLAN services.
•VSI—A virtual switch instance is a virtual Layer 2 switched domain. Each VSI provides
switching services only for one VXLAN. VSIs learn MAC addresses and forward frames
independently of one another. User terminals in different sites have Layer 2 connectivity if they
are in the same VXLAN.
•VXLAN tunnel—Logical point-to-point tunnels between VTEPs over the transport network.
Each VXLAN tunnel can trunk multiple VXLANs.
VTEPs encapsulate VXLAN traffic in the VXLAN, outer UDP, and outer IP headers. The devices in
the transport network forward VXLAN traffic only based on the outer IP header.

2
Figure 1 VXLAN network model
VXLAN packet format
As shown in Figure 2, a VTEP encapsulates a frame in the following headers:
•8-byte VXLAN header—VXLAN information for the frame.
{Flags—If the I bit is 1, the VXLAN ID is valid. If the I bit is 0, the VXLAN ID is invalid. All
other bits are reserved and set to 0.
{24-bit VXLAN ID—Identifies the VXLAN of the frame. It is also called the virtual network
identifier (VNI).
•8-byte outer UDP header for VXLAN—The default VXLAN destination UDP port number is
4789.
•20-byte outer IP header—Valid addresses of VTEPs or VXLAN multicast groups on the
transport network. Devices in the transport network forward VXLAN packets basedon the outer
IP header.
Figure 2 VXLAN packet format
Underlay network
Overlay network
VTEP 1 VTEP 2
Site 2
Site 1
VXLAN tunnel
Transport
network
P
Terminal
Terminal
VSI/VXLAN 10
VSI/VXLAN 20
VSI/VXLAN 10
VSI/VXLAN 20
Terminal
Terminal

3
Working mechanisms
The VTEP uses the following process to forward an inter-site frame:
1. Assigns the frame to its matching VXLAN if the frame is sent between sites.
2. Performs MAC learning on the VXLAN's VSI.
3. Forwards the frame through VXLAN tunnels.
This section describes this process in detail. For intra-site frames in a VSI, the system performs
typical Layer 2 forwarding, and it processes 802.1Q VLAN tags as described in "Access mode of
VSIs."
Assignment of traffic to VXLANs
Traffic from the local site to a remote site
The VTEP uses an Ethernet service instance to match customer traffic on a site-facing interface. The
VTEP assigns customer traffic to a VXLAN by mapping the Ethernet service instance to a VSI.
An Ethernet service instance is identical to an attachment circuit (AC) in L2VPN.An Ethernet service
instance matches a list of VLANs on a Layer 2 Ethernet interface by using a frame match criterion.
The frame match criterion specifies the characteristics of traffic from the VLANs, such as tagging
status and VLAN IDs.
As shown in Figure 3, Ethernet service instance 1 matches VLAN 2 and is mapped to VSIA(VXLAN
10). When a frame from VLAN 2 arrives, the VTEPassigns the frame to VXLAN 10, and looks up VSI
A's MAC address table for the outgoing interface.
Figure 3 Identifying traffic from the local site
Traffic from a remote site to the local site
When a frame arrives at a VXLAN tunnel, the VTEP uses the VXLAN ID in the frame to identify its
VXLAN.
MAC learning
The VTEP performs source MAC learning on the VSI as a Layer 2 switch.
•For traffic from the local site to theremote site, theVTEPlearns the source MAC address before
VXLAN encapsulation.
•For traffic from the remote site to the local site, the VTEP learns the source MAC address after
removing the VXLAN header.
A VSI's MAC address table includes the following types of MAC address entries:

4
•Local MAC—MAC entries dynamically learned from the local site. The outgoing interfaces for
the MAC address entries are site-facing interfaces. VXLAN does not support static local-MAC
entries.
•Remote MAC—MAC entries learned from a remote site. The outgoing interfaces for the MAC
address entries are VXLAN tunnel interfaces.
{Static—Manually added MAC entries.
{Dynamic—MAC entries learned in the data plane from incoming traffic on VXLAN tunnels.
The learned MAC addresses are contained in the inner Ethernet header.
For a MAC address, the manual static entry has higher priority than the dynamic entry.
Traffic forwarding
The device performs Layer 2 or Layer 3 forwarding for VXLANs depending on your configuration.
•In Layer 3 forwarding mode, the device uses the ARPor ND table to forward traffic for VXLANs.
•In Layer 2 forwarding mode, the device uses the MAC address table to forward traffic for
VXLANs.
Use Layer 3 forwarding mode if you want to use the device as a VXLAN IP gateway.
This section describes the Layer 2 forwarding processes. For information about Layer 3 forwarding,
see "Configuring VXLAN IP gateways."
AVTEP uses the following processes to forward traffic at Layer 2:
•Unicast process—Applies to destination-known unicast traffic.
•Flood process—Applies to multicast, broadcast, and unknown unicast traffic.
When the VTEP forwards VXLAN traffic, it processes the 802.1Q tag in the inner Ethernet header
depending on the VSI access mode (VLAN or Ethernet mode). In VLAN access mode, sites can use
different VLANs to provide the same service. For more information, see "Access mode of VSIs."
Unicast
The following process (see Figure 4) applies to a known unicast frame between sites:
1. The source VTEP encapsulates the Ethernet frame in the VXLAN/UDP/IP header.
In the outer IP header, the source IP address is the source VTEP's VXLAN tunnel source IP
address. The destination IP address is the VXLAN tunnel destination IP address.
2. The source VTEP forwards the encapsulated packet out of the outgoing VXLAN tunnel
interface found in the VSI's MAC address table.
3. The intermediate transport devices (P devices) forward the frame to the destination VTEP by
using the outer IP header.
4. The destination VTEP removes the headers on top of the inner Ethernet frame. It then performs
MAC address table lookup in the VXLAN's VSI to forward the frame out of the matching
outgoing interface.