HPE FlexFabric 7900 Series User manual

HPE FlexFabric 7900 Switch Series
VXLAN
Configuration Guide
Part number: 5998-8254R
Software version: Release 213x
Document version: 6W101-20151113

© Copyright 2015 Hewlett Packard Enterprise Development LP
The information contained herein is subject to change without notice. The only warranties for Hewlett Packard
Enterprise products and services are set forth in the express warranty statements accompanying such
products and services. Nothing herein should be construed as constituting an additional warranty. Hewlett
Packard Enterprise shall not be liable for technical or editorial errors or omissions contained herein.
Confidential computer software. Valid license from Hewlett Packard Enterprise required for possession, use, or
copying. Consistent with FAR 12.211 and 12.212, Commercial Computer Software, Computer Software
Documentation, and Technical Data for Commercial Items are licensed to the U.S. Government under vendor’s
standard commercial license.
Links to third-party websites take you outside the Hewlett Packard Enterprise website. Hewlett Packard
Enterprise has no control over and is not responsible for information outside the Hewlett Packard Enterprise
website.
Acknowledgments
Intel®, Itanium®, Pentium®, Intel Inside®, and the Intel Inside logo are trademarks of Intel Corporation in the
United States and other countries.
Microsoft® and Windows® are trademarks of the Microsoft group of companies.
Adobe® andAcrobat® are trademarks ofAdobe Systems Incorporated.
Java and Oracle are registered trademarks of Oracle and/or its affiliates.
UNIX® is a registered trademark of The Open Group.

i
Contents
VXLAN overview·····························································································1
VXLAN network model·······································································································································1
VXLAN packet format ········································································································································2
Working mechanisms·········································································································································3
Assignment of traffic to VXLANs················································································································3
MAC learning ·············································································································································3
Traffic forwarding ·······································································································································4
Access modes of VSIs·······························································································································7
ARP flood suppression ······································································································································7
Protocols and standards ····································································································································8
Configuring basic VXLAN features ·································································9
VXLAN configuration task list·····························································································································9
Prerequisites······················································································································································9
Setting the forwarding mode for VXLANs ········································································································10
Creating a VXLAN on a VSI·····························································································································10
Configuring a VXLAN tunnel····························································································································10
Assigning a VXLAN tunnel to a VXLAN···········································································································11
Mapping an Ethernet service instance to a VSI·······························································································12
Managing MAC address entries·······················································································································13
Enabling VXLAN local MAC change logging····························································································13
Configuring static remote-MAC address entries ······················································································13
Enabling remote-MAC address learning··································································································14
Confining unknown-unicast floods to the local site ··························································································14
Configuring the destination UDP port number of VXLAN packets···································································15
Configuring VXLAN packet check····················································································································15
Enabling ARP flood suppression ·····················································································································15
Disabling remote ARP learning for VXLANs····································································································16
Configuring VXLAN packet statistics ···············································································································16
Enabling packet statistics for a VSI··········································································································16
Enabling packet statistics for an Ethernet service instance·····································································17
Displaying and maintaining VXLANs ···············································································································18
VXLAN configuration examples ·······················································································································19
Unicast-mode VXLAN configuration example··························································································19
Multicast-mode VXLAN configuration example························································································23
Configuring VXLAN IP gateways ··································································31
Overview··························································································································································31
VXLAN IP gateways separated from VTEPs ···························································································31
Centralized VXLAN IP gateway deployment····························································································32
Centralized VXLAN IP gateway group deployment··················································································33
Hardware compatibility·····································································································································34
Configuration prerequisites······························································································································34
Configuring a centralized VXLAN IP gateway on a VTEP ···············································································34
Configuring a centralized VXLAN IP gateway group ·······················································································35
Configuring a VTEP group·······················································································································35
Specifying a VTEP group as the gateway for an access layer VTEP······················································36
Configuring a VSI interface······························································································································36
Enabling packet statistics for VSI interfaces····································································································37
Displaying and maintaining VXLAN IP gateway ······························································································37
VXLAN IP gateway configuration examples ····································································································38
Centralized VXLAN IP gateway configuration example···········································································38
Centralized VXLAN IP gateway group configuration example·································································43
Configuring the VTEP as an OVSDB VTEP··················································47
Overview··························································································································································47
Feature and software version compatibility······································································································47

ii
Protocols and standards ··································································································································47
OVSDB VTEP configuration task list ···············································································································47
Configuration prerequisites······························································································································48
Setting up an OVSDB connection to a controller·····························································································48
Configuration restrictions and guidelines·································································································48
Configuring active SSL connection settings·····························································································48
Configuring passive SSL connection settings··························································································49
Configuring active TCP connection settings ····························································································49
Configuring passive TCP connection settings··························································································49
Enabling the OVSDB server ····························································································································50
Enabling the OVSDB VTEP service·················································································································50
Specifying a global source address for VXLAN tunnels···················································································50
Specifying a VTEP access port························································································································51
Enabling flood proxy on multicast VXLAN tunnels···························································································51
OVSDB VTEP configuration examples············································································································51
Unicast-mode VXLAN configuration example··························································································51
Flood proxy VXLAN configuration example ·····························································································54
Document conventions and icons·································································59
Conventions·····················································································································································59
Network topology icons····································································································································60
Support and other resources ········································································61
Accessing Hewlett Packard Enterprise Support ······························································································61
Accessing updates···········································································································································61
Websites ··················································································································································62
Customer self repair·································································································································62
Remote support········································································································································62
Documentation feedback ·························································································································62
Index·············································································································63

1
VXLAN overview
Virtual eXtensible LAN (VXLAN) is a MAC-in-UDP technology that provides Layer 2 connectivity
between distant network sites across an IP network. VXLAN is typically used in data centers for
multitenant services.
VXLAN provides the following benefits:
•Support for more virtual switched domains than VLANs—Each VXLAN is uniquely
identified by a 24-bit VXLAN ID. The total number of VXLANs can reach 16777216 (224). This
specification makes VXLAN a better choice than 802.1Q VLAN to isolate traffic for VMs.
•Easy deployment and maintenance—VXLAN requires deployment only on the edge devices
of the transport network. Devices in the transport network perform typical Layer 3 forwarding.
The device supports only IPv4-based VXLAN.
VXLAN network model
As shown in Figure 1, the transport edge devices assign VMs to different VXLANs, and then forward
traffic between sites for VMs by using VXLAN tunnels.
The transport edge devices are VXLAN tunnel endpoints (VTEP). They can be servers that host VMs
or independent network devices.
A Hewlett Packard Enterprise VTEP uses VSIs and VXLAN tunnels to provide VXLAN services.
•VSI—A virtual switching instance is a virtual Layer 2 switched domain. Each VSI provides
switching services only for one VXLAN. VSIs learn MAC addresses and forward frames
independently of one another. VMs in different sites have Layer 2 connectivity if they are in the
same VXLAN.
•VXLAN tunnel—Logical point-to-point tunnels between VTEPs over the transport network.
Each VXLAN tunnel can trunk multiple VXLANs.
VTEPs encapsulate VXLAN traffic in the VXLAN, outer UDP, and outer IP headers. The devices in
the transport network forward VXLAN traffic only based on the outer IP header.

2
Figure 1 VXLAN network model
VXLAN packet format
As shown in Figure 2, a VTEP encapsulates a frame in the following headers:
•8-byte VXLAN header—VXLAN information for the frame.
{Flags—If the I bit is 1, the VXLAN ID is valid. If the I bit is 0, the VXLAN ID is invalid. All
other bits are reserved and set to 0.
{24-bit VXLAN ID—Identifies the VXLAN of the frame. It is also called the virtual network
identifier (VNI).
•8-byte outer UDP header for VXLAN—The default VXLAN UDP port number is 4789.
•20-byte outer IP header—Valid addresses of VTEPs or VXLAN multicast groups on the
transport network. Devices in the transport network forward VXLAN packets based on the outer
IP header.
Figure 2 VXLAN packet format

3
Working mechanisms
The VTEP uses the following process to forward an inter-site frame:
1. Assigns the frame to its matching VXLAN if the frame is sent between sites.
2. Performs MAC learning on the VXLAN's VSI.
3. Forwards the frame.
This section describes this process in detail. For intra-site frames in a VSI, the system performs
typical Layer 2 forwarding and processes 802.1Q VLAN tags, as described in "Access modes of
VSIs."
Assignment of traffic to VXLANs
Traffic from the local site to a remote site
The VTEP uses an Ethernet service instance to match a list of VLANs on a site-facing interface. The
VTEP assigns customer traffic from the VLANs to a VXLAN by mapping the Ethernet service
instance to a VSI.An Ethernet service instance is identical to an attachment circuit (AC) in L2VPN.
As shown in Figure 3, Ethernet service instance 1 matches VLAN 2 and is mapped to VSIA(VXLAN
10). When a frame from VLAN 2 arrives, the VTEPassigns the frame to VXLAN 10, and looks up VSI
A's MAC address table for the outgoing interface.
Figure 3 Identifying traffic from the local site
Traffic from a remote site to the local site
When a frame arrives at a VXLAN tunnel, the VTEP uses the VXLAN ID in the frame to identify its
VXLAN.
MAC learning
The VTEP performs source MAC learning on the VSI as a Layer 2 switch.
•For traffic from the local site to the remote site, the VTEP learns the source MAC address
before VXLAN encapsulation.
•For traffic from the remote site to the local site, the VTEP learns the source MAC address after
removing the VXLAN header.
A VSI's MAC address table includes the following types of MAC address entries:
•Local MAC—Dynamic MAC entries learned from the local site. The outgoing interfaces are
site-facing interfaces on which the MAC addresses are learned. VXLAN does not support
manual local MAC entries.

4
•Remote MAC—MAC entries learned from a remote site, including static, dynamic, and
OpenFlow MAC entries. The outgoing interfaces for the MAC addresses are VXLAN tunnel
interfaces.
{Static—Manually added MAC entries.
{Dynamic—MAC entries learned in the data plane from incoming traffic on VXLAN tunnels.
The learned MAC addresses are contained in the inner Ethernet header.
{OpenFlow—MAC entries issued by a remote controller through OpenFlow.
For a remote address, the manual static entry has higher priority than the dynamic entry.
Traffic forwarding
The VTEP performs Layer 2 or Layer 3 forwarding for VXLANs depending on your configuration.
•In Layer 3 forwarding mode, the VTEP uses the ARP table to forward traffic for VXLANs.
•In Layer 2 forwarding mode, the VTEP uses the MAC address table to forward traffic for
VXLANs.
Use Layer 3 forwarding mode if you want to use the VTEP as a VXLAN IP gateway.
This section describes the Layer 2 forwarding processes. For information about Layer 3 forwarding,
see "Configuring VXLAN IP gateways."
The VTEP uses the following processes to forward traffic at Layer 2:
•Unicast process—Applies to destination-known unicast traffic.
•Flood process—Applies to multicast, broadcast, and unknown unicast traffic.
When the VTEP forwards VXLAN traffic, it processes the 802.1q tag in the inner Ethernet header
depending on the VSI access mode (VLAN or Ethernet mode). In VLAN access mode, sites can use
different VLANs to provide the same service. For more information, see "Access modes of VSIs."
Unicast
The following process (see Figure 4) applies to a known unicast frame between sites:
1. The source VTEP encapsulates the Ethernet frame in the VXLAN/UDP/IP header.
In the outer IP header, the source IP address is the source VTEP's VXLAN tunnel source IP
address. The destination IP address is the VXLAN tunnel destination IP address.
2. The source VTEP forwards the encapsulated packet out of the outgoing VXLAN tunnel
interface found in the VSI's MAC address table.
3. The intermediate transport devices (P devices) forward the frame to the destination VTEP by
using the outer IP header.
4. The destination VTEP removes the headers on top of the inner Ethernet frame. It then performs
MAC address table lookup in the VXLAN's VSI to forward the frame out of the matching
outgoing interface.

5
Figure 4 Inter-site unicast
Flood
IMPORTANT:
Flood proxy is available in Release 2137 and later versions.
VXLAN supports the following modes for flood traffic:
•Unicast mode—Also called head-end replication. The source VTEP replicates the flood frame,
and then sends one replica to the destination IP address of each VXLAN tunnel in the VXLAN.
See Figure 5.
•Multicast
mode—Also called tandem replication. The source VTEP sends the flood frame in a
multicast VXLAN packet destined for a multicast group address. Transport network devices
replicate and forward the packet to remote VTEPs based on their multicast forwarding entries.
See Figure 6.
•Flood
proxy mode—The source VTEP sends the flood frame in a VXLAN packet over a
VXLAN tunnel to a flood proxy server. The flood proxy server replicates and forwards the packet
to each remote VTEP through its VXLAN tunnels. See Figure 7.
The flood proxy mode applies to VXLANs that have many sites. This mode reduces flood traffic
in the transport network without using a multicast protocol. To use a flood proxy server, you
must set up a VXLAN tunnel to the server on each VTEP.
The flood proxy mode is typically used in SDN transport networks that have a flood proxy server.
For VTEPs to forward packets based on the MAC address table issued by an SDN controller,
you must disable remote-MAC address learning by using the vxlan tunnel mac-learning
disable command.
Each destination VTEPfloods the inner Ethernet frameto all the site-facing interfaces in the VXLAN.
To avoid loops, the destination VTEPs do not flood the frame to VXLAN tunnels.
VTEP 1 VTEP 2
Transport network
P
Server 1
VM 1
VM 2
VM 3
Server 3
VM 7
VM 8
VM 9
MAC Table on VTEP 1
VXLAN/VSI MAC Interface
VXLAN 10/VSI A MAC 1 FGE1/0/1, VLAN 2
VXLAN 10/VSI A MAC 7 Tunnel 1
Server 2
VM 4
VM 5
VM 6
FGE1/0/1
FGE1/0/2
MAC Table on VTEP 2
VXLAN/VSI MAC Interface
VXLAN 10/VSI A MAC 1 Tunnel 1
VXLAN 10/VSI A MAC 7 FGE1/0/1, VLAN 20
FGE1/0/1
VXLAN tunnel 1

6
Figure 5 Unicast mode
Figure 6 Multicast mode
VTEP 1 VTEP 2
Transport network
P
Server 1
VM 1
VM 2
VM 3
Server 3
VM 7
VM 8
VM 9
Server 2
VM 4
VM 5
VM 6
FGE1/0/1
FGE1/0/2 FGE1/0/1
VXLANtunnel
VTEP 3
VXLAN tunnel
Server 4
VM 10
VM 11
VM 12
Replicate and
encapsulate
VTEP 1 VTEP 2
Transport network
P
Server 1
VM 1
VM 2
VM 3
Server 3
VM 7
VM 8
VM 9
Server 2
VM 4
VM 5
VM 6
FGE1/0/1
FGE1/0/2 FGE1/0/1
VXLAN tunnel
VTEP 3
VXLAN tunnel
Server 4
VM 10
VM 11
VM 12
Replicate
Encapsulate
with multicast
address

7
Figure 7 Flood proxy mode
Access modes of VSIs
The access mode of a VSI determines how the VTEP processes the 802.1Q VLAN tags in the
Ethernet frames.
•VLAN access mode—Ethernet frames received from or sent to the local site must contain
802.1Q VLAN tags.
{For an Ethernet frame received from the local site, the VTEP removes all its 802.1Q VLAN
tags before forwarding the frame.
{For an Ethernet frame destined for the local site, the VTEP adds 802.1Q VLAN tags to the
frame before forwarding the frame.
In VLAN access mode, VXLAN packets sent between sites do not contain 802.1Q VLAN tags.
You can use different 802.1Q VLANs to provide the same service in different sites.
•Ethernet access mode—The VTEP does not process the 802.1Q VLAN tags of Ethernet
frames received from or sent to the local site.
{For an Ethernet frame received from the local site, the VTEP forwards the frame with the
802.1Q VLAN tags intact.
{For an Ethernet frame destined for the local site, the VTEP forwards the frame without
adding 802.1Q VLAN tags.
In Ethernet access mode, VXLAN packets sent between VXLAN sites contain 802.1Q VLAN
tags. You must use the same VLAN to provide the same service between sites.
ARP flood suppression
ARP flood suppression reduces ARP request broadcasts by enabling the VTEP to reply to ARP
requests on behalf of VMs.
VTEP 1 VTEP 2
Flood proxy
server
Server 1
VM 1
VM 2
VM 3
Server 3
VM 7
VM 8
VM 9
Server 2
VM 4
VM 5
VM 6
FGE1/0/1
FGE1/0/2 FGE1/0/1
VXLANtunnel
VXLANtunnel
VTEP 3
VXLANtunnel
Server 4
VM 10
VM 11
VM 12
Encapsulate
with flood proxy
server address
VXLANtunnel
Replicate and forward packet
Source: Flood proxy server
Destination: Each remote VTEP
Transport
network

8
As shown in Figure 8, this feature snoops ARP packets to populate theARP flood suppression table
with local and remote MAC addresses. If anARP request has a matching entry, the VTEP replies to
the request on behalf of the VM. If no match is found, the VTEP floods the request to both local and
remote sites.
Figure 8 ARP flood suppression
ARP flood suppression uses the following workflow:
1. VM 1 sends an ARP request to obtain the MAC address of VM 7.
2. VTEP 1 creates a suppression entry for VM 1, and floods the ARP request in the VXLAN.
3. VTEP 2 and VTEP 3 de-encapsulate the ARP request. The VTEPs create a suppression entry
for VM 1, and broadcast the request in the local site.
4. VM 7 sends an ARP reply.
5. VTEP 2 creates a suppression entry for VM 7 and forwards the ARP reply to VTEP 1.
6. VTEP 1 de-encapsulates the ARP reply, creates a suppression entry for VM 7, and forwards the
ARP reply to VM 1.
7. VM 4 sends an ARP request to obtain the MAC address of VM 1 or VM 7.
8. VTEP 1 creates a suppression entry for VM 4 and replies to the ARP request.
9. VM 10 sends an ARP request to obtain the MAC address of VM 1.
10. VTEP 3 creates a suppression entry for VM 10 and replies to the ARP request.
Protocols and standards
IETF draft, draft-mahalingam-dutt-dcops-vxlan-04

9
Configuring basic VXLAN features
VXLAN configuration task list
Tasks at a glance Remarks
(Required.) Setting the forwarding mode for VXLANs N/A
(Required.) Creating a VXLAN on a VSI N/A
(Required.) Configuring a VXLAN tunnel N/A
(Required.) Assigning a VXLAN tunnel to a VXLAN To extend a VXLAN to remote sites, you must assign VXLAN tunnels to the
VXLAN.
(Required.) Mapping an Ethernet service instance to a VSI Perform this task to assign customer
traffic to VXLANs.
(Optional.) Managing MAC address entries
You can add static remote MAC
addresses.
When network attacks occur, disable
remote-MAC address learning to
prevent the device from learning
incorrect remote MAC addresses.
(Optional.) Confining unknown-unicast floods to the local site Perform this task to suppress unknown-unicast floods to the
transport network.
(Optional.) Configuring the destination UDP port number of VXLAN
packets N/A
(Optional.) Configuring VXLAN packet check
Perform this task to check incoming
VXLAN packets, including the
following items:
•UDP checksum.
•802.1Q VLAN tags in the inner
Ethernet header.
(Optional.) Enabling ARP flood suppression N/A
(Optional.) Disabling remote ARP learning for VXLANs This feature is available in Release
2137 and later versions.
(Optional.) Configuring VXLAN packet statistics N/A
Prerequisites
Before you can configure VXLANs, you must perform the following tasks:
•Set the system operating mode:
a. Set the system operating mode to standard by using the system-working-mode standard
command. For more information about setting the system operating mode, see device
management in Fundamentals Configuration Guide.
b. Save the configuration.
c. Delete the binary .mdb next-startup configuration file.
d. Reboot the device.

10
•Reserve one global-type VLAN interface resource for the VSI interface of each VXLAN before
the VXLAN is created if you enable Layer 3 forwarding for VXLANs.For more information about
reserving global-type VLAN interface resources, see VLAN configuration in Layer 2—LAN
Switching Configuration Guide.
Setting the forwarding mode for VXLANs
Step Command Remarks
1. Enter system view. system-view N/A
2. Set the forwarding
mode for VXLANs.
•To enable Layer 2 forwarding:
undo vxlan ip-forwarding
•To enable Layer 3 forwarding:
vxlan ip-forwarding [ tagged
| untagged ]
Use one of the commands.
If the device is a VTEP, enable Layer 2
forwarding for VXLANs. If the device is a
VXLAN IP gateway, enable Layer 3
forwarding for VXLANs. For more
information about VXLAN IP gateway,
see "Configuring VXLAN IP gateways."
You must delete all VXLAN tunnel
interfaces before you can change the
forwarding mode.
The tagged and untagged keywords are
available in Release 2137 and later
versions.
Creating a VXLAN on a VSI
Step Command Remarks
1. Enter system view. system-view N/A
2. Enable L2VPN. l2vpn enable By default, L2VPN is disabled.
3. Create a VSI and enter
VSI view. vsi vsi-name By default, no VSIs are created.
4. (Optional.) Configure a
VSI description. description text By default, a VSI does not have
description.
5. Enable the VSI. undo shutdown By default, a VSI is enabled.
6. Create a VXLAN and
enter VXLAN view. vxlan vxlan-id
By default, no VXLANs are created.
You can create only one VXLAN on a
VSI. The VXLAN ID must be unique for
each VSI.
Configuring a VXLAN tunnel
For two sites to communicate through VXLAN, you must manually configure a VXLAN tunnel
between the sites.
To configure a VXLAN tunnel:
Step Command Remarks
1. Enter system view. system-view N/A

11
Step Command Remarks
2. Specify a global source
address for VXLAN
tunnels. tunnel global source-address
ip-address
By default, no global source
address is specified for VXLAN
tunnels.
A VXLAN tunnel uses the global
source address if you do not specify
a source interface or source
address for the tunnel.
This command is available in
Release 2137 and later versions.
3. Create a VXLAN tunnel
interface and enter tunnel
interface view. interface tunnel tunnel-number
mode vxlan
By default, no tunnel interfaces
exist.
The endpoints of a tunnel must use
the same tunnel mode.
ECMP is supported only by VXLAN
tunnels with an ID in the range of 0
to 511.
4. Specify a source IP
address or source
interface for the tunnel. source { ipv4-address |
interface-type interface-number }
By default, no source IP address or
source interface is specified for a
tunnel.
This step specifies the source IP
address in the outer IP header of
tunneled VXLAN packets. If an
interface is specified, its primary IP
address is used.
5. Specify a destination IP
address for the tunnel. destination ipv4-address
By default, no destination IP
address is specified for a tunnel.
Specify the remote VTEP's IP
address. This IP address will be the
destination IP address in the outer
IP header of tunneled VXLAN
packets.
Assigning a VXLAN tunnel to a VXLAN
To provide Layer 2 connectivity for a VXLAN between two sites, you must assign the VXLAN tunnel
between the sites to the VXLAN.
You can assign multiple VXLAN tunnels to a VXLAN, and configure a VXLAN tunnel to trunk multiple
VXLANs. For a unicast-mode VXLAN, the system floods unknown unicast, multicast, and broadcast
traffic to each tunnel associated with the VXLAN.
To assign a VXLAN tunnel to a VXLAN:
Step Command Remarks
1. Enter system view. system-view N/A
2. Enter VSI view. vsi vsi-name N/A
3. Enter VXLAN view. vxlan vxlan-id N/A
4. Assign a VXLAN tunnel to
the VXLAN. tunnel tunnel-number
[ flooding-proxy ]
By default, a VXLAN does not
contain any VXLAN tunnels.
For full Layer 2 connectivity in the
VXLAN, make sure the VXLAN

12
Step Command Remarks
contains the VXLAN tunnel
between each pair of sites in the
VXLAN.
The flooding-proxy keyword is
available in Release 2137 and later
versions.
Mapping an Ethernet service instance to a VSI
An Ethernet service instance matches a list of VLANs on a site-facing interface. The VTEP assigns
customer traffic from the VLANs to a VXLAN by mapping the Ethernet service instance to a VSI.
When you configure an Ethernet service instance, follow these guidelines:
•The match criterion in each Ethernet service instance on an interface must be unique. For
example, you cannot configure the encapsulation untagged command in one Ethernet
service instance if another Ethernet service instance already contains this command. You
cannot use the encapsulation s-vid vlan-id command to specify the same 802.1Q VLAN ID for
any two Ethernet service instances on the interface.
•An Ethernet service instance can contain only one match criterion. To change the match
criterion, you must remove the original criterion first. When you remove the match criterion in an
Ethernet service instance, the mapping between the service instance and the VSI is removed
automatically.
•To forward the multicast traffic from a VLAN on the interface, make sure an Ethernet service
instance contains the VLAN ID. The interface cannot forward a multicast packet that does not
match any Ethernet service instance.
•You must create a VLAN interface for each VLAN that matches an Ethernet service instance if
ARP flood suppression is enabled. You do not need to assign IP addresses to the VLAN
interfaces. However, you must make sure the VLANs each contain a minimum of one up
physical interface.
To map an Ethernet service instance to a VSI:
Step Command Remarks
1. Enter system view. system-view N/A
2. Enter Layer 2 Ethernet
interface view or Layer 2
aggregate interface view.
•interface interface-type
interface-number
•interface bridge-aggregation
interface-number
N/A
3. Create an Ethernet
service instance and
enter Ethernet service
instance view. service-instance instance-id By default, no Ethernet service
instances exist.

13
Step Command Remarks
4. Configure a frame match
criterion.
•Match any frames:
encapsulation default
•Match any 802.1Q tagged or
untagged frames:
encapsulation { tagged |
untagged }
•Match frames tagged with the
specified outer 802.1Q VLAN
ID:
encapsulation s-vid vlan-id
[ only-tagged ]
•Match frames tagged with the
specified outer and inner
802.1Q VLAN IDs:
encapsulation s-vid vlan-id
c-vid vlan-id
By default, an Ethernet service
instance does not contain frame
match criteria.
The current software version does
not support the tagged keyword.
5. Map the Ethernet service
instance to a VSI. xconnect vsi vsi-name
[access-mode { ethernet | vlan } ] By default, an Ethernet service instance is not mapped to any VSI.
Managing MAC address entries
With VXLAN, local MAC addresses can only be learned dynamically. You cannot manually add local
MAC addresses. However, you can log the local MAC changes.
Remote MAC address entries include the following types:
•Manually created static entries.
•Dynamic entries learned in the data plane.
•Entries issued by a remote controller through OpenFlow.
Enabling VXLAN local MAC change logging
Local-MAC change logging enables the VXLAN module to send a log message to the information
center when a local MAC address is added or removed.
With the information center, you can set log message filtering and output rules, including output
destinations. For more information about configuring the information center, see Network
Management and Monitoring Configuration Guide.
To enable local MAC change logging:
Step Command Remarks
1. Enter system view. system-view N/A
2. Enable local MAC
change logging. vxlan local-mac report By default, VXLAN local MAC
change logging is disabled.
Configuring static remote-MAC address entries
Step Command Remarks
1. Enter system view. system-view N/A

14
Step Command Remarks
2. Add a static remote
entry. mac-address static mac-address
interface tunnel tunnel-number vsi
vsi-name
By default, VXLAN VSIs do not
have static remote-MAC address
entries.
For the setting to take effect, make
sure the VSI's VXLAN has been
created and specified on the
VXLAN tunnel.
Enabling remote-MAC address learning
Step Command Remarks
1. Enter system view. system-view N/A
2. Enable remote-MAC
address learning. undo vxlan tunnel mac-learning
disable
By default, remote-MAC address
learning is enabled.
When network attacks occur,
disable remote-MAC address
learning to prevent the device from
learning incorrect remote MAC
addresses.
Confining unknown-unicast floods to the local site
By default, the VTEP floods unknown unicast frames received from the local site to the following
interfaces in the frame's VXLAN:
•All site-facing interfaces except for the incoming interface.
•All VXLAN tunnel interfaces.
To confine unknown-unicast floods to site-facing interfaces for a VXLAN:
Step Command Remarks
1. Enter system view. system-view N/A
2. Enter VSI view. vsi vsi-name N/A
3. Disable the VSI to flood
unknown unicast traffic to
VXLAN tunnel interfaces. flooding disable
By default, unknown unicast traffic
is flooded to all interfaces in the
VXLAN, except for the incoming
interface.
4. (Optional.) Enable
selective flood for a MAC
address. selective-flooding mac-address
mac-address
By default, selective flood is
disabled.
Use this feature to exclude a
remote MAC address from the
flood suppression done by using
the flooding disable command.
The VTEP will flood the frames
destined for the specified MAC
address to remote sites when
unknown-unicast floods are
confined to the local site.

15
Configuring the destination UDP port number of
VXLAN packets
Step Command Remarks
1. Enter system view. system-view N/A
2. Configure a destination UDP
port for VXLAN packets. vxlan udp-port port-number
By default, the destination UDP
port number is 4789 for VXLAN
packets.
You must configure the same
destination UDP port number
on all VTEPs in a VXLAN.
Configuring VXLAN packet check
The device can check the UDP checksum and 802.1Q VLAN tags of each received VXLAN packet.
•UDP checksum check—The device always sets the UDP checksum of VXLAN packets to zero.
For compatibility with third-party devices, a VXLAN packet can pass the check if its UDP
checksum is zeroor correct. If its UDP checksum is incorrect, the VXLAN packet fails the check
and is dropped.
•VLAN tag check—The device checks the inner Ethernet header of each VXLAN packet for
802.1Q VLAN tags. If the header contains 802.1Q VLAN tags, the device drops the packet.
If a remote VTEP uses the Ethernet access mode for an Ethernet service instance, its VXLAN
packets might contain 802.1Q VLAN tags. To prevent the local VTEP from dropping the VXLAN
packets, do not execute the vxlan invalid-vlan-tag discard command on the local VTEP.
The access mode of an Ethernet service instance is configurable by using the xconnect vsi
command.
To configure VXLAN packet check:
Step Command Remarks
1. Enter system view. system-view N/A
2. Enable the VTEP to drop
VXLAN packets that fail UDP
checksum check. vxlan invalid-udp-checksum
discard
By default, the VTEP does not
check the UDP checksum of
VXLAN packets.
3. Enable the VTEP to drop
VXLAN packets that have
802.1Q VLAN tags in the
inner Ethernet header. vxlan invalid-vlan-tag discard By default, the VTEP does not
check the inner Ethernet
header for 802.1Q VLAN tags.
Enabling ARP flood suppression
Use ARP flood suppression to reduce ARP request broadcasts.
The aging timer is fixed at 25 minutes for ARP flood suppression entries. If the suppression table is
full, the VTEP stops learning new entries. For the VTEP to learn new entries, you must wait old
entries to age out, or use the reset arp suppression command to clear the table.
If the flooding disable command is configured, set the MAC aging timer to a higher value than the
aging timer for ARP flood suppression entries on all VTEPs. This setting prevents the traffic

16
blackhole that occurs when a MAC address entry ages out before its ARP flood suppression entry
ages out.
To set the MAC aging timer, use the mac-address timer command.
To enable ARP flood suppression:
Step Command Remarks
1. Enter system view. system-view N/A
2. Enter VSI view. vsi vsi-name N/A
3. Enable ARP flood
suppression. arp suppression enable By default, ARP flood
suppression is disabled.
Disabling remote ARP learning for VXLANs
IMPORTANT:
This feature is available in Release 2137 and later versions.
By default, the device learns ARP information of remote VMs from packets received on VXLAN
tunnel interfaces. To save resources on VTEPs in an SDN transport network, you can temporarily
disable remote ARP learning when the controller and VTEPs are synchronizing entries. After the
entry synchronization is completed, use the undo vxlan tunnel arp-learning disable command to
enable remoteARP learning.
As a best practice, disable remote ARPlearning for VXLANs only when the controller and VTEPs are
synchronizing entries.
To disable remote ARP learning for VXLANs:
Step Command Remarks
1. Enter system view. system-view N/A
2. Disable remote ARP
learning for VXLANs. vxlan tunnel arp-learning disable By default, remote ARP learning is
enabled for VXLANs.
Configuring VXLAN packet statistics
Enabling packet statistics for a VSI
Step Command Remarks
1. Enter system view. system-view N/A
2. Set the packet statistic
collection mode to VSI. statistic mode vsi
By default, the packet statistic
collection mode is VSI.
If you execute the statistic mode
command multiple times, the
most recent configuration takes
effect.
3. Enter VSI view. vsi vsi-name N/A