PacketLab
Protocol Library/Routing & Switching/VXLAN
VXLAN · VXLAN data-plane deployments

Static Ingress Replication

Build the smallest VXLAN segment, replicate BUM frames to a configured peer and observe data-plane learning.

Two directly connected VTEPs

Example platform: Nexus 9300/9000v · NX-OS 9.3(9) command model. Commands are platform-specific. Use a release and hardware/image with the stated VXLAN, multicast and routing features. All outputs and packet excerpts below are constructed teaching examples, not lab recordings.

A routed link connects LEAF1 and LEAF2. H1 and H2 use the same tenant subnet, but their access VLAN is not bridged across the physical uplink. Both edges map local VLAN 10 to VNI 10010. Neither host needs a VXLAN driver; assign the listed addresses/MACs to its isolated access NIC and bring the link up. No default gateway is needed for this same-subnet test.

Independent lab · staticIllustrative topology
Physical topology of static; addressing and roles appear in the following table.
Solid lines are physical connections; crossings are not junctions. The dashed blue line is the logical VXLAN tunnel. Port addresses and host settings are listed below.
Physical linkAddress at first endpointAddress at second endpoint
LEAF1 Ethernet1/1 ↔ LEAF2 Ethernet1/1192.0.2.1/30192.0.2.2/30
DeviceLoopback0 / router ID
LEAF110.255.0.1/32
LEAF210.255.0.2/32
HostLocal attachmentIP / MAC
H1LEAF1 Ethernet1/2, VLAN 1010.10.10.11/24 · 02:00:00:00:00:11
H2LEAF2 Ethernet1/2, VLAN 1010.10.10.22/24 · 02:00:00:00:00:22

Establish transport first

LEAF1 · routed uplink and source loopback

hostname LEAF1
feature ospf
router ospf UNDERLAY
  router-id 10.255.0.1
interface loopback0
  ip address 10.255.0.1/32
  ip router ospf UNDERLAY area 0.0.0.0
interface Ethernet1/1
  no switchport
  mtu 9216
  ip address 192.0.2.1/30
  ip ospf network point-to-point
  ip ospf cost 40
  ip router ospf UNDERLAY area 0.0.0.0
  no shutdown

LEAF2 uses its corresponding addresses from the complete configuration below. The OSPF area and point-to-point type agree. Loopback0 is shared as router ID and NVE source for this compact lab; dedicated source loopbacks are a production design option.

LEAF1 · illustrative output, selected fields
LEAF1# show ip route 10.255.0.2
10.255.0.2/32, ubest/mbest: 1/0
    *via 192.0.2.2, Eth1/1, [110/41], ospf-UNDERLAY, intra

A route to the remote source loopback is required in both directions before the overlay can deliver traffic. A routing adjacency alone is insufficient.

Map the VLAN and configure replication

LEAF1 · overlay configuration

feature nv overlay
feature vn-segment-vlan-based
vlan 10
  vn-segment 10010
interface Ethernet1/2
  switchport
  switchport mode access
  switchport access vlan 10
  spanning-tree port type edge
  no shutdown
interface nve1
  no shutdown
  source-interface loopback0
  member vni 10010
    ingress-replication protocol static
      peer-ip 10.255.0.2

LEAF2 · overlay configuration

feature nv overlay
feature vn-segment-vlan-based
vlan 10
  vn-segment 10010
interface Ethernet1/2
  switchport
  switchport mode access
  switchport access vlan 10
  spanning-tree port type edge
  no shutdown
interface nve1
  no shutdown
  source-interface loopback0
  member vni 10010
    ingress-replication protocol static
      peer-ip 10.255.0.1

The peer list says where to replicate broadcast, unknown-unicast and multicast frames. It is not a permanent table of every remote host MAC. Known-unicast traffic uses the learned destination location; adding more VTEPs requires deliberate peer-list maintenance.

Verify the mapping, then send traffic

LEAF1 · illustrative output, selected fields
LEAF1# show nve vni
Interface VNI     Multicast-group State Mode Type
nve1      10010   UnicastStatic   Up    DP   L2 [10]
LEAF1 · illustrative output, selected fields
LEAF1# show mac address-table dynamic
VLAN  MAC Address       Type     Ports
10    0200.0000.0011    dynamic  Eth1/2
10    0200.0000.0022    dynamic  nve1(10.255.0.2)

The MAC rows describe the state after H1 and H2 exchange traffic. An empty table before that exchange is not itself a failure. H1 sends a ping to 10.10.10.22; capture ARP first, then known unicast, and confirm the reply at H1. DP indicates data-plane learning, not a BGP EVPN session.

Separate replicated ARP from learned unicast

ARP request over the routed link · reconstructed packet fields, not a recorded capture
Outer IP: 10.255.0.1 -> 10.255.0.2 (unicast)
UDP: example source 55001 -> destination 4789
VXLAN: VNI 10010
Inner Ethernet: H1 MAC -> ff:ff:ff:ff:ff:ff
ARP: who has 10.10.10.22?

The inner frame is broadcast, but static ingress replication sends an outer unicast copy to each configured peer. After the ARP reply, both VTEPs can associate remote source MACs with the opposite VTEP. Source-port entropy and actual packet timing vary by implementation.

A missing peer and a usable recovery

LEAF1 · illustrative output, selected fields
LEAF1# show running-config interface nve1
interface nve1
  source-interface loopback0
  member vni 10010
    ingress-replication protocol static
    (no peer-ip configured)

In this independent fault, initial ARP from H1 cannot be replicated to LEAF2 even though the loopback route exists. Restore LEAF1’s peer-ip 10.255.0.2 using the overlay block, then verify ARP and endpoint ping again. A pre-existing learned entry can mask a replication fault; use a controlled fresh neighbor exchange rather than assume a successful cached ping proves BUM forwarding.

Complete independent lab configurations

Start with clean isolated lab devices. These are the complete scenario configurations, not changes to apply on top of a different lesson. Physical ports must match the address table. Virtual-image data-plane capabilities can differ from physical switches; these examples have not been executed on live devices.

Download configuration reference

LEAF1

hostname LEAF1
feature ospf
router ospf UNDERLAY
  router-id 10.255.0.1
interface loopback0
  ip address 10.255.0.1/32
  ip router ospf UNDERLAY area 0.0.0.0
interface Ethernet1/1
  no switchport
  mtu 9216
  ip address 192.0.2.1/30
  ip ospf network point-to-point
  ip ospf cost 40
  ip router ospf UNDERLAY area 0.0.0.0
  no shutdown
feature nv overlay
feature vn-segment-vlan-based
vlan 10
  vn-segment 10010
interface Ethernet1/2
  switchport
  switchport mode access
  switchport access vlan 10
  spanning-tree port type edge
  no shutdown
interface nve1
  no shutdown
  source-interface loopback0
  member vni 10010
    ingress-replication protocol static
      peer-ip 10.255.0.2

LEAF2

hostname LEAF2
feature ospf
router ospf UNDERLAY
  router-id 10.255.0.2
interface loopback0
  ip address 10.255.0.2/32
  ip router ospf UNDERLAY area 0.0.0.0
interface Ethernet1/1
  no switchport
  mtu 9216
  ip address 192.0.2.2/30
  ip ospf network point-to-point
  ip ospf cost 40
  ip router ospf UNDERLAY area 0.0.0.0
  no shutdown
feature nv overlay
feature vn-segment-vlan-based
vlan 10
  vn-segment 10010
interface Ethernet1/2
  switchport
  switchport mode access
  switchport access vlan 10
  spanning-tree port type edge
  no shutdown
interface nve1
  no shutdown
  source-interface loopback0
  member vni 10010
    ingress-replication protocol static
      peer-ip 10.255.0.1
HostAddressGateway
H110.10.10.11/24none
H210.10.10.22/24none

Further reading

Key Takeaways

  • Static ingress replication sends a unicast copy of BUM traffic to each configured VTEP.
  • A peer list is different from a learned remote-MAC entry.
  • Both VTEP source loopbacks need working underlay reachability.
  • VLAN-to-VNI mapping, NVE state and endpoint evidence verify different stages.
  • An existing learned flow can hide a broken initial-ARP path.

Static Ingress Replication Quiz

Six questions · four options each · select one answer per question. Submit all answers to see your score and explanations.

1. How is H1’s initial ARP transported in this lab?
2. Does peer-ip configure every remote host MAC?
3. Which loopback must LEAF1 reach?
4. What does DP mean in the selected NVE output?
5. A fresh MAC table is empty before any host traffic. What follows?
6. Which fault can stop fresh ARP while loopback routing stays healthy?