Describes the operational guidelines and functional limitations for dataplane IP address learning across VRF instances, bridge domains, and EPG subnets. These constraints ensure proper endpoint management and traffic policy enforcement within the network fabric.
This topic provides essential configuration guidelines and behavioral limitations for managing dataplane IP address learning at the VRF, bridge domain, and EPG levels.
Guidelines for dataplane IP address learning
The following guidelines and limitations apply to dataplane IP address learning per VRF instance, bridge domain subnet, and EPG subnet:
-
When dataplane IP address learning is disabled, all the remote IP address entries in the tenant VRF instance are removed. The local IP entries are aged out and, subsequently, will not be re-learned through the dataplane, but can still be learned from the control plane.
-
When dataplane IP address learning is disabled, already learned local IP endpoints are retained and require control plane refreshes (ARP) to be kept alive (assuming IP aging is also enabled). Dataplane Layer 3 traffic will not keep IP endpoints alive.
-
For EPG-to-EPG intra-VRF instance Layer 3 traffic, the policy is always applied on the egress leaf switch because the ingress leaf switch cannot resolve the destination class. The remote IP address is not learned.
-
For EPG-to-EPG intra-VRF instance Layer 2 traffic, the policy can be applied on the ingress leaf switch because the switch can still learn the remote MAC address, but not the remote IP address.
-
When dataplane IP address learning is enabled for an endpoint or subnet, a dataplane IP address is not learned using an endpoint-to-endpoint ARP request that does not reach a CPU. However, an ARP request to a bridge domain SVI gateway is still learned.
-
When dataplane IP address learning is enabled for a VRF instance, local and remote MAC addresses are learned using an endpoint-to-endpoint ARP request.
Disabling dataplane IP address learning per endpoint or subnet
The following guidelines and limitations apply to disabling dataplane IP address learning per endpoint or subnet:
-
If there is communication between endpoints in the same bridge domain, the L2 unknown Unicast property must be set to Flood on the bridge domain. ARP flooding must also be enabled. Otherwise, ARP between endpoints in the same bridge domain does not work because the local MAC address and remote MAC address are not learned through an endpoint-to-endpoint ARP request.
-
Instead of flushing, the local IP address is converted to the
dp-lrn-dis(dataplane learn disabled) state. -
You cannot have endpoint dataplane IP address learning enabled when the subnet for an endpoint is configured with dataplane IP address learning disabled. For example, you cannot have a bridge domain with subnet 100.10.0.1/24 with learning disabled and an EPG with 100.10.0.100/32 with learning enabled.
-
When dataplane IP address learning is disabled for an endpoint or subnet, the switch will not learn/refresh Layer 2 MAC addresses from routed Layer 3 data traffic. Layer 2 MAC addresses will only be learned from Layer 2 data traffic or ARP packets.
-
When dataplane IP address learning is disabled for an endpoint or subnet, an IP address learn or move triggered from a GARP packet is only possible with the ARP flood mode along with GARP-based endpoint move detection enabled.
-
When the EPG is participating in the Multi-Site via Nexus Dashboard Orchestrator (NDO) such that the EPG is stretched or a shadow is created on the other sites, it is not supported to disable this option.