H3C S5560X-EI Series User manual

H3C S5560X-EI Switch Series
VXLAN Configuration Guide
New H3C Technologies Co., Ltd.
http://www.h3c.com.hk
Software version: Release 1110 series
Document version: 6W102-20171207

Copyright © 2017, New H3C Technologies Co., Ltd. and its licensors
All rights reserved
No part of this manual may be reproduced or transmitted in any form or by any means without prior written
consent of New H3C Technologies Co., Ltd.
Trademarks
H3C, , H3CS, H3CIE, H3CNE,Aolynk, , H3Care, , IRF, NetPilot, Netflow, SecEngine,
SecPath, SecCenter, SecBlade, Comware, ITCMM and HUASAN are trademarks of New H3C Technologies
Co., Ltd.
All other trademarks that may be mentioned in this manual are the property of their respective owners
Notice
The information in this document is subject to change without notice. Every effort has been made in the
preparation of this document to ensure accuracy of the contents, but all statements, information, and
recommendations in this document do not constitute the warranty of any kind, express or implied.

Preface
This configuration guide describes the VXLAN fundamentals and configuration procedures.
This preface includes the following topics about the documentation:
•Audience
•Conventions
•Obtaining documentation
•Technical support
•Documentation feedback
Audience
This documentation is intended for:
•Network planners.
•Field technical support and servicing engineers.
•Network administrators working with the S5560X-EI switch series.
Conventions
The following information describes the conventions used in the documentation.
Command conventions
Convention Description
Boldface Bold text represents commands and keywords that you enter literally as shown.
Italic Italic text represents arguments that you replace with actual values.
[ ] Square brackets enclose syntax choices (keywords or arguments) that are optional.
{ x | y | ... }
Braces enclose a set of required syntax choices separated by vertical bars, from which
you select one.
[ x | y | ... ]
Square brackets enclose a set of optional syntax choices separated by vertical bars,
from which you select one or none.
{ x | y | ... } *
Asterisk marked braces enclose a set of required syntax choices separated by vertical
bars, from which you select a minimum of one.
[ x | y | ... ] *
Asterisk marked square brackets enclose optional syntax choices separated by vertical
bars, from which you select one choice, multiple choices, or none.
&<1-n> The argument or keyword and argument combination before the ampersand (&) sign
can be entered 1 to n times.
# A line that starts with a pound (#) sign is comments.
GUI conventions
Convention Description
Boldface Window names, button names, field names, and menu items are in Boldface. For
example, the New User window opens; click OK.
> Multi-level menus are separated by angle brackets. For example, File > Create >

Convention Description
Folde
r
.
Symbols
Convention Description
WARNING! An alert that calls attention to important information that if not understood or followed
can result in personal injury.
CAUTION: An alert that calls attention to important information that if not understood or followed
can result in data loss, data corruption, or damage to hardware or software.
IMPORTANT: An alert that calls attention to essential information.
NOTE: An alert that contains additional or supplementary information.
TIP: An alert that provides helpful information.
Network topology icons
Convention Description
Represents a generic network device, such as a router, switch, or firewall.
Represents a routing-capable device, such as a router or Layer 3 switch.
Represents a generic switch, such as a Layer 2 or Layer 3 switch, or a router that
supports Layer 2 forwarding and other Layer 2 features.
Represents an access controller, a unified wired-WLAN module, or the access
controller engine on a unified wired-WLAN switch.
Represents an access point.
Represents a wireless terminator unit.
Represents a wireless terminator.
Represents a mesh access point.
Represents omnidirectional signals.
Represents directional signals.
Represents a security product, such as a firewall, UTM, multiservice security
gateway, or load balancing device.
Represents a security module, such as a firewall, load balancing, NetStream, SSL
VPN, IPS, or ACG module.
T
T
T
T





Examples provided in this document
Examples in this document might use devices that differ from your device in hardware model,
configuration, or software version. It is normal that the port numbers, sample output, screenshots,
and other information in the examples differ from what you have on your device.
Obtaining documentation
To access the most up-to-date H3C product documentation, go to the H3C website at
http://www.h3c.com.hk
To obtain information about installation, configuration, and maintenance, click
http://www.h3c.com.hk/Technical_Documents
To obtain software version information such as release notes, click
http://www.h3c.com.hk/Software_Download
Technical support
[e-mail]
http://www.h3c.com.hk
Documentation feedback
You can e-mail your comments about product documentation to [e-mail].
We appreciate your comments.

i
Contents
VXLAN overview··············································································1
VXLAN network model················································································································1
VXLAN packet format ·················································································································2
Working mechanisms··················································································································3
Assignment of traffic to VXLANs·····························································································3
MAC learning ·····················································································································3
Traffic forwarding ················································································································4
Access mode of VSIs···········································································································6
ARP flood suppression················································································································6
VXLAN IP gateways ···················································································································7
Protocols and standards··············································································································7
Configuring basic VXLAN features·······················································8
Configuration restrictions and guidelines·························································································8
VXLAN configuration task list········································································································8
Setting the forwarding mode for VXLANs ························································································9
Creating a VXLAN on a VSI ·········································································································9
Configuring a VXLAN tunnel·········································································································9
Assigning VXLAN tunnels to a VXLAN··························································································10
Mapping ACs to a VSI···············································································································10
Mapping a static Ethernet service instance to a VSI··································································11
Mapping dynamic Ethernet service instances to VSIs································································11
Managing MAC address entries ··································································································12
Configuring static remote-MAC address entries ·······································································12
Disabling remote-MAC address learning·················································································12
Enabling local-MAC change logging ······················································································13
Confining floods to the local site··································································································13
Setting the destination UDP port number of VXLAN packets ·····························································14
Enabling ARP flood suppression ·································································································14
Disabling remote ARP learning for VXLANs···················································································14
Displaying and maintaining VXLANs ····························································································15
Unicast-mode VXLAN configuration example·················································································15
Network requirements ········································································································15
Configuration procedure ·····································································································16
Verifying the configuration···································································································19
Configuring VXLAN IP gateways ·······················································21
Overview································································································································21
VXLAN IP gateways separated from VTEPs············································································21
Centralized VXLAN IP gateway deployment············································································22
Distributed VXLAN IP gateway deployment·············································································23
Configuration prerequisites ········································································································26
Configuring a centralized VXLAN IP gateway·················································································26
Configuring a distributed VXLAN IP gateway ·················································································27
Configuration restrictions and guidelines ················································································27
Configuration prerequisites··································································································27
Configuration procedure ·····································································································27
Configuring a VSI interface ········································································································28
Displaying and maintaining VXLAN IP gateway··············································································29
VXLAN IP gateway configuration examples···················································································29
Centralized VXLAN IP gateway configuration example······························································29
Distributed VXLAN IPv4 gateway configuration example····························································34
Distributed VXLAN IPv6 gateway configuration example····························································43
Index···························································································54

1
VXLAN overview
Virtual eXtensible LAN (VXLAN) is a MAC-in-UDP technology that provides Layer 2 connectivity
between distant network sites across an IP network. VXLAN is typically used in data centers and
campus access networks for multitenant services.
VXLAN provides the following benefits:
•Support for more virtual switched domains than VLANs—Each VXLAN is uniquely
identified by a 24-bit VXLAN ID. The total number of VXLANs can reach 16777216 (224). This
specification makes VXLAN a better choice than 802.1Q VLAN to isolate traffic for user
terminals.
•Easy deployment and maintenance—VXLAN requires deployment only on the edge devices
of the transport network. Devices in the transport network perform typical Layer 3 forwarding.
The device supports only IPv4-based VXLAN. IPv6-based VXLAN is not supported.
VXLAN network model
As shown in Figure 1, a VXLAN is a virtual Layer 2 network (known as the overlay network) built on
top of an existing physical Layer 3 network (known as the underlay network). The overlay network
encapsulates inter-site Layer 2 frames into VXLAN packets and forwards the packets to the
destination along the Layer 3 forwarding paths provided by the underlay network. The underlay
network is transparent to tenants, and geographically dispersed sites of a tenant are merged into a
Layer 2 network.
The transport edge devices assign user terminals to different VXLANs, and then forward traffic
between sites for user terminals by using VXLAN tunnels. Supported user terminals include PCs,
wireless terminals, and user terminals on servers.
The transport edge devices are VXLAN tunnel endpoints (VTEP).
An H3C VTEP uses VSIs and VXLAN tunnels to provide VXLAN services.
•VSI—A virtual switch instance is a virtual Layer 2 switched domain. Each VSI provides
switching services only for one VXLAN. VSIs learn MAC addresses and forward frames
independently of one another. User terminals in different sites have Layer 2 connectivity if they
are in the same VXLAN.
•VXLAN tunnel—Logical point-to-point tunnels between VTEPs over the transport network.
Each VXLAN tunnel can trunk multiple VXLANs.
VTEPs encapsulate VXLAN traffic in the VXLAN, outer UDP, and outer IP headers. The devices in
the transport network forward VXLAN traffic only based on the outer IP header.

2
Figure 1 VXLAN network model
VXLAN packet format
As shown in Figure 2, a VTEP encapsulates a frame in the following headers:
•8-byte VXLAN header—VXLAN information for the frame.
{Flags—If the I bit is 1, the VXLAN ID is valid. If the I bit is 0, the VXLAN ID is invalid. All
other bits are reserved and set to 0.
{24-bit VXLAN ID—Identifies the VXLAN of the frame. It is also called the virtual network
identifier (VNI).
•8-byte outer UDP header for VXLAN—The default VXLAN destination UDP port number is
4789.
•20-byte outer IP header—Valid addresses of VTEPs or VXLAN multicast groups on the
transport network. Devices in the transport network forward VXLAN packets basedon the outer
IP header.
Figure 2 VXLAN packet format
Underlay network
Overlay network
VTEP 1 VTEP 2
Site 2
Site 1
VXLAN tunnel
Transport
network
P
Terminal
Terminal
VSI/VXLAN 10
VSI/VXLAN 20
VSI/VXLAN 10
VSI/VXLAN 20
Terminal
Terminal

3
Working mechanisms
The VTEP uses the following process to forward an inter-site frame:
1. Assigns the frame to its matching VXLAN if the frame is sent between sites.
2. Performs MAC learning on the VXLAN's VSI.
3. Forwards the frame through VXLAN tunnels.
This section describes this process in detail. For intra-site frames in a VSI, the system performs
typical Layer 2 forwarding, and it processes 802.1Q VLAN tags as described in "Access mode of
VSIs."
Assignment of traffic to VXLANs
Traffic from the local site to a remote site
The VTEP uses an Ethernet service instance to match customer traffic on a site-facing interface. The
VTEP assigns customer traffic to a VXLAN by mapping the Ethernet service instance to a VSI.
An Ethernet service instance is identical to an attachment circuit (AC) in L2VPN.An Ethernet service
instance matches a list of VLANs on a Layer 2 Ethernet interface by using a frame match criterion.
The frame match criterion specifies the characteristics of traffic from the VLANs, such as tagging
status and VLAN IDs.
As shown in Figure 3, Ethernet service instance 1 matches VLAN 2 and is mapped to VSIA(VXLAN
10). When a frame from VLAN 2 arrives, the VTEPassigns the frame to VXLAN 10, and looks up VSI
A's MAC address table for the outgoing interface.
Figure 3 Identifying traffic from the local site
Traffic from a remote site to the local site
When a frame arrives at a VXLAN tunnel, the VTEP uses the VXLAN ID in the frame to identify its
VXLAN.
MAC learning
The VTEP performs source MAC learning on the VSI as a Layer 2 switch.
•For traffic from the local site to theremote site, theVTEPlearns the source MAC address before
VXLAN encapsulation.
•For traffic from the remote site to the local site, the VTEP learns the source MAC address after
removing the VXLAN header.
A VSI's MAC address table includes the following types of MAC address entries:

4
•Local MAC—MAC entries dynamically learned from the local site. The outgoing interfaces for
the MAC address entries are site-facing interfaces. VXLAN does not support static local-MAC
entries.
•Remote MAC—MAC entries learned from a remote site. The outgoing interfaces for the MAC
address entries are VXLAN tunnel interfaces.
{Static—Manually added MAC entries.
{Dynamic—MAC entries learned in the data plane from incoming traffic on VXLAN tunnels.
The learned MAC addresses are contained in the inner Ethernet header.
For a MAC address, the manual static entry has higher priority than the dynamic entry.
Traffic forwarding
The device performs Layer 2 or Layer 3 forwarding for VXLANs depending on your configuration.
•In Layer 3 forwarding mode, the device uses the ARPor ND table to forward traffic for VXLANs.
•In Layer 2 forwarding mode, the device uses the MAC address table to forward traffic for
VXLANs.
Use Layer 3 forwarding mode if you want to use the device as a VXLAN IP gateway.
This section describes the Layer 2 forwarding processes. For information about Layer 3 forwarding,
see "Configuring VXLAN IP gateways."
AVTEP uses the following processes to forward traffic at Layer 2:
•Unicast process—Applies to destination-known unicast traffic.
•Flood process—Applies to multicast, broadcast, and unknown unicast traffic.
When the VTEP forwards VXLAN traffic, it processes the 802.1Q tag in the inner Ethernet header
depending on the VSI access mode (VLAN or Ethernet mode). In VLAN access mode, sites can use
different VLANs to provide the same service. For more information, see "Access mode of VSIs."
Unicast
The following process (see Figure 4) applies to a known unicast frame between sites:
1. The source VTEP encapsulates the Ethernet frame in the VXLAN/UDP/IP header.
In the outer IP header, the source IP address is the source VTEP's VXLAN tunnel source IP
address. The destination IP address is the VXLAN tunnel destination IP address.
2. The source VTEP forwards the encapsulated packet out of the outgoing VXLAN tunnel
interface found in the VSI's MAC address table.
3. The intermediate transport devices (P devices) forward the frame to the destination VTEP by
using the outer IP header.
4. The destination VTEP removes the headers on top of the inner Ethernet frame. It then performs
MAC address table lookup in the VXLAN's VSI to forward the frame out of the matching
outgoing interface.

5
Figure 4 Inter-site unicast
Flood
The VTEP floods a broadcast, multicast, or unknown unicast frame to all site-facing interfaces and
VXLAN tunnels in the VXLAN, except for the incoming interface.
VXLAN supports the unicast mode for flood traffic. The mode is also called head-end replication. The
source VTEP replicates the flood frame, and then sends one replica to the destination IP address of
each VXLAN tunnel in the VXLAN. See Figure 5.
Each destination VTEPfloods the inner Ethernet frame to all the site-facing interfaces in the VXLAN.
To avoid loops, the destination VTEPs do not flood the frame to VXLAN tunnels.
Figure 5 Unicast mode
VTEP 1 VTEP 2
Transport network
P
Terminal 1
Terminal 2
Terminal 3
Terminal 7
Terminal 8
Terminal 9
Terminal 4
Terminal 5
Terminal 6
VXLANtunnel
VXLANtunnel
VTEP 3
VXLAN tunnel
Terminal 10
Terminal 11
Terminal 12
Replicate and
encapsulate

6
Access mode of VSIs
The VTEP supports VLAN access mode for VSIs. In VLAN access mode, Ethernet frames received
from or sent to the local site must contain 802.1Q VLAN tags.
•For an Ethernet frame received from the local site, the VTEPremoves all its 802.1Q VLAN tags
before forwarding the frame.
•For an Ethernet frame destined for the local site, the VTEP adds 802.1Q VLAN tags to the
frame before forwarding the frame.
In VLAN access mode, VXLAN packets sent between sites do not contain 802.1Q VLAN tags. You
can use different 802.1Q VLANs to provide the same service in different sites.
ARP flood suppression
ARP flood suppression reduces ARP request broadcasts by enabling the VTEP to reply to ARP
requests on behalf of user terminals.
As shown in Figure 6, this feature snoops ARPpackets to populate the ARP flood suppression table
with local and remote MAC addresses. If anARP request has a matching entry, the VTEP replies to
the request on behalf of the user terminal. If no match is found, the VTEP floods the request to both
local and remote sites.
Figure 6 ARP flood suppression
ARP flood suppression uses the following workflow:
1. Terminal 1 sends an ARP request to obtain the MAC address of Terminal 7.
2. VTEP 1 creates a suppression entry for Terminal 1, and floods the ARP request in the VXLAN.
3. VTEP 2 and VTEP 3 de-encapsulate the ARP request. The VTEPs create a suppression entry
for Terminal 1, and broadcast the request in the local site.
4. Terminal 7 sends an ARP reply.
5. VTEP 2 creates a suppression entry for Terminal 7 and forwards the ARP reply to VTEP 1.
(1)
VTEP 1 VTEP 2
Transport
network
P
Terminal 1
Terminal 2
Terminal 3
Terminal 7
Terminal 8
Terminal 9
Terminal 4
Terminal 5
Terminal 6
VXLANtunnel
VXLANtunnel
VTEP 3
VXLAN tunnel
Terminal 10
Terminal 11
Terminal 12
(2)
(2)
(3)
(3)
(4)
(5)
(6)
(7)
(8)
(9) (10)
(2)

7
6. VTEP 1 de-encapsulates the ARP reply, creates a suppression entry for Terminal 7, and
forwards the ARP reply to Terminal 1.
7. Terminal 4 sends an ARP request to obtain the MAC address of Terminal 1 or Terminal 7.
8. VTEP 1 creates a suppression entry for Terminal 4 and replies to the ARP request.
9. Terminal 10 sends an ARP request to obtain the MAC address of Terminal 1.
10. VTEP 3 creates a suppression entry for Terminal 10 and replies to the ARP request.
VXLAN IP gateways
A VXLAN IP gateway provides Layer 3 forwarding services for user terminals in VXLANs. A VXLAN
IP gateway can be an independent device or be collocated with a VTEP. For more information about
VXLAN IP gateway placement, see "Configuring VXLAN IP gateways."
Protocols and standards
RFC 7348, Virtual eXtensible Local Area Network (VXLAN): AFramework for Overlaying Virtualized
Layer 2 Networks over Layer 3 Networks

8
Configuring basic VXLAN features
Configuration restrictions and guidelines
Before you configure VXLAN settings, perform the following tasks:
1. Execute the switch-mode 1 command in system view to set the system operating mode to
VXLAN.
2. Save the running configuration to the next-startup configuration file.
3. Reboot the device.
For more information about the system operating mode, see device management in Fundamentals
Configuration Guide.
Do not use IRF and VXLAN together on a device.
Make sure a VXLAN tunnel has only one route in the underlay network.
VXLAN configuration task list
Tasks at a glance Remarks
(Required.) Setting the forwarding mode for VXLANs N/A
(Required.) Creating a VXLAN on a VSI N/A
(Required.) Configuring a VXLAN tunnel N/A
(Required.) Assigning VXLAN tunnels to a VXLAN To extend a VXLAN to remote sites, you must assign VXLAN
tunnels to the VXLAN.
(Required.) Mapping ACs to a VSI Perform this task to assign
customer traffic to VXLANs.
(Optional.) Managing MAC address entries N/A
(Optional.) Confining floods to the local site N/A
(Optional.) Setting the destination UDP port number of VXLAN packets N/A
(Optional.) Enabling ARP flood suppression N/A
(Optional.) Disabling remote ARP learning for VXLANs N/A

9
Setting the forwarding mode for VXLANs
Step Command Remarks
1. Enter system view. system-view N/A
2. Enable Layer 2 or Layer
3 forwarding for VXLANs.
•Enable Layer 2
forwarding:
undo vxlan
ip-forwarding
•Enable Layer 3
forwarding:
vxlan ip-forwarding
By default, Layer 3 forwarding is enabled
for VXLANs.
If the VTEP is not a VXLAN IP gateway,
enable Layer 2 forwarding for VXLANs. If
the VTEP is a VXLAN IP gateway, enable
Layer 3 forwarding for VXLANs. For more
information about VXLAN IP gateways,
see "Configuring VXLAN IP gateways."
You must delete all VSIs, VSI interfaces,
and VXLAN tunnel interfaces before you
can change the forwarding mode.
Creating a VXLAN on a VSI
Step Command Remarks
1. Enter system view. system-view N/A
2. Enable L2VPN. l2vpn enable By default, L2VPN is disabled.
3. Create a VSI and enter VSI
view. vsi vsi-name By default, no VSIs exist.
4. (Optional.) Configure a VSI
description. description text By default, a VSI does not have a
description.
5. Enable the VSI. undo shutdown By default, a VSI is enabled.
6. Create a VXLAN and enter
VXLAN view. vxlan vxlan-id
By default, no VXLANs exist.
You can create only one VXLAN on
a VSI. The VXLAN ID must be
unique for each VSI.
Configuring a VXLAN tunnel
This task provides basic VXLAN tunnel configuration. For more information about tunnel
configuration and commands, see Layer 3—IP Services Configuration Guide and Layer 3—IP
Services Command Reference.
Make sure the following VXLAN tunnels are not associated with the same VXLAN when they have
the same tunnel destination IP address:
•A VXLAN tunnel automatically created by EVPN.
•A manually created VXLAN tunnel.
For more information about EVPN, see EVPN Configuration Guide.
To configure a VXLAN tunnel:
Step Command Remarks
1. Enter system view. system-view N/A

10
Step Command Remarks
2. Specify a global
source address for
VXLAN tunnels. tunnel global
source-address ip-address
By default, no global source address is
specified for VXLAN tunnels.
A VXLAN tunnel uses the global source
address if you do not specify a source
interface or source address for the tunnel.
3. Create a VXLAN
tunnel interface and
enter tunnel interface
view.
interface tunnel
tunnel-number mode vxlan
By default, no tunnel interfaces exist.
The endpoints of a tunnel must use the same
tunnel mode.
4. Specify a source IP
address or source
interface for the tunnel.
source { ipv4-address |
interface-type
interface-number }
By default, no source IP address or source
interface is specified for a tunnel.
This step specifies the source IP address in
the outer IP header of tunneled VXLAN
packets. If an interface is specified, its primary
IP address is used.
5. Specify a destination
IP address for the
tunnel. destination ipv4-address
By default, no destination IP address is
specified for a tunnel.
Specify the remote VTEP's IP address. This IP
address will be the destination IP address in
the outer IP header of tunneled VXLAN
packets.
As a best practice, do not configure multiple
VXLAN tunnels to use the same source and
destination IP addresses.
Assigning VXLAN tunnels to a VXLAN
To provide Layer 2 connectivity for a VXLAN between two sites, you must assign the VXLAN tunnel
between the sites to the VXLAN.
You can assign multiple VXLAN tunnels to a VXLAN, and configure a VXLAN tunnel to trunk multiple
VXLANs. For a VXLAN, the system floods unknown unicast, multicast, and broadcast traffic to each
tunnel associated with the VXLAN.
To assign VXLAN tunnels to a VXLAN:
Step Command Remarks
1. Enter system view. system-view N/A
2. Enter VSI view. vsi vsi-name N/A
3. Enter VXLAN view. vxlan vxlan-id N/A
4. Assign VXLAN tunnels
to the VXLAN. tunnel {tunnel-number |
all }
By default, a VXLAN does not contain any
VXLAN tunnels.
For full Layer 2 connectivity in the VXLAN,
make sure the VXLAN contains the VXLAN
tunnel between each pair of sites in the
VXLAN.
Mapping ACs to a VSI
A VSI can use a dynamic or static Ethernet service instance as an AC.

11
Mapping a static Ethernet service instance to a VSI
A static Ethernet service instance matches a list of VLANs on a site-facing interface. The VTEP
assigns customer traffic from the VLANs to a VXLAN by mapping the Ethernet service instance to a
VSI.
To map an Ethernet service instance to a VSI:
Step Command Remarks
1. Enter system view. system-view N/A
2. Enter Layer 2 Ethernet
interface view. interface interface-type
interface-number N/A
3. Create an Ethernet
service instance and
enter Ethernet service
instance view. service-instance instance-id By default, no Ethernet service
instances exist.
4. Configure a frame match
criterion.
•Match frames that do not match
any other service instance on the
interface:
encapsulation default
•Match any 802.1Q tagged or
untagged frames:
encapsulation { tagged |
untagged }
•Match frames tagged with the
specified inner and outer 802.1Q
VLAN IDs:
encapsulation s-vid vlan-id
[ c-vid vlan-id-list | only-tagged ]
By default, an Ethernet service
instance does not contain a
frame match criterion.
To match frames from a VLAN
correctly, make sure you have
created the VLAN and assigned
the interface to the VLAN. If the
default, tagged, or untagged
criterion is used, you must
assign the interface to its default
VLAN.
5. Map the Ethernet service
instance to a VSI. xconnect vsi vsi-name
[access-mode vlan ]
By default, an Ethernet service
instance is not mapped to any
VSI.
Mapping dynamic Ethernet service instances to VSIs
About dynamic Ethernet service instances
The 802.1X or MAC authentication feature can use the authorization VSI, the guest VSI, the
Auth-Fail VSI, and the critical VSI to control the access of users to network resources. When
assigning a user to a VSI, 802.1X or MAC authentication sends the VXLAN feature the VSI
information and the user's access information, including access interface, VLAN, and MAC address.
Then the VXLAN feature creates a dynamic Ethernet service instance for the user and maps it to the
VSI. For more information about 802.1X authentication and MAC authentication, see Security
Configuration Guide.
A dynamic Ethernet service instance supports the following traffic match modes:
•VLAN-based mode—Matches frames by VLAN ID.
•MAC-based mode—Matches frames by VLAN ID and source MAC address.
To use MAC-based traffic match mode for dynamic Ethernet service instances, you must enable
MAC authentication or 802.1X authentication that uses MAC-based access control.
Configuration procedure
The device automatically creates a dynamic Ethernet service instance for an 802.1X or MAC
authentication user and maps the Ethernet service instance to a VSI in the following conditions:
•The user is assigned to the guest VSI,Auth-Fail VSI, or critical VSI configured on the device.

12
•A remote AAAserver issues an authorization VSI to the user.
For a dynamic Ethernet service instance to match traffic by source MAC address, enable
MAC-based traffic match mode for the dynamic Ethernet service instance.
To enable MAC-based traffic match mode for dynamic Ethernet service instances on an interface:
Step Command Remarks
1. Enter system view. system-view N/A
2. Enter Layer 2 Ethernet
interface view. interface interface-type
interface-number N/A
3. Enable MAC-based traffic
match mode for dynamic
Ethernet service instances
on the interface. mac-based ac By default, VLAN-based traffic
match mode is used for dynamic
Ethernet service instances.
Managing MAC address entries
Local-MAC address entries can be dynamically learned. You can log local-MAC changes.
Remote-MAC address entries include the following types:
•Manually created static entries.
•Dynamic entries learned in the data plane.
Configuring static remote-MAC address entries
Do not configure static remote-MAC entries for VXLAN tunnels that are automatically established by
using EVPN.
•EVPN re-establishes VXLAN tunnels if the transport-facing interface goes down and then
comes up. If you have configured static remote-MAC entries, the entries are deleted when the
tunnels are re-established.
•EVPN re-establishes VXLAN tunnels if you perform configuration rollback. If the tunnel IDs
change during tunnel re-establishment, configuration rollback fails, and static remote-MAC
entries on the tunnels cannot be restored.
For more information about EVPN, see EVPN Configuration Guide.
To configure a static remote-MAC address entry:
Step Command Remarks
1. Enter system view. system-view N/A
2. Add a static
remote-MAC address
entry.
mac-address static
mac-address interface
tunnel tunnel-number vsi
vsi-name
By default, VXLAN VSIs do not have static
remote-MAC address entries.
For the setting to take effect, make sure the
VSI's VXLAN has been created and
specified on the VXLAN tunnel.
Disabling remote-MAC address learning
Step Command Remarks
1. Enter system view. system-view N/A

13
Step Command Remarks
2. Disable remote-MAC
address learning. vxlan tunnel mac-learning
disable
By default, remote-MAC address learning
is enabled.
When network attacks occur, disable
remote-MAC address learning to prevent
the device from learning incorrect remote
MAC addresses. You can manually add
static remote-MAC address entries.
Enabling local-MAC change logging
Local-MAC change logging enables the VXLAN module to send a log message to the information
center when a local MAC address is added or removed.
With the information center, you can set log message filtering and output rules, including output
destinations. For more information about configuring the information center, see Network
Management and Monitoring Configuration Guide.
To enable local-MAC change logging:
Step Command Remarks
1. Enter system view. system-view N/A
2. Enable local-MAC change
logging. vxlan local-mac report By default, local-MAC change
logging is disabled.
Confining floods to the local site
By default, the VTEP floods broadcast, unknown unicast, and unknown multicast frames received
from the local site to the following interfaces in the frame's VXLAN:
•All site-facing interfaces except for the incoming interface.
•All VXLAN tunnel interfaces.
To confine a kind of flood traffic to the site-facing interfaces, disable flooding for that kind of flood
traffic on the VSI bound to the VXLAN. The VSI will not flood the corresponding frames to VXLAN
tunnel interfaces.
To confine floods to site-facing interfaces for a VXLAN:
Step Command Remarks
1. Enter system view. system-view N/A
2. Enter VSI view. vsi vsi-name N/A
3. Disable flooding for the
VSI.
flooding disable { all |
{ broadcast |
unknown-multicast |
unknown-unicast } * }
By default, flooding is enabled for a VSI.

14
Setting the destination UDP port number of
VXLAN packets
Step Command Remarks
1. Enter system view. system-view N/A
2. Set a destination UDP
port for VXLAN packets. vxlan udp-port port-number
By default, the destination UDP port
number is 4789 for VXLAN packets.
You must configure the same
destination UDP port number on all
VTEPs in a VXLAN.
If you modify the destination UDP port
number, only VXLAN tunnels
established after the modification use
the new port number for sending VXLAN
packets. For the new port number to
take effect on VXLAN tunnels created
before the modification, you must
disconnect and re-establish the tunnels.
Enabling ARP flood suppression
Use ARP flood suppression to reduce ARP request broadcasts.
The aging timer is fixed at 25 minutes for ARP flood suppression entries. If the suppression table is
full, the VTEP stops learning new entries. For the VTEP to learn new entries, you must wait for old
entries to age out, or use the reset arp suppression vsi command to clear the table.
If the flooding disable command is configured, set the MAC aging timer to a higher value than the
aging timer for ARP flood suppression entries on all VTEPs. This setting prevents the traffic
blackhole that occurs when a MAC address entry ages out before its ARP flood suppression entry
ages out. To set the MAC aging timer, use the mac-address timer command.
When remote ARP learning is disabled for VXLANs, the device does not useARP flood suppression
entries to respond to ARP requests received on VXLAN tunnels.
To enable ARP flood suppression:
Step Command Remarks
1. Enter system view. system-view N/A
2. Enter VSI view. vsi vsi-name N/A
3. Enable ARP flood
suppression. arp suppression enable By default, ARP flood suppression
is disabled.
Disabling remote ARP learning for VXLANs
By default, the device learns ARP information of remote user terminals from packets received on
VXLAN tunnel interfaces. To save resources on VTEPs in an SDN transport network, you can
temporarily disable remote ARP learning when the controller and VTEPs are synchronizing entries.
After the entry synchronization is completed, use the undo vxlan tunnel arp-learning disable
command to enable remote ARP learning.