EoGRE over IPSec is a method of providing security to the Ethernet packets traversing a GRE tunnel. GRE encapsulates the data packets, while IPSec ensures the security of such encapsulated data packets by using different encryption methods. Using IPSec, an extra layer of security is added to the GRE packets in order to protect client’s sensitive information against eavesdropping or any modification. GRE packets are secured in two phases:

Using IPSec, an extra layer of security is added to the GRE packets in order to protect client’s sensitive information against eavesdropping or any modification.

Default Cipher Combination for a Better Throughput

VXLAN was developed to overcome the limited scalability of VLANs in large network deployments, e.g., datacenter networks. VXLAN creates a virtual network on top of a physical network. The virtual network is called an "overlay" while the physical network infrastructure it runs on is called an "underlay." Switches and routers that participate in VXLAN have a special interface called a VTEP. The VTEP provides the connection between the underlay and the overlay. The ethernet frames traveling over the VXLAN tunnel are encapsulated in IP and UDP headers at the source host and decapsulated at the destination client.

Arista switches support VXLAN to enable scalable virtualized datacenter networking. In addition, Arista Wi-Fi Access Points (APs) also support VXLAN to allow tunneling of data from Wi-Fi APs to a central aggregation point, e.g., an Arista switch. This allows enterprises to migrate their existing controller-based Wi-Fi networks to Arista's controller-less cloud architecture without having to change the design of their underlying campus network.

VXLAN was developed to overcome the limited scalability of VLANs in large network deployments, e.g., datacenter networks. VXLAN creates a virtual network on top of a physical network. The Ethernet frames traveling over the VXLAN tunnel are encapsulated in IP and UDP headers at the source host and decapsulated at the remote endpoint.

VXLAN creates a virtual network and IPSec adds a layer of security to the SSID traffic using different encryption methods. Using IPSec, an extra layer of security is added to the VXLAN packets in order to protect client’s sensitive information against eavesdropping or any modification.

Path Maximum Transmission Unit (MTU) is the lowest of the switch and router MTU values along a network path; it basically determines the maximum allowable size of a packet traveling along the path. Enterprise networks often tunnel Wi-Fi traffic to a wired endpoint. When TCP sessions are tunneled, the frame size of each packet increases by 50 to 200 bytes because of headers added at each protocol layer. Because the new frame size could be larger than the tunnel MTU, packets must now either be fragmented or combined into jumbo frames. Both approaches, however, could pose problems for tunneled networks.Tunnel endpoints might not support fragmentation and reassembly—for instance, in the case of VXLAN tunnels, Arista switches do not support fragmentation and reassembly—and the underlay network might not support jumbo frames.

Arista access points (APs) support maximum segment size (MSS) clamping for tunneled networks. APs clamp the MSS to a value lower than the tunnel maximum transmission unit (MTU) value, thereby ensuring that no packet flowing through the tunnel exceeds the tunnel MTU in size. When a Wi-Fi client attempts to set up a TCP connection with an MSS larger than the tunnel MTU, the AP modifies the MSS value in the TCP Syn and Syn-Ack messages so that the packet size does not exceed the tunnel MTU. (See How an Access Point Calculates the MSS based on the tunnel MTU.)

The table below provides information required to configure a Tunnel Interface Profile.

In a global organization, most of the communication happens over a tunneled network. To maintain high availability and to report the tunnel health to Access Points (APs), you configure primary and secondary endpoints in a tunnel. AP uses the tunnel health to detect whether the tunnel is down. If the AP can not reach the primary endpoint, it connects with the secondary endpoint and, thus, eliminates the network downtime.

APs use ICMP requests and responses to determine whether the endpoint is reachable or not. An AP that has active clients can suppress ICMP requests, if it receives encapsulated packets from the remote endpoint. If the AP does not have active clients, it may not suppress ICMP requests.

An AP uses these parameters to detect whether the remote endpoint is reachable or not. The AP sends an ICMP request at each network probe interval and waits for the ICMP response from the remote endpoint. If there is no ICMP response, the AP retries and sends another ICMP request based on the Network Ping Retry Count value.

If you have enabled the Prefer Primary Endpoint parameter during the configuration, then every time the primary endpoint is active, the AP will switch to the primary endpoint. For example, suppose that the AP could not establish a connection with the primary endpoint and, hence, it switched over to the secondary endpoint. At any point, if the primary endpoint starts functioning again and the AP can establish a connection with it, then the AP will disconnect from the secondary endpoint and switch over to the primary endpoint. Also, every time the AP restarts, it tries to establish a connection with the primary endpoint first. If the AP can not establish the connection with the primary endpoint, it switches over to the secondary endpoint.

For example, using defaut values, the failover time is calculated as follows:

Consider the time as T. At time = T0, the AP sends an ICMP echo request and waits for 10 seconds. The default Network Probe Interval is 10 seconds.

At T1 = T0+10, if no response is received, the AP sends another ping. The default Network Ping count is 2. So, the AP sends two pings after T0.

At T2 = T1+10, the AP sends the second ping. If no response is received, the AP starts the Network Timeout counter.

At T3 = T2+10 (because the default Network Timeout value is 10 seconds), the AP switches the tunnel.

Note that the above calculation is applicable only after the receiver increment counter stops. So, with the default values, it takes around 35 seconds for the tunnel to failover from one endpoint to the other.