VXLAN — Feature interaction table
Feature |
VXLAN impact |
---|---|
ARP protect |
VXLAN tunnel interfaces would be (implicitly) TRUSTED interfaces with no MAC/IP verification on ARP PKTs ingressing tunnels. ARP protection will be enforced on other untrusted ports of the overlay VLAN if ARP protection is enabled for that VLAN. A VLAN that has a virtual IP subnet and a VNI configured for it is referred to as an overlay VLAN in here. |
CDP |
CDP only runs on physical links. VXLANs are not able to participate in CDP. |
DHCP (v4/v6) relay |
A gateway device is able to function as a DHCP Relay agent and support transferring DHCP PKTs between the following depending on where the DHCP server is housed:
|
DHCP snooping |
VXLAN tunnel interfaces would be (implicitly) TRUSTED with no MAC/IP/Port verification on DHCP PKTs ingressing tunnels. |
filter |
|
IGMP snooping |
No support for IGMP SNOOPing and Multicast pruning on VXLAN tunnel interfaces.If a device is an IGMP querier on an overlay VLAN, the IGMP queries sourced by the device will be sent over the VTEP fabric to the other nodes as well.IGMP blocked and forward configuration cannot be applied to VXLAN interfaces. |
IGNORE untagged-MAC |
Not applicable to VXLAN tunnel interfaces. |
Link-Keepalive (UDLD) |
Not supported on VXLAN tunnel interfaces. |
LLDP |
LLDP not supported on tunnel interfaces. |
Lockout-MAC |
Traffic ingressing a network port with source MAC that is configured as lockout-MAC will not be tunneled.Traffic ingressing a tunnel interface (i.e. payload) with a source MAC that is configured as lockout-MAC on the device will be dropped upon DECAP. |
Loop Protect |
Not supported on VXLAN tunnel interfaces |
MAC-TRAP MAC-Count TRAP |
This Mac-Trap, when configured on an interface, sends out a trap when:
|
<Interface> Monitor |
Cannot monitor a VXLAN tunnel interface. |
OpenFlow |
|
Port Security |
Not supported on VXLAN tunnel interface. |
QinQ |
Mutually exclusive. |
QoS
|
|
QOS remark policy (PCP/DSCP) |
|
QoS rate-limit policy Interface rate-limit |
|
SFLOW |
Cannot configure SFLOW (sampling/polling) on tunnel interfaces and loopback ports. If a packet destined to a tunnel has been sampled, the outport field in the SFLOW header will be the tunnel resolved uplink port. |
Smart-Link |
Cannot be configured on tunnel interfaces. However Smart-Link can be used to achieve VTEP redundancy. To ensure that downlink traffic is not disrupted when a VTEP goes down and the downlink switch’s Slave Port becomes Active, Smart-Link flush messages will be allowed to traverse the L3 fabric and it will wipe out MAC table entries on tunnel interfaces for the protected VLANs. It will also clear the ARP entries pointing to Tunnel entries on the VTEPs. Per-port recv-control-vlan restriction is not applicable to Flush packets received on Tunnel Interfaces as they are trusted, any filtering can always be done on external facing ports. |
STP |
Does not run on tunnel interfaces and loopback ports. This implies that STP cannot detect loops if any among switches that are connected via VXLAN tunnels and also directly connected among them. It is important that only one device as the VTEP for a VLAN in a network where multiple devices can function as VTEPs for the same VLAN. STP Topology Change message does not have to flush MAC addresses learned on tunnel interfaces as a TC on one segment does not impact the MAC learns of another segment. When a device that is STP disabled receives BPDUs, it floods to all ports of the VLAN. This can result in BPDUs being tunneled to the remote side as well. The loopback port of the remote end will quench the packet and not process it. |
Static MAC |
Not supported on VXLAN tunnel interfaces. |
UFD |
Not supported on VXLAN tunnel interfaces. |
<Interface> IPv4/v6 ACLs |
Not supported on VXLAN tunnels and loopback ports (stolen and internal). |
<Interface> IP Source-Lockdown |
Not configurable on VXLAN tunnel and loopback interfaces (stolen and internal). |
<Interface> admin-status |
Not configurable on VXLAN tunnel interface. |
IP Source Binding |
IP source binding entries cannot be configured on VXLAN tunnel interfaces and loopback ports (stolen/internal). |
<VLAN> RIP, OSPF, BGP |
Cannot be enabled on overlay VLANs. BGP is not supported on WC.16.02. |
<VLAN> IRDP |
Cannot be enabled on overlay VLANs. |
<VLAN> IGMP (Router) |
Cannot be enabled on overlay VLANs. |
<VLAN> IGMP Proxy |
Cannot be enabled on overlay VLANs. |
<VLAN> UDP Broadcast Forwarder |
Supported on overlay VLANs. |
<Interface> QoS |
Not supported on tunnel and loopback interfaces (stolen/internal). |
IPv4 unicast Routing |
Supported. Can route traffic into a tunnel and route traffic coming out of a tunnel. |
IPv6 unicast Routing |
Not supported. |
<VLAN> MLD |
Not supported as overlays are IPv4 only. |
<VLAN> ND<VLAN> RA |
Not supported as overlays are IPv4 only.Not supported as overlays are IPv4 only. |
<VLAN> IPv6 |
Not supported as overlays are IPv4 only |
<VLAN> OSPF3 |
Cannot be enabled on overlay VLANs. |