GRE over EVPN-VXLAN

Benefits of GRE over EVPN-VXLAN Support

• Enhances network flexibility by supporting complex tunneling scenarios, accommodating diverse use cases and improving overall data traffic management.

• Enhances security by encapsulating GRE traffic within VXLAN tunnels. This provides an additional layer of security by isolating traffic from external devices and potential threats.

• Improves traffic handling efficiency by utilizing the forwarding ASIC for GRE encapsulation and de-encapsulation, ensuring high performance in data center network environments.

• Simplifies configuration and implementation with the use of existing EVPN-VXLAN and GRE settings, minimizing the need for new commands or extensive reconfiguration.

Overview

When you implement GRE over EVPN-VXLAN on the Junos OS Evolved platform, you leverage the forwarding ASIC to encapsulate and de-encapsulate GRE packets within VXLAN tunnels. This enables efficient traversal of GRE traffic across different network segments while keeping the internal payload hidden from intermediate devices.

For encapsulation, the packets are GRE-encapsulated and then looped back to add the VXLAN encapsulation. To allow the GRE-encapsulated packets to be properly looped back for VXLAN encapsulation, do not configure the bypass-loopback option.

For de-encapsulation, configure the tunnel-loopback option under the destination IRB interface. The VXLAN headers are de-encapsulated first, then the tunnel-loopback configuration enables the GRE packets to be looped back for de-encapsulation. This ensures that the internal traffic maintains its integrity throughout the VXLAN network.

To configure GRE over EVPN-VXLAN, you use existing Junos OS Evolved CLI commands for EVPN-VXLAN and GRE, ensuring a streamlined configuration process. Key configuration steps include configuring the destination IRB interfaces with the tunnel-loopback statement for de-encapsulation. For example, enter the following command: set interfaces irb unit unit-number family inet tunnel-loopback. Additionally, you need to configure the appropriate routing instances and protocol settings to ensure proper encapsulation and de-encapsulation of traffic. This setup is critical for maintaining the operational efficiency and security of network traffic across multiple segments.

Caveats and Limitations

When deploying GRE over VXLAN, note the following caveats and limitations:

• Loopback processing is required for both encapsulation and de-encapsulation, limiting overall throughput per DLB port.

• Support is limited to IPv4 underlays.

• Type 5 VXLAN tunnels are not supported.

• The bypass-loopback option under the Flexible Tunnel Interface (FTI) is not supported.

• Filter-based GRE de-encapsulation is not supported for de-encapsulation.

Despite these constraints, GRE over VXLAN improves the flexibility and scalability of network designs, enabling secure and efficient traffic traversal in a wide range of deployment scenarios.

Example Network with EVPN-VXLAN Data Center Use Case

This use case illustrates a network using GRE encapsulation to shield specific traffic as it traverses EVPN-VXLAN in a PTX based data center.

In this example, the network has traffic at Site A that being sent to Site B. The traffic must pass through a PTX based data center using EVPN-VXLAN and they are using GRE to encapsulate the traffic as it passes through the data center. They are also routing the traffic through a CE device that performs specific services on the GRE traffic before sending it on to Site B.

Figure 1 shows the path of the transit traffic through the VXLAN network.

In this example, the traffic at Site A is encapsulated using GRE and sent to the PTX Server.

Instead of being de-encapsulated when it reaches the PTX Spine, the GRE traffic is sent through the Site A and L2-VRF routing instances where it is further encapsulated in VXLAN then sent to the Leaf Switch.

The Leaf Switch forwards the GRE-encapsulated traffic to the CE for services. The GRE encapsulation shields the inner payload from other devices in the VXLAN network.

The CE device performs services and returns the traffic to the Leaf Switch where it is sent back to the PTX Spine using VXLAN.

The Spine receives the traffic from the Leaf Switch, de-encapsulates the VXLAN and recognizes the GRE encapsulation. The tunnel-loopback configuration under the IRB loops the GRE packets through inet.0 for the GRE de-encapsulation.

After the inner payload is completely de-encapsulated it is forwarded to Site B.

Example Configurations

The following examples show the relevant configurations for the devices shown in Figure 1. These configurations are focused on configuring GRE over VXLAN and do not include all the configurations necessary to implement an IP fabric underlay.

• Site A
• PTX Spine
• Leaf Switch