vpp: support L2 VXLAN EVPN by sambenko · Pull Request #1761 · sonic-net/sonic-sairedis

sambenko · 2026-02-05T10:18:43Z

This PR aims to add support for L2 VXLAN with BGP EVPN to the vpp platform. Previously, only L3 VXLAN using SAI_OBJECT_TYPE_NEXT_HOP was supported. This change enables L2 bridging over VXLAN using BGP EVPN for MAC learning and VTEP discovery.

For now, TunnelVPPData is shared and only tunnel creation works.

Signed-off-by: Samuel Benko <samuel.benko@pantheon.tech>

mssonicbld · 2026-02-05T10:18:51Z

/azp run

linux-foundation-easycla · 2026-02-05T10:18:51Z

The committers listed above are authorized under a signed CLA.

✅ login: sambenko / name: Samuel Benko (15f3dd2)

azure-pipelines · 2026-02-05T10:18:57Z

Azure Pipelines will not run the associated pipelines, because the pull request was updated after the run command was issued. Review the pull request again and issue a new run command.

Signed-off-by: Samuel Benko <samuel.benko@pantheon.tech>

mssonicbld · 2026-02-05T10:24:30Z

/azp run

azure-pipelines · 2026-02-05T10:24:37Z

Azure Pipelines will not run the associated pipelines, because the pull request was updated after the run command was issued. Review the pull request again and issue a new run command.

yue-fred-gao

Thanks for the contribution. This is an important feature. Can you clarify what tests you have run?

yue-fred-gao · 2026-02-05T18:26:11Z

vslib/vpp/TunnelManager.cpp

+        if (vni != 0 && vlan_id != 0) break;
+    }
+
+    if (vni == 0) {


What if the tunnel is a l3 tunnel and there is no tunnel mapper of SAI_TUNNEL_MAP_TYPE_VNI_TO_VLAN_ID? Will this cause l3 tunnel creation failed?

Yes, but I thought that l3 tunnel creation uses a different code path (SAI_OBJECT_TYPE_NEXT_HOP -> createNexthop -> create_tunnel_encap_nexthop -> tunnel_encap_nexthop_action), so I assumed that it won't even be hit.
I could change it to return SAI_STATUS_SUCCESS instead of failure

Fixed in commit 4b83fcf based on Copilot suggestion - now returns SAI_STATUS_SUCCESS to skip non-L2 tunnels gracefully.

yue-fred-gao · 2026-02-06T02:08:01Z

sonic-vpp t1-lag sonic-mgmt test is in PR checker. You can trigger it like this PR: sonic-net/sonic-buildimage#25369

sambenko · 2026-02-06T13:02:11Z

Thanks for the contribution. This is an important feature. Can you clarify what tests you have run?

Hey, I have ran tests on a local containerlab topology:

2x sonic-vpp routers and 2x linux PCs (praqma/network-multitool:latest image)
bgp evpn peering between routers for vtep discovery and mac learning
PCs attached to access VLANs (untagged) on each router

With this setup I tested and confirmed:

vpp vxlan tunnel creation with 'vppctl show vxlan tunnel'
bridge domain membership with tunnel interface 'vppctl show bridge-domain'
verified sai objects in redis asic_db (tunnel, tunnel maps, tunnel map entries)
single vni vlan mapping

sambenko · 2026-02-06T13:16:07Z

/azp run Azure.sonic-sairedis

azure-pipelines · 2026-02-06T13:16:14Z

Commenter does not have sufficient privileges for PR 1761 in repo sonic-net/sonic-sairedis

yue-fred-gao · 2026-02-06T14:30:52Z

sonic-vpp t1-lag sonic-mgmt test is in PR checker. You can trigger it like this PR: sonic-net/sonic-buildimage#25369

Can you run sonic-vpp sonic-mgmt to make sure it doesn't break anything?

yue-fred-gao · 2026-02-06T14:37:35Z

sonic-vpp t1-lag sonic-mgmt test is in PR checker. You can trigger it like this PR: sonic-net/sonic-buildimage#25369

Can you run sonic-vpp sonic-mgmt to make sure it doesn't break anything?

nvm. You already did :)

lguohan · 2026-02-12T02:02:55Z

any test cases?

yue-fred-gao · 2026-02-12T14:16:49Z

any test cases?

It seems there is no EVPN test case in sonic-mgmt. sonic-vpp doesn't have a UT infrastructure either. Max from Arista and his team is working on that.

Copilot

Pull request overview

This pull request adds support for L2 VXLAN with BGP EVPN to the VPP platform in the sonic-sairedis virtual switch implementation. Previously, only L3 VXLAN using SAI_OBJECT_TYPE_NEXT_HOP was supported. The changes enable L2 bridging over VXLAN tunnels using BGP EVPN for MAC learning and VTEP discovery.

Changes:

Extended TunnelVPPData structure to support both L2 and L3 VXLAN tunnel configurations
Added create_l2_vxlan_tunnel method to create P2P VXLAN tunnels and associate them with bridge domains (VLANs)
Modified VLAN member creation to skip VPP operations for tunnel-type bridge ports

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 5 comments.

File	Description
vslib/vpp/TunnelManager.h	Extended TunnelVPPData with L2 VXLAN fields (VNI, VLAN ID, src/dst IPs) and added m_l2_tunnel_map storage with create_l2_vxlan_tunnel method declaration
vslib/vpp/TunnelManager.cpp	Implemented create_l2_vxlan_tunnel to extract tunnel configuration from SAI objects, create VPP VXLAN tunnels, and add them to bridge domains
vslib/vpp/SwitchVppFdb.cpp	Added early return in vpp_create_vlan_member to skip VPP operations for SAI_BRIDGE_PORT_TYPE_TUNNEL bridge ports
vslib/vpp/SwitchVpp.cpp	Hooked SAI_OBJECT_TYPE_TUNNEL creation to call create_l2_vxlan_tunnel after internal object creation

vslib/vpp/TunnelManager.cpp

vslib/vpp/SwitchVpp.cpp

vslib/vpp/TunnelManager.cpp

Signed-off-by: Samuel Benko <samuel.benko@pantheon.tech>

mssonicbld · 2026-02-17T16:02:55Z

/azp run

azure-pipelines · 2026-02-17T16:03:07Z

Azure Pipelines successfully started running 1 pipeline(s).

mssonicbld · 2026-02-17T23:56:24Z

/azp run

azure-pipelines · 2026-02-17T23:56:35Z

Azure Pipelines successfully started running 1 pipeline(s).

Signed-off-by: Samuel Benko <samuel.benko@pantheon.tech>

mssonicbld · 2026-02-17T23:58:05Z

/azp run

azure-pipelines · 2026-02-17T23:58:16Z

Azure Pipelines successfully started running 1 pipeline(s).

Signed-off-by: Samuel Benko <samuel.benko@pantheon.tech>

mssonicbld · 2026-02-18T00:54:07Z

/azp run

azure-pipelines · 2026-02-18T00:54:20Z

Azure Pipelines successfully started running 1 pipeline(s).

Cherry-picked from sonic-net/sonic-sairedis PR sonic-net#1761 (sambenko). Fixes syncd segfault when EVPN creates P2P tunnel bridge ports: - Handle SAI_BRIDGE_PORT_TYPE_TUNNEL in vpp_create_vlan_member - Create/remove VPP VxLAN tunnels for L2 EVPN P2P tunnels - Add tunnel interface to VLAN bridge domain in VPP Signed-off-by: Tamer Ahmed <tamerahmed@microsoft.com>

vpp_remove_vlan_member() dereferences SAI_BRIDGE_PORT_ATTR_PORT_ID without checking the bridge port type. When the bridge port is a VxLAN tunnel (SAI_BRIDGE_PORT_TYPE_TUNNEL), this attribute is not set, causing a null pointer dereference and SIGSEGV. This is the same root cause as the create path fixed by PR sonic-net#1761, but in the remove path which was missed. Add a bridge port type check before the PORT_ID lookup, and skip tunnel bridge ports gracefully. Signed-off-by: Tamer Ahmed <tamerahmed@microsoft.com>

mssonicbld · 2026-02-20T08:33:01Z

/azp run

azure-pipelines · 2026-02-20T08:33:13Z

Azure Pipelines successfully started running 1 pipeline(s).

yue-fred-gao · 2026-02-20T16:58:06Z

hi @tahmed-dev , can you share the issues you found in the PR? I saw you made a few changes.

yue-fred-gao · 2026-02-20T17:00:57Z

hi @sambenko , can you please check the comments from copilot? Some of them make sense. BTW, the current test_vxlan_ecmp test is broken in the baseline. I will take a look. Once that is fixed, we can trigger the PR checker again for sanity check.

Signed-off-by: Samuel Benko <samuel.benko@pantheon.tech>

mssonicbld · 2026-02-23T13:39:09Z

/azp run

azure-pipelines · 2026-02-23T13:39:22Z

Azure Pipelines successfully started running 1 pipeline(s).

When deleting an L2 VXLAN tunnel map entry (e.g. "config vxlan map del"), the SAI orchestrator cascades removal of VLAN members, bridge ports, and triggers FDB flushes. Several VPP-specific functions in SwitchVppFdb.cpp unconditionally access SAI_BRIDGE_PORT_ATTR_PORT_ID on bridge port objects, but tunnel bridge ports (SAI_BRIDGE_PORT_TYPE_TUNNEL) carry SAI_BRIDGE_PORT_ATTR_TUNNEL_ID instead. Accessing the missing PORT_ID attribute returns a null pointer, and dereferencing it causes a segfault (crash at offset 0x18 from NULL). The specific crash occurred in vpp_fdbentry_flush() during a FLUSH_BY_INTERFACE operation (mode 5) on a tunnel bridge port. Changes: - Add is_tunnel_bridge_port() utility method to SwitchVpp that safely checks whether a bridge port is of type TUNNEL - Guard vpp_create_vlan_member() using the new utility (replaces inline check) - Guard vpp_remove_vlan_member() using the new utility (replaces inline check) - Guard vpp_fdbentry_add() to skip VPP FDB operations for tunnel bridge ports - Guard vpp_fdbentry_del() to skip VPP FDB operations for tunnel bridge ports - Guard vpp_fdbentry_flush() FLUSH_BY_INTERFACE case to fall back to flush_all for tunnel bridge ports instead of dereferencing PORT_ID Signed-off-by: Samuel Benko <samuel.benko@pantheon.tech>

mssonicbld · 2026-02-24T18:39:43Z

/azp run

azure-pipelines · 2026-02-24T18:39:54Z

Azure Pipelines successfully started running 1 pipeline(s).

sambenko · 2026-02-25T09:06:36Z

hey @yue-fred-gao and @lguohan I incorporated the fixes from Copilot suggestions as well as some additional sigsegv issues during vxlan tunnel removal and it works now. Some additional steps that need to be taken, apart from the test_vxlan_ecmp test being broken?

hi @sambenko , can you please check the comments from copilot? Some of them make sense. BTW, the current test_vxlan_ecmp test is broken in the baseline. I will take a look. Once that is fixed, we can trigger the PR checker again for sanity check.

yue-fred-gao · 2026-03-02T20:11:50Z

hi @sambenko , I have fixed the failure in test_vxlan_ecmp with PR sonic-net/sonic-mgmt#22644. Please trigger the vpp t1-lag test again for sanity. thanks!

sambenko · 2026-03-02T20:27:06Z

hi @sambenko , I have fixed the failure in test_vxlan_ecmp with PR sonic-net/sonic-mgmt#22644. Please trigger the vpp t1-lag test again for sanity. thanks!

Hey @yue-fred-gao thanks for the fix. However, when I try to rerun the failed jobs (t1-lag test), I get

TF400813: The user 'aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa' is not authorized to access this resource.

could you please rerun it for me so we don't have to trigger the entire pipeline for this? Thank you!
https://dev.azure.com/mssonic/build/_build/results?buildId=1045498&view=results

yue-fred-gao · 2026-03-02T21:23:11Z

hi @sambenko , I have fixed the failure in test_vxlan_ecmp with PR sonic-net/sonic-mgmt#22644. Please trigger the vpp t1-lag test again for sanity. thanks!

Hey @yue-fred-gao thanks for the fix. However, when I try to rerun the failed jobs (t1-lag test), I get
TF400813: The user 'aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa' is not authorized to access this resource.
could you please rerun it for me so we don't have to trigger the entire pipeline for this? Thank you! https://dev.azure.com/mssonic/build/_build/results?buildId=1045498&view=results

I don't have the permission either. I think you will have to trigger the entire azure pipeline.

mssonicbld · 2026-03-16T12:42:09Z

/azp run

azure-pipelines · 2026-03-16T12:42:21Z

Azure Pipelines successfully started running 1 pipeline(s).

yue-fred-gao

I ran test_vxlan_ecmp and it passed.

feat: L2 VXLAN EVPN support

4e95db9

Signed-off-by: Samuel Benko <samuel.benko@pantheon.tech>

chore: specify L2 VXLAN fields in TunnelVPPData

7ec1d0d

Signed-off-by: Samuel Benko <samuel.benko@pantheon.tech>

yue-fred-gao reviewed Feb 5, 2026

View reviewed changes

lguohan requested a review from Copilot February 14, 2026 06:13

Copilot started reviewing on behalf of lguohan February 14, 2026 06:14 View session

Copilot AI reviewed Feb 14, 2026

View reviewed changes

feat: remove L2 vxlan tunnel

6de5561

Signed-off-by: Samuel Benko <samuel.benko@pantheon.tech>

Merge branch 'sonic-net:master' into feat/L2-vxlan-evpn

24775bc

chore: remove em dash

2970c0f

Signed-off-by: Samuel Benko <samuel.benko@pantheon.tech>

fix: some Copilot suggestions

83e893a

Signed-off-by: Samuel Benko <samuel.benko@pantheon.tech>

sambenko added 4 commits February 23, 2026 14:19

fix: skip L2 VXLAN setup gracefully when no VNI-to-VLAN mapping exists

4b83fcf

Signed-off-by: Samuel Benko <samuel.benko@pantheon.tech>

fix: remove incorrect default VRF association from L2 VXLAN tunnels

68d9898

Signed-off-by: Samuel Benko <samuel.benko@pantheon.tech>

fix: remove redundant vlan_id check in create_l2_vxlan_tunnel

9ab3285

Signed-off-by: Samuel Benko <samuel.benko@pantheon.tech>

fix: skip L3 neighbor entry setup for L2 VXLAN tunnels

7744878

Signed-off-by: Samuel Benko <samuel.benko@pantheon.tech>

Merge remote-tracking branch 'upstream/master' into feat/L2-vxlan-evpn

15f3dd2

yue-fred-gao approved these changes Mar 21, 2026

View reviewed changes

Conversation

sambenko commented Feb 5, 2026

Uh oh!

mssonicbld commented Feb 5, 2026

Uh oh!

linux-foundation-easycla bot commented Feb 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

azure-pipelines bot commented Feb 5, 2026

Uh oh!

mssonicbld commented Feb 5, 2026

Uh oh!

azure-pipelines bot commented Feb 5, 2026

Uh oh!

yue-fred-gao left a comment

Choose a reason for hiding this comment

Uh oh!

yue-fred-gao Feb 5, 2026

Choose a reason for hiding this comment

Uh oh!

sambenko Feb 6, 2026

Choose a reason for hiding this comment

Uh oh!

sambenko Feb 23, 2026

Choose a reason for hiding this comment

Uh oh!

yue-fred-gao commented Feb 6, 2026

Uh oh!

sambenko commented Feb 6, 2026

Uh oh!

sambenko commented Feb 6, 2026

Uh oh!

azure-pipelines bot commented Feb 6, 2026

Uh oh!

yue-fred-gao commented Feb 6, 2026

Uh oh!

yue-fred-gao commented Feb 6, 2026

Uh oh!

lguohan commented Feb 12, 2026

Uh oh!

yue-fred-gao commented Feb 12, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

mssonicbld commented Feb 17, 2026

Uh oh!

azure-pipelines bot commented Feb 17, 2026

Uh oh!

mssonicbld commented Feb 17, 2026

Uh oh!

azure-pipelines bot commented Feb 17, 2026

Uh oh!

mssonicbld commented Feb 17, 2026

Uh oh!

azure-pipelines bot commented Feb 17, 2026

Uh oh!

mssonicbld commented Feb 18, 2026

Uh oh!

azure-pipelines bot commented Feb 18, 2026

Uh oh!

mssonicbld commented Feb 20, 2026

Uh oh!

azure-pipelines bot commented Feb 20, 2026

Uh oh!

yue-fred-gao commented Feb 20, 2026

Uh oh!

yue-fred-gao commented Feb 20, 2026

Uh oh!

mssonicbld commented Feb 23, 2026

Uh oh!

azure-pipelines bot commented Feb 23, 2026

Uh oh!

linux-foundation-easycla bot commented Feb 5, 2026 •

edited

Loading

sambenko commented Feb 25, 2026 •

edited

Loading