The multi-homed node from the previous post has two equal-cost layer 3 uplinks. The kernel’s multipath hash never sees the flow — Cilium’s bpf_fib_lookup carries L3 only. Feeding it the flow label and the L4 ports makes ECMP real, on the default hash policy. With the help of AI coding with my stupid ideas, cilium distributes traffic to both uplinks.
Two L3 uplinks per node, address on dummy0, BGP unnumbered to the fabric, and Cilium peering with the node’s own FRR over a single ::1 session that carries both address families — so no Kubernetes manifest ever contains a TOR address.
How L3VPN affects Kubernetes and when it is meaningful?
An alternative Cilium Egress Gateway that removes state synchronization and conntrack overhead in active-active multi-gateway setups from the gateway
I lost an afternoon to a “routing loop” that turned out not to be a loop at all. It was an EVPN all-active multihoming feature quietly not working in a virtual lab — and the packets ping-ponging between two switches were a symptom, not the disease. This post is two things: a refresher on how Arista ESI (Ethernet Segment) multihoming actually forwards traffic, and a write-up of the specific trap you can fall into when you build EVPN designs on vEOS/containerlab instead of real hardware. ...
Dual-homed servers use IP-unnumbered physical interfaces. A dedicated dummy interface (not lo) is assigned to each server as its IPv4 node address. FRR runs between the servers and the ToR switches to provide node-level connectivity, advertising the server’s node IP (dummy interface address) and receiving the default route from the ToRs. Using a bond interface between ToRs can also be used for redundancy and failover for server connectivity. You may also configure Layer 3 interfaces. The main issue is about node identity and service continuity during the failure of a single link. Using a bond interface or a dummy interface seems like a more usable approach. ...
ESI Multi-Homing and ARP Suppression Issue: Duplicate Packets & Flooding When ESI is not functioning correctly, you may observe duplicate packets destined for hosts behind the ESI. Remote switches might flood traffic toward the ESI switches instead of handling it efficiently. TCAM Carving for ARP Suppression To use the suppress-arp feature effectively and prevent unnecessary flooding, you must allocate sufficient TCAM resources on the switch hardware. 1 2 3 # Configure TCAM carving for ARP suppression hardware access-list tcam region racl 512 hardware access-list tcam region arp-ether 256 double-wide Warning: It was observed that enabling suppress-arp caused reachability and ARP resolution to break between hosts when attempting to use RFC 5549 (BGP Unnumbered / IPv6 underlay) between Spines and Leafs for IPv4 and EVPN. Note that an IPv6 underlay is generally not supported for Cisco Nexus 9300/9500v platforms in this context. ...
Overview This document outlines the security policies and dynamic routing configurations for the network gateway, including firewall rules via nftables and BGP peering via BIRD. How Zones are Defined and Connected In this architecture, zones (zone_blue, zone_green, zone_red, and wan) directly correspond to network interfaces (either physical NICs, VLAN tags, or bridge interfaces) on the Gateway Server. Chain Structure (nftables): The firewall strictly controls traffic flow by matching the input interface (iif) and output interface (oif). For example, iif zone_blue oif zone_green tcp dport 22 accept explicitly states: If a packet enters the server via the zone_blue interface and is destined to leave via the zone_green interface on TCP Port 22, allow it. ...
Overview This document describes a method for simulating multiple servers belonging to different network domains on a single Linux host. Each simulated server runs inside its own Linux network namespace and is connected to a dedicated VLAN. Training and demonstration environments Each namespace behaves as an independent server with: Its own IP address Its own MAC address An SSH service A simple HTTP server Network Topology The Linux host uses the following interfaces: ...
We run multiple teams on the same OpenStack platform, one project per team. Traffic between two projects always hairpins through the gateway nodes, even with DVR enabled. This is expected behavior, not a misconfiguration. Below is the technical summary of why. What DVR distributes East-west between networks on the same router: routed locally on the ingress chassis, tunneled to the destination chassis. Fully distributed. North-south with a floating IP: the chassis hosting the VM performs the 1:1 NAT and answers ARP for the FIP on the external network. Distributed, but requires the provider network to be attached to every compute node and distributed FIP to be enabled. North-south with SNAT: centralized. The router’s external address is shared by all VMs behind it; it can be ARP-owned at only one point of the external segment, and the NAT state must live in a single conntrack table. It is pinned to a gateway chassis by design. DVR distributes only what it can bind 1:1 to a single chassis. Everything based on a shared, stateful address is centralized. ...