Tunnels and overlay networks: GRE, VXLAN, EVPN
You build virtual networks on top of the physical one with GRE and VXLAN, add a control plane with EVPN and solve MTU and encryption issues.
Level 401 · 16 lessons · 15 practice labs
Lessons
Tunnels
- Encapsulation: a packet inside a packet
- Building a GRE tunnel
- IPIP and SIT tunnels
- MTU and fragmentation in tunnels
- Short task: encrypt a GRE tunnel with IPsec
VXLAN
- VXLAN: VNI and VTEP
- Building static VXLAN
- Unknown traffic: multicast and head-end replication
- Attaching VXLAN to a Linux bridge
- Short task: stretch one L2 network between two data centres
EVPN
- EVPN: learning MAC addresses with BGP
- EVPN-VXLAN with FRRouting
- Distributed routing with symmetric IRB
- Troubleshooting an overlay network
- Short task: build a three-leaf EVPN fabric
Wrap-up
- Capstone: design and build an overlay for two data centres
Practice labs
- Link two branches with GRE: Build a GRE tunnel between two branch routers, add routes to the branch LANs and show the encapsulated packets in a capture on the outside interface.
- The tunnel comes up then goes down: Find the recursive routing mistake sending the route to the tunnel endpoint through the tunnel itself, fix it and show the tunnel staying up.
- Three branches, OSPF over GRE: Link Blue Harbour Cargo’s three branches in a triangle of GRE tunnels, run OSPF over the tunnels and show traffic taking the other path when one tunnel drops.
- Work out the tunnel MTU: Work out the right tunnel MTU for GRE, IPIP and VXLAN from their header overheads, and confirm the limit with large pings.
- Web pages half-load over the tunnel: Tie small requests working but big replies hanging over the tunnel to filtering that breaks PMTUD, solve it with MSS clamping and show full page loads.
- An IPv6 island over an IPv4 network: Link two IPv6 networks over an IPv4-only backbone with a SIT tunnel, solve the MTU and routing issues and show an IPv6 file transfer between the ends.
- One L2 network between two servers: Build static VXLAN between two servers, attach the ends to bridges and show namespaces on both sides talking on the same subnet.
- The third VTEP gets no broadcasts: Find from the FDB entries the VTEP missing from the head-end replication list, add it and show ARP reaching all three ends in a capture.
- Two tenants’ traffic is mixing: Find the VNI and bridge-mapping mistakes letting two tenants see each other’s ARP requests in Copperleaf Insurance’s static VXLAN setup, fix them and prove the separation with a capture.
- Find MAC addresses in the BGP table: In a working EVPN fabric, find which leaf announces a client’s MAC address as a Type 2 route and match it to the bridge FDB.
- A leaf does not advertise the VNI: Find why one leaf in a three-leaf fabric is not advertising the VNI (advertise-all-vni, bridge membership), fix it and show end-to-end connectivity.
- Routing between VNIs is broken: Find why clients in different VNIs cannot reach each other in a symmetric-IRB fabric (L3 VNI, VRF, route targets), fix it and show routing between leaves.
- Underlay or overlay problem?: For a broken connection in an overlay, apply a checklist testing VTEP reachability in the underlay first and then the overlay, and show which layer holds the fault.
- The same MAC in two data centres: Detect from BGP and FDB output the flapping caused by the same MAC announced from two leaves, find its source and remove it.
- The overlay is down: search four layers: Find the faults spread across the underlay route, BGP session, VNI mapping and MTU in Kuzey Logistics’s two-data-centre EVPN-VXLAN network, fix them in order and note the evidence for each step.
About this course
You build virtual networks on top of the physical one with GRE and VXLAN, add a control plane with EVPN and solve MTU and encryption issues.
What you will learn
Prerequisites
You should have practised the topics of the same path up to level 301.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 401; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.