How VXLAN and Geneve packets are processed

Summary

The key components involved in VXLAN and Geneve packet processing are:

  • VTEP source interface: Performs encapsulation and decapsulation of VXLAN and Geneve traffic

  • Inner MAC frame: The original packet payload that gets encapsulated

  • Outer frame: The encapsulated packet with VXLAN or Geneve headers

  • Remote VTEP: The destination endpoint for encapsulated traffic

Workflow

These stages describe how VXLAN and Geneve packet processing work:

  1. Traffic entering and exiting the VTEP source interface is subject to VXLAN processing, specifically encapsulation or decapsulation. Encapsulation processing includes these tasks:
    • The VTEP source interface encapsulates the inner MAC frame with the VXLAN header.
    • The UDP checksum field is set to zero.
    • The Outer frame source IP is set to the VTEP interface IP.
    • The Outer frame destination IP is decided by a remote VTEP IP lookup.
    Decapsulation: the Firewall Threat Defense only decapsulates a VXLAN packet if:
    • It is a UDP packet with the destination port set to 4789 (this value is user configurable).
    • The ingress interface is the VTEP source interface.
    • The ingress interface IP address is the same as the destination IP address.
    • The VXLAN packet format is compliant with the standard.
  2. Traffic entering and exiting the VTEP source interface is subject to Geneve processing, specifically encapsulation or decapsulation. Encapsulation processing includes these tasks:
    • The VTEP source interface encapsulates the inner MAC frame with the Geneve header.
    • The UDP checksum field is set to zero.
    • The Outer frame source IP is set to the VTEP interface IP.
    • The Outer frame destination IP is set the peer IP address that you configured.
    Decapsulation; the Firewall Threat Defense only decapsulates a Geneve packet if:
    • It is a UDP packet with the destination port set to 6081 (this value is user configurable).
    • The ingress interface is the VTEP source interface.
    • The ingress interface IP address is the same as the destination IP address.
    • The Geneve packet format is compliant with the standard.