Network Virtualization using Extreme Fabric Connect

Network Virtualization Using Extreme Fabric Connect
© 2019 Extreme Networks, Inc. All rights reserved. 171
Figure 100 L3 VSN Extension
However, when IP multicast is not required and it is desired to have an end-to-end L2 service, the L2 VSN
extension method is often selected. There is an important principle to remember regarding L2 VSNs. Any IP
address assigned to the VLAN gets placed onto the GRT. This obviously creates a security issue with
segmentation. In the figure above, note that BEB-A has a local VLAN termination to a VRF. It is in turn
associated with an L2 VSN that extends over to BEB-B. The proper practice is to ensure that no IP
addresses are assigned to the remote VLAN service termination point. By following this practice, any L2
VSN extensions off an L3 VSN will remain off the GRT.
Tip
The following is a stealth design quick checklist:
• Reserve the GRT for IT management and security practices only!
• Never assign IP addresses to L2 VSN service termination VLANs unless you intend
on having the VSN be part of the GRT.
• When extending L3 VSN VRF subnets using L2 VSNs, never assign IP addresses to
remote L2 VSN service termination VLANs unless you intend on having the L3 VSN
be part of the GRT. This should be viewed as temporary measure and a switch
capable of proper VRF termination should be deployed.
• Perform regular checks on the GRT to ensure that any inadvertent insertions are
caught as soon as possible. Ideally the GRT should be only ISIS Source IDs and
administrative systems for network management and security.