Configure Fabric Extend Logical Interfaces
Use the following procedures to configure Fabric Extend (FE) between a Main office to a Branch office, which is a typical deployment.
VSP 4450 Series supports FE, but the switch must connect to an Open Networking Adapter (ONA) because the VSP 4450 Series does not support FE natively:
Configure Fabric Extend Logical Interfaces for Native Support
About this task
Configuring Fabric Extend consists of two primary tasks: configuring the tunnel source address and configuring the logical interface. These tasks must be completed on both ends of the tunnel.
VRF is an optional parameter. If a VRF is not configured, then FE uses the GRT.
Procedure
Configure Fabric Extend Logical Interfaces for ONA Support
About this task
Configuring Fabric Extend consists of two primary tasks: configuring the tunnel source address and configuring the logical interface. These tasks must be completed on both ends of the tunnel.
The VSP 4450 Series source address command is different than other platforms. The logical interface commands are different between Layer 2 and Layer 3 networks.
![Note](images/note.png)
Note
The interface VLAN that connects to the ONA network port is always in the GRT, and the member port that the VLAN is part of is always an access port.
VRF is an optional parameter. If a VRF is not configured, then FE uses the GRT.
Procedure
Logical Interfaces Field Descriptions
Use the data in the following table to use the Logical Interfaces tab and the Insert Logical Interfaces dialog. The available fields in the dialog differ depending on the type of core you select: layer 2 or ip.
Name |
Description |
---|---|
Id |
Specifies the index number that uniquely identifies this logical interface. This field displays on the Insert Logical Interfaces dialog only. |
IfIndex |
Specifies the index number that uniquely identifies this logical interface. This field is read-only. This field displays on the Logical Interfaces tab only. |
Name |
Specifies the administratively assigned name of this logical interface, which can be up to 64 characters. |
Type Note:
Exception: Type Layer 2 is not supported on XA1400 Series. |
Specifies the type of logical interface to create:
|
DestIPAddr |
Specifies the destination IP address for the IP-type logical interface. |
DestIfIndex Note:
Exception: Not supported on XA1400 Series. |
Specifies the physical port or MultiLink Trunking (MLT) that the Layer 2 logical interface is connected to. |
Vids Note:
Exception: Not supported on XA1400 Series. |
Specifies the list of VLANs that are associated with this logical interface. |
PrimaryVid Note:
Exception: Not supported on XA1400 Series. |
Specifies the primary tunnel VLAN ID associated with this Layer 2 Intermediate-System-to-Intermediate-System (IS-IS) logical interface. |
CircIndex |
Identifies the IS-IS circuit created under the logical interface. This field displays on the Logical Interfaces tab only. |
NextHopVrf Note:
Exception: Not supported on XA1400 Series. |
Identifies the next-hop VRF name to reach the logical tunnel destination IP. This field displays on the Logical Interfaces tab only. |
IpsecEnable Note:
Exception: Only supported on XA1400 Series. |
Specifies whether the logical interface should use IPsec. |
AuthenticationKey Note:
Exception: Only supported on XA1400 Series. |
Specifies the authentication key of this logical interface, which can be up to 32 characters. |
ShapingRate Note:
Exception: Only supported on XA1400 Series. |
Specifies the value, in Mbps, of the Egress Tunnel Shaper applied to the logical interface. |
Mtu Note:
Exception: Only supported on XA1400 Series. |
Specifies the Maximum Transmission Unit (MTU) size for each logical interface. The default MTU value is 1950. |
IpsecTunnelDestAddress Note:
Exception: Only supported on XA1400 Series. |
Specifies the destination IP address for the IPsec tunnel. Note:
When you configure the destination IP address for the IPsec tunnel, IKE protocol uses UDP port 500. However, if IPsec NAT-T is detected, IKE protocol uses UDP port 4500 instead. |
BfdEnable Note: Exception: Not
supported on VSP 8600
Series or XA1400
Series.
|
Enables or disables BFD on an IS-IS Logical Interface. |
IpsecResponderOnly Note:
Exception: Only supported on XA1400 Series. |
Specifies whether the device is a Responder device in an IPsec Network Address Translation Traversal (NAT-T) connection. |
IpsecRemoteNatIPAddr Note:
Exception: Only supported on XA1400 Series. |
Specifies the public IP address of the NAT router connected to the Responder device in an IPsec NAT-T connection. Note:
When you configure the IPsec remote NAT IP address, IKE protocol uses UDP port 4500. |
IpsecAuthMethod Note:
Exception: Only supported on XA1400 Series. |
Configures the IPsec authentication method for the tunnel as either a pre-shared key or RSA signature for digital certificates. The default is pre-shared key. |
CertSubjectName Note:
Exception: Only supported on XA1400 Series. |
Specifies the digital certificate subject name used as the identity certificate. |
Compression Note:
Exception: Only supported on XA1400 Series. |
Reduces the size of the IP datagram to improve the communication performance between hosts connected behind Backbone Edge Bridges (BEB). Tip:
As a best practice, use IPsec compression only for Fabric Extend tunnels where latency is greater than 70ms. |
FragmentBeforeEncrypt Note:
Exception: Only supported on XA1400 Series. |
Enables or disables the fragmentation of packets before IPsec encryption on the tunnel. By default, fragmentation before encryption is disabled. |
TunnelSourceType Note:
Exception: Only supported on XA1400 Series. |
Specifies the type of source IP address for the IPsec tunnel.
The default is global. |
TunnelSourceAddress Note:
Exception: Only supported on XA1400 Series. |
Specifies the source IP address for the IPsec tunnel. |
TunnelVrf Note:
Exception: Only supported on XA1400 Series. |
Specifies the VRF name associated with the IPsec tunnel. |
Esp Note:
Exception: Only supported on XA1400 Series. |
Specifies the Encapsulating Security Payload (ESP) cipher suite for IPsec.
The default value is aes128gcm16-sha256. |