Network base Network base

Tunnel Why this slade

Tunnel IPIP Do not support multi CAST and ipv6 GRE Vxlan （1 to N ） IPSEC (transport and tunnel) Racoon Openswan strongswan NVGRE Geneve STT L2TP(Layer 2 Tunneling Protocol) PPTP(Point to Point Tunneling Protocol) LSP (MPLS VPN) ...

Vxlan Vxlan （L2 in L4 udp) https://tools.ietf.org/html/rfc7348 0 1 2 3 0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 VXLAN Header: +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |R|R|R|R|I|R|R|R| Reserved | | VXLAN Network Identifier (VNI) | Reserved |

Vxlan Vxlan （L2 in L4 udp) https://tools.ietf.org/html/rfc7348

Vxlan background https://tools.ietf.org/html/rfc7348#section-3 Limitations Imposed by Spanning Tree and VLAN Ranges Multi-tenant Environments 4094 VLAN limit cross-pod expansion（"stretched" L2） Inadequate Table Sizes at ToR Switch

Vxlan background https://tools.ietf.org/html/rfc7348#section-3 Limitations Imposed by Spanning Tree and VLAN Ranges Multi-tenant Environments 4094 VLAN limit cross-pod expansion（"stretched" L2） Inadequate Table Sizes at ToR Switch

Vxlan Unicast https://tools.ietf.org/html/rfc7348#section-4.1 VNI identifies the scope of the inner MAC frame originated by the individual VM remote VTEP learns and stores the mapping from inner source MAC to outer source (VNI，inner MAC，outer vtep_ip)

Vxlan Broadcast https://tools.ietf.org/html/rfc7348#section-4.2 broadcast packet is sent out to the IP multicast group mapping between the VXLAN VNI and the IP multicast group

Vxlan VXLAN gateways traffic between VXLAN and non-VXLAN

Vxlan Linux implement Stephen Hemminger (iproute2 maintainer) drivers/net/vxlan.c

Vxlan Doc Documentation/networking/vxlan.txt 1. Create vxlan device # ip li add vxlan0 type vxlan id 42 group 239.1.1.1 dev eth1 2. Delete vxlan device # ip link delete vxlan0 3. Show vxlan info # ip -d link show vxlan0

Vxlan Doc Documentation/networking/vxlan.txt 1. Create forwarding table entry # bridge fdb add to 00:17:42:8a:b4:05 dst 192.19.0.2 dev vxlan0 2. Delete forwarding table entry # bridge fdb delete 00:17:42:8a:b4:05 dev vxlan0 3. Show forwarding table # bridge fdb show dev vxlan0

NVGRE NVGRE (L2 in L3) Terminology Each VSID(24 bits) represents a virtual L2 broadcast domain Terminology https://tools.ietf.org/html/draft-sridharan- virtualization-nvgre-08#page-4

NVGRE Key field（Initial version） https://tools.ietf.org/html/draft-sridharan- virtualization-nvgre-00#section-3.2 TNI: lower 24 bits, Tenant Network Identifier. The Key Present (bit 2 in the GRE header) is always set to 1. upper 8 bits: reserved for use by NVGRE endpoints. NVGRE endpoints MUST set this value to zero

NVGRE Key field（Initial version） 0 1 2 3 0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 GRE Header: +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |0 | |1|0| Reserved0 | Ver | Protocol Type 0x6558 | | Tenant Network ID (TNI) | FlowID |

NVGRE Key field （Latest version） Virtual Subnet ID (VSID): 24-bit, identify the NVGRE based Virtual Layer 2 Network. FlowID: 8-bit, provide per-flow entropy for flows in the same VSID. MUST NOT be modified by transit devices. The encapsulating NVE SHOULD provide as much entropy as possible in the FlowId. If a FlowID is not generated, it MUST be set to all zero.

NVGRE Key field （Latest version） 0 1 2 3 0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 GRE Header: +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |0 | |1|0| Reserved0 | Ver | Protocol Type 0x6558 | | Virtual Subnet ID (VSID) | FlowID |

NVGRE Broadcast and Multicast Traffic sent to the assigned multicast address. N-Way unicast

NVGRE Unicast Traffic the destination PA corresponding to the location of the destination endpoint.

NVGRE IP Fragmentation

NVGRE Try to provide a experience by docker

VXLAN vs NVGRE ??

TOPOLOGY On mxh host

TOPOLOGY qbr: br-tun br-int br-ex security layer （ovs not support iptable tap) Check the security group apply to the VM tap #iptables -S |grep tap-xxxxx br-tun # ovs-ofctl dump-flows br-tun Network computer br-int Computer br-ex