FortiGate
FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
seyuboglu
Staff
Staff
Article Id 369586
Description This article describes how to troubleshoot If the VXLAN interface is disappearing after each reboot. 
Scope FortiGate v7.4.4.
Solution

This issue is reported in the v7.4 branch. If a VXLAN's interface's underlying interface has 'set mode dhcp',  the interface disappears after each reboot.  

 

Detailed information about VXLAN can be found in the this document: General VXLAN configuration and topologies

 

Example configuration when the interface is created successfully: 

 

config system vxlan
    edit "VXLAN"
        set interface "port1"         <----- Underlying interface.
        set vni 1600

        set remote-ip "10.10.10.10"
    next
end

 

diagnose ip address list

IP=11.11.11.11->12.12.12.12/255.255.255.0 index=5 devname=port3
IP=14.14.14.14->15.15.15.15/255.255.255.0 index=6 devname=port4

IP=169.254.40.1->169.254.40.1/255.255.255.252 index=22 devname=VXLAN

 

diagnose sys vxlan device list
vf=root name=VXLAN rip=10.10.10.10 sip=10.10.10.1 port=4898 vni=1600 flags=0x01

 

config system interface 

    edit port1                  <-----  Underlying interface.

        set mode dhcp               <----- Triggering condition.

    next

end

 

After rebooting the device for any reason (warm reboot, power cycle, etc.), the interface disappears. 

 

Example output is shown below after reboot : 

 

diagnose sys vxlan device list
total device num: 0

 

diagnose ip address list

IP=11.11.11.11->12.12.12.12/255.255.255.0 index=5 devname=port3
IP=14.14.14.14->15.15.15.15/255.255.255.0 index=6 devname=port4

 

The VXLAN interface will not be listed.

 

Workaround :

  1. Reconfigure the VXLAN interface a few seconds after the system reboots.
  2. As an alternative solution, EVPN VXLAN can be used. However, this involves additional configurations on routing and EVPN.

Detailed information about VXLAN can be found in this document: Using MP-BGP EVPN with VXLAN

 

This issue has been fixed in v7.6.3 and v7.4.8. 

 

With this fix, the following additional CLI restrictions have been introduced:

  1. Changing the IPv6 address of a VXLAN underlying interface is no longer allowed.
  2. If a VXLAN interface's underlying interface does not have an IP address configured, and it is not as configured as DHCP, the VXLAN can no longer be created.