PicOS OVS VXLAN Configuration Guide

Overview

VXLAN (Virtual Extensible LAN) extends Layer 2 networks over Layer 3 infrastructure using UDP encapsulation. PicOS with Open vSwitch provides hardware-accelerated VXLAN with EVPN control plane support.

Architecture

• VTEP (VXLAN Tunnel Endpoint): Creates/terminates VXLAN tunnels
• VNI (VXLAN Network Identifier): 24-bit identifier, supports 16M segments
• Underlay: IP network carrying encapsulated traffic
• Overlay: Logical Layer 2 network over underlay

Initial PicOS Configuration

# Enter OVS database
ovs-vsctl set Open_vSwitch . other_config:hw-offload=true
ovs-vsctl set Open_vSwitch . other_config:tc-policy=HW

# Create VXLAN bridge
ovs-vsctl add-br br-vxlan
ovs-vsctl set bridge br-vxlan datapath_type=netdev

VXLAN VTEP Configuration

Static VXLAN (Multicast Mode)

# Add physical port to VXLAN bridge
ovs-vsctl add-port br-vxlan ge-1/1/1

# Create VXLAN port
ovs-vsctl add-port br-vxlan vxlan0 \
  -- set interface vxlan0 type=vxlan \
  options:remote_ip=192.168.10.20 \
  options:key=1000 \
  options:dst_port=4789 \
  options:local_ip=192.168.10.10 \
  options:multicast_group=239.1.1.1

# Verify VXLAN port
ovs-vsctl show
ovs-ofctl show br-vxlan

EVPN-Based VXLAN (Recommended)

# Configure BGP EVPN
set protocols bgp local-address 192.168.10.10
set protocols bgp peer 192.168.10.1
set protocols bgp peer 192.168.10.1 evpn
set protocols bgp peer 192.168.10.1 remote-as 65000

# Configure EVPN address family
set protocols bgp group UNDERLAY address-family l2vpn-evpn
set protocols bgp group UNDERLAY neighbor 192.168.10.1 address-family l2vpn-evpn

# Create L2 VNI
set protocols bgp evpn vni 1000
set protocols bgp evpn vni 1000 rd 192.168.10.10:1000
set protocols bgp evpn vni 1000 route-target both auto

VLAN to VNI Mapping

# Map VLAN 10 to VNI 10000
set vlans vlan-id 10
set vlans vlan-id 10 l3-interface irb.10

# Configure IRB (Integrated Routing and Bridging)
set interfaces irb unit 10 family inet address 192.168.10.254/24
set interfaces irb unit 10 virtual-gateway-address 192.168.10.1

# Enable symmetric IRB
set protocols bgp evpn vni 10000 symmetric-routing

Spine-Leaf Topology Example

Leaf-01 (VTEP) <-> Spine-01 (Route Reflector)
192.168.10.10       192.168.1.1
         \          /
          \        /
           Spine-02
          192.168.1.2

# Leaf-01 Configuration
set protocols bgp peer 192.168.1.1 peer-as 65000
set protocols bgp peer 192.168.1.2 peer-as 65000
set protocols bgp route-reflector cluster-id 192.168.1.1

# Advertise VNI routes
set protocols bgp evpn vni 10000
set protocols bgp evpn vni 10000 route-target export target:1000:1
set protocols bgp evpn vni 10000 route-target import target:1000:1

Verifying VXLAN Operation

# Check VXLAN tunnels
ovs-appctl vlog/list
ovs-appctl tunnel/list

# Check MAC address table
ovs-appctl fdb/show br-vxlan

# Check EVPN routes
show bgp l2vpn evpn route

# Check VXLAN statistics
ovs-ofctl -O OpenFlow13 dump-ports br-vxlan

MTU Considerations

Troubleshooting

VTEP not learning MAC addresses:

• Verify underlay connectivity (ping VTEP IPs)
• Check security groups/firewalls allow UDP port 4789
• Verify multicast group membership

EVPN routes not advertised:

• Check BGP session is established
• Verify VNI is properly configured
• Review route-target import/export policies

High CPU usage:

• Enable hardware offload: hw-offload=true
• Check flow table size with ovs-dpctl show

Related Documentation

• EVPN-VXLAN vs Traditional STP
• S5860 Series Configuration Guide
• High-Density 400G Data Center Design