MÓDULO VXLAN-{1..3}.Art

VTEP front-end for Agents (TRUST-only VXLAN).

Function

VTEP (VXLAN Tunnel Endpoint) front-ends in front of the bench's agent fleet — PW (VXLAN-1), K6 (VXLAN-2), MAC/ARP (VXLAN-3). The NGFW under test sees VXLAN-encapsulated traffic on TRUST side; the agents themselves don't speak VXLAN — the front-end handles encap/decap.

Used for NGFW VTEP-handling validation (does the NGFW correctly inspect VXLAN-inner traffic? Does it decap before inspection? What's the throughput cost of VXLAN inspection vs raw L2?).

Identity

Element	Value
Plane	DATA
Internal code	vyos-vtep-{playwright,k6,mac-arp}
K8s namespace	web-agents
OOBI slot	n/a (data-plane only)
VNI	per-MÓDULO (VXLAN-1 = 10020, VXLAN-2 = 10030, VXLAN-3 = 12900)

Dependencies

• VyOS + FRR (VTEP support)
• Multus + macvlan for underlay + overlay attachments

Operator controls

• /admin/vxlan-vtep — toggle each VTEP independently, configure VNI
• Inner workload uses unchanged PW/K6/MAC-ARP agents

Key telemetry

• vxlan_packets_per_vni{vni, direction}
• vxlan_encap_drops_total (HER head-end replication health)
• vxlan_inner_throughput_bps{vni}

Notes

VXLAN.Art targets the TRUST side only — adding VXLAN to UNTRUST introduces external-Internet ambiguity that doesn't model real customer scenarios.

Related

• Memory: discuss_vxlan_vtep_trust_2026_05_09
• v4.10 target release