Geneve

  GENEVE (Generic Network Virtualization Encapsulation)

GENEVE encapsulated packets are designed to be transmitted via standard networking equipment. Packets are sent from one tunnel endpoint to one or more tunnel endpoints using either unicast or multicast addressing.

Applications generate identical IP packets as if they were communicating via hardware switches and routers. The destination IP address included in the packet is significant only within the cloud tenant's virtual network. The tunnel endpoint then encapsulates the end-user IP packet in the GENEVE header, adding the tunnel identifier specifying the tenant's virtual network followed by any options. The header consists of fields specifying that it is a GENEVE packet, the overall length of the options if any, the tunnel identifier and the series of options. The completed packet is then transmitted to the destination endpoint in a standard UDP packet which is supported via IPv4 and IPv6. The receiving tunnel endpoint strips off the header, interprets any included options and directs the end-user packet to its destination within the virtual network indicated by the tunnel identifier.

GENEVE tunnel endpoints will communicate only with each other and packets are handled by the network infrastructure identically to any other UDP packet.

=====

On FTD

Geneve is an encapsulation network protocol similar to Virtual eXtensible Local Area Network (VXLAN).

The FTDv supports Amazon Web Services (AWS) Gateway Load Balancer, which combines a transparent network gateway (that is, a single entry and exit point for all traffic) and a load balancer that distributes traffic and scales the virtual appliances such as the FTDv with the demand.

The FTDv deployed on AWS platform supports only the single-arm proxy mode.

Geneve has a flexible inner header that is not limited to the MAC address. Geneve encapsulation is required for transparent routing of packets between an Amazon Web Services (AWS) Gateway Load Balancer and appliances, and for sending extra information

VXLAN tunnel endpoint (VTEP) devices perform VXLAN encapsulation and decapsulation. Each VTEP has two interface types: one or more virtual interfaces called VXLAN Network Identifier (VNI) interfaces to which you apply your security policy, and a regular interface called the VTEP source interface that tunnels the VNI interfaces between VTEPs. The VTEP source interface is attached to the transport IP network for VTEP-to-VTEP communication. The destination port for Geneve is 6081.

The VTEP source interface is a regular interface with which you plan to associate all VNI interfaces. You can configure one VTEP source interface per FTDv.

The VTEP source interface can be devoted wholly to Geneve traffic, although it is not restricted to that use. If desired, you can use the interface for regular traffic and apply a security policy to the interface for that traffic. For Geneve traffic, however, all security policy must be applied to the VNI interfaces. The VTEP interface serves as a physical port only.