HPE FlexNetwork VSR1000 User manual

HPE VSR1000 Virtual Services Router
VXLAN Configuration Guide
Part number: 5200-3163
Software version: VSR1000_HPE-CMW710-E0518-X64
Document version: 5W100-20170314

© Copyright 2017 Hewlett Packard Enterprise Development LP
The information contained herein is subject to change without notice. The only warranties for Hewlett Packard
Enterprise products and services are set forth in the express warranty statements accompanying such
products and services. Nothing herein should be construed as constituting an additional warranty. Hewlett
Packard Enterprise shall not be liable for technical or editorial errors or omissions contained herein.
Confidential computer software. Valid license from Hewlett Packard Enterprise required for possession, use, or
copying. Consistent with FAR 12.211 and 12.212, Commercial Computer Software, Computer Software
Documentation, and Technical Data for Commercial Items are licensed to the U.S. Government under vendor’s
standard commercial license.
Links to third-party websites take you outside the Hewlett Packard Enterprise website. Hewlett Packard
Enterprise has no control over and is not responsible for information outside the Hewlett Packard Enterprise
website.
Acknowledgments
Intel®, Itanium®, Pentium®, Intel Inside®, and the Intel Inside logo are trademarks of Intel Corporation in the
United States and other countries.
Microsoft® and Windows® are either registered trademarks or trademarks of Microsoft Corporation in the
United States and/or other countries.
Adobe® and Acrobat® are trademarks of Adobe Systems Incorporated.
Java and Oracle are registered trademarks of Oracle and/or its affiliates.
UNIX® is a registered trademark of The Open Group.

i
Contents
VXLAN overview ····························································································· 1
VXLAN network model ······································································································································· 1
VXLAN packet format ········································································································································ 2
Working mechanisms ········································································································································· 3
VXLAN tunnel establishment and assignment ··························································································· 3
Assignment of traffic to VXLANs ················································································································ 3
MAC learning ············································································································································· 3
Traffic forwarding ······································································································································· 4
ARP flood suppression ······································································································································ 7
VXLAN IP gateways ··········································································································································· 8
Protocols and standards ···································································································································· 8
Configuring basic VXLAN features ································································· 9
VXLAN configuration task list ····························································································································· 9
Creating a VXLAN on a VSI ······························································································································· 9
Configuring a VXLAN tunnel ···························································································································· 10
Assigning a VXLAN tunnel to a VXLAN ··········································································································· 11
Mapping a Layer 3 interface to a VSI ··············································································································· 11
Managing MAC address entries ······················································································································· 12
Enabling local-MAC change logging ········································································································ 12
Configuring static remote-MAC address entries ······················································································ 12
Disabling remote-MAC address learning ································································································· 13
Configuring a multicast-mode VXLAN ············································································································· 13
Confining unknown-unicast floods to the local site ·························································································· 14
Setting the destination UDP port number of VXLAN packets ·········································································· 14
Configuring VXLAN packet check ···················································································································· 14
Enabling ARP flood suppression ····················································································································· 15
Enabling VXLAN packet statistics ···················································································································· 15
Enabling packet statistics for a VSI ·········································································································· 15
Enabling packet statistics for a Layer 3 interface ····················································································· 16
Displaying and maintaining VXLANs ··············································································································· 16
Unicast-mode VXLAN configuration example ·································································································· 17
Network requirements ······························································································································ 17
Configuration procedure ··························································································································· 17
Verifying the configuration ························································································································ 20
Configuring VXLAN IP gateways ·································································· 22
Overview ·························································································································································· 22
VXLAN IP gateways separated from VTEPs ··························································································· 22
Centralized VXLAN IP gateway deployment ···························································································· 23
Centralized VXLAN gateway group deployment ······················································································ 24
Distributed VXLAN IP gateway deployment ····························································································· 25
Configuration prerequisites ······························································································································ 28
Configuring a centralized VXLAN IP gateway ·································································································· 28
Configuring a centralized VXLAN IP gateway group ······················································································· 29
Configuring a VTEP group ······················································································································· 29
Specifying a VTEP group as the gateway for an access layer VTEP ······················································ 30
Configuring a distributed VXLAN IP gateway ·································································································· 30
Configuring a VSI interface ······························································································································ 31
Enabling packet statistics for a VSI interface ··································································································· 32
Displaying and maintaining VXLAN IP gateway ······························································································ 32
VXLAN IP gateway configuration examples ···································································································· 32
Centralized VXLAN IP gateway configuration example ··········································································· 32
Distributed VXLAN IPv4 gateway configuration example ········································································ 37
Distributed VXLAN IPv6 gateway configuration example ········································································ 47

ii
Configuring ENDP ························································································· 57
Overview ·························································································································································· 57
Working mechanism ································································································································· 57
ENDP timers ············································································································································ 57
ENDP authentication ································································································································ 58
Configuration restrictions and guidelines ········································································································· 58
Configuring ENDP ············································································································································ 58
Configuring the VTEP as an ENDS ·········································································································· 58
Configuring the VTEP as an ENDC ········································································································· 59
Displaying and maintaining ENDP ··················································································································· 59
ENDP configuration example ··························································································································· 60
Network requirements ······························································································································ 60
Configuration procedure ··························································································································· 60
Verifying the configuration ························································································································ 64
Configuring VXLAN IS-IS ·············································································· 69
VXLAN IS-IS configuration task list ·················································································································· 69
Specifying a reserved VXLAN for VXLAN IS-IS ······························································································· 69
Enabling VXLAN autonegotiation to automate VXLAN tunnel assignment ······················································ 69
Enabling MAC advertisement through VXLAN IS-IS ······················································································· 70
Enabling host route advertisement through VXLAN IS-IS ··············································································· 70
Enabling local-host route proxy ························································································································ 70
Enabling host route MAC learning ··················································································································· 71
Tuning VXLAN IS-IS parameters ····················································································································· 71
Setting the VXLAN IS-IS hello interval and the hello multiplier for calculating the adjacency hold time ·· 71
Configuring the DED priority and CSNP interval ······················································································ 72
Tuning LSP timers ···································································································································· 72
Enabling adjacency change logging········································································································· 74
Configuring Graceful Restart for VXLAN IS-IS ························································································· 74
Increasing the maximum number of MAC entries in an LSP ··································································· 75
Displaying and maintaining VXLAN IS-IS ········································································································ 75
VXLAN IS-IS configuration example ················································································································ 76
Network requirements ······························································································································ 76
Configuration procedure ··························································································································· 77
Verifying the configuration ························································································································ 81
Configuring the VTEP as an OVSDB VTEP ·················································· 86
Overview ·························································································································································· 86
Protocols and standards ·································································································································· 86
OVSDB VTEP configuration task list ··············································································································· 86
Configuration prerequisites ······························································································································ 87
Setting up an OVSDB connection to a controller ····························································································· 87
Configuration restrictions and guidelines ································································································· 87
Configuring active SSL connection settings ····························································································· 87
Configuring passive SSL connection settings ·························································································· 88
Configuring active TCP connection settings ···························································································· 88
Configuring passive TCP connection settings ·························································································· 89
Enabling the OVSDB server ···························································································································· 89
Enabling the OVSDB VTEP service ················································································································· 89
Specifying a global source address for VXLAN tunnels ··················································································· 89
Specifying a VTEP access port ························································································································ 90
Enabling flood proxy on multicast VXLAN tunnels ··························································································· 90
OVSDB VTEP configuration examples ············································································································ 90
Unicast-mode VXLAN configuration example ·························································································· 90
Flood proxy VXLAN configuration example ····························································································· 93
Document conventions and icons ································································· 98
Conventions ····················································································································································· 98
Network topology icons ···································································································································· 99

iii
Support and other resources ······································································ 100
Accessing Hewlett Packard Enterprise Support ···························································································· 100
Accessing updates ········································································································································· 100
Websites ················································································································································ 101
Customer self repair ······························································································································· 101
Remote support ······································································································································ 101
Documentation feedback ······················································································································· 101
Index ··········································································································· 103

1
VXLAN overview
Virtual eXtensible LAN (VXLAN) is a MAC-in-UDP technology that provides Layer 2 connectivity
between distant network sites across an IP network. VXLAN is typically used in data cent ers for
multitenant services.
VXLAN provides the following benefits:
•Support for more virtual switched domains than VLANs—Each VXLAN is uniquely
identified by a 24-bit VXLAN ID. The total number of VXLANs can reach 16777216 (224). This
specification makes VXLAN a better choice than 802.1Q VLAN to isolate traffic for VMs.
•Easy deployment and maintenance—VXLAN requires deployment only on the edge devices
of the transport network. Devices in the transport network perform typical Layer 3 forwarding.
The device supports only IPv4-based VXLAN. IPv6-based VXLAN is not supported.
VXLAN network model
As shown in Figure 1, a VXLAN is a virtual Layer 2 network (known as the overlay network) built on
top of an existing physical Layer 3 network (known as the underlay network). The overlay network
encapsulates inter-site L ayer 2 frame s into VXL AN packets an d forwards the packet s to the
destination along the Laye r 3 forwa rding paths provided by the underl ay network. Th e underlay
network is transparent to tenants, and geographically dispersed sites of a tenant are merged into a
Layer 2 network.
The transport edge devices assign VMs to different VXLANs, and then forward traffic between sites
for VMs by using VXLAN tunnels.
The transport edge devices are VXLAN tunnel endpoints (VTEP). They can be servers that host VMs
or independent network devices.
An HPE VTEP uses VSIs and VXLAN tunnels to provide VXLAN services.
•VSI—A virtual switch instance is a virtual Layer 2 switched domain. Each VSI provides
switching services only for one VXLAN. VSIs learn MAC addresses and forward frames
independently of one another. VMs in different sites have Layer 2 connectivity if they are in the
same VXLAN.
•VXLAN tunnel—Logical point-to-point tunnels between VTEPs over the transport network.
Each VXLAN tunnel can trunk multiple VXLANs.
VTEPs encapsulate VXLAN traffic in the VXLAN, outer UDP, and outer IP headers. The devices in
the transport network forward VXLAN traffic only based on the outer IP header.

2
Figure 1 VXLAN network model
VXLAN packet format
As shown in Figure 2, a VTEP encapsulates a frame in the following headers:
•8-byte VXLAN header—VXLAN information for the frame.
{ Flags—If the I bit is 1, the VXLAN ID is valid. If the I bit is 0, the VXLAN ID is invalid. All
other bits are reserved and set to 0.
{ 24-bit VXLAN ID—Identifies the VXLAN of the frame. It is also called the virtual network
identifier (VNI).
•8-byte outer UDP header for VXLAN—The default VXLAN destination UDP port number is
4789.
•20-byte outer IP header—Valid addresses of VTEPs or VXLAN multicast groups on the
transport network. Devices in the transport network forward VXLAN packets based on the outer
IP header.
Figure 2 VXLAN packet format
Underlay network
Overlay network
VTEP 1 VTEP 2
Server Site 2
Server
Site 1
VXLAN tunnel
Transport
network
P
VM
VM
VSI/VXLAN 10
VSI/VXLAN 20
VSI/VXLAN 10
VSI/VXLAN 20
VM
VM

3
Working mechanisms
The VTEP uses the following process to forward an inter-site frame:
1. Discovers remote VTEPs, establishes VXLAN tunnels, and assigns the VXLAN tunnels to
VXLANs.
2. Assigns the frame to its matching VXLAN if the frame is sent between sites.
3. Performs MAC learning on the VXLAN's VSI.
4. Forwards the frame through VXLAN tunnels.
This section describes this process in detail. For intra-site frames in a VSI, the syste m performs
typical Layer 2 forwarding.
VXLAN tunnel establishment and assignment
To provide Layer 2 connectivity for a VXLAN bet ween two sites, you must create a VXLAN tunnel
between the sites and assign the tunnel to the VXLAN.
VXLAN tunnel establishment
VXLAN supports manual and automatic VXLAN tunnel establishment.
•Manual creation—Manually create a VXLAN tunnel interface, and specify the tunnel source
and destination IP addresses on the peer VTEPs.
•Automatic creation—Configure the Enhanced Neighbor Discovery Protocol (ENDP) to
automatically discover VTEPs and set up VXLAN tunnels. For more information about ENDP,
see "Configuring ENDP."
VXLAN tunnel assignment
VXLAN supports manual and automatic VXLAN tunnel assignment.
•Manual assignment—Manually assign VXLAN tunnels to VXLANs.
•Automatic assignment—Run VXLAN IS-IS to advertise VXLAN IDs over all VXLAN tunnels
between VTEPs. Two VTEPs automatically assign the VXLAN tunnel between them to a
VXLAN if both of them have the VXLAN ID.
Assignment of traffic to VXLANs
Traffic from the local site to a remote site
The VTEP uses a Layer 3 interface to match customer traffic on a site-facing interface. The VTEP
assigns customer traffic to a VXLAN by mapping the Layer 3 interface to a VSI. A Layer 3 interface is
identical to an attachment circuit (AC) in L2VPN.
Traffic from a remote site to the local site
When a frame arrives at a VXLAN tunnel, the VTEP uses the VXLAN ID in the f rame to identify its
VXLAN.
MAC learning
The VTEP performs source MAC learning on the VSI as a Layer 2 switch.
•For traffic from the local site to the remote site, the VTEP learns the source MAC address before
VXLAN encapsulation.
•For traffic from the remote site to the local site, the VTEP learns the source MAC address after
removing the VXLAN header.

4
The VTEP can also u se VXLAN IS-IS in the c ontrol plane to advertise lo cal MAC reach ability
information to remote sites and learn MAC reachability information from remote sites.
A VSI's MAC address table includes the following types of MAC address entries:
•Local MAC—Dynamic MAC entries learned from the local site. The outgoing interfaces are
site-facing interfaces on which the MAC addresses are learned. VXLAN does not support
manual local-MAC entries.
•Remote MAC—MAC entries learned from a remote site, including static and dynamic MAC
entries. The outgoing interfaces for the MAC addresses are VXLAN tunnel interfaces.
{ Static—Manually added MAC entries.
{ Dynamic—MAC entries learned in the data plane from incoming traffic on VXLAN tunnels.
The learned MAC addresses are contained in the inner Ethernet header.
{ IS-IS—MAC entry advertised through VXLAN IS-IS.
{ OpenFlow—MAC entry issued by a remote controller through OpenFlow.
{ OVSDB—MAC entry issued by a remote controller through OVSDB.
For a remote address, the manual static entry has higher priority than dynamic and advertised
entries. Dynamic and advertised entries have the same priority and overwrite each other.
Traffic forwarding
A VTEP uses the following processes to forward traffic at Layer 2:
•Unicast process—Applies to destination-known unicast traffic.
•Flood process—Applies to multicast, broadcast, and unknown unicast traffic.
Unicast
The following process (see Figure 3) applies to a known unicast frame between sites:
1. The source VTEP encapsulates the Ethernet frame in the VXLAN/UDP/IP header.
In the outer IP header, the source IP address is the source VTEP's VXLAN tunnel source IP
address. The destination IP address is the VXLAN tunnel destination IP address.
2. The source VTEP forwards the encapsulated packet out of the outgoing VXLAN tunnel
interface found in the VSI's MAC address table.
3. The intermediate transport devices (P devices) forward the frame to the destination VTEP by
using the outer IP header.
4. The destination VTEP removes the headers on top of the inner Ethernet frame. It then performs
MAC address table lookup in the VXLAN's VSI to forward the frame out of the matching
outgoing interface.

5
Figure 3 Inter-site unicast
Flood
The VTEP floods a broadcast, multicast, or unknown unicast frame to all site-facing interfaces and
VXLAN tunnels in the VXLAN, except for the incoming interface.
VXLAN supports the following modes for flood traffic:
•Unicast mode—Also called head-end replication. The source VTEP replicates the flood frame,
and then sends one replica to the destination IP address of each VXLAN tunnel in the VXLAN.
See Figure 4.
•Multicast
mode—Also called tandem replication. The source VTEP sends the flood frame in a
multicast VXLAN packet destined for a multicast group address. Transport network devices
replicate and forward the packet to remote VTEPs based on their multicast forwarding entries.
See Figure 5.
•Flood
proxy mode—The source VTEP sends the flood frame in a VXLAN packet over a
VXLAN tunnel to a flood proxy server. The flood proxy server replicates and forwards the packet
to each remote VTEP through its VXLAN tunnels. See Figure 6.
The flood proxy mode applies to VXLANs that have many sites. This mode reduces flood traffic
in the transport network without using a multicast protocol. To use a flood proxy server, you
must set up a VXLAN tunnel to the server on each VTEP.
NOTE:
The flood proxy mode is typically used in SDN transport networks that have a flood proxy
server. For VTEPs to forward packets based on the MAC address table issued by an SDN
controller, you must perform the following tasks on the VTEPs:
• Disable remote-MAC address learning by using the vxlan tunnel mac-learning disable
command.
• Disable source MAC ch eck on all trans port-facing interfaces by using the undo
mac-address static source-check enable command. If the VTEP is an IRF fabric, you
must also disable the feature on all IRF ports.
Each destination VTEP floods the inner Ethernet frame to all the site-facing interfaces in the VXLAN.
To avoid loops, the destination VTEPs do not flood the frame to VXLAN tunnels.

6
Figure 4 Unicast mode
Figure 5 Multicast mode
VTEP 1 VTEP 2
Transport network
P
Server 1
VM 1
VM 2
VM 3
Server 3
VM 7
VM 8
VM 9
Server 2
VM 4
VM 5
VM 6
GE1/0/1
GE1/0/2 GE1/0/1
VXLAN tunnel
VTEP 3
VXLAN tunnel
Server 4
VM 10
VM 11
VM 12
Replicate and
encapsulate
VTEP 1 VTEP 2
Transport network
P
Server 1
VM 1
VM 2
VM 3
Server 3
VM 7
VM 8
VM 9
Server 2
VM 4
VM 5
VM 6
GE1/0/1
GE1/0/2 GE1/0/1
VXLAN tunnel
VTEP 3
VXLAN tunnel
Server 4
VM 10
VM 11
VM 12
Replicate
Encapsulate
with multicast
address

7
Figure 6 Flood proxy mode
ARP flood suppression
ARP flood su ppression reduces ARP request broadcasts by enabling the VTEP to reply to AR P
requests on behalf of VMs.
As shown in Figure 7, this feature snoops ARP packets to populate the ARP flood suppression table
with local and remote MAC addresses. If an ARP request has a matching entry, the VTEP replies to
the request on behalf of the VM. If no match is found, the VTEP floods the request to both local and
remote sites.
VXLAN tunnel

8
Figure 7 ARP flood suppression
ARP flood suppression uses the following workflow:
1. VM 1 sends an ARP request to obtain the MAC address of VM 7.
2. VTEP 1 creates a suppression entry for VM 1, and floods the ARP request in the VXLAN.
3. VTEP 2 and VTEP 3 de-encapsulate the ARP request. The VTEPs create a suppression entry
for VM 1, and broadcast the request in the local site.
4. VM 7 sends an ARP reply.
5. VTEP 2 creates a suppression entry for VM 7 and forwards the ARP reply to VTEP 1.
6. VTEP 1 de-encapsulates the ARP reply, creates a suppression entry for VM 7, and forwards the
ARP reply to VM 1.
7. VM 4 sends an ARP request to obtain the MAC address of VM 1 or VM 7.
8. VTEP 1 creates a suppression entry for VM 4 and replies to the ARP request.
9. VM 10 sends an ARP request to obtain the MAC address of VM 1.
10. VTEP 3 creates a suppression entry for VM 10 and replies to the ARP request.
VXLAN IP gateways
A VXLAN IP gateway provides Layer 3 forwarding services for VMs in VXLANs. A VXLAN IP gateway
can be an independent device or be collocated with a VTEP. For more information about VXLAN IP
gateway placement, see "Configuring VXLAN IP gateways."
Protocols and standards
RFC 7348, Virtual eXtensible Local Area Network (VXLAN): A Framework for Overlaying Virtualized
Layer 2 Networks over Layer 3 Networks

9
Configuring basic VXLAN features
VXLAN configuration task list
Tasks at a glance Remarks
(Required.) Creating a VXLAN on a VSI N/A
(Required.) Configuring a VXLAN tunnel N/A
(Required.) Assigning a VXLAN tunnel to a VXLAN
To extend a VXLAN to remote
sites, you must assign VXLAN
tunnels to the VXLAN.
(Required.) Mapping a Layer 3 interface to a VSI Perform this task to assign
customer traffic to VXLANs.
(Optional.) Managing MAC address entries N/A
(Optional.) Configuring a multicast-mode VXLAN
By default, the VTEP floods
VXLAN traffic in unicast mode. If
the network is multicast dense,
configure the VTEP to flood
VXLAN traffic in multicast mode.
(Optional.) Confining unknown-unicast floods to the local site N/A
(Optional.) Setting the destination UDP port number of VXLAN packets N/A
(Optional.) Configuring VXLAN packet check
Perform this task to check
incoming VXLAN packets,
including the following items:
• UDP checksum.
• 802.1Q VLAN tags in the
inner Ethernet header.
(Optional.) Enabling ARP flood suppression N/A
(Optional.) Enabling VXLAN packet statistics N/A
Creating a VXLAN on a VSI
Step Command Remarks
1. Enter system view. system-view N/A
2. Enable L2VPN. l2vpn enable By default, L2VPN is disabled.
3. Create a VSI and enter
VSI view. vsi vsi-name By default, no VSIs exist.
4. (Optional.) Configure a
VSI description. description text By default, a VSI does not have a
description.
5. Enable the VSI. undo shutdown By default, a VSI is enabled.
6. (Optional.) Set the
MTU for the VSI. mtu mtu The default MTU is 1500 bytes for a VSI.
7. (Optional.) Enable
MAC address learning
for the VSI. mac-learning enable By default, MAC address learning is
enabled for a VSI.

10
Step Command Remarks
8. Create a VXLAN and
enter VXLAN view. vxlan vxlan-id
By default, no VXLANs exist.
You can create only one VXLAN on a
VSI. The VXLAN ID must be unique for
each VSI.
Configuring a VXLAN tunnel
You can manually configure a VXLAN tunnel or configure ENDP to automatically establish a VXLAN
tunnel. This section describes manual VXLAN tunnel setup. For more information about ENDP, see
"Configuring ENDP."
This task provides basic VXLAN tunnel co nfiguration. For more information about tunnel
configuration and comm ands, see Layer 3—IP Services Configuration Guide and Layer 3—IP
Services Command Reference.
To configure a VXLAN tunnel:
Step Command Remarks
1. Enter system view. system-view N/A
2. Create a VXLAN tunnel
interface and enter tunnel
interface view.
interface tunnel tunnel-number
mode vxlan
By default, no tunnel interfaces
exist.
The endpoints of a tunnel must use
the same tunnel mode.
3. Specify a source IP
address or source
interface for the tunnel.
source { ipv4-address |
interface-type interface-number }
IMPORTANT:
Do not perform this step if you are
using OVSDB for VXLAN tunnel
management.
By default, no source IP address or
source interface is specified for a
tunnel.
This step specifies the source IP
address in the outer IP header of
tunneled VXLAN packets. If an
interface is specified, its primary IP
address is used.
For a multicast-mode VXLAN, the
source IP address cannot be a
loopback interface's address, and
the source interface cannot be a
loopback interface.
4. Specify a destination IP
address for the tunnel. destination ipv4-address
By default, no destination IP
address is specified for a tunnel.
Specify the remote VTEP's IP
address. This IP address will be the
destination IP address in the outer
IP header of tunneled VXLAN
packets.
As a best practice, do not configure
multiple VXLAN tunnels to use the
same source and destination IP
addresses.
5. (Optional.) Enable BFD
on the tunnel. tunnel bfd enable
destination-mac mac-address By default, BFD is disabled on a
tunnel.

11
Assigning a VXLAN tunnel to a VXLAN
To provide Layer 2 connectivity for a VXLAN between two sites, you must assign the VXLAN tunnel
between the sites to the VXLAN.
You can assign multiple VXLAN tunnels to a VXLAN, and configure a VXLAN tunnel to trunk multiple
VXLANs. For a unicast-mode VXLAN, the system floods unknown unicast, multicast, and broadcast
traffic to each tunnel associated with the VXLAN. If a flood proxy server i s used, the VTEP sends
flood traffic to the server through the f lood proxy tunnel. The flood proxy server replicates and
forwards flood traffic to remote VTEPs.
This section describes the manual VXLAN tunnel assignment. For information about auto matic
VXLAN tunnel assignment through VXLAN IS-IS, see "Configuring VXLAN IS-IS."
To assign a VXLAN tunnel to a VXLAN:
Step Command Remarks
1. Enter system view. system-view N/A
2. Enter VSI view. vsi vsi-name N/A
3. Enter VXLAN view. vxlan vxlan-id N/A
4. Assign a VXLAN tunnel to
the VXLAN. tunnel tunnel-number
[ flooding-proxy ]
By default, a VXLAN does not
contain any VXLAN tunnels.
For full Layer 2 connectivity in the
VXLAN, make sure the VXLAN
contains the VXLAN tunnel
between each pair of sites in the
VXLAN.
Enable flood proxy on the tunnel for
the VTEP to send flood traffic to the
flood proxy server. The flood proxy
server replicates and forwards flood
traffic to remote VTEPs.
Mapping a Layer 3 interface to a VSI
To assign the customer traffic on a Layer 3 interface to a VXLAN, map the interface to the VXLAN's
VSI. The VSI uses its MAC address table to forward the customer traffic.
To map a Layer 3 interface to a VSI:
Step Command Remarks
1. Enter system view. system-view N/A
2. Enter Layer 3 interface
view. interface interface-type
interface-number N/A
3. Map the Layer 3 interface
to a VSI. xconnect vsi vsi-name [track
track-entry-number&<1-3> ]
By default, a Layer 3 interface is
not mapped to any VSI.

12
Managing MAC address entries
With VXLAN, local MAC addresses are learned dynamically. You can log MAC changes, but you
cannot manually add local MAC addresses.
Remote-MAC address entries include the following types:
•Manually created static entries.
•Dynamic entries learned in the data plane.
•Entries advertised in the control plane through VXLAN IS-IS.
•Entries issued by a remote controller through OpenFlow or OVSDB.
For more information about VXLAN IS-IS MAC add ress advertisement, see "Configuring VXLAN
IS-IS."
Enabling local-MAC change logging
Local-MAC change logging enables the VXLAN module to send a log message to the info rmation
center when a local MAC address is added or removed.
With the information center, you can set log mess age filtering a nd output rules, including output
destinations. For mo re information about configuring the information center, see Network
Management and Monitoring Configuration Guide.
To enable local-MAC change logging:
Step Command Remarks
1. Enter system view. system-view N/A
2. Enable local-MAC
change logging. vxlan local-mac report By default, local-MAC change
logging is disabled.
Configuring static remote-MAC address entries
Do not configure static remote-MAC entries for VXLAN tunnels that are automatically established by
using ENDP.
•ENDP re-establishes VXLAN tunnels if the transport-facing interface goes down, and then
comes up. If you have configured static remote-MAC entries, the entries are deleted when the
tunnels are re-established.
•ENDP re-establishes VXLAN tunnels if you perform configuration rollback. If the tunnel IDs
change during tunnel re-establishment, configuration rollback fails, and static remote-MAC
entries on the tunnels cannot be restored.
For more information about ENDP, see "Configuring ENDP."
Configuration rollback fails if the following conditions exist:
•Static remote-MAC entries are configured for manually created VXLAN tunnels.
•Automatic VXLAN tunnel assignment is in progress.
To avoid rollback failure, perform configuration rollback after VXLAN IS-IS finishes VXLA N tunnel
assignment. For more information about VXLAN IS-IS, see " Configuring VXLAN IS-IS." For more
information about configu ration rollback, see configuration file management in Fundamentals
Configuration Guide.
To configure static remote-MAC address entries:

13
Step Command Remarks
1. Enter system view. system-view N/A
2. Add a static remote
entry.
mac-address static mac-address
interface tunnel tunnel-number vsi
vsi-name
By default, VXLAN VSIs do not
have static remote-MAC address
entries.
For the setting to take effect, make
sure the VSI's VXLAN has been
created and specified on the
VXLAN tunnel.
Disabling remote-MAC address learning
Step Command Remarks
1. Enter system view. system-view N/A
2. Disable remote-MAC
address learning. vxlan tunnel mac-learning disable
By default, remote-MAC address
learning is enabled.
When network attacks occur,
disable remote-MAC address
learning to prevent the device from
learning incorrect remote MAC
addresses. You can manually add
static remote-MAC address entries.
Configuring a multicast-mode VXLAN
In a multicast-mode VXLAN, VTEPs and transport network devices run PIM to generate multica st
forwarding entries. If a VTEP has multiple transport-facing interfaces, PIM dynamically selects the
outgoing interfaces for multicast VXLAN packets.
For a multicast-mode VXLAN to flood t raffic, you must perform the follo wing tasks in addition to
multicast-mode configuration:
•Enable IP multicast routing on all VTEPs and transport network devices.
•Configure a multicast routing protocol on transport network devices. A VTEP can be both a
multicast source and multicast group member. As a best practice, use BIDIR-PIM.
To configure a multicast-mode VXLAN:
Step Command Remarks
1. Enter system view. system-view N/A
2. Enter the view of a
transport-facing interface. interface interface-type
interface-number N/A
3. Enable PIM.
• Enable PIM-SM:
pim sm
• Enable PIM-DM:
pim dm
By default, PIM is disabled on an interface.

14
Confining unknown-unicast floods to the local site
By default, the VTEP floods unknown unicast frames received from the local site to the follo wing
interfaces in the frame's VXLAN:
•All site-facing interfaces except for the incoming interface.
•All VXLAN tunnel interfaces.
To confine unknown-unicast floods to site-facing interfaces for a VXLAN:
Step Command Remarks
1. Enter system view. system-view N/A
2. Enter VSI view. vsi vsi-name N/A
3. Disable the VSI to flood
unknown unicast traffic to
VXLAN tunnel interfaces. flooding disable
By default, unknown unicast traffic
is flooded to all interfaces in the
VXLAN, except for the incoming
interface.
4. (Optional.) Enable
selective flood for a MAC
address.
selective-flooding mac-address
mac-address
By default, selective flood is
disabled.
Use this feature to exclude a
remote MAC address from the
flood suppression done by using
the flooding disable command.
The VTEP will flood the frames
destined for the specified MAC
address to remote sites when
unknown-unicast floods are
confined to the local site.
Setting the destination UDP port number of
VXLAN packets
Step Command Remarks
1. Enter system view. system-view N/A
2. Set a destination UDP
port for VXLAN packets. vxlan udp-port port-number
By default, the destination UDP
port number is 4789 for VXLAN
packets.
You must configure the same
destination UDP port number on all
VTEPs in a VXLAN.
Configuring VXLAN packet check
The device can check the UDP checksum and 802.1Q VLAN tags of each received VXLAN packet.
•UDP checksum check—The device always sets the UDP checksum of VXLAN packets to zero.
For compatibility with third-party devices, a VXLAN packet can pass the check if its UDP
checksum is zero or correct. If its UDP checksum is incorrect, the VXLAN packet fails the check
and is dropped.

15
•VLAN tag check—The device checks the inner Ethernet header of each VXLAN packet for
802.1Q VLAN tags. If the header contains 802.1Q VLAN tags, the device drops the packet.
To configure VXLAN packet check:
Step Command Remarks
1. Enter system view. system-view N/A
2. Enable the VTEP to drop VXLAN
packets that fail UDP checksum
check.
vxlan invalid-udp-checksum
discard
By default, the VTEP does not
check the UDP checksum of
VXLAN packets.
3. Enable the VTEP to drop VXLAN
packets that have 802.1Q VLAN
tags in the inner Ethernet header. vxlan invalid-vlan-tag discard By default, the VTEP does not
check the inner Ethernet
header for 802.1Q VLAN tags.
Enabling ARP flood suppression
Use ARP flood suppression to reduce ARP request broadcasts.
The aging timer is fixed at 25 minutes for ARP flood suppression entries. If the suppression table is
full, the VTEP stops learning new entries. For the VTEP to learn new entries, you must wait for old
entries to age out, or use the reset arp suppression vsi command to clear the table.
If the flooding disable command is configured, set the MAC aging timer to a higher value than the
aging timer for ARP flood supp ression entries on all VTEPs. This setting prevents the traf fic
blackhole that occurs when a MAC address entry ages out before its ARP flood suppression entry
ages out.
To set the MAC aging timer, use the mac-address timer command.
To enable ARP flood suppression:
Step Command Remarks
1. Enter system view. system-view N/A
2. Enter VSI view. vsi vsi-name N/A
3. Enable ARP flood
suppression. arp suppression enable By default, ARP flood
suppression is disabled.
Enabling VXLAN packet statistics
Enabling packet statistics for a VSI
Step Command Remarks
1. Enter system view. system-view N/A
2. Enter VSI view. vsi vsi-name N/A
3. Enable packet statistics
for the VSI. statistics enable By default, the packet statistics
feature is disabled for all VSIs.
4. (Optional.) Display packet
statistics for VSIs. display l2vpn vsi verbose This command is available in any
view.