While Ethernet VPN (EVPN) control-plane logic and the underlying BGP routed fabric prevent Layer 3 routing loops via standard Split Horizon and BGP path attribute mechanisms, Layer 2 overlay fabrics remain vulnerable to Layer 2 bridging loops. Such loops typically arise from accidental physical cross-connects, external unmanaged switches, misconfigured hypervisor virtual switches, or redundant Layer 2 interconnections between tenant segments.
Standard Spanning Tree Protocol (STP) instances are terminated locally at the Virtual Tunnel Endpoint (VTEP) access ports and are not encapsulated or transmitted across the VXLAN overlay tunnels by default. To address this risk, ArubaOS-CX provides native support for Loop Protection over VXLAN interfaces.
When Loop Protection is enabled across the VXLAN configuration in AOS-CX, the VTEP switch periodically transmits proprietary loop-protect probe packets into the VXLAN Network Identifier (VNI) overlay across its VXLAN tunnel interfaces. If a VTEP detects its own loop-protection probe returning on an overlay interface or a corresponding local port associated with that same VNI, it identifies an active forwarding loop and takes defensive action—typically disabling the offending local interface or alerting network operators. This prevents broadcast storms from crippling overlay fabric resources.
Chosen Answer:
This is a voting comment (?). You can switch to a simple comment. It is better to Upvote an existing comment if you don't have anything to add.
Submit