Hot!VLAN inside VXLAN with 6.2.3

Author
Toshi Esumi
Expert Member
  • Total Posts : 2177
  • Scores: 213
  • Reward points: 0
  • Joined: 2014/11/06 09:56:42
  • Status: offline
2020/04/21 16:46:52 (permalink)
0

VLAN inside VXLAN with 6.2.3

Did anyone make below set up work successfully with 6.2.3? I'm just testing with relatively simple set up: FG50E -- FG30E direct connection and trying to connect vlan 100 network on both ends. Likely my test environment is causing some issues. But once I drop the vlan subinterface and use it's parent interface without vlan tag, it just works end to end. Sniffing shows ARP requests arrive at local vlan100 subinterface, but never goes over to the other side.
https://docs.fortinet.com...4150/vlan-inside-vxlan
 
 
 
#1

9 Replies Related Threads

    tanr
    Platinum Member
    • Total Posts : 802
    • Scores: 36
    • Reward points: 0
    • Joined: 2016/05/09 17:09:43
    • Status: offline
    Re: VLAN inside VXLAN with 6.2.3 2020/04/22 13:14:24 (permalink)
    0
    Hi Toshi,
     
    Did you get any further with this?  I've been wanting to test this as well, but don't have a second lab FortiGate and would like to hear a success story before I test this on production over IPsec.
    #2
    Toshi Esumi
    Expert Member
    • Total Posts : 2177
    • Scores: 213
    • Reward points: 0
    • Joined: 2014/11/06 09:56:42
    • Status: offline
    Re: VLAN inside VXLAN with 6.2.3 2020/04/22 14:11:52 (permalink)
    0
    So far I haven't figured out a way for this 6.2 new feature (to me the whole reason to have VXLAN) to work, while 6.0 supported part works fine. That's why I posted the question if anyone had made it work. I'm feeling the description in Cookbook is missing something important. If no reply from others, I will need to move my current test environment to another FGT that has a support then open a ticket at TAC to get help.
     
    Toshi
    #3
    emnoc
    Expert Member
    • Total Posts : 5748
    • Scores: 373
    • Reward points: 0
    • Joined: 2008/03/20 13:30:33
    • Location: AUSTIN TX AREA
    • Status: offline
    Re: VLAN inside VXLAN with 6.2.3 2020/04/22 14:16:47 (permalink)
    0
    When you do 'diag  sniffer packet < vxlan interface > '    what do you see when traffic is being generated? in or out ?
     
    Ken Felix
     

    PCNSE 
    NSE 
    StrongSwan  
    #4
    Toshi Esumi
    Expert Member
    • Total Posts : 2177
    • Scores: 213
    • Reward points: 0
    • Joined: 2014/11/06 09:56:42
    • Status: offline
    Re: VLAN inside VXLAN with 6.2.3 2020/04/22 14:28:12 (permalink)
    0
    Last time when I sniffed it I did it with the main vxlan interface instead of its vlan subinterface and saw nothing. I might have needed to sniff at the subinterface. Once I moved the environment, I'll try that too.
    #5
    emnoc
    Expert Member
    • Total Posts : 5748
    • Scores: 373
    • Reward points: 0
    • Joined: 2008/03/20 13:30:33
    • Location: AUSTIN TX AREA
    • Status: offline
    Re: VLAN inside VXLAN with 6.2.3 2020/04/22 14:40:31 (permalink)
    0
    Yes do the subinterface and generate traffic from A -to Z and then Z to A  directions and see if you get any packets.
     
    We started using linux for our vxlan transport. The performance is much better.
     
    ken 

    PCNSE 
    NSE 
    StrongSwan  
    #6
    Toshi Esumi
    Expert Member
    • Total Posts : 2177
    • Scores: 213
    • Reward points: 0
    • Joined: 2014/11/06 09:56:42
    • Status: offline
    Re: VLAN inside VXLAN with 6.2.3 2020/04/22 22:40:53 (permalink)
    0
    All right. It works now after I moved one side to FG60E. Since I reconfigured FG30E side from scratch, I don't know what I misconfigured. But likely I put the parent vxlan interface into the soft-switch interface while I was supposed to put the vlan sub-interface into it, or something like that kind of a simple mistake or two...
    I'm using multivdom environment on one side and two physical switches (Cisco and Juniper) are involved to convert untagged to/from tagged on both sides, it complicated the cabling too, which might have confused myself.
     
    I was surprised to see only internal (overlay) packets when I sniffed on the tagged vxlan sub-interface. But this might make sense if the outer (underlay) UDP header is added/stripped in-between the vxlan sub-interface and the physical ougoing port.
     
    I'll proceed to "VLAN inside VXLAN over IPSec" like tanr has been planning.
     
    Toshi
    #7
    scan
    New Member
    • Total Posts : 8
    • Scores: 0
    • Reward points: 0
    • Joined: 2019/07/22 02:33:51
    • Status: offline
    Re: VLAN inside VXLAN with 6.2.3 2020/04/22 22:48:02 (permalink)
    0
    Hi Toshi
     
    I created a sample configuration example for VLAN in VXLAN over IPsec. 
    If you need help with the manual please let me know.
     
    Cheers,
    scan
    #8
    Toshi Esumi
    Expert Member
    • Total Posts : 2177
    • Scores: 213
    • Reward points: 0
    • Joined: 2014/11/06 09:56:42
    • Status: offline
    Re: VLAN inside VXLAN with 6.2.3 2020/04/23 08:12:37 (permalink)
    0
    Thanks scan,
    #9
    ispcolohost
    Silver Member
    • Total Posts : 84
    • Scores: -1
    • Reward points: 0
    • Joined: 2014/11/18 08:06:51
    • Status: offline
    Re: VLAN inside VXLAN with 6.2.3 2020/07/16 15:52:51 (permalink)
    0
    Hi all, I could use that sample config if you all have it available, or any guidance.  I'm also attempting vlan in vxlan across ipsec.
    #10
    Jump to:
    © 2020 APG vNext Commercial Version 5.5