Configure VXLAN and VNIs

60 minLabConfigurationVirtualOpen-source

Create the tenant VLAN, define the VXLAN tunnel sourced from Loopback0, map VLAN-to-VNI (L2VNI), and verify the tunnel object reaches an operational state on both leaves. This is data-plane plumbing only — EVPN comes in Lab 4.3.

Safety: Caution

May change state — take a snapshot first.

VLAN/VXLAN changes touch the data plane; work from the 'underlay-good' snapshot.

Two-leaf VXLAN lab (Host1—Leaf1—underlay—Leaf2—Host2)

  Host1 (Linux)                                   Host2 (Linux)
  10.10.10.11/24                                  10.10.10.12/24
      │ eth1                                           eth1 │
      │                                                     │
  ┌───┴────────┐        virtual underlay          ┌────────┴───┐
  │  Leaf1     │  Ethernet0  ── p2p ──  Ethernet0  │  Leaf2     │
  │  SONiC-VS  │◀───────── routed IP fabric ──────▶│  SONiC-VS  │
  │  Lo0 =     │        (BGP, ECMP-capable)        │  Lo0 =     │
  │  10.0.0.1  │                                   │  10.0.0.2  │
  └────────────┘                                   └────────────┘
   access: EthernetX (VLAN 10 ↔ VNI 10010)   access: EthernetX (VLAN 10 ↔ VNI 10010)

Objective

• Create VLAN 10 and add the host-facing access port to it on both leaves.
• Define a VXLAN tunnel object sourced from Loopback0.
• Map VLAN 10 to VNI 10010 (L2VNI) on both leaves.
• Verify the tunnel and VLAN-VNI map reach an operational state.

Starting state

• Underlay up, loopbacks reachable, MTU validated.
• No VLANs, VXLAN tunnel, or VNI maps configured yet.

Prerequisites: Lab 4.1 complete ('underlay-good' snapshot). · Host1/Host2 attached to a chosen access interface on each leaf.

Tasks

1
Create the tenant VLAN and access port
SONiC CLI
```
sudo config vlan add 10
```
SONiC CLIhost-facing access port
```
sudo config vlan member add 10 Ethernet4 --untagged
```
SONiC CLI
```
show vlan brief
```
Expected:
- VLAN 10 exists with the access port as an untagged member on both leaves.
What happened internally: Rung 2 of the ladder (local bridge) is being built. This writes VLAN and VLAN_MEMBER to CONFIG_DB.
2
Define the VXLAN tunnel (VTEP)
The tunnel's source IP must be Loopback0 — the VTEP identity the overlay advertises.
SONiC CLILeaf1: source = its Lo0 (10.0.0.2 on Leaf2)
```
sudo config vxlan add vtep 10.0.0.1
```
Expected:
- A VXLAN tunnel object exists sourced from Loopback0.
What happened internally: Writes VXLAN_TUNNEL to CONFIG_DB. This is the NVE/VTEP object — a discrete thing, not an interface toggle.
3
Map VLAN to VNI (L2VNI)
SONiC CLIVLAN 10 ↔ VNI 10010
```
sudo config vxlan map add vtep 10 10010
```
SONiC CLI
```
show vxlan vlanvnimap
```
Expected:
- VLAN 10 maps to VNI 10010 identically on both leaves.
What happened internally: Writes VXLAN_TUNNEL_MAP (L2VNI). A mismatch here vs the far leaf is a classic Lab 4.6 failure — keep the map symmetric.
4
Verify tunnel state
SONiC CLI
```
show vxlan tunnel
```
SONiC CLI
```
show vxlan interface
```
SONiC DBASIC_DB objects (VS caveat)
```
redis-cli -n 1 KEYS "*VXLAN*"
```
Expected:
- Tunnel object present and operational; ASIC_DB shows VXLAN/tunnel objects (on VS this reflects intent, not real forwarding).
What happened internally: Rungs 3, 7, 8 of the ladder are now observable. Remote VTEP/remote MAC entries will remain empty until EVPN (Lab 4.3) or manual/static config populates them.

Troubleshooting branches

If: show vxlan tunnel empty

Then: Confirm the VTEP was added with Loopback0's IP and that Loopback0 exists/has that IP.

If: VNI map not applied

Then: Verify VLAN 10 exists before mapping; check show vxlan vlanvnimap on both leaves for symmetry.

If: No ASIC_DB VXLAN keys

Then: On VS this can still be limited; note the image. On hardware, check syncd/orchagent logs for SAI errors.

Cleanup / rollback

Keep the VXLAN plumbing — Lab 4.3 adds EVPN on top.
Snapshot each leaf as 'vxlan-configured'.

Lab evidence checklist

☐ VLAN 10 with access member on both leaves.
☐ VXLAN tunnel sourced from Loopback0 on both leaves.
☐ VLAN 10 ↔ VNI 10010 map symmetric across leaves.
☐ Tunnel object operational; ASIC_DB VXLAN objects observed (VS caveat noted).

Reflection

At this point can Host1 reach Host2? Why not — what is still missing between 'tunnel exists' and 'remote MAC known'?
Which single object, if mismatched between leaves, would silently break forwarding later?

Lab notes & observations