Member
I wrote a VXLAN implementation in Rust. 40% faster than Linux kernel VXLAN on same hardware. Not production yet because I also wrote the memory allocator and I don't trust myself.
The real answer is nobody should stretch L2. But if you must, kernel GENEVE has better performance characteristics than VXLAN on 6.x. Tested on my Threadripper lab in Stockholm.
This. We spent 18 months making VXLAN work between two Hetzner facilities, finally gave up and re-IP'd everything. The migration weekend was less painful than the previous 18 months.
Legacy apps that need same subnet are legacy apps that need rewriting.
Member
Easy to say. Try telling that to a factory floor with 200 PLCs configured by a guy who retired in 2014. The subnet is burned into firmware I cannot touch.
VXLAN stays. I just accept the 3am pages.
We stretch L2 with DMVPN over 4G backup between Casablanca and Rabat. Main link is fiber, backup is Huawei 4G routers. VXLAN over DMVPN over IPsec over 4G. Latency is 80ms. It works for SCADA. I do not ask why.
RAID is not backup. DMVPN is not a WAN. But here we are.
Has anyone tried Tinc for this? Mesh VPN, can do L2 tap interfaces. I used it for a homelab stretch between two apartments. Not datacenter grade but simpler than VXLAN setup.
Probably scales to "embarrassing" and no further.
Tinc is a toy. We evaluated it for a client in 2019, performance fell off a cliff at 100 Mbps. No hardware offload, single-threaded crypto.
Back to the actual question: what about Nokia SR Linux? Their EVPN implementation has auto-RT and works with Linux VXLAN. Anyone running it outside of ISPs?
Price puts it in "ask your account team" territory. Not a war story, a procurement story.
Real war story: we used AlgoVPN (WireGuard) to stretch L2 between two DigitalOcean droplets for a demo. Worked for 20 minutes then kernel panicked. Demo completed, invoice never paid, lesson learned.
Following this thread closely. We are about to start exactly the same project: Hetzner Falkenstein to Nuremberg, VM migration for legacy SAP. Currently on single site, outgrowing it.
Based on what I am reading, VXLAN/EVPN is the path but I need to budget for the separate network option for jumbo frames. Correct?
Correct on separate network. Also budget for a third VTEP somewhere if you want true redundancy, or accept split-brain during migrations. Two VTEPs with anycast gateway is the minimum complexity that mostly works.
I can share my Ansible templates if useful. ROS 7 specific.
Please do. I am in the same boat, Hetzner to Hetzner, looking at CCR2116 vs CHR. The CHR instability YuriDavid mentioned worries me.
Is the crash reproducible? Specific traffic pattern?
