Enabling VXLAN MAC flapping protection

If your FortiGate with NP7 processors is terminating VXLAN-over-IPsec connections you may notice traffic drops during broadcast storms. One cause of the traffic drops could be VXLAN MAC flapping. VXLAN MAC flapping can occur when the FortiGate receives large numbers of packets that flip MAC addresses in the forwarding database (FDB) between local and remote paths. This activity can use excessive CPU resources and can lead to FDB instability.

You can use the following command to stop VXLAN MAC flapping:

config system npu

set vxlan-mac-flapping-guard enable

end

When vxlan-mac-flapping-guard is enabled, each VXLAN FDB entry records the encapsulation direction when it is first learned and if a later packet tries to flip the same MAC to the opposite direction, the update is rejected. This behavior prevents VXLAN MAC flapping during loops or broadcast storms.

You can restore normal VXLAN FDB behavior by disabling this option.