Configure the VTEP source interface

This task enables you to set up VXLAN network virtualization by configuring a Network Virtualization Endpoint (NVE) on your firewall device.

You can configure one VTEP source interface per Firewall Threat Defense device. The VTEP is defined as a Network Virtualization Endpoint (NVE). VXLAN is the default encapsulation type. An exception is made for clustering on the Firewall Threat Defense Virtual in Azure, where you can use one VTEP source interface for the cluster control link and a second one for the data interface connected to the Azure GWLB.

Procedure

Step 1

If you want to specify a group of peer VTEPs, add a network object with the peer IP addresses. See Create a network object.

Step 2

Choose Devices > Device Management.

Step 3

Click Edit (edit icon) next to the device on which you want to configure VXLAN.

Step 4

(Optional) Specify that the source interface is NVE-only.

This setting is optional for routed mode where this setting restricts traffic to VXLAN and common management traffic only on this interface. This setting is automatically enabled for transparent firewall mode.

  1. Click Interfaces.

  2. Click Edit (edit icon) for the VTEP source interface.

  3. On the General page, check the check box of NVE Only.

Step 5

Click VTEP if it is not already displaying.

Step 6

Check Enable NVE.

Step 7

Click Add VTEP.

  1. For the Encapsulation Type, choose VXLAN.

    For AWS, you can choose between VXLAN and Geneve. Other platforms have VXLAN chosen automatically.

  2. Enter the value for the Encapsulation port within the specified range.

    The default value is 4789.

  3. Select the VTEP Source Interface.

    Select from the list of available physical interfaces present on the device. If the source interface MTU is less than 1554 bytes for IPv4 or 1574 bytes for IPv6, then the Cloud-Delivered Firewall Management Center automatically raises the MTU to 1554 bytes or 1574 bytes.

  4. Select the Neighbor Address. The available options are:

    • None—No neighbor address is specified.

    • Peer VTEP—Specify a peer VTP address.

    • Peer Group—Specify a network object with the peer IP addresses.

    • Default Multicast—Specify a default multicast group for all associated VNI interfaces. If you do not configure the multicast group per VNI interface, then this group is used. If you configure a group at the VNI interface level, then that group overrides this setting.

Step 8

Click OK.

Step 9

Click Save.

What to do next

Configure the routed interface parameters. See Configure Routed Mode Interfaces.