vtep(5)

📦
version 4.0.0 · 12 versions
, in arch rolling, nixpkgs unstable

✨ NAME ✨

okay so bestie, this is vtep(5), and it's literally the hardware_vtep database schema manual. No cap, it's giving “how a VTEP plugs physical ports into logical switches managed by a network virtualization controller such as NSX.” 🫶

The schema specifies relations that a VTEP can use to integrate physical ports into logical switches maintained by a network virtualization controller such as NSX. Periodt.

🫶 Common Column 🫶

Glossary time, because acronyms are iconic but also lowkey a lot:

  • VTEP — VXLAN Tunnel End Point, an entity which originates and/or terminates VXLAN tunnels. 🦋
  • HSC — Hardware Switch Controller.
  • NVC — Network Virtualization Controller, e.g. NSX.
  • VRF — Virtual Routing and Forwarding instance.

Some tables contain a column named other_config. This column has the same form and purpose each place that it appears, so we describe it here to save space later. Efficient queen behavior. 💅

  • other_config: map of string-string pairs — key-value pairs for configuring rarely used or proprietary features.

Some tables do not have other_config column because no key-value pairs have yet been defined for them.

🧾 TABLE SUMMARY 🧾

The following list summarizes the purpose of each of the tables in the hardware_vtep database. Each table is described in more detail on a later page. Here's the whole cast, main-character energy included: ✨

  • Global — Top-level configuration.
  • Manager — OVSDB management connection.
  • Physical_Switch — A physical switch.
  • Tunnel — A tunnel created by a physical switch.
  • Physical_Port — A port within a physical switch.
  • Logical_Binding_Stats — Statistics for a VLAN on a physical port bound to a logical network.
  • Logical_Switch — A layer-2 domain.
  • Ucast_Macs_Local — Unicast MACs (local)
  • Ucast_Macs_Remote — Unicast MACs (remote)
  • Mcast_Macs_Local — Multicast MACs (local)
  • Mcast_Macs_Remote — Multicast MACs (remote)
  • Logical_Router — A logical L3 router.
  • Arp_Sources_Local — ARP source addresses for logical routers
  • Arp_Sources_Remote — ARP source addresses for logical routers
  • Physical_Locator_Set — Physical_Locator_Set configuration.
  • Physical_Locator — Physical_Locator configuration.
  • ACL_entry — ACL_entry configuration.
  • ACL — ACL configuration.

🌍 Global TABLE 🌍

Top-level configuration for a hardware VTEP. There must be exactly one record in the Global table. One. Single. Record. No cap. 👑

🌸 Summary 🌸

  • switches — set of Physical_Switchs
  • Database Configuration:
    • managers — set of Managers
  • Common Column:
    • other_config — map of string-string pairs

🔍 Details 🔍

  • switches: set of Physical_Switchs — The physical switch or switches managed by the VTEP.

When a physical switch integrates support for this VTEP schema, which is expected to be the most common case, this column should point to one Physical_Switch record that represents the switch itself. In another possible implementation, a server or a VM presents a VTEP schema front-end interface to one or more physical switches, presumably communicating with those physical switches over a proprietary protocol. In that case, this column would point to one Physical_Switch for each physical switch, and the set might change over time as the front-end server comes to represent a differing set of switches. The way that's a whole stable-relationship arc 😭

🗄️ Database Configuration 🗄️

These columns primarily configure the database server (ovsdb-server), not the hardware VTEP itself. Important distinction, bestie. 🫶

  • managers: set of Managers — Database clients to which the database server should connect or to which it should listen, along with options for how these connection should be configured. See the Manager table for more information.

🫶 Common Column 🫶

The overall purpose of this column is described under Common Column at the beginning of this document.

  • other_config: map of string-string pairs

🛰️ Manager TABLE 🛰️

Configuration for a database connection to an Open vSwitch Database (OVSDB) client. It's giving “connection manager but make it database-core.” 💜

The database server can initiate and maintain active connections to remote clients. It can also listen for database connections.

🌸 Summary 🌸

  • Core Features:
    • target — string (must be unique within table)
  • Client Failure Detection and Handling:
    • max_backoff — optional integer, at least 1,000
    • inactivity_probe — optional integer
  • Status:
    • is_connected — boolean
    • status : last_error — optional string
    • status : state — optional string, one of ACTIVE, BACKOFF, CONNECTING, IDLE, or VOID
    • status : sec_since_connect — optional string, containing an integer, at least 0
    • status : sec_since_disconnect — optional string, containing an integer, at least 0
    • status : locks_held — optional string
    • status : locks_waiting — optional string
    • status : locks_lost — optional string
    • status : n_connections — optional string, containing an integer, at least 2
  • Connection Parameters:
    • other_config : dscp — optional string, containing an integer

🔍 Details 🔍

💖 Core Features 💖

  • target: string (must be unique within table) — Connection method for managers.

The following connection methods are currently supported:

  • ssl:host[:port] — The specified SSL/TLS port (default: 6640) on the given host, which can either be a DNS name (if built with unbound library) or an IP address. SSL/TLS key and certificate configuration happens outside the database. 🔐
  • tcp:host[:port] — The specified TCP port (default: 6640) on the given host, which can either be a DNS name (if built with unbound library) or an IP address.
  • pssl:[port][:host] — Listens for SSL/TLS connections on the specified TCP port (default: 6640). If host, which can either be a DNS name (if built with unbound library) or an IP address, is specified, then connections are restricted to the resolved or specified local IP address.
  • ptcp:[port][:host] — Listens for connections on the specified TCP port (default: 6640). If host, which can either be a DNS name (if built with unbound library) or an IP address, is specified, then connections are restricted to the resolved or specified local IP address.

🩺 Client Failure Detection and Handling 🩺

  • max_backoff: optional integer, at least 1,000 — Maximum number of milliseconds to wait between connection attempts. Default is implementation-specific. The patience is real. 😭
  • inactivity_probe: optional integer — Maximum number of milliseconds of idle time on connection to the client before sending an inactivity probe message. If the Open vSwitch database does not communicate with the client for the specified number of seconds, it will send a probe. If a response is not received for the same additional amount of time, the database server assumes the connection has been broken and attempts to reconnect. Default is implementation-specific. A value of 0 disables inactivity probes.

📊 Status 📊

  • is_connected: boolean — true if currently connected to this manager, false otherwise.
  • status : last_error: optional string — A human-readable description of the last error on the connection to the manager; i.e. strerror(errno). This key will exist only if an error has occurred.
  • status : state: optional string, one of ACTIVE, BACKOFF, CONNECTING, IDLE, or VOID — The state of the connection to the manager:
    • VOID — Connection is disabled.
    • BACKOFF — Attempting to reconnect at an increasing period.
    • CONNECTING — Attempting to connect.
    • ACTIVE — Connected, remote host responsive.
    • IDLE — Connection is idle. Waiting for response to keep-alive.
These values may change in the future. They are provided only for human consumption. So don't build your whole personality on them, bestie.
  • status : sec_since_connect: optional string, containing an integer, at least 0 — The amount of time since this manager last successfully connected to the database (in seconds). Value is empty if manager has never successfully connected.
  • status : sec_since_disconnect: optional string, containing an integer, at least 0 — The amount of time since this manager last disconnected from the database (in seconds). Value is empty if manager has never disconnected.
  • status : locks_held: optional string — Space-separated list of the names of OVSDB locks that the connection holds. Omitted if the connection does not hold any locks.
  • status : locks_waiting: optional string — Space-separated list of the names of OVSDB locks that the connection is currently waiting to acquire. Omitted if the connection is not waiting for any locks.
  • status : locks_lost: optional string — Space-separated list of the names of OVSDB locks that the connection has had stolen by another OVSDB client. Omitted if no locks have been stolen from this connection. Rude, honestly. 💀
  • status : n_connections: optional string, containing an integer, at least 2 — When target specifies a connection method that listens for inbound connections (e.g. ptcp: or pssl:) and more than one connection is actually active, the value is the number of active connections. Otherwise, this key-value pair is omitted.

When multiple connections are active, status columns and key-value pairs (other than this one) report the status of one arbitrarily chosen connection.

🔧 Connection Parameters 🔧

Additional configuration for a connection between the manager and the database server.

  • other_config : dscp: optional string, containing an integer — The Differentiated Service Code Point (DSCP) is specified using 6 bits in the Type of Service (TOS) field in the IP header. DSCP provides a mechanism to classify the network traffic and provide Quality of Service (QoS) on IP networks. The DSCP value specified here is used when establishing the connection between the manager and the database server. If no value is specified, a default value of 48 is chosen. Valid DSCP values must be in the range 0 to 63. Slay those packets with the right priority. 🌈

🌸 Physical_Switch TABLE 🌸

A physical switch that implements a VTEP. This table is literally the whole “the box that does VTEP things” vibe check, bestie. 🦋

📋 Summary

  • ports — set of Physical_Ports
  • tunnels — set of Tunnels
  • Network Status:
    • management_ips — set of strings
    • tunnel_ips — set of strings
  • Identification:
    • name — string (must be unique within table)
    • description — string
  • Error Notification:
    • switch_fault_status : mac_table_exhaustion — none
    • switch_fault_status : tunnel_exhaustion — none
    • switch_fault_status : lr_switch_bindings_fault — none
    • switch_fault_status : lr_static_routes_fault — none
    • switch_fault_status : lr_creation_fault — none
    • switch_fault_status : lr_support_fault — none
    • switch_fault_status : unspecified_fault — none
    • switch_fault_status : unsupported_source_node_replication — none
  • Common Column:
    • other_config — map of string-string pairs

🕵️♀️ Details

  • ports: set of Physical_Ports — the physical ports within the switch. Like, the actual holes and lanes where packets live their lives. 🔌
  • tunnels: set of Tunnels — tunnels created by this switch as instructed by the NVC. The switch is not freelancing here; NVC said jump, so it jumps. 🕳️

🌐 Network Status

  • management_ips: set of strings — IPv4 or IPv6 addresses at which the switch may be contacted for management purposes. Basically where you slide into its DMs for admin stuff. 📬
  • tunnel_ips: set of strings — IPv4 or IPv6 addresses on which the switch may originate or terminate tunnels.

This column is intended to allow a Manager to determine the Physical_Switch that terminates the tunnel represented by a Physical_Locator. So yes, it’s giving “tunnel owner reveal” energy. 🔍

🏷️ Identification

  • name: string (must be unique within table) — symbolic name for the switch, such as its hostname. Unique means unique, bestie; no twin names in this table. 👑
  • description: string — an extended description for the switch, such as its switch login banner. Put the lore here. 📝

🚨 Error Notification

An entry in this column indicates to the NVC that this switch has encountered a fault. The switch must clear this column when the fault has been cleared. No leaving stale fault receipts lying around, periodt. 💅

  • switch_fault_status : mac_table_exhaustion — none — Indicates that the switch has been unable to process MAC entries requested by the NVC due to lack of table resources.
  • switch_fault_status : tunnel_exhaustion — none — Indicates that the switch has been unable to create tunnels requested by the NVC due to lack of resources.
  • switch_fault_status : lr_switch_bindings_fault — none — Indicates that the switch has been unable to create the logical router interfaces requested by the NVC due to conflicting configurations or a lack of hardware resources.
  • switch_fault_status : lr_static_routes_fault — none — Indicates that the switch has been unable to create the static routes requested by the NVC due to conflicting configurations or a lack of hardware resources.
  • switch_fault_status : lr_creation_fault — none — Indicates that the switch has been unable to create the logical router requested by the NVC due to conflicting configurations or a lack of hardware resources.
  • switch_fault_status : lr_support_fault — none — Indicates that the switch does not support logical routing. Not every switch has that range, and that’s just facts. 💀
  • switch_fault_status : unspecified_fault — none — Indicates that an error has occurred in the switch but that no more specific information is available. The classic “something is wrong but make it mysterious” fault. 🙈
  • switch_fault_status : unsupported_source_node_replication — none — Indicates that the requested source node replication mode cannot be supported by the physical switch; this specifically means in this context that the physical switch lacks the capability to support source node replication mode. This error occurs when a controller attempts to set source node replication mode for one of the logical switches that the physical switch is keeping context for. An NVC that observes this error should take appropriate action (for example reverting the logical switch to service node replication mode). It is recommended that an NVC be proactive and test for support of source node replication by using a test logical switch on vtep physical switch nodes and then trying to change the replication mode to source node on this logical switch, checking for error. The NVC could remember this capability per vtep physical switch. Using mixed replication modes on a given logical switch is not recommended. Service node replication mode is considered a basic requirement since it only requires sending a packet to a single transport node, hence it is not expected that a switch should report that service node mode cannot be supported.

🧩 Common Column

The overall purpose of this column is described under Common Column at the beginning of this document. Go check the earlier glow-up if you need the full context, bestie. 🫶

  • other_config: map of string-string pairs

🌈 Tunnel TABLE 🌈

A tunnel created by a Physical_Switch. Basically a lil point-to-point situationship between switches, and we are obsessed 💖

Summary ✨

  • local — Physical_Locator
  • remote — Physical_Locator
  • Bidirectional Forwarding Detection (BFD):
    • BFD Local Configuration:
      • bfd_config_local : bfd_dst_mac — optional string
      • bfd_config_local : bfd_dst_ip — optional string
    • BFD Remote Configuration:
      • bfd_config_remote : bfd_dst_mac — optional string
      • bfd_config_remote : bfd_dst_ip — optional string
    • BFD Parameters:
      • bfd_params : enable — optional string, either true or false
      • bfd_params : min_rx — optional string, containing an integer, at least 1
      • bfd_params : min_tx — optional string, containing an integer, at least 1
      • bfd_params : decay_min_rx — optional string, containing an integer
      • bfd_params : forwarding_if_rx — optional string, either true or false
      • bfd_params : cpath_down — optional string, either true or false
      • bfd_params : check_tnl_key — optional string, either true or false
    • BFD Status:
      • bfd_status : enabled — optional string, either true or false
      • bfd_status : state — optional string, one of admin_down, down, init, or up
      • bfd_status : forwarding — optional string, either true or false
      • bfd_status : diagnostic — optional string
      • bfd_status : remote_state — optional string, one of admin_down, down, init, or up
      • bfd_status : remote_diagnostic — optional string
      • bfd_status : info — optional string

Details 🦋

  • local: Physical_Locator — tunnel end-point local to the physical switch.
  • remote: Physical_Locator — tunnel end-point remote to the physical switch.

Bidirectional Forwarding Detection (BFD) 💓

Okay so BFD, defined in RFC 5880, is the whole point-to-point connectivity-failure-detection moment. It works by occasionally transmitting BFD control messages, and VTEPs are expected to implement BFD. No cap.

BFD operates by regularly transmitting BFD control messages at a rate negotiated independently in each direction. Each endpoint specifies the rate at which it expects to receive control messages, and the rate at which it’s willing to transmit them. An endpoint which fails to receive BFD control messages for a period of three times the expected reception rate will signal a connectivity fault. In the case of a unidirectional connectivity issue, the system not receiving BFD control messages will signal the problem to its peer in the messages it transmits.

A hardware VTEP is expected to use BFD to determine reachability of devices at the end of the tunnels with which it exchanges data. This can enable the VTEP to choose a functioning service node among a set of service nodes providing high availability. It also enables the NVC to report the health status of tunnels. Very main-character energy, honestly 👑

In many cases the BFD peer of a hardware VTEP will be an Open vSwitch instance. The Open vSwitch implementation of BFD aims to comply faithfully with the requirements put forth in RFC 5880. Open vSwitch does not implement the optional Authentication or ``Echo Mode’’ features.

BFD Local Configuration 🎀

The HSC writes the key-value pairs in the bfd_config_local column to specify the local configurations to be used for BFD sessions on this tunnel.

  • bfd_config_local : bfd_dst_mac — optional string. Set to an Ethernet address in the form xx:xx:xx:xx:xx:xx to set the MAC expected as destination for received BFD packets. The default is 00:23:20:00:00:01.
  • bfd_config_local : bfd_dst_ip — optional string. Set to an IPv4 address to set the IP address that is expected as destination for received BFD packets. The default is 169.254.1.0.

BFD Remote Configuration 🌸

The bfd_config_remote column is the remote counterpart of the bfd_config_local column. The NVC writes the key-value pairs in this column.

  • bfd_config_remote : bfd_dst_mac — optional string. Set to an Ethernet address in the form xx:xx:xx:xx:xx:xx to set the destination MAC to be used for transmitted BFD packets. The default is 00:23:20:00:00:01.
  • bfd_config_remote : bfd_dst_ip — optional string. Set to an IPv4 address to set the IP address used as destination for transmitted BFD packets. The default is 169.254.1.1.

BFD Parameters ⚙️

The NVC sets up key-value pairs in the bfd_params column to enable and configure BFD.

  • bfd_params : enable — optional string, either true or false. True to enable BFD on this Tunnel. If not specified, BFD will not be enabled by default.
  • bfd_params : min_rx — optional string, containing an integer, at least 1. The shortest interval, in milliseconds, at which this BFD session offers to receive BFD control messages. The remote endpoint may choose to send messages at a slower rate. Defaults to 1000.
  • bfd_params : min_tx — optional string, containing an integer, at least 1. The shortest interval, in milliseconds, at which this BFD session is willing to transmit BFD control messages. Messages will actually be transmitted at a slower rate if the remote endpoint is not willing to receive as quickly as specified. Defaults to 100.
  • bfd_params : decay_min_rx — optional string, containing an integer. An alternate receive interval, in milliseconds, that must be greater than or equal to bfd_params:min_rx. The implementation should switch from bfd_params:min_rx to bfd_params:decay_min_rx when there is no obvious incoming data traffic at the tunnel, to reduce the CPU and bandwidth cost of monitoring an idle tunnel. This feature may be disabled by setting a value of 0. This feature is reset whenever bfd_params:decay_min_rx or bfd_params:min_rx changes.
  • bfd_params : forwarding_if_rx — optional string, either true or false. When true, traffic received on the Tunnel is used to indicate the capability of packet I/O. BFD control packets are still transmitted and received. At least one BFD control packet must be received every 100 * bfd_params:min_rx amount of time. Otherwise, even if traffic is received, the bfd_params:forwarding will be false.
  • bfd_params : cpath_down — optional string, either true or false. Set to true to notify the remote endpoint that traffic should not be forwarded to this system for some reason other than a connectivity failure on the interface being monitored. The typical underlying reason is ``concatenated path down,’’ that is, that connectivity beyond the local system is down. Defaults to false.
  • bfd_params : check_tnl_key — optional string, either true or false. Set to true to make BFD accept only control messages with a tunnel key of zero. By default, BFD accepts control messages with any tunnel key.

BFD Status 👀

The VTEP sets key-value pairs in the bfd_status column to report the status of BFD on this tunnel. When BFD is not enabled, with bfd_params:enable, the HSC clears all key-value pairs from bfd_status.

  • bfd_status : enabled — optional string, either true or false. Set to true if the BFD session has been successfully enabled. Set to false if the VTEP cannot support BFD or has insufficient resources to enable BFD on this tunnel. The NVC will disable the BFD monitoring on the other side of the tunnel once this value is set to false.
  • bfd_status : state — optional string, one of admin_down, down, init, or up. Reports the state of the BFD session. The BFD session is fully healthy and negotiated if UP.
  • bfd_status : forwarding — optional string, either true or false. Reports whether the BFD session believes this Tunnel may be used to forward traffic. Typically this means the local session is signaling UP, and the remote system isn’t signaling a problem such as concatenated path down.
  • bfd_status : diagnostic — optional string. A diagnostic code specifying the local system’s reason for the last change in session state. The error messages are defined in section 4.1 of [RFC 5880].
  • bfd_status : remote_state — optional string, one of admin_down, down, init, or up. Reports the state of the remote endpoint’s BFD session.
  • bfd_status : remote_diagnostic — optional string. A diagnostic code specifying the remote system’s reason for the last change in session state. The error messages are defined in section 4.1 of [RFC 5880].
  • bfd_status : info — optional string. A short message providing further information about the BFD status (possibly including reasons why BFD could not be enabled).

Physical_Port TABLE 💅

okay bestie, this table is literally one port inside a Physical_Switch — and it’s carrying so much VLAN/ACL lore. Let’s go column by column, no cap.

✨ Summary ✨

  • vlan_bindings — map of integer-Logical_Switch pairs, key in range 0 to 4,095
  • acl_bindings — map of integer-ACL pairs, key in range 0 to 4,095
  • vlan_stats — map of integer-Logical_Binding_Stats pairs, key in range 0 to 4,095

🎀 Identification

  • name — string
  • description — string

🚨 Error Notification

  • port_fault_status : invalid_vlan_map — none
  • port_fault_status : invalid_ACL_binding — none
  • port_fault_status : unspecified_fault — none

🌸 Common Column

  • other_config — map of string-string pairs

💖 Details 💖

  • vlan_bindings: map of integer-Logical_Switch pairs, key in range 0 to 4,095 Identifies how VLANs on the physical port are bound to logical switches. So if the map contains a (VLAN, logical switch) pair, a packet that arrives on the port in the VLAN is considered to belong to the paired logical switch. A value of zero in the VLAN field means that untagged traffic on the physical port is mapped to the logical switch. Periodt. 🫶
  • acl_bindings: map of integer-ACL pairs, key in range 0 to 4,095 Attach Access Control Lists (ACLs) to the physical port. The column is a map of VLAN tags to ACLs. If the value of the VLAN tag in the map is 0, that means the ACL is associated with the entire physical port. Non-zero values mean that the ACL is applied only on packets carrying that VLAN tag value. Switches will not necessarily support matching on the VLAN tag for all ACLs, and unsupported ACL bindings will cause errors to be reported. Also: the binding of an ACL to a specific VLAN and the binding of an ACL to the entire physical port should not be combined on a single physical port. That is, a mix of zero and non-zero keys in the map is not recommended. 💀
  • vlan_stats: map of integer-Logical_Binding_Stats pairs, key in range 0 to 4,095 Statistics for VLANs bound to logical switches on the physical port. An implementation that fully supports such statistics would populate this column with a mapping for every VLAN that is bound in vlan_bindings. An implementation that does not support such statistics or only partially supports them would not populate this column or partially populate it, respectively. A value of zero in the VLAN field refers to untagged traffic on the physical port. ✨

🌈 Identification 🌈

  • name: string Symbolic name for the port. The name ought to be unique within a given Physical_Switch, but the database is not capable of enforcing this. iykyk. 🙈
  • description: string An extended description for the port.

🔥 Error Notification 🔥

An entry in this column indicates to the NVC that the physical port has encountered a fault. The switch must clear this column when the error has been cleared.

  • port_fault_status : invalid_vlan_map: none Indicates that a VLAN-to-logical-switch mapping requested by the controller could not be instantiated by the switch because of a conflict with local configuration.
  • port_fault_status : invalid_ACL_binding: none Indicates that an error has occurred in associating an ACL with a port.
  • port_fault_status : unspecified_fault: none Indicates that an error has occurred on the port but that no more specific information is available.

🦋 Common Column 🦋

The overall purpose of this column is described under Common Column at the beginning of this document.

  • other_config: map of string-string pairs

Logical_Binding_Stats TABLE 📊

Reports statistics for the Logical_Switch with which a VLAN on a Physical_Port is associated. It’s giving “receipts for your binding.” 🧾✨

🌟 Summary 🌟

💜 Statistics

  • packets_from_local — integer
  • bytes_from_local — integer
  • packets_to_local — integer
  • bytes_to_local — integer

💫 Details 💫

🍓 Statistics 🍓

These statistics count only packets to which the binding applies.

  • packets_from_local: integer Number of packets sent by the Physical_Switch.
  • bytes_from_local: integer Number of bytes in packets sent by the Physical_Switch.
  • packets_to_local: integer Number of packets received by the Physical_Switch.
  • bytes_to_local: integer Number of bytes in packets received by the Physical_Switch.

Logical_Switch TABLE 👑

A logical Ethernet switch, whose implementation may span physical and virtual media, possibly crossing L3 domains via tunnels; a logical layer-2 domain; an Ethernet broadcast domain. Main character energy fr fr. 🌈

✨ Summary ✨

🌸 Per Logical-Switch Tunnel Key

  • tunnel_key — optional integer

🎀 Replication Mode

  • replication_mode — optional string, either service_node or source_node

💖 Identification

  • name — string (must be unique within table)
  • description — string

🦋 Common Column

  • other_config — map of string-string pairs

💅 Details 💅

🧚 Per Logical-Switch Tunnel Key 🧚

Tunnel protocols tend to have a field that allows the tunnel to be partitioned into sub-tunnels: VXLAN has a VNI, GRE has a key, CAPWAP has a WSI, and so on. We call these generically ``tunnel keys.’’ Given that one needs to use a tunnel key at all, there are at least two reasonable ways to assign their values:

  • Per Logical_Switch+Physical_Locator pair. That is, each logical switch may be assigned a different tunnel key on every Physical_Locator. This model is especially flexible.

In this model, Physical_Locator carries the tunnel key. Therefore, one Physical_Locator record will exist for each logical switch carried at a given IP destination.

  • Per Logical_Switch. That is, every tunnel associated with a particular logical switch carries the same tunnel key, regardless of the Physical_Locator to which the tunnel is addressed. This model may ease switch implementation because it imposes fewer requirements on the hardware datapath.

In this model, Logical_Switch carries the tunnel key. Therefore, one Physical_Locator record will exist for each IP destination.

  • tunnel_key: optional integer This column is used only in the tunnel key per Logical_Switch model (see above), because only in that model is there a tunnel key associated with a logical switch.

For vxlan_over_ipv4 encapsulation, when the tunnel key per Logical_Switch model is in use, this column is the VXLAN VNI that identifies a logical switch. It must be in the range 0 to 16,777,215. 🔥

🎀 Replication Mode 🎀

For handling L2 broadcast, multicast and unknown unicast traffic, packets can be sent to all members of a logical switch referenced by a physical switch. There are different modes to replicate the packets. The default mode of replication is to send the traffic to a service node, which can be a hypervisor, server or appliance, and let the service node handle replication to other transport nodes (hypervisors or other VTEP physical switches). This mode is called service node replication. An alternate mode of replication, called source node replication, involves the source node sending to all other transport nodes. Hypervisors are always responsible for doing their own replication for locally attached VMs in both modes. Service node replication mode is the default and considered a basic requirement because it only requires sending the packet to a single transport node. 💫

  • replication_mode: optional string, either service_node or source_node This optional column defines the replication mode per Logical_Switch. There are 2 valid values, service_node and source_node. If the column is not set, the replication mode defaults to service_node.

🌟 Identification 🌟

  • name: string (must be unique within table) Symbolic name for the logical switch.
  • description: string An extended description for the logical switch, such as its switch login banner.

🌈 Common Column 🌈

The overall purpose of this column is described under Common Column at the beginning of this document.

  • other_config: map of string-string pairs

Ucast_Macs_Local TABLE 🦋

Mapping of unicast MAC addresses to tunnels (physical locators). This table is written by the HSC, so it contains the MAC addresses that have been learned on physical ports by a VTEP. It’s literally the “who’s who” of learned MACs, bestie. 👑

🌸 Summary 🌸

  • MAC — string
  • logical_switch — Logical_Switch
  • locator — Physical_Locator
  • ipaddr — string

💜 Details 💜

  • MAC: string A MAC address that has been learned by the VTEP.
  • logical_switch: Logical_Switch The Logical switch to which this mapping applies.
  • locator: Physical_Locator The physical locator to be used to reach this MAC address. In this table, the physical locator will be one of the tunnel IP addresses of the appropriate VTEP.
  • ipaddr: string The IP address to which this MAC corresponds. Optional field for the purpose of ARP supression.

💖 Ucast_Macs_Remote TABLE 💖

okay so this table is the mapping of unicast MAC addresses to tunnels (physical locators), and it's written by the NVC — so it holds all the MAC addresses the NVC has learned. Those include VM MAC addresses, and when it's a VM MAC the physical locators are hypervisor IP addresses. The NVC will also report MACs it learned from other HSCs in the network, and in that case the physical locators are the tunnel IP addresses of the corresponding VTEPs. two flavors, one table, iykyk 🦋

🎀 Summary

MAC                           string
logical_switch                Logical_Switch
locator                       Physical_Locator
ipaddr                        string

✨ Details ✨

  • MAC: string — a MAC address that has been learned by the NVC.
  • logical_switch: Logical_Switch — the logical switch this mapping applies to.
  • locator: Physical_Locator — the physical locator used to reach this MAC address. In this table it's either a hypervisor IP address or a tunnel IP address of another VTEP.
  • ipaddr: string — the IP address this MAC corresponds to. It's an optional field, and it's there for the purpose of ARP suppression.

🌸 Mcast_Macs_Local TABLE 🌸

mapping of multicast MAC addresses to tunnels (physical locators) 🎀 this one is written by the HSC, so it's got the MAC addresses that have been learned on physical ports by a VTEP — learned by IGMP snooping, for example. and bestie, this table also specifies how to handle unknown unicast and broadcast packets. very main character of it.

🎀 Summary

MAC                           string
logical_switch                Logical_Switch
locator_set                   Physical_Locator_Set
ipaddr                        string

✨ Details ✨

  • MAC: string — a MAC address that has been learned by the VTEP.

The keyword unknown-dst is used as a special "Ethernet address" that indicates the locations to which packets in a logical switch should be sent when their destination addresses don't otherwise appear in Ucast_Macs_Local (for unicast addresses) or Mcast_Macs_Local (for multicast addresses).

  • logical_switch: Logical_Switch — the logical switch this mapping applies to.
  • locator_set: Physical_Locator_Set — the physical locator set used to reach this MAC address. In this table, the physical locator set will contain one or more tunnel IP addresses of the appropriate VTEP(s).
  • ipaddr: string — the IP address this MAC corresponds to. Optional field, there for the purpose of ARP suppression.

🦋 Mcast_Macs_Remote TABLE 🦋

mapping of multicast MAC addresses to tunnels (physical locators) 💅 this one's written by the NVC, so it's the MACs the NVC has learned. and just like the local version, it also specifies how to handle unknown unicast and broadcast packets.

so here's the tea: multicast packet replication may be handled by a service node, and then the physical locators are IP addresses of service nodes. but if the VTEP supports replication onto multiple tunnels using source node replication, then this may be used to replicate directly onto VTEP-hypervisor or VTEP-VTEP tunnels. multiple paths, pick your fighter ✨

🎀 Summary

MAC                           string
logical_switch                Logical_Switch
locator_set                   Physical_Locator_Set
ipaddr                        string

✨ Details ✨

  • MAC: string — a MAC address that has been learned by the NVC.

The keyword unknown-dst is used as a special "Ethernet address" that indicates the locations to which packets in a logical switch should be sent when their destination addresses don't otherwise appear in Ucast_Macs_Remote (for unicast addresses) or Mcast_Macs_Remote (for multicast addresses).

  • logical_switch: Logical_Switch — the logical switch this mapping applies to.
  • locator_set: Physical_Locator_Set — the physical locator set used to reach this MAC address. In this table the physical locator set will be either a set of service nodes (when service node replication is used) or the set of transport nodes — defined as hypervisors or VTEPs — participating in the associated logical switch (when source node replication is used). When service node replication is used, the VTEP should send packets to one member of the locator set that is known to be healthy and reachable, which could be determined by BFD. When source node replication is used, the VTEP should send packets to all members of the locator set. one vs. all, no cap 👑
  • ipaddr: string — the IP address this MAC corresponds to. Optional field, there for the purpose of ARP suppression.

🔥 Logical_Router TABLE 🔥

a logical router, aka a VRF 🫶 a logical router may be connected to one or more logical switches, and subnet addresses and interface addresses may be configured on the interfaces. it's giving "router but make it virtual."

🎀 Summary

switch_binding                map of string-Logical_Switch pairs
static_routes                 map of string-string pairs
acl_binding                   map of string-ACL pairs
Identification:
  name                        string (must be unique within table)
  description                 string
Error Notification:
  LR_fault_status : invalid_ACL_binding
                              none
  LR_fault_status : unspecified_fault
                              none
Common Column:
  other_config                map of string-string pairs

✨ Details ✨

  • switch_binding: map of string-Logical_Switch pairs — maps from an IPv4 or IPv6 address prefix in CIDR notation to a logical switch. multiple prefixes may map to the same switch. by writing a 32-bit (or 128-bit for v6) address with a /N prefix length, you configure both the router's interface address and the subnet prefix at once. like, 192.68.1.1/24 creates a /24 subnet for the logical switch attached to the interface and assigns the address 192.68.1.1 to the router interface. two birds, one stone, slay 💅
  • static_routes: map of string-string pairs — one or more static routes, mapping IP prefixes to next hop IP addresses.
  • acl_binding: map of string-ACL pairs — maps ACLs to logical router interfaces. the router interfaces are indicated using IP address notation, and they must be the same interfaces created in the switch_binding column. for example, an ACL could be associated with the logical router interface that has an address of 192.68.1.1 as defined in the example above.

💜 Identification 💜

  • name: string (must be unique within table) — symbolic name for the logical router.
  • description: string — an extended description for the logical router.

💜 Error Notification 💜

an entry in this column indicates to the NVC that the HSC has encountered a fault in configuring state related to the logical router 😭

  • LR_fault_status : invalid_ACL_binding: none — indicates that an error has occurred in associating an ACL with a logical router port.
  • LR_fault_status : unspecified_fault: none — indicates that an error has occurred in configuring the logical router, but that no more specific information is available.

💜 Common Column 💜

the overall purpose of this column is described under Common Column at the beginning of this document 📎

  • other_config: map of string-string pairs

🌈 Arp_Sources_Local TABLE 🌈

the MAC address to be used when a VTEP issues ARP requests on behalf of a logical router 🔥

okay so a distributed logical router is implemented by a set of VTEPs (both hardware VTEPs and vswitches). for a given VTEP to populate the local ARP cache for a logical router, it issues ARP requests with a source MAC address that is unique to that VTEP. and a single per-VTEP MAC can be re-used across all logical networks — efficiency queen 👑 this table contains the MACs used by the VTEPs of a given HSC, and it provides the mapping from MAC to physical locator for each VTEP, so replies to the ARP requests can be sent back to the correct VTEP using the appropriate physical locator. 🫶

🎀 Summary

src_mac                       string
locator                       Physical_Locator

✨ Details ✨

  • src_mac: string — the source MAC to be used by a given VTEP.
  • locator: Physical_Locator — the Physical_Locator to use for replies to ARP requests from this MAC address.

⭐ Arp_Sources_Remote TABLE ⭐

the MAC address to be used when a remote VTEP issues ARP requests on behalf of a logical router 🦋

this table is the remote counterpart of Arp_sources_local. the NVC writes this table to notify the HSC of the MACs that will be used by remote VTEPs when they issue ARP requests on behalf of a distributed logical router. it's the same vibe, just... elsewhere ✨

🎀 Summary

src_mac                       string
locator                       Physical_Locator

✨ Details ✨

  • src_mac: string — the source MAC to be used by a given VTEP.
  • locator: Physical_Locator — the Physical_Locator to use for replies to ARP requests from this MAC address.

💀 Physical_Locator_Set TABLE 💀

a set of one or more Physical_Locators 🎀

and like... the only reason this table exists? OVSDB doesn't have a way to express the type map from string to one or more Physical_Locator records. so we made a table instead. iconic workaround, honestly 💅

🎀 Summary

locators                      immutable set of 1 or more
                              Physical_Locators

✨ Details ✨

  • locators: immutable set of 1 or more Physical_Locators

💖 Physical_Locator TABLE 💖

Okay bestie, this one's the "where is everybody" table — it clocks an endpoint that logical switch traffic can get encapsulated and yeeted off to. Iconic.

So the vxlan_over_ipv4 encapsulation — the only one anybody's defined so far, no cap — can roll with either tunnel key model, both of which are laid out in the Per Logical-Switch Tunnel Key'' section over in the Logical_Switch table. Here's the gossip: when the tunnel key per Logical_Switch model is the one in use, the `tunnel_key` column in the Logical_Switch table is where the VNI lives and the `tunnel_key` column in *this* table is just sitting there empty, vibing. In the key-per-tunnel model? Literally the opposite, bestie. And ngl, the former model is the older one, so it's probably the one with more widespread support out in the wild. Want the full discussion of the model? It's in that Per Logical-Switch Tunnel Key'' section in the Logical_Switch table. 🫶

Summary:

  • encapsulation_type — immutable string, must be vxlan_over_ipv4
  • dst_ip — immutable string
  • tunnel_key — optional integer

Details:

  • encapsulation_type: immutable string, must be vxlan_over_ipv4 — the type of tunneling encapsulation, periodt.
  • dst_ip: immutable string — for vxlan_over_ipv4 encapsulation, this is the IPv4 address of the VXLAN tunnel endpoint. We expect this column could also be used for IPv4 or IPv6 addresses in encapsulations that get introduced later. 🔮
  • tunnel_key: optional integer — this column is only used in the tunnel key per Logical_Switch+Physical_Locator model (see above, bestie). For vxlan_over_ipv4 encapsulation, when the Logical_Switch+Physical_Locator model is in use, this column is the VXLAN VNI. It must be in the range 0 to 16,777,215. No sneaking outside the range. 💅

🎀 ACL_entry TABLE 🎀

This one describes the individual entries that make up an Access Control List. Each entry in the table = a single rule to match on certain header fields.

Now the ✨vibe check✨ on hardware: there are a large number of fields you can match on, but most hardware cannot match on arbitrary combinations of fields. It's common to match on either L2 fields (the L2 group of columns, below) or L3/L4 fields (the L3/L4 group of columns) — but not both. And if an ACL entry makes the hardware switch controller match on an incompatible mixture of fields, it may log an error. So like, be mindful. 😭

Summary:

  • sequence — integer
  • L2 fields:
    • source_mac — optional string
    • dest_mac — optional string
    • ethertype — optional string
  • L3/L4 fields:
    • source_ip — optional string
    • source_mask — optional string
    • dest_ip — optional string
    • dest_mask — optional string
    • protocol — optional integer
    • source_port_min — optional integer
    • source_port_max — optional integer
    • dest_port_min — optional integer
    • dest_port_max — optional integer
    • tcp_flags — optional integer
    • tcp_flags_mask — optional integer
    • icmp_type — optional integer
    • icmp_code — optional integer
  • direction — string, either egress or ingress
  • action — string, either deny or permit
  • Error Notification:
    • acle_fault_status : invalid_acl_entry — none
    • acle_fault_status : unspecified_fault — none

Details:

  • sequence: integer — the sequence number for the ACL entry, for the purpose of ordering entries in an ACL. Lower numbered entries get matched before higher numbered entries. First come, first served, basically. 👑
  • L2 fields:
    • source_mac: optional string — source MAC address, in the form xx:xx:xx:xx:xx:xx
    • dest_mac: optional string — destination MAC address, in the form xx:xx:xx:xx:xx:xx
    • ethertype: optional string — ethertype in hexadecimal, in the form 0xAAAA
  • L3/L4 fields:
    • source_ip: optional string — source IP address, in the form xx.xx.xx.xx for IPv4 or appropriate colon-separated hexadecimal notation for IPv6.
    • source_mask: optional string — mask that determines which bits of source_ip to match on, in the form xx.xx.xx.xx for IPv4 or appropriate colon-separated hexadecimal notation for IPv6.
    • dest_ip: optional string — destination IP address, in the form xx.xx.xx.xx for IPv4 or appropriate colon-separated hexadecimal notation for IPv6.
    • dest_mask: optional string — mask that determines which bits of dest_ip to match on, in the form xx.xx.xx.xx for IPv4 or appropriate colon-separated hexadecimal notation for IPv6.
    • protocol: optional integer — protocol number in the IPv4 header, or the value of the "next header" field in the IPv6 header.
    • source_port_min: optional integer — lower end of the range of source port values. The value specified is included in the range. 🫶
    • source_port_max: optional integer — upper end of the range of source port values. The value specified is included in the range.
    • dest_port_min: optional integer — lower end of the range of destination port values. The value specified is included in the range.
    • dest_port_max: optional integer — upper end of the range of destination port values. The value specified is included in the range.
    • tcp_flags: optional integer — integer representing the value of TCP flags to match. For example, the SYN flag is the second least significant bit in the TCP flags. Hence a value of 2 would indicate that the "SYN" flag should be set (assuming an appropriate mask).
    • tcp_flags_mask: optional integer — integer representing the mask to apply when matching TCP flags. For example, a value of 2 would imply that the "SYN" flag should be matched and all other flags ignored.
    • icmp_type: optional integer — ICMP type to be matched.
    • icmp_code: optional integer — ICMP code to be matched.
  • direction: string, either egress or ingress — direction of traffic to match on the specified port, either "ingress" (toward the logical switch or router) or "egress" (leaving the logical switch or router).
  • action: string, either deny or permit — action to take for this rule, either "permit" or "deny".

🚨 Error Notification:

An entry in this column indicates to the NVC that the ACL could not be configured as requested. The switch must clear this column when the error has been cleared. (Yes, must. Don't leave it hanging. 🙈)

  • acle_fault_status : invalid_acl_entry: none — indicates that an ACL entry requested by the controller could not be instantiated by the switch, e.g. because it requires an unsupported combination of fields to be matched.
  • acle_fault_status : unspecified_fault: none — indicates that an error has occurred in configuring the ACL entry but no more specific information is available. Like when the error message is just "error". 💀

🌈 ACL TABLE 🌈

The Access Control List table, obvi. Each ACL is constructed as a set of entries from the ACL_entry table. And here's the important bit: packets that are not matched by any entry in the ACL are allowed by default. Default = yes babe, come in. ✨

Summary:

  • acl_entries — set of 1 or more ACL_entrys
  • acl_name — string (must be unique within table)
  • Error Notification:
    • acl_fault_status : invalid_acl — none
    • acl_fault_status : resource_shortage — none
    • acl_fault_status : unspecified_fault — none

Details:

  • acl_entries: set of 1 or more ACL_entrys — a set of references to entries in the ACL_entry table.
  • acl_name: string (must be unique within table) — a human readable name for the ACL, which may (for example) be displayed on the switch CLI. Give it a cute name, it'll show up in public. 🎀

🚨 Error Notification:

An entry in this column indicates to the NVC that the ACL could not be configured as requested. The switch must clear this column when the error has been cleared.

  • acl_fault_status : invalid_acl: none — indicates that an ACL requested by the controller could not be instantiated by the switch, e.g., because it requires an unsupported combination of fields to be matched.
  • acl_fault_status : resource_shortage: none — indicates that an ACL requested by the controller could not be instantiated by the switch due to a shortage of resources (e.g. TCAM space). Too popular, ran out of room. 😭
  • acl_fault_status : unspecified_fault: none — indicates that an error has occurred in configuring the ACL but no more specific information is available.

And that's a wrap on the whole page, bestie!! 🦋✨ This part was vtep(5) from Open vSwitch 4.0.0, DB Schema 1.7.0 — mwah, go forth and encapsulate responsibly. 💜🌸

📦 where this page comes from