- About this Document
- Solution Overview
- Solution Benefits
- Use Case and Reference Architecture
- Validation Framework
- Considerations when implementing VXLAN-GBP
- Test Objectives
- Recommendations
- APPENDIX: Switch Template Configuration Examples
- APPENDIX: Dynamic Client Authentication Using the Mist Authentication Cloud
- APPENDIX: Static Client Assignments
- APPENDIX: Debugging Examples Using the Junos OS CLI
- Revision History
Validation Framework
To be able to test VXLAN GBPs you must have the following in place:
- Wired clients with a known MAC address you can configure in the Juniper Mist cloud or on a RADIUS server.
- Wired clients with 802.1X EAP supplicant support.
- The wired clients IP address can be configured either:
- With a pre-configured static IP address
- As a DHCP client. In this case, the fabric needs to be
configured for:
- DHCP relay for the fabric towards the DHCP server.
- A DHCP server attached to hand out the DHCP lease back to the wired client.
- A Juniper Mist-managed campus fabric with IP Clos
configuration:
- Configured as either a 3-stage or 5-stage fabric.
- Has WAN routers attached to the fabric.
- That uses EX4100 or Juniper Networks® EX4400 access switches that MUST be running Junos OS Release 24.2R2 or higher.
- May use optional service block switches.
- RADIUS server:
- Any third-party RADIUS server that is reachable via the fabric management network.
- Juniper Mist Access Assurance (NAC) that is reachable via the Internet.
- A minimum enterprise PKI for the EAP authentications between client (supplicant) and RADIUS server to be performed.
- Wi-Fi access points are optional.
Test Bed
We tested a 5-Stage IP Clos fabric which was managed via Juniper Mist cloud.
The access switches were configured as either:
- Virtual Chassis with 4 members
- Standalone switches
The local RADIUS server was a FreeRADIUS virtual machine and Juniper Mist Access Assurance tests were operated via the Juniper Mist auth cloud.
All wired clients were emulated via Spirent testing equipment.
The test bed topology can be seen in Figure 1:
Platforms / Devices Under Test (DUT)
Testing was performed with a focus on EX4400 Switches configured as access switches since those switches supported all current features.
| Devices Under Test | |||
|---|---|---|---|
| Platform | Device | Junos OS Release | Note on Junos OS Release used |
| EX4400 | Access Virtual Chassis | 24.2R2 | Important for the solution and testing performed. |
| EX4100 | Access Standalone switch | 24.2R2 | Important for the solution and testing performed. |
| EX4650 | Distribution switch | 24.2R2 | Not important for the solution as it’s just forwarding VXLAN packets |
| EX4650 | Core switch | 24.2R2 | Not important for the solution as it’s just forwarding VXLAN packets |
| EX4650 | EX4650 | 24.2R2 | Not important for the solution as it’s just forwarding VXLAN packets |
| SRX1500 | SRX1500 | Not important for the solution | |
For more information about supported devices and related Junos OS releases, see: https://www.juniper.net/documentation/us/en/software/junos/evpn/topics/example/micro-segmentation-using-group-based-policy.html
