H3C S5560X-EI Series User manual

H3C S5560X-EI Switch Series

VXLAN Configuration Guide

New H3C Technologies Co., Ltd.

http://www.h3c.com.hk

Software version: Release 1110 series

Document version: 6W102-20171207

No part of this manual may be reproduced or transmitted in any form or by any means without prior written

consent of New H3C Technologies Co., Ltd.

Trademarks

H3C, , H3CS, H3CIE, H3CNE,Aolynk, , H3Care, , IRF, NetPilot, Netflow, SecEngine,

SecPath, SecCenter, SecBlade, Comware, ITCMM and HUASAN are trademarks of New H3C Technologies

Co., Ltd.

All other trademarks that may be mentioned in this manual are the property of their respective owners

Notice

The information in this document is subject to change without notice. Every effort has been made in the

preparation of this document to ensure accuracy of the contents, but all statements, information, and

recommendations in this document do not constitute the warranty of any kind, express or implied.

Preface

This configuration guide describes the VXLAN fundamentals and configuration procedures.

This preface includes the following topics about the documentation:

•Audience

•Conventions

•Obtaining documentation

•Technical support

•Documentation feedback

Audience

This documentation is intended for:

•Network planners.

•Field technical support and servicing engineers.

•Network administrators working with the S5560X-EI switch series.

Conventions

The following information describes the conventions used in the documentation.

Command conventions

Convention Description

Boldface Bold text represents commands and keywords that you enter literally as shown.

Italic Italic text represents arguments that you replace with actual values.

[ ] Square brackets enclose syntax choices (keywords or arguments) that are optional.

{ x | y | ... }

Braces enclose a set of required syntax choices separated by vertical bars, from which

you select one.

[ x | y | ... ]

Square brackets enclose a set of optional syntax choices separated by vertical bars,

from which you select one or none.

{ x | y | ... } *

Asterisk marked braces enclose a set of required syntax choices separated by vertical

bars, from which you select a minimum of one.

[ x | y | ... ] *

Asterisk marked square brackets enclose optional syntax choices separated by vertical

bars, from which you select one choice, multiple choices, or none.

&<1-n> The argument or keyword and argument combination before the ampersand (&) sign

can be entered 1 to n times.

# A line that starts with a pound (#) sign is comments.

GUI conventions

Convention Description

Boldface Window names, button names, field names, and menu items are in Boldface. For

example, the New User window opens; click OK.

> Multi-level menus are separated by angle brackets. For example, File > Create >

Convention Description

Folde

Symbols

Convention Description

WARNING! An alert that calls attention to important information that if not understood or followed

can result in personal injury.

CAUTION: An alert that calls attention to important information that if not understood or followed

can result in data loss, data corruption, or damage to hardware or software.

IMPORTANT: An alert that calls attention to essential information.

NOTE: An alert that contains additional or supplementary information.

TIP: An alert that provides helpful information.

Network topology icons

Convention Description

Represents a generic network device, such as a router, switch, or firewall.

Represents a routing-capable device, such as a router or Layer 3 switch.

Represents a generic switch, such as a Layer 2 or Layer 3 switch, or a router that

supports Layer 2 forwarding and other Layer 2 features.

Represents an access controller, a unified wired-WLAN module, or the access

controller engine on a unified wired-WLAN switch.

Represents an access point.

Represents a wireless terminator unit.

Represents a wireless terminator.

Represents a mesh access point.

Represents omnidirectional signals.

Represents directional signals.

Represents a security product, such as a firewall, UTM, multiservice security

gateway, or load balancing device.

Represents a security module, such as a firewall, load balancing, NetStream, SSL

VPN, IPS, or ACG module.



Examples provided in this document

Examples in this document might use devices that differ from your device in hardware model,

configuration, or software version. It is normal that the port numbers, sample output, screenshots,

and other information in the examples differ from what you have on your device.

Obtaining documentation

To access the most up-to-date H3C product documentation, go to the H3C website at

http://www.h3c.com.hk

To obtain information about installation, configuration, and maintenance, click

http://www.h3c.com.hk/Technical_Documents

To obtain software version information such as release notes, click

http://www.h3c.com.hk/Software_Download

Technical support

service@h3c.com

http://www.h3c.com.hk

Documentation feedback

You can e-mail your comments about product documentation to info@h3c.com.

We appreciate your comments.

Contents

VXLAN overview··············································································1

VXLAN network model················································································································1

VXLAN packet format ·················································································································2

Working mechanisms··················································································································3

Assignment of traffic to VXLANs·····························································································3

MAC learning ·····················································································································3

Traffic forwarding ················································································································4

Access mode of VSIs···········································································································6

ARP flood suppression················································································································6

VXLAN IP gateways ···················································································································7

Protocols and standards··············································································································7

Configuring basic VXLAN features·······················································8

Configuration restrictions and guidelines·························································································8

VXLAN configuration task list········································································································8

Setting the forwarding mode for VXLANs ························································································9

Creating a VXLAN on a VSI ·········································································································9

Configuring a VXLAN tunnel·········································································································9

Assigning VXLAN tunnels to a VXLAN··························································································10

Mapping ACs to a VSI···············································································································10

Mapping a static Ethernet service instance to a VSI··································································11

Mapping dynamic Ethernet service instances to VSIs································································11

Managing MAC address entries ··································································································12

Configuring static remote-MAC address entries ·······································································12

Disabling remote-MAC address learning·················································································12

Enabling local-MAC change logging ······················································································13

Confining floods to the local site··································································································13

Setting the destination UDP port number of VXLAN packets ·····························································14

Enabling ARP flood suppression ·································································································14

Disabling remote ARP learning for VXLANs···················································································14

Displaying and maintaining VXLANs ····························································································15

Unicast-mode VXLAN configuration example·················································································15

Network requirements ········································································································15

Configuration procedure ·····································································································16

Verifying the configuration···································································································19

Configuring VXLAN IP gateways ·······················································21

Overview································································································································21

VXLAN IP gateways separated from VTEPs············································································21

Centralized VXLAN IP gateway deployment············································································22

Distributed VXLAN IP gateway deployment·············································································23

Configuration prerequisites ········································································································26

Configuring a centralized VXLAN IP gateway·················································································26

Configuring a distributed VXLAN IP gateway ·················································································27

Configuration restrictions and guidelines ················································································27

Configuration prerequisites··································································································27

Configuration procedure ·····································································································27

Configuring a VSI interface ········································································································28

Displaying and maintaining VXLAN IP gateway··············································································29

VXLAN IP gateway configuration examples···················································································29

Centralized VXLAN IP gateway configuration example······························································29

Distributed VXLAN IPv4 gateway configuration example····························································34

Distributed VXLAN IPv6 gateway configuration example····························································43

Index···························································································54

VXLAN overview

Virtual eXtensible LAN (VXLAN) is a MAC-in-UDP technology that provides Layer 2 connectivity

between distant network sites across an IP network. VXLAN is typically used in data centers and

campus access networks for multitenant services.

VXLAN provides the following benefits:

•Support for more virtual switched domains than VLANs—Each VXLAN is uniquely

identified by a 24-bit VXLAN ID. The total number of VXLANs can reach 16777216 (224). This

specification makes VXLAN a better choice than 802.1Q VLAN to isolate traffic for user

terminals.

•Easy deployment and maintenance—VXLAN requires deployment only on the edge devices

of the transport network. Devices in the transport network perform typical Layer 3 forwarding.

The device supports only IPv4-based VXLAN. IPv6-based VXLAN is not supported.

VXLAN network model

As shown in Figure 1, a VXLAN is a virtual Layer 2 network (known as the overlay network) built on

top of an existing physical Layer 3 network (known as the underlay network). The overlay network

encapsulates inter-site Layer 2 frames into VXLAN packets and forwards the packets to the

destination along the Layer 3 forwarding paths provided by the underlay network. The underlay

network is transparent to tenants, and geographically dispersed sites of a tenant are merged into a

Layer 2 network.

The transport edge devices assign user terminals to different VXLANs, and then forward traffic

between sites for user terminals by using VXLAN tunnels. Supported user terminals include PCs,

wireless terminals, and user terminals on servers.

The transport edge devices are VXLAN tunnel endpoints (VTEP).

An H3C VTEP uses VSIs and VXLAN tunnels to provide VXLAN services.

•VSI—A virtual switch instance is a virtual Layer 2 switched domain. Each VSI provides

switching services only for one VXLAN. VSIs learn MAC addresses and forward frames

independently of one another. User terminals in different sites have Layer 2 connectivity if they

are in the same VXLAN.

•VXLAN tunnel—Logical point-to-point tunnels between VTEPs over the transport network.

Each VXLAN tunnel can trunk multiple VXLANs.

VTEPs encapsulate VXLAN traffic in the VXLAN, outer UDP, and outer IP headers. The devices in

the transport network forward VXLAN traffic only based on the outer IP header.

Figure 1 VXLAN network model

VXLAN packet format

As shown in Figure 2, a VTEP encapsulates a frame in the following headers:

•8-byte VXLAN header—VXLAN information for the frame.

{Flags—If the I bit is 1, the VXLAN ID is valid. If the I bit is 0, the VXLAN ID is invalid. All

other bits are reserved and set to 0.

{24-bit VXLAN ID—Identifies the VXLAN of the frame. It is also called the virtual network

identifier (VNI).

•8-byte outer UDP header for VXLAN—The default VXLAN destination UDP port number is

4789.

•20-byte outer IP header—Valid addresses of VTEPs or VXLAN multicast groups on the

transport network. Devices in the transport network forward VXLAN packets basedon the outer

IP header.

Figure 2 VXLAN packet format

Underlay network

Overlay network

VTEP 1 VTEP 2

Site 2

Site 1

VXLAN tunnel

Transport

network

Terminal

VSI/VXLAN 10

VSI/VXLAN 20

VSI/VXLAN 10

VSI/VXLAN 20

Terminal

Working mechanisms

The VTEP uses the following process to forward an inter-site frame:

1. Assigns the frame to its matching VXLAN if the frame is sent between sites.

2. Performs MAC learning on the VXLAN's VSI.

3. Forwards the frame through VXLAN tunnels.

This section describes this process in detail. For intra-site frames in a VSI, the system performs

typical Layer 2 forwarding, and it processes 802.1Q VLAN tags as described in "Access mode of

VSIs."

Assignment of traffic to VXLANs

Traffic from the local site to a remote site

The VTEP uses an Ethernet service instance to match customer traffic on a site-facing interface. The

VTEP assigns customer traffic to a VXLAN by mapping the Ethernet service instance to a VSI.

An Ethernet service instance is identical to an attachment circuit (AC) in L2VPN.An Ethernet service

instance matches a list of VLANs on a Layer 2 Ethernet interface by using a frame match criterion.

The frame match criterion specifies the characteristics of traffic from the VLANs, such as tagging

status and VLAN IDs.

As shown in Figure 3, Ethernet service instance 1 matches VLAN 2 and is mapped to VSIA(VXLAN

10). When a frame from VLAN 2 arrives, the VTEPassigns the frame to VXLAN 10, and looks up VSI

A's MAC address table for the outgoing interface.

Figure 3 Identifying traffic from the local site

Traffic from a remote site to the local site

When a frame arrives at a VXLAN tunnel, the VTEP uses the VXLAN ID in the frame to identify its

VXLAN.

MAC learning

The VTEP performs source MAC learning on the VSI as a Layer 2 switch.

•For traffic from the local site to theremote site, theVTEPlearns the source MAC address before

VXLAN encapsulation.

•For traffic from the remote site to the local site, the VTEP learns the source MAC address after

removing the VXLAN header.

A VSI's MAC address table includes the following types of MAC address entries:

•Local MAC—MAC entries dynamically learned from the local site. The outgoing interfaces for

the MAC address entries are site-facing interfaces. VXLAN does not support static local-MAC

entries.

•Remote MAC—MAC entries learned from a remote site. The outgoing interfaces for the MAC

address entries are VXLAN tunnel interfaces.

{Static—Manually added MAC entries.

{Dynamic—MAC entries learned in the data plane from incoming traffic on VXLAN tunnels.

The learned MAC addresses are contained in the inner Ethernet header.

For a MAC address, the manual static entry has higher priority than the dynamic entry.

Traffic forwarding

The device performs Layer 2 or Layer 3 forwarding for VXLANs depending on your configuration.

•In Layer 3 forwarding mode, the device uses the ARPor ND table to forward traffic for VXLANs.

•In Layer 2 forwarding mode, the device uses the MAC address table to forward traffic for

VXLANs.

Use Layer 3 forwarding mode if you want to use the device as a VXLAN IP gateway.

This section describes the Layer 2 forwarding processes. For information about Layer 3 forwarding,

see "Configuring VXLAN IP gateways."

AVTEP uses the following processes to forward traffic at Layer 2:

•Unicast process—Applies to destination-known unicast traffic.

•Flood process—Applies to multicast, broadcast, and unknown unicast traffic.

When the VTEP forwards VXLAN traffic, it processes the 802.1Q tag in the inner Ethernet header

depending on the VSI access mode (VLAN or Ethernet mode). In VLAN access mode, sites can use

different VLANs to provide the same service. For more information, see "Access mode of VSIs."

Unicast

The following process (see Figure 4) applies to a known unicast frame between sites:

1. The source VTEP encapsulates the Ethernet frame in the VXLAN/UDP/IP header.

In the outer IP header, the source IP address is the source VTEP's VXLAN tunnel source IP

address. The destination IP address is the VXLAN tunnel destination IP address.

2. The source VTEP forwards the encapsulated packet out of the outgoing VXLAN tunnel

interface found in the VSI's MAC address table.

3. The intermediate transport devices (P devices) forward the frame to the destination VTEP by

using the outer IP header.

4. The destination VTEP removes the headers on top of the inner Ethernet frame. It then performs

MAC address table lookup in the VXLAN's VSI to forward the frame out of the matching

outgoing interface.

Other manuals for S5560X-EI Series

Table of contents

Popular Switch manuals by other brands

URC

URC Total Control MFS-8 installation manual

Azbil

Azbil HPQ-D11 user manual

Sony

Sony DFS-900M operating instructions

SICK

SICK i17S operating instructions

F&F

F&F SZR-277 quick start guide

Shure

Shure UAMS/BK user guide

Dräger

Dräger X-zone Switch Off Instructions for use

Asco

Asco Joucomatic 349 Series manual

BT Mini Hub user guide

D-Link

D-Link DES-1226G manual

Johnson Controls

Johnson Controls FS80-C installation instructions

Alcatel-Lucent

Alcatel-Lucent 7450 ESS-12 Configuration guide

MicroNet

MicroNet SP1200A user manual

Ruijie

Ruijie RG-PF2920 Series Hardware installation and reference guide

Altinex

Altinex DA1914SX user guide

MiLAN

MiLAN MIL-SM2401M user guide

RJM

RJM MASTERMIND PBC/6X user manual

Atlas

Atlas MMK-KVM8 owner's manual