Member
ARP burst during VM boot. 500+ requests in <1 second, CHR queue fills, watchdog kills it. Reproducible every time with a full vMotion of our largest VM.
Workaround: arp-limit 50/second on the bridge. Side effect: first ping drops during migration. Acceptable.
Same workaround here but on Linux bridge with ebtables. Not CHR, just vanilla Debian with FRR. The ARP burst is the real enemy, not VXLAN itself.
We also saw it with OVS-DPDK. The DPDK poll mode driver doesn't care about your ARP storm, it just forwards faster.
This thread answered my question before I asked it. Was going to suggest L2TPv3, saw the "dead protocol" warning, read the rest, now I know better.
Thanks all. Following for the Ansible templates.
Still runs on Cisco IOS if you have a time machine and a support contract from 2012. I maintain one for a bank in Zurich. They pay me to not tell anyone.
VXLAN is the present. L2TPv3 is the past. GENEVE is the future that keeps not arriving.
Late to this but: has anyone tried just... not? We used Hetzner's vSwitch for same-ASN private networking, routed /29 between pops, reconfigured VMs to use it. No L2 stretch, no VXLAN, no 3am pages.
Took longer to migrate but zero network complexity. Sometimes the best inter-datacenter layer 2 extension is no extension.
VSwitch is single-datacenter only. You cannot span vSwitch across Hetzner regions. We asked. They said "use VPN."
Which brings us back to this thread's beginning. The circle is complete.
