Technical Tip: VXLAN and VRRP on NP7 platform

Description

This article describes the effects of setting the VXLAN MAC flapping guard option in a VXLAN environment spread across data centers that uses VRRP mechanisms to achieve gateway-level redundancy.

Scope

FortiGates with NP7, FortiOS v7.6.5 and later.

Solution

It is quite common to deploy a gateway level redundancy protocols (such as VRRP, HSRP, etc) in networks to attain some level of redundancy. When such mechanisms are used in conjunction with VXLANs, it is essential to note the MAC flapping protection feature available on FortiGate NP7 platforms which may interrupt normal functions of these gateway redundancy protocols.

By default, vxlan-mac-flapping-guard is enabled on NP7 starting firmware v7.6.5 (and later).

config system npu
    set vxlan-mac-flapping-guard enable 
end

When the VRRP master MAC address switches between locations, the VRRP master IP may normally failover to a different datacenter/switch. In order to allow the VRRP master MAC address to learn about such updates dynamically on VXLAN FDB whenever such VRRP master changes are made, it is necessary to keep vxlan-mac-flapping-guard disabled on FortiGate.

config system npu
    set vxlan-mac-flapping-guard disable 
end