Monday, January 25, 2021

Juniper DDOS Protocol Violation - VXLAN & L3NHOP? Any ideas what this is...

Hey All.... I activated iBGP between my core routers (sharing full route table) and suddenly our EVPN/VXLAN fabric went down. I have one switch connected to each core router and then the switches are interconnected. Any ideas what VXLAN DDOS protocol violation and L3NHOP are and why I'm getting violations when iBGP is turned up?

There's a detailed description here:

https://kb.juniper.net/InfoCenter/index?page=content&id=KB35684&cat=QFX_SERIES&actp=LIST

VXLAN =

  1. VXLAN_L2_L3_PKTS: Any VXLAN exception packets like SIP miss and BFD packets over VXLAN. 2) Arp and IPV6 NS/ND packets with no-arp-suppression disabled.3) Any vxlan packets received over VTEP/Access ports which are not classified into any protocol Q will make it to Q 7.

L3NHOP =

UCAST_SWITCHED/NHOP_HIT If the packet is copied to CPU through NH table, it will be mapped to this Q.

Edit: Quick crappy diagram: https://i.imgur.com/pTHQpAI.png

I've raised it with Juniper, just asking if by chance someone here knows what I'm talking about



No comments:

Post a Comment