Usage Scenario

Static ARP entries are manually configured and maintained. They will not be aged out or overridden by dynamic ARP entries. Therefore, you can run the arp static bridge-domain command on an interface of a VXLAN network to configure static ARP entries to increase communication security. Static ARP entries enable the local device and a specified device to communicate with each other using only specified MAC addresses. Attackers cannot modify mappings between IP addresses and MAC addresses in static ARP entries.

Prerequisites

The outbound interface has been added to a VLAN and bound to a BD.

Precautions

• If a static ARP entry already exists, the new configuration cannot be delivered.

• The specified ip-address must be in the same network segment as the outbound interface address in the ARP entry.

• To specify the vid vlan-id and cevid vlan-id parameters, set the same encapsulation type as that on the interface first.

• When you configure a static ARP entry on an interface of the card except the SA, and X series card, you must configure a static MAC address entry for the MAC address in the ARP entry. Otherwise, the switch will broadcast traffic from this MAC address.

Usage Scenario

Static ARP entries are manually configured and maintained. They will not be aged out or overridden by dynamic ARP entries. Running the arp static vni command on a device to configure static ARP entries for a VXLAN tunnel increases communication security. Static ARP entries enable the local device and a specified device to communicate with each other using only specified MAC addresses. Attackers cannot modify mappings between IP addresses and MAC addresses in static ARP entries.

Prerequisites

A VXLAN tunnel and a Layer 3 gateway have been configured.

Precautions

• If a static ARP entry already exists, the new configuration cannot be delivered.

• The specified IP address must be in the same network segment as the outbound interface address in the ARP entry.

Usage Scenario

VXLAN needs to be deployed on a downlink interface to provide access services and an uplink interface to establish a VXLAN tunnel.

To create a BD based on encapsulation mode, create a Layer 2 sub-interface first. Then run the encapsulation (Layer 2 sub-interface view) command to configure a supported encapsulation mode on the sub-interface. After you run the bridge-domain (Layer 2 sub-interface view) command to associate a Layer 2 sub-interface with a BD, packets containing the same VLAN tag from different LANs can communicate at Layer 2.

Prerequisites

Precautions

One Layer 2 sub-interface can be associated with only one BD.

For the BD that bind to the Layer 2 sub-interfaces which use dot1q encapsulation, the VBDIF interface of this BD cannot be created on the device.

BDs are Layer 2 bridge domains on a large Layer 2 network constructed using VXLAN. VXLAN packets can be forwarded at Layer 2 within a BD through a VXLAN tunnel.

After you run the bridge-domain command to create a BD, you can complete other VXLAN configurations in the BD.

Usage Scenario

When a large number of broadcast packets are transmitted on a network, a lot of network resources are occupied, and services on the network are affected. You can run the broadcast-suppression command to enable broadcast traffic suppression in a BD and configure the maximum number of broadcast packets that can pass through a BD. When the broadcast traffic volume exceeds the specified threshold, the system discards excess broadcast packets.

Precautions

The EA, EC, ED series cards of the S7700 do not support traffic suppression in a BD.

If you have configured multiple BDs using the bridge-domain (system view) command, run the description command in the corresponding BD view to configure the description for each BD. BD description helps you quickly understand the function of each BD, facilitating service management.

After BDs are created on a device, you can run the display bridge-domain command to view the configuration of a specified BD or all BDs.

Usage Scenario

You can run the display bridge-domain statistics command to view packet statistics in a BD. The information helps you locate faults and simplifies VXLAN network maintenance.

Before using this command to view packet statistics in a BD, run the statistics enable (BD view) command in the BD view to enable packet statistics collection in the BD.

Precautions

Only the X series card support VXLAN packet statistics collection.

To monitor the NVE interface status or locate an NVE interface fault on the VXLAN network, run the display interface nve command to check the running status and statistics of the NVE interface.

Usage Scenario

To monitor an interface or locate an interface fault, you can use the display interface vbdif command to view the interface status, interface configuration, and traffic statistics on the interface. The information helps you locate faults in the system or on an interface.

Prerequisites

The specified VBDIF interface has been created.

Usage Scenario

The MAC address table of a switch stores MAC addresses of other devices. The switch queries the MAC address table to quickly locate the outbound interface for data forwarding. You can run the display mac-address bridge-domain command to view MAC address entries of a specified BD.

Follow-up Procedure

If any MAC address entry in the command output is incorrect, run the undo mac-address command to delete the entry or run the mac-address static command to add a correct one.

The Simple Network Management Protocol (SNMP) is a standard network management protocol widely used on TCP/IP networks. It uses a central computer (a network management station) that runs network management software to manage network elements. The management agent on the network element automatically reports traps to the network management station. After that, the network administrator immediately takes measures to resolve the problem.

The display snmp-agent trap feature-name adpvxlan all command displays whether all trap functions of the ADPVXLAN module are enabled.

Usage Scenario

After completing VXLAN configuration, you can run the display vxlan peer command to view information about the source and destination IP address bound to the VNI.

Precautions

Before running the display vxlan peer command, ensure that the device has been configured with VNIs. Otherwise, the command output is meaningless.

Usage Scenario

You can run the display vxlan statistics command to view VXLAN tunnel packet statistics. The information helps you locate faults and simplifies VXLAN network maintenance.

Before using this command to view VXLAN tunnel packet statistics, run the vxlan statistics enable command on an NVE interface to enable statistics collection on VXLAN tunnel packets.

Precautions

Only the X series card support VXLAN packet statistics collection.

After VXLAN tunnels are established, you can run the display vxlan tunnel command to view VXLAN tunnel information.

Applications

After VXLAN is configured, you can run the display vxlan vni command to view information about BDs associated with VNIs and VNI status.

Precautions

Before running the display vxlan vni command, ensure that the device has been configured with VNIs. Otherwise, the command output is meaningless.

Usage Scenario

On a VXLAN network, a Layer 2 sub-interface functions as a VXLAN service access point to forward data packets in a BD.

Packets passing through a physical interface may contain one or two VLAN tags or no VLAN tag. After you run the encapsulation command in a Layer 2 sub-interface view to configure the encapsulation mode, the sub-interface can forward only specified types of packets.

Prerequisites

Run the command interface interface-type interface-number.subnum mode l2 to create a VXLAN Layer 2 sub-interface

Precautions

When configuring an encapsulation mode on a Layer 2 sub-interface, pay attention to the following points:

• Only interfaces on the X, SC, and FC series cards support set the encapsulation mode to qinq.

• The VLAN ID in dot1q mode or outer VLAN ID in qinq mode cannot be the same as the allowed VLAN of the corresponding main interface or the global VLAN.

• On the same main interface, the VLAN ID in dot1q mode and the outer VLAN ID in qinq mode must be different.

• After NAC authentication is configured on the main interface, the traffic encapsulation type on a Layer 2 sub-interface cannot be set to default.

• When the encapsulation mode of a Layer 2 sub-interface is default, the corresponding main interface cannot be added to any VLAN, including VLAN 1.

• Before the encapsulation mode of a Layer 2 sub-interface is set to default, the main interface has only one sub-interface.

• After the encapsulation mode of a Layer 2 sub-interface is set to default, no other sub-interface can be created on the main interface.

• When the encapsulation mode of a Layer 2 sub-interface is set to untag, other sub-interfaces of the main interface cannot be set to untag.

• You can configure only one encapsulation mode for each Layer 2 sub-interface. If an encapsulation mode has been configured for a Layer 2 sub-interface, run the undo encapsulation command to delete the original mode before you configure another mode.

Usage Scenario

To make full use of advantages of server virtualization, you can deploy VXLAN to connect to multiple tenants. VXLAN tunnel information needs to be configured on an NVE interface, so the interface nve command needs to be executed to create the NVE interface.

Precautions

After a VXLAN tunnel is configured, running the undo interface nve command will delete the specified NVE interface and all the configuration of the NVE interface.

Usage Scenario

IP routes are required for communication between VXLAN networks on different network segments and between VXLAN and non-VXLAN networks.

To enable the communication, run the interface vbdif command to create a VBDIF interface for each BD and assign an IP address to the VBDIF interface. A VBDIF interface is a Layer 3 logical interface and can be configured with an IP address.

Prerequisites

The specified BD has been created.

Usage Scenario

VXLAN needs to be deployed on a downlink interface to provide access services and an uplink interface to establish a VXLAN tunnel.

After you run this command to associate specified VLANs with a BD, different VLANs associated with the same BD form a large Layer 2 network. Users belong to these VLANs can communicate at Layer 2 through VXLAN tunnels.

Prerequisites

The VLAN to be bound to the BD has been created using the vlan command.

Precautions

Usage Scenario

When a large number of multicast packets are transmitted on a network, a lot of network resources are occupied, and services on the network are affected. You can run the multicast-suppression command to enable multicast traffic suppression in a BD and configure the maximum number of multicast packets that can pass through a BD. When the multicast traffic volume exceeds the specified threshold, the system discards excess multicast packets.

Precautions

The EA, EC, ED series cards of the S7700 do not support traffic suppression in a BD.

Usage Scenario

When the device creates a MAC address table by learning source MAC addresses, the device cannot distinguish packets from authorized and unauthorized users. This threatens network security. If an unauthorized user uses the MAC address of an authorized user as the source MAC address of attack packets and connects to another interface of the device, the device learns an incorrect MAC address entry. The device incorrectly forwards the packets to the unauthorized user. Actually, the packets should be forwarded to the authorized user. You can run the mac-address static bridge-domain command to add a static MAC address entry to the MAC address table on the VXLAN access side. The static MAC address entry binds the MAC address to a specified interface, which prevents unauthorized users from intercepting data of authorized users. In addition, a manually configured static MAC address entry improves the unicast packet forwarding efficiency and saves bandwidth.

• The interface has been added to a BD.

Usage Scenario

When the device creates a MAC address table by learning source MAC addresses, the device cannot distinguish packets from authorized and unauthorized users. This threatens network security. If an unauthorized user uses the MAC address of an authorized user as the source MAC address of attack packets and connects to another interface of the device, the device learns an incorrect MAC address entry. The device incorrectly forwards the packets to the unauthorized user. Actually, the packets should be forwarded to the authorized user. You can run the mac-address static bridge-domain vni command to add a static MAC address entry to the MAC address table on the VXLAN tunnel side. The static MAC address entry binds the MAC address to a specified interface, which prevents unauthorized users from intercepting data of authorized users. In addition, a manually configured static MAC address entry improves the unicast packet forwarding efficiency and saves bandwidth.

A VXLAN tunnel has been created.

Usage Scenario

Before you collect packet statistics in a specified BD within a specific period, run the reset bridge-domain statistics command to clear the existing statistics in the BD to ensure statistics accuracy.

Precautions

Packet statistics cannot be restored after you clear them; therefore, exercise caution before you run the reset bridge-domain statistics command.

Usage Scenario

Before you collect VXLAN tunnel packet statistics within a specific period, run the reset vxlan statistics command to clear the existing statistics to ensure statistics accuracy.

Precautions

Packet statistics cannot be restored after you clear them; therefore, exercise caution before you run the reset vxlan statistics command.

Usage Scenario

If a switch uses an interface on the ES1D2X48SEC4 card as the tunnel-side interface, the switch can decapsulate received VXLAN packets and forward them at Layer 3 only after a VXLAN loopback interface is configured. As a result, you need to configure an Eth-Trunk as the VXLAN loopback interface when the switch functions as the Layer 3 VXLAN gateway.

Follow-up Procedure

Run the trunkport command to add member interfaces to the VXLAN loopback interface.

Precautions

• After an Eth-Trunk is configured as a VXLAN loopback interface, STP is automatically disabled on the Eth-Trunk. The Eth-Trunk then does not support STP configuration commands. After the configuration is canceled, STP is automatically enabled on the Eth-Trunk.

• Only one Eth-Trunk on a switch can be configured as the VXLAN loopback interface. VXLAN packets from all VBDIF interfaces are encapsulated and decapsulated by this loopback interface.

• An Eth-Trunk containing member interfaces cannot be configured as a VXLAN loopback interface.

• The configurations allowed on an Eth-Trunk to be configured as a loopback interface include description, enable snmp trap updown, jumboframe enable, qos car inbound, qos phb marking enable, set flow-stat interval, shutdown, traffic-policy (interface view), and trust. If other configurations exist on the Eth-Trunk, the Eth-Trunk cannot be configured as a loopback interface.

• After an Eth-Trunk is configured as a loopback interface, the Eth-Trunk supports only the following configurations: authentication open ucl-policy enable, description, enable snmp trap updown, jumboframe enable, mixed-rate link enable, qos car inbound, qos phb marking enable, set flow-stat interval, shutdown, statistic enable (interface view), traffic-policy (interface view), vcmp disable, and trust.

• Before running the undo service type vxlan-tunnel command, delete all the member interfaces from the Eth-Trunk.

• Only interfaces on the X series and ES1D2X48SEC4 cards can be added to a VXLAN loopback interface.

Usage Scenario

When VXLAN is configured, the device supports 4095 BDs by default. If you want more than 4095 BDs, run the set vxlan resource super-mode command to set the super VXLAN resource mode. After this command is configured, the device supports 16000 BDs.

Precautions

• After setting the super VXLAN resource mode, save the configuration and then restart the device to make the configuration take effect.

• When the super VXLAN resource mode is configured, the forwarding performance of some services may degrade, such as the IP multicast, VPLS, VLAN mapping, Layer 3 traffic forwarding of sub-interfaces, and VLAN stacking services.

The ADPVXLAN module is not configured with the function of excessive traps. To enable the traps of one or more events, you can specify trap-name.

Usage Scenario

VXLAN needs to be deployed on a downlink interface to provide access services and an uplink interface to establish a VXLAN tunnel.

To establish a VXLAN tunnel, configure IP addresses for the source and destination VTEPs.

To configure an IP address for a source VTEP, run this command. When access service packets reach a Network Virtualization Edge (NVE), the VTEP encapsulates the packets based on the IP addresses of source and destination VTEPs and forwards them.

Precautions

You can specify the IP address of a physical interface or a loopback interface as the IP address of the source VTEP. The address of a loopback interface is recommended.

Generally, the NVE interfaces of different devices must be configured with different VTEP addresses; otherwise, traffic forwarding errors may occur.

Follow-up Procedure

Run the vni head-end peer-list command to configure an IP address for a destination VTEP.

Usage Scenario

Packet statistics in a BD provide information about the number of packets going into and leaving a BD.

To view packet statistics in a BD, run the statistics enable and display bridge-domain statistics commands in sequence. The information helps you locate faults.

Precautions

Only the X series card support VXLAN packet statistics collection.

The MAC address table space is limited on a device. If the number of MAC address entries reaches the upper limit, the device cannot learn new MAC address entries before some entries in the MAC address table are aged out. In this case, the device broadcasts packets from new users, wasting network resources. To solve the problem, you can run the undo mac-address bridge-domain command to manually delete unnecessary MAC address entries of a specified BD.

Usage Scenario

When a large number of unknown unicast packets are transmitted on the network, a lot of network resources are occupied, and services on the network are affected. You can run the unknown-unicast-suppression command to enable unknown unicast traffic suppression in a BD and configure the maximum number of unknown unicast packets that can pass through a BD. When the unknown unicast traffic volume exceeds the specified threshold, the system discards excess unknown unicast packets.

Precautions

The EA, EC, ED series cards of the S7700 do not support traffic suppression in a BD.

Usage Scenario

After the ingress of a VXLAN tunnel receives broadcast, unknown unicast, and multicast (BUM) packets, it replicates these packets and sends a copy to each VTEP in the ingress replication list. The ingress replication list is a collection of remote VTEP IP addresses to which the ingress of a VXLAN tunnel should send replicated BUM packets.

If a source VTEP on a VXLAN connects to multiple remote VTEPs on the same VXLAN segment, run the vni head-end peer-list command to configure an ingress replication list that contains the IP addresses of those remote VTEPs. After the source NVE receives BUM packets, the local VTEP sends a copy of the BUM packets to every VTEP in the list.

Precautions

• You need to run the vni head-end peer-list command to configure the corresponding VTEP address even if the source VTEP matches only one destination VTEP.

• Run the ping command to check whether a reachable route exists between two ends of the tunnel. If there is a reachable route, the tunnel can be established and packets can be normally forwarded. If the two devices have a route to each other but the route is unreachable, the tunnel can still go Up but packets cannot be forwarded.

Usage Scenario

VXLAN tunnel packet statistics provide information about the number of packets going into and leaving a VXLAN tunnel.

To view VXLAN tunnel packet statistics, run the vxlan statistics enable and display vxlan statistics commands in sequence.

Packet statistics collection based on the VXLAN tunnel and VNI and packet statistics collection based on the VXLAN tunnel are mutually exclusive. For example, if the vxlan statistics peer 10.1.1.1 vni 10 enable command is configured, do not configure the vxlan statistics peer 10.1.1.1 enable command. If the vxlan statistics peer 10.1.1.1 enable command is configured, do not configure the vxlan statistics peer 10.1.1.1 vni 10 enable command.

Precautions

Only the X series card support VXLAN packet statistics collection.

Similar to VLAN ID, VNI is used to distinguish VXLAN segments.

On the VXLAN network, one VXLAN segment is a large Layer 2 BD; therefore, VNI and BD have a one-to-one mapping relationship.

You can run this command to configure the mapping relationship between VNIs and BDs. In this way, the VTEP can forward received packets through a correct VXLAN tunnel based on the mapping between BDs and VNIs.