Wired Intelligent Edge

 View Only

  • 1.  VXLAN Route reachability from within the switch itself

    Posted Aug 13, 2021 11:05 AM
    Hi all,

    I've noticed some strange behaviour in my Aruba-CX environment. Since I didn't find anything about it in documentation I am sharing it here, to see what you guys think.  It could end up as a TAC case, If it does I'll share the results.

    I have an EVPN-VXLAN setup with  a couple of 8325 as spines , two VSX sets of 8325's as Leaves and a set of 6405 as Leaves.

    Some vlans are shared between all vteps, and everything works as expected there. On the 6405 VSX  VTEP' s I have a BGP connection to my firewall, from which I get a default route. Both 6405 have their own /31 to the firewall.. The default route is learned by the other VTEP's. All connected hosts can use the default route to reach anything beyond the firewall.

    The only thing that does not work, is traffic from the leaves themselves to VXLAN L3 only routes (such as the default route).
    So If I try to ping  google from one of the 8325 leaves, I get a ' network unreachable' message, even though a default route is present in the VRF. All hosts connected in that VRF can do that ping without issues.

    Another behaviour is with traceroute. If I traceroute from a host connected to the 8325' s, the trace stops Immediately because the switch reports: Destination net unreacheble.


    It seems to me that the underlying Linux OS cannot ' see'  the VXLAN routes.

    Is this expected behaviour or did I make a mistake in my configuration somewhere?



    ------------------------------
    Jelmer Hartman
    ------------------------------


  • 2.  RE: VXLAN Route reachability from within the switch itself

    Posted 13 days ago

    Hi Jalmer !

    I'm currently facing the same issue. Were you able to find a solution? If so, I'd really appreciate it if you could share what worked for you. Thanks!




  • 3.  RE: VXLAN Route reachability from within the switch itself

    Posted 12 days ago

    Is the problem on icmp echo packet or the problem on the icmp reply packet ?
    Pay attention, that you must source your test traffic (ping, traceroute) from a unicast address, and not from the active-gateway anycast address as the reply
    packet might reach the wrong VTEPs. Please configure a unicast loopback in the VRF of interest, source the ping from the loopback IP and report.
    Thanks.




  • 4.  RE: VXLAN Route reachability from within the switch itself

    Posted 10 days ago

    When I ping from the VTEP, it returns "Network is unreachable." The packet is not even exiting the source VTEP. However, the hosts can communicate with each other without any issues.

    LEAF-A# sh ip route vrf TENANT_1 | in 10.194.20.

    10.194.20.0/24      3.3.3.3                                  -             -                 B/EV      [200/0]      07h:20m:33s

    LEAF-A# sh bgp l2vpn evpn route-type 5 | in 10.194.20.

    *>i [5]:[0]:[0]:[24]:[10.194.20.0]                         3.3.3.3                                 0          100        0       ?

    LEAF-A# ping 10.194.20.22 source 10.194.10.2 vrf TENANT_1

    PING 10.194.20.22 (10.194.20.22) from 10.194.10.2 : 100(128) bytes of data.

    ping4: sendmsg: Network is unreachable

    ping4: sendmsg: Network is unreachable

    ping4: sendmsg: Network is unreachable

    ping4: sendmsg: Network is unreachable

    ping4: sendmsg: Network is unreachable

    --- 10.194.20.22 ping statistics ---

    5 packets transmitted, 0 received, 100% packet loss, time 4098ms

    interface vlan 10

    vrf attach TENANT_1

    ip address 10.194.10.2/24

    active-gateway ip mac 00:00:00:00:00:02

    active-gateway ip 10.194.10.254

    Host on LEAF_A in vlan 10 can communicate to host on LEAF_B in vlan 20
    ITD_SERV_1#sh ip int brief | in 10.194.10.

    FastEthernet0/0            10.194.10.23YES manual up                    up

    ITD_SERV_1#ping 10.194.20.22

    Type escape sequence to abort.

    Sending 5, 100-byte ICMP Echos to 10.194.20.22, timeout is 2 seconds:

    !!!!!

    Success rate is 100 percent (5/5),


    Original Message


  • 5.  RE: VXLAN Route reachability from within the switch itself

    Posted 5 days ago

    Worth noting you sourced from the SVI address, not a loopback, so the suggestion above hasn't really been tested yet. Two things to check before you call it a bug.

    First, confirm 10.194.10.2 is actually unique to that leaf. Since 10.09.0010 the SVI IP is allowed to be the same as the active gateway IP on every VTEP, and plenty of configs now reuse the same SVI address across leaves. If both leaves answer to .2, it's not a usable source for anything the switch originates itself.

    Second, build the loopback properly and advertise it:

    interface loopback 2
        vrf attach TENANT_1
        ip address 10.255.255.1/32

    then redistribute connected under vrf TENANT_1, address-family ipv4 unicast, or the far end has no route back and you'll trade the error for silent loss. Then ping source loopback2 vrf TENANT_1. The EVPN VXLAN guide recommends exactly this, a unique loopback as the source, when the SVI carries an anycast gateway.



    ------------------------------
    Dustin Burns

    @Worldcom Exchange, Inc.


    If my post was useful accept solution and/or give kudos
    ------------------------------

    Original Message


  • 6.  RE: VXLAN Route reachability from within the switch itself

    Posted 2 hours ago
    Edited by AB-null 2 hours ago

    Hi Dustin,

    I have created loopback 10.5.40.22 on leaf_2 and 10.5.60.22 on leaf_3 and advertise them in vrf TENANT_1. Both Leaf switches are learning  this route via route type 5.
    But still it's showing "Network unreachable ' while pinging 10.5.60.22(loopback_Leaf_3) or 10.194.30.25 (host on Leaf_3) source 10.5.40.22


    LEAF-3# sh ip route vrf TENANT_1 | in 10.5.
    10.5.40.22/32       2.2.2.2                                  -             -                 B/EV      [200/0]      00h:28m:13s  
    10.5.60.22/32       -                                        loopback1     -                 L         [0/0]        -        
    LEAF-2# sh ip route vrf TENANT_1 | in 10.5.
    10.5.40.22/32       -                                        loopback1     -                 L         [0/0]        -            
    10.5.60.22/32       3.3.3.3                                  -             -                 B/EV      [200/0]      00h:22m:27s  
    LEAF-2# 
    LEAF-2# sh ip route vrf TENANT_1 | in 10.194.30.25        
    10.194.30.25/32     3.3.3.3                                  -             -                 B/EV      [200/0]      00h:10m:52s  
    10.194.30.254/32    3.3.3.3                                  -             -                 B/EV      [200/0]      00h:31m:09s  
    LEAF-2# 
    LEAF-2# ping 10.194.60.22 source 10.5.40.22 vrf TENANT_1  
    PING 10.194.60.22 (10.194.60.22) from 10.5.40.22 : 100(128) bytes of data.
    ping4: sendmsg: Network is unreachable
    ping4: sendmsg: Network is unreachable
    ping4: sendmsg: Network is unreachable
    ^C
    LEAF-2# 
    LEAF-2# ping 10.194.30.25 source 10.5.40.22 vrf TENANT_1        
    PING 10.194.30.25 (10.194.30.25) from 10.5.40.22 : 100(128) bytes of data.
    ping4: sendmsg: Network is unreachable
    ping4: sendmsg: Network is unreachable
    ping4: sendmsg: Network is unreachable

       


    Original Message


Related Content