PPTAPICMod05 - VxLAN Overlays

Nexus9000StandaloneModeVxLANOverlays,Thenextgenerationofdatacenterswitching,VxLANDeepDiveOverview,Thismodulewillcover:IntroductiontoOverlaysVxLANInDepthVxLANonNexus9000,VxLANDeepDiveIntroductiontoDataCenterOverlays,VxLANDeepDiveOverlaysWhyOverlays?,FlexibleOverlayVirtualNetworkMobilityTrackend-pointattachatedgesScaleReducecorestateDistributeandpartitionstatetonetworkedgeFlexibility/ProgrammabilityReducednumberoftouchpoints,RobustUnderlay/FabricHighCapacityResilientFabricIntelligentPacketHandlingProgrammable&Manageable,VxLANDeepDiveOverlaysOverlayTaxonomy,OverlayControlPlane,Encapsulation,Service=VirtualNetwork(VN),UnderlayControlPlane,UnderlayNetwork,Hosts(end-points),VxLANDeepDiveOverlaysTypesofOverlayService,EmulateaLANsegmentTransportEthernetFrames(IPandnon-IP)Singlesubnetmobility(L2domain)ExposuretoopenL2floodingUsefulinemulatingphysicaltopologies,AbstractIPbasedconnectivityTransportIPPacketsFullmobilityregardlessofsubnetsContainnetworkrelatedfailures(e.g.-floods)Usefulinabstractingconnectivityandpolicy,Layer2Overlays,Layer3Overlays,VxLANDeepDiveOverlaysTypesofOverlayEdgeDevices,Virtualend-pointsonlySingleadmindomainVXLAN,NVGRE,STT,TunnelEndPoint,PhysicalandVirtualResiliency+ScaleCross-organizations/FederationOpenStandards,NetworkOverlays,IntegratedOverlays,HostOverlays,Router/switchend-pointsProtocolsforresiliency/loopsTraditionalVPNsOTV,VXLAN,VPLS,LISP,VxLANOverlaysOverviewofVXLAN,VxLANDeepDiveOverviewTheWhyandHowofVxLAN,ChallengesVxLANAddressesVLANScalabilityVXLANextendstheL2SegmentIDfieldto24-bits,potentiallyallowingupto16millionuniqueL2SegmentsoverthesamenetworkLayer2SegmentElasticityoverLayer3BoundaryVXLANencapsulatesL2frameinIP-UDPheaderallowingL2adjacencyacrossrouterboundariesVXLANTechnologyOverviewMAC-in-UDPencapsulationLeveragesmulticastinthetransportnetworktosimulatefloodingbehaviorforbroadcast,unknownunicastandmulticastinthelayer2segmentLeverageECMPtoachieveoptimalpathusageoverthetransportnetwork,EthernetHeader,Payload,FCS,OuterIP,OuterUDP,VXLAN,OuterEthernet,InnerEthernet,Payload,NewFCS,InstanceID,1,Reserved,Reserved,Flags,Rsvd,Rsvd,8Bytes,1Byte,OuterUDPDestinationPort=VXLAN(originally8472,recentlyupdatedto4789)OuterUDPSourcePort=HashofInnerFrameHeaders(optional),VxLANDeepDiveOverviewVirtualeXtensibleLAN(VXLAN),VirtualeXtensibleLAN(VXLAN)isaLayer2overlayschemeoveraLayer3network.A24-bitVXLANSegmentIDorVXLANNetworkIdentifier(VNI)isincludedintheencapsulationtoprovideupto16MVXLANsegmentsfortrafficisolation/segmentation,incontrasttothe4KsegmentsachievablewithVLANs.EachofthesesegmentsrepresentsauniqueLayer2broadcastdomain,andcanbeadministeredinsuchawaythatitcanuniquelyidentifyagiventenantsaddressspaceorsubnet,VxLANDeepDiveOverviewFrameFormat,FCS,OuterMacHeader,OuterIPHeader,UDPHeader,VXLANHeader,OriginalL2Frame,FCS,14Bytes(4bytesoptional),20Bytes,8Bytes,8Bytes,48,48,16,16,16,72,8,16,32,32,16,16,16,16,8,24,24,8,EthernetframesizemustbeincreasedtoallowfortheUDP/VxLANheaders.,VxLANDeepDiveOverviewVirtualTunnelEndPointVirtual/Physical,VLAN10,VLAN20,vSwitchVTEP,vSwitchVTEP,SwitchVTEP,VNI1000,VNI2000,VXLANcanbeimplementedonbothHypervisor-basedVirtualSwitchestoallowforscalableVMdeployments,aswellasonPhysicalswitches,whichprovidestheabilitytobridgeVXLANsegmentsbackintoVLANsegments.Inthesecases,thePhysicalSwitchinstantiatesaVirtualTunnelEndPoint(VTEP),andfunctionasaVXLANGateway,VxLANDeepDiveOverviewVTEPInterfaces,VXLANterminatesitstunnelsonVirtualTunnelEndPoints(VTEPs).EachVTEPhastwointerfaces:OnetoprovidebridgingfunctionforlocalhostsTheotherhasanIPinterfaceinthecorenetworkforVxLANencapsulation/de-encapsulation,VxLANDeepDiveOverviewVTEPHandlingofMulti-DestinationTraffic,Sinceacontrol/signalingprotocolhasnotbeendefined,emulationofMulti-Destinationtraffic(Broadcast,Multicast,UnknownUnicast)ishandledthroughtheVXLANIPunderlaythroughtheuseofsegmentcontrolmulticastgroups,IPNetwork,VTEP1IP-1,VTEP2IP-2,VTEP-2,EndSystemBMAC-BIP-B,VTEP1IP-1MAC-1,VTEP2IP-2MAC-2,VTEP3IP-3,VTEP-1,VTEP-3,EndSystem,EndSystem,6,EndSystemAMAC-AIP-A,VxLANDeepDiveOverviewVTEPDiscoveryandAddressLearning,Router-1,MAC-AIP-A:00,MAC-BIP-B:01,MAC-1IP-1:,MAC-4IP-4:,MAC-2IP-2:,MAC-3IP-3:,IPNetwork,Router-2,VTEP-1,VTEP-2,2,3,RoutedBasedonOuterIPheader,4,VxLANDeepDiveOverviewVTEPUnicastForwardingPacketFlow,VxLANDeepDiveVxLANontheNexus9000Series,VXLANissupportedacrosstheNexus9000seriesplatforms.TheVXLANGatewayfunctionalityissupportedacrossallformfactorsandlinecards.IntegratedVxLANroutingfunctionalityisonlysupportedonACI-enabledModules,Nexus9500Series,Nexus9300Series,VxLANDeepDiveNexus9000Nexus9000SeriesVXLANSupport,NXOSModeOnly,VXLANgatewaybridgestrafficbetweenVXLANsegmentandanotherphysical/logicallayer2domain(suchasaVLAN),VxLANDeepDiveNexus9000VxLANGateway,NXOSModeOnly,featurenvoverlayfeaturevn-segment-vlan-basedinterfaceet4/13switchportswitchportaccessvlan10noshutinterfacenve1noshutdownsource-interfaceloopback0overlay-encapsulationvxlanmembervni1010mcast-groupvlan10vn-segment1010,switch#shownvevniInterfaceVNIMulticast-groupVNIState-nve11010upswitch#shownvepeersInterfacePeer-IPVNIUpTime-nve101000:52:24switch#,TheNexus9000seriessupportsVxLANGatewayfunction,allowingVLANstobebridged/mappedtoVxLANSegmentsandviceversa,VxLANDeepDiveNexus9000VxLANGatewayMapping,NXOSModeOnly,PP,EPP,Encap/Decap,VXLAN,VxLAN,VLAN,VLAN,BridgingandGatewaymodesupportAnytoAnyBehavior,VxLANDeepDiveNexus9000VxLANBridgingandGatewayNexus9300,VxLANEncapsulationandDe-encapsulationoccuronTridentIIASICVLAN-VXLAN(gateway)VxLAN-VLAN(gateway)VxLANVXLAN(bridging)BridgingandGatewayareindependentoftheporttype(1/10/40Gports),NXOSModeOnly,VxLANDeepDiveNexus9000VxLANBridgingandGatewayNexus9500,VxLANEncapsulationandDe-encapsulationoccuronPPVLANVxLAN(gateway)VxLANVLAN(gateway)VxLANVxLAN(bridging),Encap,Decap,Decap,NXOSModeOnly,VxLANroutedmoderoutestrafficbetweenVxLANsegmentsandbetweenVxLANanotherphysical/logicallayer2domain(suchasaVLAN),VxLANDeepDiveNexus9000RoutingVxLAN,NXOSModeOnly,Insieme,Encap/Decap,Recirculate,RoutePacket,VLANSubnet/24,VxLANSubnet/24,Insieme,Encap/Decap,Recirculate,RoutePacket,VLANSubnet/24,VxLANSubnet/24,VxLANDeepDiveNexus9000RoutingVxLANForwardingPathNexus9300,VxLANRoutingisnotsupportedcurrentlyonthePacketProcessorAdditionalrecirculationrequiredforVxLANroutingthroughtheExtendedPacketProcessor,EPP,EPP,PP,PP,NXOSModeOnly,Decap,IPRoute,Decap,IPRoute,Encap,IPRoute,LPMIPRoute,LPMIPRoute,IfrequiredLPMroutelookuponFabric,/32routelookuponingressPP,VxLANDeepDiveNexus9000RoutingVxLANForwardingPathNexus9500,VxLANEncapsulationandDe-encapsulationoccuronPPDe-encapsulationoningresslinecardEncapsulationonegressIPRoutingoccursontheingressPPandifrequiredonfabricPPVxLANRoutingoccursontheEPPASIC,PP,PP,PP,VxLAN,VLAN,VxLAN,VLAN,VLAN,VXLANRoute,VXLANRoute,NXOSModeOnly,VXxAN,VLAN,AnyCastVTEP,AnyCastVTEP,VxLANDeepDiveNexus9000ForwardingVirtualPortChannel,WhenVirtualPortChannel(vPC)isenabledananycastVTEPaddressisprogrammedonbothvPCpeersSymmetricalforwardingbehavioronbothpeersMulticasttopologypreventsBUMtrafficbeingsenttothesameIPaddressacrosstheL3networkPreventsduplicationoffloodedpacketsvPCpeer-gatewayfeaturemustbeenabledonbothpeersVXLANheaderisnotcarriedonthevPCPeerlink,NXOSModeOnly,VTEP,VxLAN,VLAN,VxLANDeepDiveNexus9000ForwardingDesignConsiderations,WhenVxLANisbeingroutedthenexthopforVXLANencapsulatedframesneedstobeoveranL3interfaceAlternatively,allSVIsfromaVxLANGatewaymustpointtothesamephysicalnexthopSameVxLANheaderMACDestinationAddressforallVxLANencapsulatedpacketssentfromthesamephysicalport,VxLANVTEPdownstreamofaNexus2000FEXisnotsupported,NXOSModeOnly,L3Core,Pod1,Pod2,VxLANDeepDiveNexus9000DeploymentScenariosL2ExtensionacrossPods,NXOSModeOnly,VxLANEnabledHypervisor,VTEP,VxLANEnabledHypervisor,VTEP,VxLANDeepDiveNex