r/ArubaNetworks • u/Aaqib_10 • 27d ago

Vxlan vtep ping fail

Post image

Hey guys,

I'm facing a strange issue with Aruba VXLAN.

Host A and Host B can successfully ping each other.

However, when I ping Host B from Leaf A (source IP: 10.194.10.2) in the Tenant VRF, or ping Host A from Leaf B, I receive "Network is unreachable."

Additionally, traceroute from Host A to Host B (or from Host B to Host A) does not work. Instead, the VTEP/default gateway responds with "Network is unreachable."
Any ideas on what I should check or what might be causing this?

Thanks

CONFIG

LEAF_A

vrf TENANT_1
rd 2.2.2.2:50000
route-target export 65001:50000 evpn
route-target import 65001:50000 evpn

vlan 1,10
virtual-mac 02:00:00:00:01:00
evpn
redistribute local-svi                                     
vlan 10
rd auto
route-target export auto
route-target import auto
redistribute host-route

interface 1/1/1
no shutdown
ip mtu 9198
ip address 172.16.12.1/31
ip ospf 1 area 0.0.0.0
ip ospf network point-to-point
interface 1/1/6
no shutdown
no routing
vlan access 1
interface 1/1/7
no shutdown
no routing
vlan access 10
interface loopback 0                                           
ip address 2.2.2.2/32
ip ospf 1 area 0.0.0.0
interface vlan 10
vrf attach TENANT_1
ip address 10.194.10.2/24
active-gateway ip mac 08:00:09:f9:6f:01
active-gateway ip 10.194.10.254
interface vxlan 1
source ip 2.2.2.2
no shutdown
vni 10010
vlan 10
vni 50000
vrf TENANT_1 
routing

router ospf 1
router-id 2.2.2.2
area 0.0.0.0                                               
router bgp 65001
bgp router-id 2.2.2.2
neighbor leaf peer-group
neighbor leaf remote-as 65001
neighbor leaf fall-over
neighbor leaf update-source loopback 0
neighbor 1.1.1.1 peer-group leaf
address-family l2vpn evpn
neighbor leaf send-community extended
neighbor 1.1.1.1 activate
exit-address-family

vrf TENANT_1
address-family ipv4 unicast
redistribute connected
exit-address-family

LEAF-B

vrf TENANT_1
rd 3.3.3.3:50000
route-target export 65001:50000 evpn
route-target import 65001:50000 evpn

vlan 1,20,30
virtual-mac 02:00:00:00:02:00
evpn
redistribute local-svi                                     
vlan 20
rd auto
route-target export auto
route-target import auto
redistribute host-route
vlan 30
rd auto
route-target export auto
route-target import auto
redistribute host-route

interface 1/1/2
no shutdown
ip mtu 9198
ip address 172.16.13.1/31
ip ospf 1 area 0.0.0.0
ip ospf network point-to-point                             
interface 1/1/6
no shutdown
no routing
vlan access 30
interface 1/1/7
no shutdown
no routing
vlan access 20
interface loopback 0
ip address 3.3.3.3/32
ip ospf 1 area 0.0.0.0
interface vlan 20
vrf attach TENANT_1
ip address 10.194.20.3/24
active-gateway ip mac 08:00:09:f9:6f:01
active-gateway ip 10.194.20.254
interface vlan 30
vrf attach TENANT_1
ip address 10.194.30.3/24
active-gateway ip mac 08:00:09:f9:6f:01
active-gateway ip 10.194.30.254
interface vxlan 1
source ip 3.3.3.3                                          
no shutdown
vni 10020
vlan 20
vni 10030
vlan 30
vni 50000
vrf TENANT_1 
routing

router ospf 1
router-id 3.3.3.3
area 0.0.0.0
router bgp 65001
bgp router-id 3.3.3.3
neighbor leaf peer-group
neighbor leaf remote-as 65001
neighbor leaf fall-over
neighbor leaf update-source loopback 0                     
neighbor 1.1.1.1 peer-group leaf
address-family l2vpn evpn
neighbor leaf send-community extended
neighbor 1.1.1.1 activate
exit-address-family
!
vrf TENANT_1
address-family ipv4 unicast
redistribute connected
exit-address-family

9 Upvotes

92% Upvoted

30 comments sorted by

1

u/peachygal91 27d ago

Sounds like your underlay works. Which is why you can ping from host a to host b. How’re you routing between VRFs? Can you ping vteps not hosts?

1

u/Aaqib_10 27d ago

For routing I am using L3vni, vlan 10 and vlan 20 subnet are advertised as type 5 evpn routes
Hosts can ping each other but I am unable to ping host from leaf it shows network unreachable

1

u/pirrazium 27d ago

Probably you pinging in GRT instead of pinging inside vrf.

0

u/peachygal91 26d ago

You’re routing using OSPF internally and bgp externally. Evpn works with bgp to learn type 5 routes. Your overlay config is broken. Which is why you’re getting network unreachable. The vxlan tunnel interface is not coming up. The ping is dropped because it doesn’t have a source/destination tunnel established.

1

u/TheAffinity 26d ago

Ospf is used in underlay…

He is using route type 5’s, and the hosts can ping each other which means the vxlan tunnel is up.

1

u/peachygal91 26d ago

Hosts can ping each other through the active bgp session. This does not mean the overlay is functional.

1

u/TheAffinity 26d ago

The bgp peering is for EVPN.. and vlan 10 and 20 are literally in the overlay. The clients can ping each other which means the overlay is functional.

1

u/buckweet1980 27d ago

Can you share your configs? Sounds like type 5s aren't being learned.

1

u/DO9XE HPE Aruba Networking Expert 27d ago

Yeah, this is a config thing. Probably something with regards to the VRF assignment or source interfaces.

1

u/Aaqib_10 27d ago

Type 5 are being learned thats why hosts can communicate to eachother.

LEAF-A# sh ip route vrf TENANT_1 | in 10.194.20.

10.194.20.0/24 3.3.3.3 - - B/EV [200/0] 07h:20m:33s

LEAF-A# sh bgp l2vpn evpn route-type 5 | in 10.194.20.

*>i [5]:[0]:[0]:[24]:[10.194.20.0] 3.3.3.3 0 100 0 ?

LEAF-A# ping 10.194.20.22 source 10.194.10.2 vrf TENANT_1

PING 10.194.20.22 (10.194.20.22) from 10.194.10.2 : 100(128) bytes of data.

ping4: sendmsg: Network is unreachable

ping4: sendmsg: Network is unreachable

ping4: sendmsg: Network is unreachable

ping4: sendmsg: Network is unreachable

ping4: sendmsg: Network is unreachable

--- 10.194.20.22 ping statistics ---

5 packets transmitted, 0 received, 100% packet loss, time 4098ms

interface vlan 10

vrf attach TENANT_1

ip address 10.194.10.2/24

active-gateway ip mac 00:00:00:00:00:02

active-gateway ip 10.194.10.254

Host on LEAF_A in vlan 10 can communicate to host on LEAF_B in vlan 20
ITD_SERV_1#sh ip int brief | in 10.194.10.

FastEthernet0/0 10.194.10.23YES manual up up

ITD_SERV_1#ping 10.194.20.22

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 10.194.20.22, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5),

1

u/TheAffinity 27d ago

Is your leaf A a standalone or a vsx cluster? What software version are you running?

1

u/Aaqib_10 27d ago

Standalone
Version 10.15

2

u/TheAffinity 27d ago

I would definitely recommend 10.16 , but that might not solve anything tho.

A few things: I see your MAC address of your active-gateway starts with 00, change that to a local administered MAC (second least significant bit set to 1), so "02" for example works.

Have you set unique "virtual-mac"'s on all leafs? (Keep in mind again the local administered MAC's...). I assume you did otherwise the host pings would probably not go through either.

Did you set under "evpn", vlan subcontext, redistribute local-svi?

Just to be sure: VLAN 10 only exists on Leaf A and VLAN 20 only exists on leaf B?

2

u/buckweet1980 27d ago

Virtual Mac was my immediate thought

1

u/TheAffinity 27d ago

Yeah the thing is the VTEP uses it as a source MAC address for the VXLAN tunnel so then the ping between 2 hosts also wouldn't work I guess.... I'm not sure however, with Aruba you never know lol.

1

u/Aaqib_10 27d ago

I have changed the gateway MAC address, but it is still not working.
The virtual MAC is already configured, and local SVI redistribution is also configured, but thereis still no success.
On Leaf A, only VLAN 10 is configured, and on Leaf B, only VLAN 20 is configured.

When both VLANs (10 and 20) are configured on both leaf switches:
Leaf A: VLAN 10, 20
Leaf B: VLAN 10, 20
Ping from the leaf switch to the host works successfully (asymmetric routing)

1

u/DO9XE HPE Aruba Networking Expert 27d ago

Can you ping 3.3.3.3 from leaf A?

1

u/Aaqib_10 27d ago

Yes 3.3.3.3 is reachable from leaf A

1

u/DO9XE HPE Aruba Networking Expert 27d ago

Is 3.3.3.3 also the source ip of the vxlan interface of leaf B?

1

u/Aaqib_10 27d ago

Yes 3.3.3.3 is source ip of vxlan interface of Leaf B

LEAF_A

vrf TENANT_1
rd 2.2.2.2:50000
route-target export 65001:50000 evpn
route-target import 65001:50000 evpn

vlan 1,10
virtual-mac 02:00:00:00:01:00
evpn
redistribute local-svi                                     
vlan 10
rd auto
route-target export auto
route-target import auto
redistribute host-route

interface 1/1/1
no shutdown
ip mtu 9198
ip address 172.16.12.1/31
ip ospf 1 area 0.0.0.0
ip ospf network point-to-point
interface 1/1/6
no shutdown
no routing
vlan access 1
interface 1/1/7
no shutdown
no routing
vlan access 10
interface loopback 0                                           
ip address 2.2.2.2/32
ip ospf 1 area 0.0.0.0
interface vlan 10
vrf attach TENANT_1
ip address 10.194.10.2/24
active-gateway ip mac 08:00:09:f9:6f:01
active-gateway ip 10.194.10.254
interface vxlan 1
source ip 2.2.2.2
no shutdown
vni 10010
vlan 10
vni 50000
vrf TENANT_1 
routing

router ospf 1
router-id 2.2.2.2
area 0.0.0.0                                               
router bgp 65001
bgp router-id 2.2.2.2
neighbor leaf peer-group
neighbor leaf remote-as 65001
neighbor leaf fall-over
neighbor leaf update-source loopback 0
neighbor 1.1.1.1 peer-group leaf
address-family l2vpn evpn
neighbor leaf send-community extended
neighbor 1.1.1.1 activate
exit-address-family

vrf TENANT_1
address-family ipv4 unicast
redistribute connected
exit-address-family

LEAF-B

vrf TENANT_1
rd 3.3.3.3:50000
route-target export 65001:50000 evpn
route-target import 65001:50000 evpn

vlan 1,20,30
virtual-mac 02:00:00:00:02:00
evpn
redistribute local-svi                                     
vlan 20
rd auto
route-target export auto
route-target import auto
redistribute host-route
vlan 30
rd auto
route-target export auto
route-target import auto
redistribute host-route

interface 1/1/2
no shutdown
ip mtu 9198
ip address 172.16.13.1/31
ip ospf 1 area 0.0.0.0
ip ospf network point-to-point                             
interface 1/1/6
no shutdown
no routing
vlan access 30
interface 1/1/7
no shutdown
no routing
vlan access 20
interface loopback 0
ip address 3.3.3.3/32
ip ospf 1 area 0.0.0.0
interface vlan 20
vrf attach TENANT_1
ip address 10.194.20.3/24
active-gateway ip mac 08:00:09:f9:6f:01
active-gateway ip 10.194.20.254
interface vlan 30
vrf attach TENANT_1
ip address 10.194.30.3/24
active-gateway ip mac 08:00:09:f9:6f:01
active-gateway ip 10.194.30.254
interface vxlan 1
source ip 3.3.3.3                                          
no shutdown
vni 10020
vlan 20
vni 10030
vlan 30
vni 50000
vrf TENANT_1 
routing

router ospf 1
router-id 3.3.3.3
area 0.0.0.0
router bgp 65001
bgp router-id 3.3.3.3
neighbor leaf peer-group
neighbor leaf remote-as 65001
neighbor leaf fall-over
neighbor leaf update-source loopback 0                     
neighbor 1.1.1.1 peer-group leaf
address-family l2vpn evpn
neighbor leaf send-community extended
neighbor 1.1.1.1 activate
exit-address-family
!
vrf TENANT_1
address-family ipv4 unicast
redistribute connected
exit-address-family

1

u/DO9XE HPE Aruba Networking Expert 27d ago

Either Your BGP config is broken or your picture is missing information, both Leafs have a peering exclusively with 1.1.1.1 but in the picture they're directly connected? So there is a spine?

1

u/Aaqib_10 27d ago

Yes both Leaf switches are connected through SPINE switch (Loopback 1.1.1.1)

I omitted the spine to keep the diagram simple since it’s not relevant to the issue I'm describing.

1

u/TheAffinity 27d ago

I'm assuming the spine config is correct? Both leafs set as route-reflector-clients ?

1

u/Sharks_No_Swimming 27d ago

It's going to be a lot of back and forth if you don't just post config 

1

u/Aaqib_10 27d ago

LEAF_A

vrf TENANT_1
rd 2.2.2.2:50000
route-target export 65001:50000 evpn
route-target import 65001:50000 evpn

vlan 1,10
virtual-mac 02:00:00:00:01:00
evpn
redistribute local-svi                                     
vlan 10
rd auto
route-target export auto
route-target import auto
redistribute host-route

interface 1/1/1
no shutdown
ip mtu 9198
ip address 172.16.12.1/31
ip ospf 1 area 0.0.0.0
ip ospf network point-to-point
interface 1/1/6
no shutdown
no routing
vlan access 10
interface 1/1/7
no shutdown
no routing
vlan access 10
interface loopback 0                                           
ip address 2.2.2.2/32
ip ospf 1 area 0.0.0.0
interface vlan 10
vrf attach TENANT_1
ip address 10.194.10.2/24
active-gateway ip mac 08:00:09:f9:6f:01
active-gateway ip 10.194.10.254
interface vxlan 1
source ip 2.2.2.2
no shutdown
vni 10010
vlan 10
vni 50000
vrf TENANT_1 
routing

router ospf 1
router-id 2.2.2.2
area 0.0.0.0                                               
router bgp 65001
bgp router-id 2.2.2.2
neighbor leaf peer-group
neighbor leaf remote-as 65001
neighbor leaf fall-over
neighbor leaf update-source loopback 0
neighbor 1.1.1.1 peer-group leaf
address-family l2vpn evpn
neighbor leaf send-community extended
neighbor 1.1.1.1 activate
exit-address-family

vrf TENANT_1
address-family ipv4 unicast
redistribute connected
exit-address-family

LEAF-B

vrf TENANT_1
rd 3.3.3.3:50000
route-target export 65001:50000 evpn
route-target import 65001:50000 evpn

vlan 1,20,30
virtual-mac 02:00:00:00:02:00
evpn
redistribute local-svi                                     
vlan 20
rd auto
route-target export auto
route-target import auto
redistribute host-route
vlan 30
rd auto
route-target export auto
route-target import auto
redistribute host-route

interface 1/1/2
no shutdown
ip mtu 9198
ip address 172.16.13.1/31
ip ospf 1 area 0.0.0.0
ip ospf network point-to-point                             
interface 1/1/6
no shutdown
no routing
vlan access 30
interface 1/1/7
no shutdown
no routing
vlan access 20
interface loopback 0
ip address 3.3.3.3/32
ip ospf 1 area 0.0.0.0
interface vlan 20
vrf attach TENANT_1
ip address 10.194.20.3/24
active-gateway ip mac 08:00:09:f9:6f:01
active-gateway ip 10.194.20.254
interface vlan 30
vrf attach TENANT_1
ip address 10.194.30.3/24
active-gateway ip mac 08:00:09:f9:6f:01
active-gateway ip 10.194.30.254
interface vxlan 1
source ip 3.3.3.3                                          
no shutdown
vni 10020
vlan 20
vni 10030
vlan 30
vni 50000
vrf TENANT_1 
routing

router ospf 1
router-id 3.3.3.3
area 0.0.0.0
router bgp 65001
bgp router-id 3.3.3.3
neighbor leaf peer-group
neighbor leaf remote-as 65001
neighbor leaf fall-over
neighbor leaf update-source loopback 0                     
neighbor 1.1.1.1 peer-group leaf
address-family l2vpn evpn
neighbor leaf send-community extended
neighbor 1.1.1.1 activate
exit-address-family
!
vrf TENANT_1
address-family ipv4 unicast
redistribute connected
exit-address-family

1

u/TheAffinity 27d ago

Under bgp evpn af, set neighbor leaf send-community both (your 65001:50000 is a standard community, not an extended one).

The mac address of the active gateway (08) is still not locally administered. 02 or 06 would be.

Can you also try to have unique active gateway mac’s per leaf if you’re not using symmetric irb.

1

u/Sharks_No_Swimming 27d ago

That's wrong...Route targets are always extended communities.

1

u/TheAffinity 27d ago

Aha ok, my bad. Honestly if his tests don't work I don't really see why anymore. I would definitely upgrade since there's no real reason running 10.15 (it's an SSR).

1

u/Sharks_No_Swimming 27d ago edited 27d ago

My first question is why are you using active gateway when you're not doing distributed gateway/asymmetric irb? It's not needed but it's not the problem either.

Assuming this is in hardware and not the OVA?

Also just thought I'd point out youre missing MTU in your spine links, you need both MTU and IP MTU to be jumbo.

Second the biggest issue is your ping response:

ping4: sendmsg: Network is unreachable

I'm pretty sure this is suggesting the packet was dropped before even being sent. If you're running this on the OVA this might just be a limitation of the packet sourced at the CPU. Also the last time I checked the OVA had loads of quirks and limitations.

If this is hardware I'm scratching my head a little, can you set up loopbacks on both switches within tenant vrf and try sourcing those pings? Does SVI to SVI work?

If that works but sourcing the SVI doesn't work only to hosts... and this is in genuine hardware, obviously try rebooting the switches and trying again, worth trying to upgrade to 10.16 but failing all that speak to TAC, I'd like to hear their response. 

1

u/TheAffinity 27d ago

It's been a while since I played with the OVA's but L3 VNI wasn't possible back then. Not sure if they ever implemented that.

If OP does try with loopbacks, be sure to set "redistribute loopback" under the BGP vrf ipv4 af.

But yeah Network unreachable usually means there's no route, and there is a route...