Trace a MAC Between Leaves

55 minLabCorrelationObservationVirtualOpen-source

Correlation lab: generate traffic from Host1 and follow one MAC through the whole machine — local learning on Leaf1, type-2 advertisement, import and remote installation on Leaf2, down to the FDB/tunnel objects — then confirm VXLAN forwarding actually delivers the frame to Host2.

Safety: Safe

Non-disruptive. Safe to run in the virtual lab.

Two-leaf VXLAN lab (Host1—Leaf1—underlay—Leaf2—Host2)

  Host1 (Linux)                                   Host2 (Linux)
  10.10.10.11/24                                  10.10.10.12/24
      │ eth1                                           eth1 │
      │                                                     │
  ┌───┴────────┐        virtual underlay          ┌────────┴───┐
  │  Leaf1     │  Ethernet0  ── p2p ──  Ethernet0  │  Leaf2     │
  │  SONiC-VS  │◀───────── routed IP fabric ──────▶│  SONiC-VS  │
  │  Lo0 =     │        (BGP, ECMP-capable)        │  Lo0 =     │
  │  10.0.0.1  │                                   │  10.0.0.2  │
  └────────────┘                                   └────────────┘
   access: EthernetX (VLAN 10 ↔ VNI 10010)   access: EthernetX (VLAN 10 ↔ VNI 10010)

Objective

• Observe local MAC learning on the ingress leaf.
• Watch the type-2 advertisement leave Leaf1 and arrive/import on Leaf2.
• Confirm remote installation into Leaf2's FDB pointing at Leaf1's VTEP.
• Validate end-to-end VXLAN forwarding (Host1 ↔ Host2).

Starting state

• EVPN established, remote VTEP known, VNI mapped. Host MAC tables may be empty until traffic flows.

Prerequisites: Lab 4.3 complete ('evpn-established' snapshot).

Tasks

1
Generate deterministic traffic
Use a known source so you can track exactly one MAC through the system.
Linuxnote Host1's MAC first
```
ip -br link show eth1
```
LinuxHost1 → Host2
```
ping -c 5 10.10.10.12
```
Expected:
- ARP resolves (BUM path) then ICMP replies (unicast path) — both classes exercised.
What happened internally: ARP travels the type-3/BUM path; the ICMP that follows uses the type-2 unicast FDB entry. You are exercising both doors from Lesson 4.4.
2
Observe local learning (Leaf1)
SONiC CLI
```
show mac | grep -i <host1-mac>
```
Expected:
- Host1's MAC learned on the access port in VLAN 10.
What happened internally: Rung 1–2. Local learn is the trigger that originates the type-2 route.
3
Watch advertisement and import (both leaves)
FRR / vtyshLeaf1: originated; Leaf2: received
```
vtysh -c 'show bgp l2vpn evpn route type macip'
```
FRR / vtysh
```
vtysh -c 'show evpn mac vni 10010'
```
Expected:
- Host1's MAC as a type-2 route on Leaf1 and imported on Leaf2 (RT match) in VNI 10010.
What happened internally: Rung 5–6. If present on Leaf1 but absent on Leaf2, suspect RT/import — the exact 'session up, route absent' state.
4
Confirm remote installation (Leaf2)
SONiC CLIon Leaf2: should show remote/VTEP
```
show mac | grep -i <host1-mac>
```
SONiC CLI
```
show vxlan remotemac
```
SONiC DBASIC_DB FDB (VS caveat)
```
redis-cli -n 1 KEYS "*FDB*"
```
Expected:
- On Leaf2, Host1's MAC shows as remote behind Leaf1's VTEP (10.0.0.1); FDB objects present.
What happened internally: Rung 7–8. Route imported but no remote FDB → the 'present but not programmed' split state (Lesson 4.6).
5
Validate end-to-end forwarding
LinuxHost1 → Host2, steady state
```
ping -c 3 10.10.10.12
```
Expected:
- Consistent replies. Correlate: local learn → type-2 → remote FDB → forwarding, all lined up.
What happened internally: This closes the loop between control-plane correlation and actual data delivery. On VS, delivery fidelity is limited — note the image.

Troubleshooting branches

If: MAC learned on Leaf1 but not seen on Leaf2

Then: type-2 originated? RT import matches? This is 'session up, route absent' — inspect rung 6.

If: MAC in Leaf2 RIB but not in show mac/FDB

Then: 'Present but not programmed' — check tunnel up (rung 7) and ASIC_DB/orchagent (rung 8).

If: ARP fails but you expect unicast to work

Then: ARP is BUM/type-3; verify the flood/IMET path before the unicast path.

Cleanup / rollback

No teardown needed; keep state for Lab 4.5.

Lab evidence checklist

☐ Host1 MAC captured and traced end to end.
☐ Local learn (Leaf1) → type-2 → import (Leaf2) → remote FDB documented.
☐ End-to-end ping succeeds and lines up with the control-plane evidence.

Reflection

At which single step would a route-target mismatch have stopped the trace, and what would you have seen?
How would 'remote MAC present but not programmed' have looked different from 'route never imported'?

Lab notes & observations