Arp Suppression - Cisco Nexus 7000 Series Configuration Manual

Configuring VXLAN BGP EVPN

ARP Suppression

The source VTEP receives traffic and takes the routing decision. It then stamps the packet with the associated
VRF VNI while sending traffic to the destination VTEP, which in turn forwards traffic to the destination
server
Communication between a VXLAN overlay and an external network
The data center interconnect (DCI) functionality is implemented on the border device (leaf or spine) of the
VXLAN EVPN network. Depending on the type of hand-off to the outside network such as MPLS, LISP,
layer-2, and so on, appropriate DCI configuration is required on the border device(s) and the connecting edge
device(s) of the outside network.
ARP Suppression
The following section illustrates ARP suppression functionality at VTEP V1 (Refer the ARP Suppression
image, given below). ARP suppression is an enhanced function configured under the layer-2 VNI (using the
suppress-arp command). Essentially, the IP-MACs learnt locally via ARP as well as those learnt over
BGP-EVPN are stored in a local ARP suppression cache at each ToR. ARP request sent from the end host is
trapped at the source ToR. A lookup is performed in the ARP suppression cache with the destination IP as
the key. If there is a HIT, then the ToR proxies on behalf of the destination with the destination MAC. This
is the case depicted in the below image.
In case the lookup results in a MISS, when the destination is unknown or a silent end host, the ToR re-injects
the ARP request received from the requesting end host and broadcasts it within the layer-2 VNI. This entails
sending the ARP request out locally over the server facing ports as well as sending a VXLAN encapsulated
packet with the layer-2 VNI over the IP core. The VXLAN encapsulated packet will be decapsulated by every
receiving VTEP that has membership within the same layer-2 VNI. These receiving VTEPs will then forward
the inner ARP frame toward the server facing ports. Assuming that the destination is alive, the ARP request
will reach the destination, which in turn will send out an ARP response toward the sender. The ARP response
is trapped by the receiving ToR, even though ARP response is a unicast packet directed to the source VM,
since the ARP-suppression feature is enabled. The ToR will learn about the destination IP/MAC and in turn
advertise it over BGP-EVPN to all the other ToRs. In addition, the ToR will reinject the ARP response packet
Cisco Nexus 7000 Series NX-OS VXLAN Configuration Guide
50