VXLAN / MT-Help wrong...

[Guscht]

Hi,

according to:
https://help.mikrotik.com/docs/display/ROS/VXLAN

The commands for a simple VXLAN-setup are:

/interface vxlan
add name=vxlan1 port=8472 vni=10

# Router1
/interface vxlan vteps
add interface=vxlan1 remote-ip=192.168.10.10
 
# Router2
/interface vxlan vteps
add interface=vxlan1 remote-ip=192.168.20.20

Lets do this in Winbox, default-settings, VNI set to “10” as in accordance to the manual:

This comes out:

OK, BOTH Interface and Group must be specified… This is not what the Manual says:

group > (IPv4; Default: ) When specified, a multicast group address can be used to forward…

A “when” and “can” is not a mandatory must…

interface > (name; Default: ) Interface name used for multicast forwarding.

Who said I want that never-really-working-multicast-crap?!

MT says:

Multicast or unicast is used […]

I want Unicast, where do I specify Unicast or Multicast?




OK, the Winbox-way doesnt work lets try the CLI (as stated in the manual):

Seems to work:

or…

Lets open the VXLAN-Interface:

Now, the same happens…

Who is wrong, I, the Manual, ROS? No one, all?



Sidenote to MT: Are you serious? After (felt) 1000 years of developing V7 you come up with this…
This is nothing more than a public BETA. After trying this VXLAN-setup, I assume no one ever has tried the setps you write in your own manual.

[aglabs]

as you mentioned its not possible to configure unicast in winbox, there is no specific option to define multicast vs unicast, the help does create a unicast session. When you define a vtep w/o defining a multicast group its the same as unicast.

For reference rfc7348 defines vtep as:
VXLAN Tunnel End Point. An entity that originates and/or terminates VXLAN tunnels

Using the example from help I have vxlan working unicast over a wireguard tunnel.

/interface vxlan
add name=vxlan1 port=8472 vni=10
/interface vxlan vteps
add interface=vxlan1 remote-ip=172.16.96.46
add interface=vxlan1 remote-ip=172.16.96.47

172.16.96.46 and .47 are remote mikrotik 5009’s connected back to this site via wireguard.

You cannot edit the vxlan interface from winbox after defining in CLI (seems like there is room for improvement there).

Once the vxlan interface is defined you can then add it to a bridge and tag/untag vlans on it:

/interface bridge
add ingress-filtering=no name=bridge1 vlan-filtering=yes
add name=loopback1
/interface bridge port
add bridge=bridge1 interface=ether1
add bridge=bridge1 interface=ether4 pvid=98
add bridge=bridge1 interface=ether5 pvid=3
add bridge=bridge1 interface=vxlan1
/interface bridge vlan
add bridge=bridge1 tagged=ether1,ether4,bridge1,vxlan1 vlan-ids=201

I really hope they improve winbox in the future surrounding vxlan configuration, not being able to manage VTEP config or make changes to a vxlan interface is a bummer.

[duquesnoyinfo]

Hi,

i solve my problem by adding a rule in the firewall of both routers for vxlan

add action=accept chain=input comment=Vxlan dst-port=8472 protocol=udp

[mada3k]

I find it strange that you can add multiple VTEPs with the same IP+Port for the same tunnels. Feels like a bug.