What is a VTEP, and where does it live?
Show the answer
Say this first
A VXLAN tunnel endpoint is the device that encapsulates and decapsulates VXLAN. It maps local VLANs to VNIs, keeps track of which MACs and IPs sit behind which remote VTEP, and sources its tunnels from a loopback advertised into the underlay. Hardware VTEPs are leaf switches. Software VTEPs run in hypervisors and Linux hosts (Open vSwitch, the Linux kernel, VMware NSX).
Go deeper
On each platform
interface nve1
no shutdown
host-reachability protocol bgp
source-interface loopback1
member vni 10010
ingress-replication protocol bgpinterface Vxlan1
vxlan source-interface Loopback1
vxlan udp-port 4789
vxlan vlan 10 vni 10010ip link add vxlan10010 type vxlan id 10010 local 10.0.1.11 dstport 4789 nolearningWhy a separate VTEP loopback
Most designs use loopback0 for the router ID and BGP peering and loopback1 for the VTEP. In a vPC or MLAG pair, both switches share one VTEP address (an anycast VTEP; on NX-OS a secondary IP on loopback1) so remote leaves see one tunnel endpoint for dual-homed hosts. The router IDs stay unique.
What the VTEP knows
- Local MACs, learned from frames on access ports.
- Remote MACs and IPs, learned from EVPN type 2 routes (or from decapsulated traffic in flood and learn mode).
- Peers, the remote VTEPs it has tunnels to:
show nve peerson NX-OS,show vxlan vtepon EOS.
They will ask next
Is there a tunnel setup handshake between VTEPs?
No. VXLAN tunnels are stateless. A VTEP becomes a "peer" when the control plane tells it that remote VTEP exists, or when it first receives traffic from it in flood and learn mode.
Traps
- Using the shared anycast VTEP address of a vPC pair as the BGP router ID.