inner vlan in VXLAN

[payeljayesh]

Hi All,

I was searching a document which described steps/guide to configure the handling of VLAN inside vxlan (inner vlan).

Is it supported inn NSX Manager 6.1.3?

I appreciate any reference.

Thanks,

Jayesh

[larsonm]

That capability appears to have been released in version 6.2

VMware NSX for vSphere 6.2.0 Release Notes

[payeljayesh]

Hi Larsonm,

Thanks for your reply.

Downloaded the latest version 6.2.1 of NSX manager.

I just wanted to test the inner vlan scenario with VXLAN. I have configured the guest vlan on VMs interfaces which is connected to vxlan-wire. Also modified vlan config under port-group in dvSwitch properties.

After these changes also, VMs are not reachable over the vxlan.

Am I missing any configuration? Appreciate any pointers for documents or configuration.

[amolnjadhav]

Hi payeljayesh,

I have not tested this feature in my NSX Lab but i am just trying to understand what is exact requirement here?

Double tagging "VXLAN and VLAN" you are trying to use,  Is it application requirement or any specific setup you are using it for?

Regards

Amol J

[payeljayesh]

Hi Amol,

I was bit busy, so i did not able to reply.

We are providing VXLAN offload, VLAN offload feature in over NIC adapter. So i would like to test if guest vlan over vxlan is supported and our NIC adapter is able to offload guest vlan.

Thanks,

Jayesh

[vwic]

Hi,

I've also been researching this topic whilst trying to do inner-VLAN tagging in VXLAN; basically a VXLAN Logical Switch port group configured as trunk port - very useful when doing a nested vSphere environment which itself has NSX (i.e. nested NSX).

Packet capture confirms that the original guest-tagged packets, after being encapsulated by NSX into VXLAN, the inner VLAN tag is removed.

After packet captures and referring to RFC 7348, I've concluded that by default the VMware NSX implementation of VXLAN strips out the inner vlan tag (see section 6.1 of the RFC). f this default behaviour is overridable, can someone from VMware please let us know?

regards,

Victor

[revr3nd]

So I am also trying to test this inner VLAN tag through VXLAN for the sake of labbing some virtual routers as an analog for production routers. I have been able to get this partially working with the following setup:

• Logical switch set to multicast backing
• Disabled IP address and MAC address learning on the logical switch
• Distributed port group for logical switch changed to allow promiscuous, allow forged transmits, allow MAC changes, and set to trunk VLANs 1-4096

With this configuration I can confirm communication between two VMs, each using VLAN tag 10 on their traffic between each other. This also works across the layer 3 boundary by putting each VM on a separate host.

BUT the problem is that any broadcasts such as ARP do not transmit across hosts, only within the same host. So in order to fill the ARP table of the VM, both VMs must be on the same host to see each other's ARP requests. Once ARP is populated, then they can be split to different hosts without issue.

So, any thoughts on keeping broadcasts flowing between the two hosts?