1. Network base
Network base

2. Tunnel
Why this slade

3. Tunnel IPIP Do not support multi CAST and ipv6 GRE Vxlan （1 to N ）
IPSEC (transport and tunnel)
Racoon
Openswan
strongswan
NVGRE
Geneve
STT
L2TP(Layer 2 Tunneling Protocol)
PPTP(Point to Point Tunneling Protocol)
LSP (MPLS VPN)
...

4. Vxlan Vxlan （L2 in L4 udp) https://tools.ietf.org/html/rfc7348 0 1 2 3
VXLAN Header:
|R|R|R|R|I|R|R|R| Reserved |
| VXLAN Network Identifier (VNI) | Reserved |

5. Vxlan
Vxlan （L2 in L4 udp)

6. Vxlan background https://tools.ietf.org/html/rfc7348#section-3
Limitations Imposed by Spanning Tree and VLAN Ranges
Multi-tenant Environments
4094 VLAN limit
cross-pod expansion（"stretched" L2）
Inadequate Table Sizes at ToR Switch

7. Vxlan background https://tools.ietf.org/html/rfc7348#section-3
Limitations Imposed by Spanning Tree and VLAN Ranges
Multi-tenant Environments
4094 VLAN limit
cross-pod expansion（"stretched" L2）
Inadequate Table Sizes at ToR Switch

8. Vxlan Unicast https://tools.ietf.org/html/rfc7348#section-4.1
VNI identifies the scope of the inner MAC frame originated by the individual VM
remote VTEP learns and stores the mapping from inner source MAC to outer source
(VNI，inner MAC，outer vtep_ip)

9. Vxlan Broadcast https://tools.ietf.org/html/rfc7348#section-4.2
broadcast packet is sent out to the IP multicast group
mapping between the VXLAN VNI and the IP multicast group

10. Vxlan
VXLAN gateways
traffic between VXLAN and non-VXLAN

11. Vxlan Linux implement Stephen Hemminger (iproute2 maintainer)
drivers/net/vxlan.c

12. Vxlan Doc Documentation/networking/vxlan.txt 1. Create vxlan device
# ip li add vxlan0 type vxlan id 42 group dev eth1
2. Delete vxlan device
# ip link delete vxlan0
3. Show vxlan info
# ip -d link show vxlan0

13. Vxlan Doc Documentation/networking/vxlan.txt
1. Create forwarding table entry
# bridge fdb add to 00:17:42:8a:b4:05 dst dev vxlan0
2. Delete forwarding table entry
# bridge fdb delete 00:17:42:8a:b4:05 dev vxlan0
3. Show forwarding table
# bridge fdb show dev vxlan0

14. NVGRE NVGRE (L2 in L3) Terminology
Each VSID(24 bits) represents a virtual L2 broadcast domain
Terminology
virtualization-nvgre-08#page-4

15. NVGRE Key field（Initial version）
virtualization-nvgre-00#section-3.2
TNI: lower 24 bits, Tenant Network Identifier. The Key Present (bit 2 in the GRE header) is always set to 1.
upper 8 bits: reserved for use by NVGRE endpoints. NVGRE endpoints MUST set this value to zero

16. NVGRE Key field（Initial version） 0 1 2 3
GRE Header:
|0 | |1|0| Reserved | Ver | Protocol Type 0x |
| Tenant Network ID (TNI) | FlowID |

17. NVGRE Key field （Latest version）
Virtual Subnet ID (VSID): 24-bit, identify the NVGRE based Virtual Layer 2 Network.
FlowID: 8-bit, provide per-flow entropy for flows in the same VSID. MUST NOT be modified by transit devices. The encapsulating NVE SHOULD provide as much entropy as possible in the FlowId. If a FlowID is not generated, it MUST be set to all zero.

18. NVGRE Key field （Latest version） 0 1 2 3
GRE Header:
|0 | |1|0| Reserved | Ver | Protocol Type 0x |
| Virtual Subnet ID (VSID) | FlowID |

19. NVGRE Broadcast and Multicast Traffic
sent to the assigned multicast address.
N-Way unicast

20. NVGRE
Unicast Traffic
the destination PA corresponding to the location of the destination endpoint.

21. NVGRE
IP Fragmentation

22. NVGRE
Try to provide a experience by docker

23. VXLAN vs NVGRE ??

24. TOPOLOGY
On mxh host

25. TOPOLOGY qbr: br-tun br-int br-ex
security layer （ovs not support iptable tap)
Check the security group apply to the VM tap
#iptables -S |grep tap-xxxxx
br-tun
# ovs-ofctl dump-flows br-tun
Network
computer
br-int
Computer
br-ex