HPE FlexFabric 5940 SERIES User manual

HPE FlexFabric 5940 Switch Series
VXLAN Configuration Guide
Part number: 5200-1037a
Software version: Release 2508 and later verison
Document version: 6W101-20161101

© Copyright 2016 Hewlett Packard Enterprise Development LP
The information contained herein is subject to change without notice. The only warranties for Hewlett Packard
Enterprise products and services are set forth in the express warranty statements accompanying such
products and services. Nothing herein should be construed as constituting an additional warranty. Hewlett
Packard Enterprise shall not be liable for technical or editorial errors or omissions contained herein.
Confidential computer software. Valid license from Hewlett Packard Enterprise required for possession, use, or
copying. Consistent with FAR 12.211 and 12.212, Commercial Computer Software, Computer Software
Documentation, and Technical Data for Commercial Items are licensed to the U.S. Government under vendor’s
standard commercial license.
Links to third-party websites take you outside the Hewlett Packard Enterprise website. Hewlett Packard
Enterprise has no control over and is not responsible for information outside the Hewlett Packard Enterprise
website.
Acknowledgments
Intel®, Itanium®, Pentium®, Intel Inside®, and the Intel Inside logo are trademarks of Intel Corporation in the
United States and other countries.
Microsoft® and Windows® are trademarks of the Microsoft group of companies.
Adobe® andAcrobat® are trademarks ofAdobe Systems Incorporated.
Java and Oracle are registered trademarks of Oracle and/or its affiliates.
UNIX® is a registered trademark of The Open Group.

i
Contents
VXLAN overview·····························································································1
VXLAN network model·······································································································································1
VXLAN packet format ········································································································································2
Working mechanisms·········································································································································3
Assignment of traffic to VXLANs················································································································3
MAC learning ·············································································································································3
Traffic forwarding ·······································································································································4
Access modes of VSIs·······························································································································7
ARP flood suppression ······································································································································7
VXLAN IP gateways···········································································································································8
Protocols and standards ····································································································································9
Configuring basic VXLAN features ·······························································10
VXLAN configuration task list···························································································································10
Setting the VXLAN hardware resource allocation mode··················································································10
Creating a VXLAN on a VSI·····························································································································11
Configuring a VXLAN tunnel····························································································································11
Assigning VXLAN tunnels to a VXLAN ············································································································12
Mapping an Ethernet service instance to a VSI·······························································································13
Managing MAC address entries·······················································································································14
Enabling local-MAC change logging········································································································14
Configuring static remote-MAC address entries ······················································································14
Disabling remote-MAC address learning ·································································································15
Configuring a multicast-mode VXLAN ·············································································································15
Configuring a VTEP using the PIM method ·····························································································16
Configuring a VTEP using the IGMP host method···················································································16
Confining floods to the local site ······················································································································17
Setting the destination UDP port number of VXLAN packets ··········································································17
Configuring VXLAN packet check····················································································································17
Enabling ARP flood suppression ·····················································································································18
Disabling remote ARP learning for VXLANs····································································································19
Enabling VXLAN packet statistics····················································································································19
Enabling packet statistics for a VSI··········································································································19
Enabling packet statistics for an Ethernet service instance·····································································19
Testing the reachability of a remote VM ··········································································································20
Displaying and maintaining VXLANs ···············································································································20
VXLAN configuration examples ·······················································································································21
Unicast-mode VXLAN configuration example··························································································21
Multicast-mode VXLAN configuration example························································································25
Configuring VXLAN IP gateways ··································································33
Overview··························································································································································33
VXLAN IP gateways separated from VTEPs ···························································································33
Centralized VXLAN IP gateway deployment····························································································34
Centralized VXLAN gateway group deployment······················································································35
Distributed VXLAN IP gateway deployment·····························································································36
Configuration restrictions and guidelines·········································································································39
Configuration prerequisites······························································································································40
Configuring a centralized VXLAN IP gateway··································································································40
Configuring a centralized VXLAN IP gateway group ·······················································································41
Configuration restrictions and guidelines·································································································41
Configuring a VTEP group·······················································································································41
Specifying a VTEP group as the gateway for an access layer VTEP······················································42
Configuring a distributed VXLAN IP gateway ··································································································42
Configuration restrictions and guidelines·································································································42
Configuration prerequisites······················································································································43
Configuration procedure···························································································································43

ii
Configuring a VSI interface······························································································································44
Enabling packet statistics for a VSI interface···································································································44
Displaying and maintaining VXLAN IP gateway ······························································································45
VXLAN IP gateway configuration examples ····································································································45
Centralized VXLAN IP gateway configuration example···········································································45
Centralized VXLAN IP gateway group configuration example·································································50
Distributed VXLAN IPv4 gateway configuration example ········································································54
Distributed VXLAN IPv6 gateway configuration example ········································································63
Configuring the VTEP as an OVSDB VTEP··················································74
Overview··························································································································································74
Protocols and standards ··································································································································74
OVSDB VTEP configuration task list ···············································································································74
Configuration prerequisites······························································································································75
Setting up an OVSDB connection to a controller·····························································································75
Configuration restrictions and guidelines·································································································75
Configuring active SSL connection settings·····························································································75
Configuring passive SSL connection settings··························································································76
Configuring active TCP connection settings ····························································································76
Configuring passive TCP connection settings··························································································76
Enabling the OVSDB server ····························································································································77
Enabling the OVSDB VTEP service·················································································································77
Specifying a global source address for VXLAN tunnels···················································································77
Specifying a VTEP access port························································································································77
Enabling flood proxy on multicast VXLAN tunnels···························································································78
OVSDB VTEP configuration examples············································································································78
Unicast-mode VXLAN configuration example··························································································78
Flood proxy VXLAN configuration example ·····························································································81
Document conventions and icons·································································86
Conventions·····················································································································································86
Network topology icons····································································································································87
Support and other resources ········································································88
Accessing Hewlett Packard Enterprise Support ······························································································88
Accessing updates···········································································································································88
Websites ··················································································································································89
Customer self repair·································································································································89
Remote support········································································································································89
Documentation feedback ·························································································································89
Index·············································································································91

1
VXLAN overview
Virtual eXtensible LAN (VXLAN) is a MAC-in-UDP technology that provides Layer 2 connectivity
between distant network sites across an IP network. VXLAN is typically used in data centers for
multitenant services.
VXLAN provides the following benefits:
•Support for more virtual switched domains than VLANs—Each VXLAN is uniquely
identified by a 24-bit VXLAN ID. The total number of VXLANs can reach 16777216 (224). This
specification makes VXLAN a better choice than 802.1Q VLAN to isolate traffic for VMs.
•Easy deployment and maintenance—VXLAN requires deployment only on the edge devices
of the transport network. Devices in the transport network perform typical Layer 3 forwarding.
The device supports only IPv4-based VXLAN. IPv6-based VXLAN is not supported.
VXLAN network model
As shown in Figure 1, a VXLAN is a virtual Layer 2 network (known as the overlay network) built on
top of an existing physical Layer 3 network (known as the underlay network). The overlay network
encapsulates inter-site Layer 2 frames into VXLAN packets and forwards the packets to the
destination along the Layer 3 forwarding paths provided by the underlay network. The underlay
network is transparent to tenants, and geographically dispersed sites of a tenant are merged into a
Layer 2 network.
The transport edge devices assign VMs to different VXLANs, and then forward traffic between sites
for VMs by using VXLAN tunnels.
The transport edge devices are VXLAN tunnel endpoints (VTEP). They can be servers that host VMs
or independent network devices.
An HPE VTEP uses VSIs and VXLAN tunnels to provide VXLAN services.
•VSI—A virtual switch instance is a virtual Layer 2 switched domain. Each VSI provides
switching services only for one VXLAN. VSIs learn MAC addresses and forward frames
independently of one another. VMs in different sites have Layer 2 connectivity if they are in the
same VXLAN.
•VXLAN tunnel—Logical point-to-point tunnels between VTEPs over the transport network.
Each VXLAN tunnel can trunk multiple VXLANs.
VTEPs encapsulate VXLAN traffic in the VXLAN, outer UDP, and outer IP headers. The devices in
the transport network forward VXLAN traffic only based on the outer IP header.

2
Figure 1 VXLAN network model
VXLAN packet format
As shown in Figure 2, a VTEP encapsulates a frame in the following headers:
•8-byte VXLAN header—VXLAN information for the frame.
{Flags—If the I bit is 1, the VXLAN ID is valid. If the I bit is 0, the VXLAN ID is invalid. All
other bits are reserved and set to 0.
{24-bit VXLAN ID—Identifies the VXLAN of the frame. It is also called the virtual network
identifier (VNI).
•8-byte outer UDP header for VXLAN—The default VXLAN destination UDP port number is
4789.
•20-byte outer IP header—Valid addresses of VTEPs or VXLAN multicast groups on the
transport network. Devices in the transport network forward VXLAN packets basedon the outer
IP header.
Figure 2 VXLAN packet format
Underlay network
Overlay network
VTEP 1 VTEP 2
Server Site 2
Server
Site 1
VXLAN tunnel
Transport
network
P
VM
VM
VSI/VXLAN 10
VSI/VXLAN 20
VSI/VXLAN 10
VSI/VXLAN 20
VM
VM

3
Working mechanisms
The VTEP uses the following process to forward an inter-site frame:
1. Assigns the frame to its matching VXLAN if the frame is sent between sites.
2. Performs MAC learning on the VXLAN's VSI.
3. Forwards the frame through VXLAN tunnels.
This section describes this process in detail. For intra-site frames in a VSI, the system performs
typical Layer 2 forwarding, and it processes 802.1Q VLAN tags as described in "Access modes of
VSIs."
Assignment of traffic to VXLANs
Traffic from the local site to a remote site
The VTEP uses an Ethernet service instance to match a list of VLANs on a site-facing interface. The
VTEP assigns customer traffic to a VXLAN by mapping the Ethernet service instance to a VSI. An
Ethernet service instance is identical to an attachment circuit (AC) in L2VPN.
As shown in Figure 3, Ethernet service instance 1 matches VLAN 2 and is mapped to VSI A(VXLAN
10). When a frame from VLAN 2 arrives, the VTEPassigns the frame to VXLAN 10, and looks up VSI
A's MAC address table for the outgoing interface.
Figure 3 Identifying traffic from the local site
Traffic from a remote site to the local site
When a frame arrives at a VXLAN tunnel, the VTEP uses the VXLAN ID in the frame to identify its
VXLAN.
MAC learning
The VTEP performs source MAC learning on the VSI as a Layer 2 switch.
•For traffic from the local site to the remote site, the VTEP learns the source MACaddress before
VXLAN encapsulation.
•For traffic from the remote site to the local site, the VTEP learns the source MAC address after
removing the VXLAN header.
A VSI's MAC address table includes the following types of MAC address entries:
•Local MAC—Dynamic MAC entries learned from the local site. The outgoing interfaces are
site-facing interfaces on which the MAC addresses are learned. VXLAN does not support
manual local-MAC entries.

4
•Remote MAC—MAC entries learned from a remote site, including static and dynamic MAC
entries. The outgoing interfaces for the MAC addresses are VXLAN tunnel interfaces.
{Static—Manually added MAC entries.
{Dynamic—MAC entries learned in the data plane from incoming traffic on VXLAN tunnels.
The learned MAC addresses are contained in the inner Ethernet header.
{OpenFlow—MAC entry issued by a remote controller through OpenFlow.
{OVSDB—MAC entry issued by a remote controller through OVSDB.
For a remote address, the manual static entry has higher priority than the dynamic entry.
Traffic forwarding
A VTEP uses the following processes to forward traffic at Layer 2:
•Unicast process—Applies to destination-known unicast traffic.
•Flood process—Applies to multicast, broadcast, and unknown unicast traffic.
When the VTEP forwards VXLAN traffic, it processes the 802.1Q tag in the inner Ethernet header
depending on the VSI access mode (VLAN or Ethernet mode). In VLAN access mode, sites can use
different VLANs to provide the same service. For more information, see "Access modes of VSIs."
Unicast
The following process (see Figure 4) applies to a known unicast frame between sites:
1. The source VTEP encapsulates the Ethernet frame in the VXLAN/UDP/IP header.
In the outer IP header, the source IP address is the source VTEP's VXLAN tunnel source IP
address. The destination IP address is the VXLAN tunnel destination IP address.
2. The source VTEP forwards the encapsulated packet out of the outgoing VXLAN tunnel
interface found in the VSI's MAC address table.
3. The intermediate transport devices (P devices) forward the frame to the destination VTEP by
using the outer IP header.
4. The destination VTEP removes the headers on top of the inner Ethernet frame. It then performs
MAC address table lookup in the VXLAN's VSI to forward the frame out of the matching
outgoing interface.
Figure 4 Inter-site unicast

5
Flood
The VTEP floods a broadcast, multicast, or unknown unicast frame to all site-facing interfaces and
VXLAN tunnels in the VXLAN, except for the incoming interface.
VXLAN supports the following modes for flood traffic:
•Unicast mode—Also called head-end replication. The source VTEP replicates the flood frame,
and then sends one replica to the destination IP address of each VXLAN tunnel in the VXLAN.
See Figure 5.
•Multicast
mode—Also called tandem replication. The source VTEP sends the flood frame in a
multicast VXLAN packet destined for a multicast group address. Transport network devices
replicate and forward the packet to remote VTEPs based on their multicast forwarding entries.
See Figure 6.
•Flood
proxy mode—The source VTEP sends the flood frame in a VXLAN packet over a
VXLAN tunnel to a flood proxy server. The flood proxy server replicates and forwards the packet
to each remote VTEP through its VXLAN tunnels. See Figure 7.
The flood proxy mode applies to VXLANs that have many sites. This mode reduces flood traffic
in the transport network without using a multicast protocol. To use a flood proxy server, you
must set up a VXLAN tunnel to the server on each VTEP.
NOTE:
The flood proxy mode is typically used in SDN transport networks that have a flood proxy
server. For VTEPs to forward packets based on the MAC address table issued by an SDN
controller, you must perform the following tasks on the VTEPs:
•Disable remote-MAC address learning by using the vxlan tunnel mac-learning disable
command.
•Disable source MAC check on all transport-facing interfaces by using the undo
mac-address static source-check enable command. If the VTEP is an IRF fabric, you
must also disable the feature on all IRF ports.
Each destination VTEPfloods the inner Ethernet frameto all the site-facing interfaces in the VXLAN.
To avoid loops, the destination VTEPs do not flood the frame to VXLAN tunnels.

6
Figure 5 Unicast mode
Figure 6 Multicast mode

7
Figure 7 Flood proxy mode
Access modes of VSIs
The access mode of a VSI determines how the VTEP processes the 802.1Q VLAN tags in the
Ethernet frames.
•VLAN access mode—Ethernet frames received from or sent to the local site must contain
802.1Q VLAN tags.
{For an Ethernet frame received from the local site, the VTEP removes all its 802.1Q VLAN
tags before forwarding the frame.
{For an Ethernet frame destined for the local site, the VTEP adds 802.1Q VLAN tags to the
frame before forwarding the frame.
In VLAN access mode, VXLAN packets sent between sites do not contain 802.1Q VLAN tags.
You can use different 802.1Q VLANs to provide the same service in different sites.
•Ethernet access mode—The VTEP does not process the 802.1Q VLAN tags of Ethernet
frames received from or sent to the local site.
{For an Ethernet frame received from the local site, the VTEP forwards the frame with the
802.1Q VLAN tags intact.
{For an Ethernet frame destined for the local site, the VTEP forwards the frame without
adding 802.1Q VLAN tags.
In Ethernet access mode, VXLAN packets sent between VXLAN sites contain 802.1Q VLAN
tags. You must use the same VLAN to provide the same service between sites.
ARP flood suppression
ARP flood suppression reduces ARP request broadcasts by enabling the VTEP to reply to ARP
requests on behalf of VMs.
VTEP 1 VTEP 2
Flood proxy
server
Server 1
VM 1
VM 2
VM 3
Server 3
VM 7
VM 8
VM 9
Server 2
VM 4
VM 5
VM 6
VXLANtunnel
VXLANtunnel
VTEP 3
VXLANtunnel
Server 4
VM 10
VM 11
VM 12
Encapsulate
with flood proxy
server address
VXLANtunnel
Replicate and forward packet
Source: Flood proxy server
Destination: Each remote VTEP
Transport
network

8
As shown in Figure 8, this feature snoops ARPpackets to populate the ARP flood suppression table
with local and remote MAC addresses. If anARP request has a matching entry, the VTEP replies to
the request on behalf of the VM. If no match is found, the VTEP floods the request to both local and
remote sites.
Figure 8 ARP flood suppression
ARP flood suppression uses the following workflow:
1. VM 1 sends an ARP request to obtain the MAC address of VM 7.
2. VTEP 1 creates a suppression entry for VM 1, and floods the ARP request in the VXLAN.
3. VTEP 2 and VTEP 3 de-encapsulate the ARP request. The VTEPs create a suppression entry
for VM 1, and broadcast the request in the local site.
4. VM 7 sends an ARP reply.
5. VTEP 2 creates a suppression entry for VM 7 and forwards the ARP reply to VTEP 1.
6. VTEP 1 de-encapsulates the ARP reply,creates a suppression entry for VM 7, and forwards the
ARP reply to VM 1.
7. VM 4 sends an ARP request to obtain the MAC address of VM 1 or VM 7.
8. VTEP 1 creates a suppression entry for VM 4 and replies to the ARP request.
9. VM 10 sends an ARP request to obtain the MAC address of VM 1.
10. VTEP 3 creates a suppression entry for VM 10 and replies to the ARP request.
VXLAN IP gateways
AVXLAN IP gateway provides Layer 3 forwarding services for VMs in VXLANs. AVXLAN IP gateway
can be an independent device or be collocated with a VTEP. For more information about VXLAN IP
gateway placement, see "Configuring VXLAN IP gateways."

9
Protocols and standards
RFC 7348, Virtual eXtensible Local Area Network (VXLAN): A Framework for Overlaying Virtualized
Layer 2 Networks over Layer 3 Networks

10
Configuring basic VXLAN features
VXLAN configuration task list
Tasks at a glance Remarks
(Required.) Setting the VXLAN hardware resource allocation mode Set the VXLAN hardware resource allocation mode based on the role
of the device in the network.
(Required.) Creating a VXLAN on a VSI N/A
(Required.) Configuring a VXLAN tunnel N/A
(Required.) Assigning VXLAN tunnels to a VXLAN To extend a VXLAN to remote
sites, you must assign VXLAN
tunnels to the VXLAN.
(Required.) Mapping an Ethernet service instance to a VSI Perform this task to assign
customer traffic to VXLANs.
(Optional.) Managing MAC address entries N/A
(Optional.) Configuring a multicast-mode VXLAN
By default, the VTEP floods
VXLAN traffic in unicast mode. If
the network is multicast dense,
configure the VTEP to flood
VXLAN traffic in multicast mode.
(Optional.) Confining floods to the local site N/A
(Optional.) Setting the destination UDP port number of VXLAN packets N/A
(Optional.) Configuring VXLAN packet check
Perform this task to check
incoming VXLAN packets,
including the following items:
•UDP checksum.
•802.1Q VLAN tags in the
inner Ethernet header.
(Optional.) Enabling ARP flood suppression N/A
(Optional.) Disabling remote ARP learning for VXLANs N/A
(Optional.) Enabling VXLAN packet statistics N/A
(Optional.) Testing the reachability of a remote VM N/A
Setting the VXLAN hardware resource allocation
mode
Set the hardware resource allocation mode for VXLAN based on the role of the device.
•l2gw—Applies to VTEPs that perform only Layer 2 forwarding.
•l3gw8k, l3gw16k, l3gw24k, l3gw32k, or l3gw40k—Applies to VXLAN IP gateways.
•border8k, border16k, border24k, border32k, or border40k—Applies to Layer 3 border
gateways that provide access to external networks.
For the hardware resource allocation mode to take effect, you must reboot the device.

11
To set the VXLAN hardware resource allocation mode:
Step Command Remarks
1. Enter system view. system-view N/A
2. Set the VXLAN hardware
resource allocation mode.
hardware-resource vxlan { border8k
| border16k | border24k | border32k |
border40k | l2gw | l3gw8k | l3gw16k |
l3gw24k | l3gw32k | l3gw40k }
By default, the VXLAN
hardware resource allocation
mode is l2gw.
Creating a VXLAN on a VSI
Step Command Remarks
1. Enter system view. system-view N/A
2. Enable L2VPN. l2vpn enable By default, L2VPN is disabled.
3. Create a VSI and enter VSI
view. vsi vsi-name By default, no VSIs exist.
4. (Optional.) Configure a VSI
description. description text By default, a VSI does not have a
description.
5. (Optional.) Set the
broadcast, multicast, or
unknown unicast restraint
bandwidth for the VSI.
restrain { broadcast | multicast
| unknown-unicast } bandwidth
The default broadcast, multicast,
and unknown unicast restraint
bandwidths are 4294967295 kbps.
6. Enable the VSI. undo shutdown By default, a VSI is enabled.
7. Create a VXLAN and enter
VXLAN view. vxlan vxlan-id
By default, no VXLANs exist.
You can create only one VXLAN on
a VSI. The VXLAN ID must be
unique for each VSI.
Configuring a VXLAN tunnel
This task provides basic VXLAN tunnel configuration. For more information about tunnel
configuration and commands, see Layer 3—IP Services Configuration Guide and Layer 3—IP
Services Command Reference.
If the VXLAN packets of two VXLAN tunnels are sent to different next hops in the transport network,
make sure the VXLAN tunnels use different physical outgoing interfaces.
To configure a VXLAN tunnel:
Step Command Remarks
1. Enter system view. system-view N/A
2. Create a VXLAN
tunnel interface and
enter tunnel interface
view.
interface tunnel
tunnel-number mode vxlan
By default, no tunnel interfaces exist.
The endpoints of a tunnel must use the same
tunnel mode.
3. Specify a source IP
address or source
interface for the tunnel.
source { ipv4-address |
interface-type
interface-number }
IMPORTANT:
Do not perform this step if you are using
OVSDB for VXLAN tunnel management.
By default, no source IP address or source

12
Step Command Remarks
interface is specified for a tunnel.
This step specifies the source IP address in
the outer IP header of tunneled VXLAN
packets. If an interface is specified, its primary
IP address is used.
For a multicast-mode VXLAN, the source IP
address cannot be a loopback interface's
address, and the source interface cannot be a
loopback interface.
4. Specify a destination
IP address for the
tunnel. destination ipv4-address
By default, no destination IP address is
specified for a tunnel.
Specify the remote VTEP's IP address. This IP
address will be the destination IP address in
the outer IP header of tunneled VXLAN
packets.
As a best practice, do not configure multiple
VXLAN tunnels to use the same source and
destination IP addresses.
5. (Optional.) Enable
BFD on the tunnel. tunnel bfd enable
destination-mac
mac-address
By default, BFD is disabled on a tunnel.
For BFD sessions to come up, you must
reserve a VXLAN by using the reserved
vxlan command.
BFD sessions cannot come up when uRPF is
enabled. Do not use uRPF if you enable BFD
on VXLAN tunnels. For more information
about uRPF, see Security Configuration
Guide.
6. (Optional.) Return to
system view. quit N/A
7. (Optional.) Specify the
reserved VXLAN. reserved vxlan vxlan-id
By default, no VXLAN has been reserved.
You can specify only one reserved VXLAN on
the VTEP. The reserved VXLAN cannot be the
VXLAN created on any VSI.
Assigning VXLAN tunnels to a VXLAN
To provide Layer 2 connectivity for a VXLAN between two sites, you must assign the VXLAN tunnel
between the sites to the VXLAN.
You can assign multiple VXLAN tunnels to a VXLAN, and configure a VXLAN tunnel to trunk multiple
VXLANs. For a unicast-mode VXLAN, the system floods unknown unicast, multicast, and broadcast
traffic to each tunnel associated with the VXLAN. If a flood proxy server is used, the VTEP sends
flood traffic to the server through the flood proxy tunnel. The flood proxy server replicates and
forwards flood traffic to remote VTEPs.
To assign VXLAN tunnels to a VXLAN:
Step Command Remarks
1. Enter system view. system-view N/A
2. Enter VSI view. vsi vsi-name N/A
3. Enter VXLAN view. vxlan vxlan-id N/A
4. Assign VXLAN tunnels tunnel { tunnel-number By default, a VXLAN does not contain any

13
Step Command Remarks
to the VXLAN. [ flooding-proxy ] | all } VXLAN tunnels.
For full Layer 2 connectivity in the VXLAN,
make sure the VXLAN contains the VXLAN
tunnel between each pair of sites in the
VXLAN.
Enable flood proxy on the tunnel for the VTEP
to send flood traffic to the flood proxy server.
The flood proxy server replicates and forwards
flood traffic to remote VTEPs.
Mapping an Ethernet service instance to a VSI
An Ethernet service instance matches a list of VLANs on a site-facing interface. The VTEP assigns
customer traffic from the VLANs to a VXLAN by mapping the Ethernet service instance to a VSI.
An Ethernet service instance can contain only one match criterion. To change the match criterion,
you must remove the original criterion first. When you remove the match criterion in an Ethernet
service instance, the mapping between the service instance and the VSI is removed automatically.
If an Ethernet service instance contains the encapsulation default match criterion, traffic is
matched as follows:
•The service instance matches any frames if it is the only instance on the interface.
•The service instance matches frames that do not match any other service instance if multiple
instances exist on the interface.
You can create only one Ethernet service instance on a Layer 2 Ethernet interface or Layer 2
aggregate interface if the Ethernet service instance meets the following requirements:
•The frame match criterion is encapsulation default.
•The access mode is VLAN.
To forward the multicast traffic from a VLAN on the interface, make sure an Ethernet service instance
contains the VLAN ID. The interface cannot forward a multicast packet that does not match any
Ethernet service instance.
To map an Ethernet service instance to a VSI:
Step Command Remarks
1. Enter system view. system-view N/A
2. Enter Layer 2 Ethernet
interface view or Layer 2
aggregate interface view.
•interface interface-type
interface-number
•interface bridge-aggregation
interface-number
N/A
3. Create an Ethernet
service instance and
enter Ethernet service
instance view. service-instance instance-id By default, no Ethernet service
instances exist.
4. Configure a frame match
criterion.
•Match frames that do not match
any other service instance on the
interface:
encapsulation default
•Match any 802.1Q tagged or
untagged frames:
encapsulation { tagged |
untagged }
•Match frames tagged with the
By default, an Ethernet service
instance does not contain a
frame match criterion.

14
Step Command Remarks
specified outer and inner 802.1Q
VLAN IDs:
{encapsulation s-vid vlan-id
[ c-vid { vlan-id-list | all } |
only-tagged ]
{encapsulation s-vid
vlan-id-list [ c-vid vlan-id-list ]
5. Map the Ethernet service
instance to a VSI. xconnect vsi vsi-name
[access-mode { ethernet | vlan } ]
[track track-entry-number&<1-3> ]
By default, an Ethernet service
instance is not mapped to any
VSI.
Managing MAC address entries
With VXLAN, local MAC addresses are learned dynamically. You can log MAC changes, but you
cannot manually add local MAC addresses.
Remote-MAC address entries include the following types:
•Manually created static entries.
•Dynamic entries learned in the data plane.
•Entries issued by a remote controller through OpenFlow or OVSDB.
Enabling local-MAC change logging
Local-MAC change logging enables the VXLAN module to send a log message to the information
center when a local MAC address is added or removed.
With the information center, you can set log message filtering and output rules, including output
destinations. For more information about configuring the information center, see Network
Management and Monitoring Configuration Guide.
To enable local-MAC change logging:
Step Command Remarks
1. Enter system view. system-view N/A
2. Enable local-MAC change
logging. vxlan local-mac report By default, local-MAC change
logging is disabled.
Configuring static remote-MAC address entries
Do not configure static remote-MAC entries for VXLAN tunnels that are automatically established by
using EVPN.
•EVPN re-establishes VXLAN tunnels if the transport-facing interface goes down and then
comes up. If you have configured static remote-MAC entries, the entries are deleted when the
tunnels are re-established.
•EVPN re-establishes VXLAN tunnels if you perform configuration rollback. If the tunnel IDs
change during tunnel re-establishment, configuration rollback fails, and static remote-MAC
entries on the tunnels cannot be restored.
For more information about EVPN, see EVPN Configuration Guide.
To configure a static remote-MAC address entry:

15
Step Command Remarks
1. Enter system view. system-view N/A
2. Add a static
remote-MAC address
entry.
mac-address static
mac-address interface
tunnel tunnel-number vsi
vsi-name
By default, VXLAN VSIs do not have static
remote-MAC address entries.
For the setting to take effect, make sure the
VSI's VXLAN has been created and
specified on the VXLAN tunnel.
Disabling remote-MAC address learning
Step Command Remarks
1. Enter system view. system-view N/A
2. Disable remote-MAC
address learning. vxlan tunnel mac-learning
disable
By default, remote-MAC address learning
is enabled.
When network attacks occur, disable
remote-MAC address learning to prevent
the device from learning incorrect remote
MAC addresses. You can manually add
static remote-MAC address entries.
Configuring a multicast-mode VXLAN
A multicast-mode VXLAN supports the following multicast methods:
•PIM—VTEPs and transport network devices run PIM to generate multicast forwarding entries.
On a VTEP, you can use the IP address of a loopback interface as the source IP address for
multicast VXLAN packets. If the VTEP has multiple transport-facing interfaces, PIM dynamically
selects the outgoing interfaces for multicast VXLAN packets.
•IGMP host—VTEPs and transport network devices run PIM and IGMP to generate multicast
forwarding entries.
{Transport-facing interfaces of VTEPs act as IGMP hosts.
{Transport network devices connected to a VTEP run IGMP.
{All transport network devices run PIM.
On a VTEP, you must use the IP address of the transport-facing interface as the source IP
address for multicast VXLAN packets. If the VTEP has multiple transport-facing interfaces,
multicast VXLAN packets are sent to the transport network through the interface that provides
the source IP address for multicast VXLAN packets.
VTEPs in a multicast-mode VXLAN can use different multicast methods.
For a multicast-mode VXLAN to flood traffic, you must perform the following tasks in addition to
multicast-mode configuration:
•Enable IP multicast routing on all VTEPs and transport network devices.
•Configure a multicast routing protocol on transport network devices. A VTEP can be both a
multicast source and multicast group member. As a best practice, use BIDIR-PIM.
•Enable IGMP on transport network devices that are connected to an IGMPhost-enabled VTEP.

16
Configuring a VTEP using the PIM method
Step Command Remarks
1. Enter system view. system-view N/A
2. Enter VSI view. vsi vsi-name N/A
3. Enter VXLAN view. vxlan vxlan-id N/A
4. Assign a multicast group
address for flood traffic, and
specify a source IP address
for multicast VXLAN
packets.
group group-address source
source-address
By default, a VXLAN uses unicast mode
for flood traffic. No multicast group
address or source IP address is
specified for multicast VXLAN packets.
You must assign all VTEPs in a
multicast-mode VXLAN to the same
multicast group.
You can specify the IP address of a
loopback interface as the source IP
address for multicast VXLAN packets.
For multicast traffic to be forwarded
correctly, you must use the source IP
address of an up VXLAN tunnel as the
source IP address for multicast VXLAN
packets.
5. Enter the view of the
transport-facing interface. interface interface-type
interface-number N/A
6. Enable PIM.
•Enable PIM-SM
pim sm
•Enable PIM-DM
pim dm
By default, PIM is disabled on an
interface.
Configuring a VTEP using the IGMP host method
Step Command Remarks
1. Enter system view. system-view N/A
2. Enter VSI view. vsi vsi-name N/A
3. Enter VXLAN view. vxlan vxlan-id N/A
4. Assign a multicast group
address for flood traffic, and
specify a source IP address
for multicast VXLAN
packets.
group group-address source
source-address
By default, a VXLAN uses unicast mode
for flood traffic. No multicast group
address or source IP address is
specified for multicast VXLAN packets.
You must assign all VTEPs in a
multicast-mode VXLAN to the same
multicast group.
5. Enter the view of the
transport-facing interface. interface interface-type
interface-number N/A
6. Enable the IGMP host
feature. igmp host enable
By default, the IGMP host feature is
disabled on an interface.
The IGMP host feature enables the
interface to send IGMP reports in
response to IGMP queries before it can
receive traffic from the multicast group.
The igmp host enable command takes