Wired Intelligent Edge

Hi Vincent!

We have two VSX pairs between which we want to do static VXLAN. The idea is to use anycast loopback with a shared address between the primary and secondary device in a VSX pair. Anycast loopback would be used as a source, on the other hand it would be a destination for other pair of switches.
What bothers us is that when you do a ping with the source address from that anycast loopback to the address on another pair of switches - from one device that source works, but from the other it does not, which I would say is normal behavior in case we have "duplicates" IP".

Is this behavior expected? 

How does it behave when we have a VXLAN tunnel up? Will the tunnel be functional only from one switch at a time or?
An example of such a configuration is not really present in the available documents, so I would like to know how it behaves in reality.

Thanks!

Marko

Hello Marko,

Yes, it is expected behavior as the reply packet may (depending on ECMP, hashing) return on the VSX node which didn't send the echo packet. For ping/traceroute you need to source the traffic from unicast IP address (not from the anycast IP). This point is addressed in VXLAN user guide. So, best is to create a loopback, unique to each individual switch, one per VRF, and then source point from it.

Tunnel is up on both switch, no issue. As this is static MACs are learnt through the dataplane. We fully support and document the concept of Extended-Edge where a standalone VTEP has a static VXLAN tunnel to a VSX pair (called Stub VTEP, linking dataplane MAC learning to EVPN domain). But not between 2 VSX pairs as a use-case. It is not officially tested and supported but technically it should work (would need to check exact recovery time at scale during live upgrade).

When we have 2 VSX pairs, EVPN was the priority in term of qualification as the main use-case. 

Hi Vincent!

We have two VSX pairs between which we want to do static VXLAN. The idea is to use anycast loopback with a shared address between the primary and secondary device in a VSX pair. Anycast loopback would be used as a source, on the other hand it would be a destination for other pair of switches.
What bothers us is that when you do a ping with the source address from that anycast loopback to the address on another pair of switches - from one device that source works, but from the other it does not, which I would say is normal behavior in case we have "duplicates" IP".

Is this behavior expected? 

How does it behave when we have a VXLAN tunnel up? Will the tunnel be functional only from one switch at a time or?
An example of such a configuration is not really present in the available documents, so I would like to know how it behaves in reality.

Thanks!

Marko

Hi Vincent, thank you for your reply. We eventually configured BGP EVPN and it works fine! But we received a request to isolate that underlay network in a separate VRF. In the documentation we did not find explicitly a restriction for that, but it seems that we cannot configure evpn neighbors that are in VRF context. Can you maybe confirm that? 

Hello Marko,

Yes, it is expected behavior as the reply packet may (depending on ECMP, hashing) return on the VSX node which didn't send the echo packet. For ping/traceroute you need to source the traffic from unicast IP address (not from the anycast IP). This point is addressed in VXLAN user guide. So, best is to create a loopback, unique to each individual switch, one per VRF, and then source point from it.

Tunnel is up on both switch, no issue. As this is static MACs are learnt through the dataplane. We fully support and document the concept of Extended-Edge where a standalone VTEP has a static VXLAN tunnel to a VSX pair (called Stub VTEP, linking dataplane MAC learning to EVPN domain). But not between 2 VSX pairs as a use-case. It is not officially tested and supported but technically it should work (would need to check exact recovery time at scale during live upgrade).

When we have 2 VSX pairs, EVPN was the priority in term of qualification as the main use-case. 

Hi Vincent!

We have two VSX pairs between which we want to do static VXLAN. The idea is to use anycast loopback with a shared address between the primary and secondary device in a VSX pair. Anycast loopback would be used as a source, on the other hand it would be a destination for other pair of switches.
What bothers us is that when you do a ping with the source address from that anycast loopback to the address on another pair of switches - from one device that source works, but from the other it does not, which I would say is normal behavior in case we have "duplicates" IP".

Is this behavior expected? 

How does it behave when we have a VXLAN tunnel up? Will the tunnel be functional only from one switch at a time or?
An example of such a configuration is not really present in the available documents, so I would like to know how it behaves in reality.

Thanks!

Marko