Virtual eXtensible Local Area Networking documentation | Linux 6.18.37

요약·해설과 원문, 전문 번역을 서로 분리했습니다. API 이름, symbol, source path는 원문 표기를 사용합니다.

1. 요약·해설

원문의 핵심 논리와 kernel programming 관점의 보충 설명입니다. 아래의 전문 번역과는 별도로 작성했습니다.

요약·해설

vxlan.rst:1-88

VXLAN은 24-bit VNI로 L2 segment를 UDP underlay 위에 확장하는 1:N overlay입니다. FDB가 inner MAC을 remote VTEP IP로 연결하고 unknown destination은 구성한 multicast group으로 보낼 수 있습니다.

Linux에서는 iproute2로 tunnel device를 만들고 bridge command로 FDB를 관리합니다. NIC가 UDP tunnel segmentation이나 receive-port parsing을 지원하면 ethtool feature와 tunnel table로 확인할 수 있습니다.

VXLAN forwarding

Inner frameVNI lookupFDB hitRemote VTEP UDP

Inner frameFDB missMulticast group UDP

Inner destination에 따라 learned/static VTEP 또는 multicast로 전달합니다.

2. 영어 원문 전체

번역 기준이 된 Linux v6.18.37 원문입니다. 줄 번호는 이 버전의 파일 좌표입니다.

원문 전체 펼치기

1 .. SPDX-License-Identifier: GPL-2.0

3 ======================================================

4 Virtual eXtensible Local Area Networking documentation

5 ======================================================

7 The VXLAN protocol is a tunnelling protocol designed to solve the

8 problem of limited VLAN IDs (4096) in IEEE 802.1q. With VXLAN the

9 size of the identifier is expanded to 24 bits (16777216).

11 VXLAN is described by IETF RFC 7348, and has been implemented by a

12 number of vendors. The protocol runs over UDP using a single

13 destination port. This document describes the Linux kernel tunnel

14 device, there is also a separate implementation of VXLAN for

15 Openvswitch.

17 Unlike most tunnels, a VXLAN is a 1 to N network, not just point to

18 point. A VXLAN device can learn the IP address of the other endpoint

19 either dynamically in a manner similar to a learning bridge, or make

20 use of statically-configured forwarding entries.

22 The management of vxlan is done in a manner similar to its two closest

23 neighbors GRE and VLAN. Configuring VXLAN requires the version of

24 iproute2 that matches the kernel release where VXLAN was first merged

25 upstream.

27 1. Create vxlan device::

29 # ip link add vxlan0 type vxlan id 42 group 239.1.1.1 dev eth1 dstport 4789

31 This creates a new device named vxlan0. The device uses the multicast

32 group 239.1.1.1 over eth1 to handle traffic for which there is no

33 entry in the forwarding table. The destination port number is set to

34 the IANA-assigned value of 4789. The Linux implementation of VXLAN

35 pre-dates the IANA's selection of a standard destination port number

36 and uses the Linux-selected value by default to maintain backwards

37 compatibility.

39 2. Delete vxlan device::

41 # ip link delete vxlan0

43 3. Show vxlan info::

45 # ip -d link show vxlan0

47 It is possible to create, destroy and display the vxlan

48 forwarding table using the new bridge command.

50 1. Create forwarding table entry::

52 # bridge fdb add to 00:17:42:8a:b4:05 dst 192.19.0.2 dev vxlan0

54 2. Delete forwarding table entry::

56 # bridge fdb delete 00:17:42:8a:b4:05 dev vxlan0

58 3. Show forwarding table::

60 # bridge fdb show dev vxlan0

62 The following NIC features may indicate support for UDP tunnel-related

63 offloads (most commonly VXLAN features, but support for a particular

64 encapsulation protocol is NIC specific):

66 - `tx-udp_tnl-segmentation`

67 - `tx-udp_tnl-csum-segmentation`

68 ability to perform TCP segmentation offload of UDP encapsulated frames

70 - `rx-udp_tunnel-port-offload`

71 receive side parsing of UDP encapsulated frames which allows NICs to

72 perform protocol-aware offloads, like checksum validation offload of

73 inner frames (only needed by NICs without protocol-agnostic offloads)

75 For devices supporting `rx-udp_tunnel-port-offload` the list of currently

76 offloaded ports can be interrogated with `ethtool`::

78 $ ethtool --show-tunnels eth0

79 Tunnel information for eth0:

80 UDP port table 0:

81 Size: 4

82 Types: vxlan

83 No entries

84 UDP port table 1:

85 Size: 4

86 Types: geneve, vxlan-gpe

87 Entries (1):

88 port 1230, vxlan-gpe

3. 한국어 전문 번역

영어 원문의 문단 순서와 의미를 유지한 전체 번역입니다. 코드, 함수명, symbol과 URL은 원문 표기를 유지합니다.

VXLAN protocol 개요

1-25

VXLAN은 IEEE 802.1Q VLAN ID가 4096개로 제한되는 문제를 해결하려고 설계한 tunneling protocol입니다. VXLAN identifier는 24-bit로 확장되어 16,777,216개의 segment를 표현할 수 있습니다.

IETF RFC 7348이 VXLAN을 규정하며 여러 vendor가 구현했습니다. Protocol은 하나의 destination port를 사용하는 UDP 위에서 동작합니다. 이 문서는 Linux kernel tunnel device를 설명하며 Open vSwitch에는 별도 VXLAN 구현이 있습니다.

대부분의 tunnel과 달리 VXLAN은 point-to-point가 아니라 1:N network입니다. VXLAN device는 learning bridge처럼 다른 endpoint의 IP address를 동적으로 학습하거나 정적으로 구성한 forwarding entry를 사용할 수 있습니다.

VXLAN 관리는 GRE와 VLAN에 가까운 방식으로 수행합니다. 구성에는 VXLAN이 처음 upstream merge된 kernel release에 대응하는 iproute2 version이 필요합니다.

Overlay identifier 확장

TechnologyIdentifier bits개수

IEEE 802.1Q VLAN124,096

VXLAN VNI2416,777,216

VLAN과 VXLAN의 segment identifier 공간을 비교합니다.

.. SPDX-License-Identifier: GPL-2.0

======================================================
Virtual eXtensible Local Area Networking documentation
======================================================

The VXLAN protocol is a tunnelling protocol designed to solve the
problem of limited VLAN IDs (4096) in IEEE 802.1q.  With VXLAN the
size of the identifier is expanded to 24 bits (16777216).

VXLAN is described by IETF RFC 7348, and has been implemented by a
number of vendors.  The protocol runs over UDP using a single
destination port.  This document describes the Linux kernel tunnel
device, there is also a separate implementation of VXLAN for
Openvswitch.

Unlike most tunnels, a VXLAN is a 1 to N network, not just point to
point. A VXLAN device can learn the IP address of the other endpoint
either dynamically in a manner similar to a learning bridge, or make
use of statically-configured forwarding entries.

The management of vxlan is done in a manner similar to its two closest
neighbors GRE and VLAN. Configuring VXLAN requires the version of
iproute2 that matches the kernel release where VXLAN was first merged
upstream.

VXLAN device 생성·삭제·조회

26-46

`ip link add vxlan0 type vxlan id 42 group 239.1.1.1 dev eth1 dstport 4789`는 VNI 42인 `vxlan0`을 만듭니다.

Forwarding table에 entry가 없는 traffic은 eth1 위의 multicast group 239.1.1.1로 보냅니다. Destination port는 IANA가 할당한 4789입니다. Linux VXLAN 구현은 표준 port 선정 이전부터 존재해 backwards compatibility를 위해 기본적으로 예전 Linux 선택값을 사용하므로 명시적 `dstport 4789`가 중요할 수 있습니다.

Device 삭제는 `ip link delete vxlan0`, 상세 정보 표시는 `ip -d link show vxlan0`으로 수행합니다.

VXLAN unknown-destination path

Inner Ethernet framevxlan0 VNI 42FDB missUDP encapsulation dstport 4789239.1.1.1 via eth1

FDB miss가 multicast underlay 전송으로 이어집니다.


1. Create vxlan device::

    # ip link add vxlan0 type vxlan id 42 group 239.1.1.1 dev eth1 dstport 4789

This creates a new device named vxlan0.  The device uses the multicast
group 239.1.1.1 over eth1 to handle traffic for which there is no
entry in the forwarding table.  The destination port number is set to
the IANA-assigned value of 4789.  The Linux implementation of VXLAN
pre-dates the IANA's selection of a standard destination port number
and uses the Linux-selected value by default to maintain backwards
compatibility.

2. Delete vxlan device::

    # ip link delete vxlan0

3. Show vxlan info::

    # ip -d link show vxlan0

Forwarding database 관리

47-61

새 `bridge` command로 VXLAN forwarding table을 생성, 삭제, 표시할 수 있습니다.

`bridge fdb add to 00:17:42:8a:b4:05 dst 192.19.0.2 dev vxlan0`은 inner destination MAC을 remote VXLAN endpoint IP에 연결합니다. `bridge fdb delete ...`로 삭제하고 `bridge fdb show dev vxlan0`으로 현재 table을 봅니다.

VXLAN FDB operation

작업핵심 정보

addMAC 00:17:42:8a:b4:05 → VTEP 192.19.0.2, vxlan0

deletevxlan0의 MAC entry 제거

showvxlan0 FDB 전체 표시

Bridge FDB가 inner MAC과 remote VTEP를 연결합니다.

It is possible to create, destroy and display the vxlan
forwarding table using the new bridge command.

1. Create forwarding table entry::

    # bridge fdb add to 00:17:42:8a:b4:05 dst 192.19.0.2 dev vxlan0

2. Delete forwarding table entry::

    # bridge fdb delete 00:17:42:8a:b4:05 dev vxlan0

3. Show forwarding table::

    # bridge fdb show dev vxlan0

UDP tunnel NIC offload

62-88

일부 NIC feature는 UDP tunnel 관련 offload 지원을 나타냅니다. 흔히 VXLAN에 쓰이지만 특정 encapsulation protocol 지원 여부는 NIC마다 다릅니다.

`tx-udp_tnl-segmentation`과 `tx-udp_tnl-csum-segmentation`은 UDP-encapsulated frame에 TCP segmentation offload를 수행하는 기능입니다.

`rx-udp_tunnel-port-offload`는 receive side에서 UDP encapsulated frame을 parse해 inner frame checksum validation 같은 protocol-aware offload를 가능하게 합니다. Protocol-agnostic offload가 없는 NIC에만 필요합니다.

이 RX feature를 지원하는 device는 `ethtool --show-tunnels eth0`으로 현재 offload된 port를 조회합니다. 예제에는 vxlan용 빈 UDP port table과 geneve·vxlan-gpe용 table의 port 1230 entry가 표시됩니다.

UDP tunnel offload feature

Feature기능

tx-udp_tnl-segmentationUDP tunnel frame의 TCP segmentation

tx-udp_tnl-csum-segmentationChecksum을 포함한 UDP tunnel segmentation

rx-udp_tunnel-port-offloadConfigured UDP port를 parse해 inner protocol-aware offload

TX segmentation과 RX tunnel-port parsing 역할입니다.

The following NIC features may indicate support for UDP tunnel-related
offloads (most commonly VXLAN features, but support for a particular
encapsulation protocol is NIC specific):

 - `tx-udp_tnl-segmentation`
 - `tx-udp_tnl-csum-segmentation`
    ability to perform TCP segmentation offload of UDP encapsulated frames

 - `rx-udp_tunnel-port-offload`
    receive side parsing of UDP encapsulated frames which allows NICs to
    perform protocol-aware offloads, like checksum validation offload of
    inner frames (only needed by NICs without protocol-agnostic offloads)

For devices supporting `rx-udp_tunnel-port-offload` the list of currently
offloaded ports can be interrogated with `ethtool`::

  $ ethtool --show-tunnels eth0
  Tunnel information for eth0:
    UDP port table 0:
      Size: 4
      Types: vxlan
      No entries
    UDP port table 1:
      Size: 4
      Types: geneve, vxlan-gpe
      Entries (1):
          port 1230, vxlan-gpe