Monday, 5 January 2026

 Overview of VXLAN


1️⃣ 🌈🔥 VXLAN Setup Breakdown (Start → End — High-Impact Edition)



2️⃣ 🔵💡 UNDERLAY PREPARATION (Physical IP Fabric – FOUNDATION)

Before the VXLAN overlay can operate, the underlay must be fully stable and resilient.

🔧 What you need

🔷 Leaf–Spine switches
🛣️ Dynamic routing (OSPF / IS-IS / BGP)
🎯 Loopbacks (VTEP + Router-ID)
📏 MTU 9216+
🔀 ECMP load balancing

⚙️ What to configure

🟦 IP addressing on all P2P links
🟩 Routing protocol + loopback advertisements
🟨 Fully redundant, stable IP fabric



3️⃣ 🟢🚀 VTEP CREATION (VXLAN Tunnel Engine)

The VTEP (VXLAN Tunnel Endpoint) is the core of VXLAN encapsulation and decapsulation.

🔧 What you need

🎯 Loopback0 = VTEP IP
🌐 NVE / VXLAN interface
🔌 UDP port 4789

⚙️ What to configure

🟢 Create the NVE interface (e.g., nve1)
🟣 Bind the VTEP source to the loopback
🟧 Add all required VNIs



4️⃣ 🟠🔗 VLAN–VNI MAPPING (Local ↔ Global Translation)

Each VLAN must be assigned a unique VNI that all VTEPs agree on.

🌈 Example Mapping

🟡 VLAN 10 → VNI 10010
🟢 VLAN 20 → VNI 10020
🔵 VLAN 30 → VNI 10030

All VTEPs must share identical VLAN–VNI mappings for consistency.



5️⃣ 🟡🧠 EVPN CONTROL PLANE (The Brain Layer)

EVPN (BGP-based) brings intelligence, scalability, and cleaner operations to VXLAN.

⭐ Why EVPN?

🔕 ARP suppression
📘 Control-plane MAC learning
🧩 Multi-tenancy
🔄 Seamless host mobility
📡 EVPN Route Types 2 / 3 / 5

⚙️ What to configure

🟦 BGP neighbors
🏛️ Spines as Route Reflectors
🟢 Leafs as RR clients
🟫 Activate L2VPN EVPN AFI/SAFI



6️⃣ 🟪🌍 ANYCAST GATEWAY (Distributed L3 Gateway Everywhere)

Hosts use the same default gateway IP regardless of their location.

How it works

🟣 Same SVI IP across all leaf switches
🟢 Same virtual MAC
🟦 Local L3 switching with global consistency

Ideal for mobility-heavy, distributed workloads.



7️⃣ 🔴📡 BUM TRAFFIC HANDLING (Broadcast / Unknown / Multicast)

VXLAN manages L2 flooding using one of two models:

1️⃣ 🟥 Ingress Replication (Modern Standard)
• No multicast required
• EVPN signals all remote VTEPs
• Simpler, widely used, scalable

2️⃣ 🟧 Multicast-Based VXLAN (Traditional)
• Requires PIM
• One multicast group per VNI
• Used less frequently today



8️⃣ 🟫🔍 OVERLAY VALIDATION (End-to-End Checks)

Validation ensures that the data-plane and control-plane are operating correctly.

🔍 Verify

🟦 NVE interface is UP
🟧 VNIs are UP
🟢 EVPN BGP peers established
🟪 MAC learning occurs via EVPN
🟡 ARP suppression is active
🟩 Successful ping within same VNI
🔵 Successful inter-VNI routed ping



9️⃣ 🌟 COMPLETE FLOW SUMMARY (Color Edition)
1. 🔵 Build the IP underlay
2. 🟢 Advertise loopbacks
3. 🟡 Create VTEP
4. 🟠 Map VLAN → VNI
5. 🟣 Configure EVPN (BGP)
6. 🟪 Deploy Anycast Gateway
7. 🔴 Choose BUM method
8. 🟫 Validate overlay

No comments:

Post a Comment

🔥 The Hidden Risk of “Wide Open” Internal Policies — And How To Remove Them Safely

In one of my recent projects, I noticed a wide open internal traffic policy in place. Later, I was asked to work on this issue and remove th...