L3 VPN

The L3 VPN Configuration feature lets network administrators create and manage L3 VPN bindings on SPB-capable switches. These bindings connect VRFs to SPB services for inter-site Layer 3 connectivity. It supports both IPv4 and IPv6 gateways.

Use the L3VPN screen to display information about all of the configured L3 VPN bindings across the organization. Refer to the troubleshooting section for solutions to your queries. This screen also allows you to create, edit, or delete L3 VPN configuration. To access the L3VPN screen, click on LAN > Advance > L3VPN under the “Configure” section of the OmniVista Cirrus Menu. The below screen appears:

Creating an L3 VPN

The Create L3VPN screen is used to create L3 VPN bindings across the organization on the selected devices. Click on Create L3VPN to access the Create L3 VPN screen.

Consider the following use cases while configuring L3 VPN bindings on the devices.

• Configure at least one SPB Service Profile before creating an L3 VPN binding. The system must ensure both the SPB service and the VRF are configured on the target device. If the device lacks an SPB service device config for the L3VPN's ISID, the system auto-creates the SPB Service device configuration record and marks its status as PENDING. The system auto-provisions them in this order:

  • VRF device configuration exists for this device and VRF.

  • If a VRF template exists but no device configuration, auto-create the device configuration using the template and push the VRF configuration to the device.

  • If neither VRF device configuration nor VRF template exists, the system auto-creates both and pushes the VRF configuration to the device.

• Target switch devices must be online (management connectivity ON) to receive configuration.

• If the SPB service does not exist on the device but the L3 VPN includes that SPB, and the SPB exists in OmniVista Cirrus, the polling service will find it by ISID and map it to the L3 VPN template.

• L3 VPN is fully supported from package version 6.6. If you use an earlier version, L3 VPN features may not work as expected. Upgrade to version 6.6 or later for full compatibility.

• An L3 VPN binding record in the system is uniquely identified by a composite key consisting of four fields: VRF ID, ISID, Gateway Type, and Org ID. The Gateway Type distinguishes between IPv4 and IPv6 bindings. This means a single logical L3VPN service (same VRF + same ISID) can have up to two separate binding records — one for IPv4 and one for IPv6. These are not duplicates; they are distinct records because the Gateway Type differs.

• The Omni Vista Agent on each switch polls L3 VPN data from three MIB tables: l3_vpn (SPB IPVPN Bind table), ala_iprm_import_isid (IPv4 import ISID), and ala_iprm_v6_import_isid (IPv6 import ISID). This polling is set under the l3_vpn.info group with a 60-minute polling interval.

  The "vrf": 1 flag enables VRF aware polling. Instead of polling these MIB tables once globally, the agent iterates over each VRF instance on the switch and polls the tables within each VRF context.

  When vrf: 1 is set, the agent discovers all VRF instances on the switch, then queries the configured MIB tables for each VRF. Each VRF's data is sent as a separate MQTT message to the topic OVNG/lan/l3_vpn_info.

  Each message includes a vrf Context field identifying the VRF the data belongs to. If vrf Context is null or absent, the data belongs to the "default" VRF (Global Routing Table context).

• When an L3 VPN poll message arrives with an empty data list for a vrf Context, check the database for existing L3VPN records matching the vrf Context name. If none are found, ignore the message; this indicates the VRF never had L3VPN bindings managed by OmniVista or was already cleaned up. If a match exists, the L3 VPN configuration was removed on the switch, but the OmniVista database still holds stale records. The backend should remove these L3 VPN assignments to synchronize the database with the switch state.

• If the user deletes both the L3 VPN and the VRF through OmniVista or directly on the switch, the above use case does not apply. The VRF feature's deletion handler triggers the cascade cleanup of associated L3 VPN records. This cleanup occurs in a separate code path during a subsequent processing cycle, not through the empty-poll-message logic described above.

• When creating an L3 VPN, the user assigns a gateway IP address to each L3 VPN. The user or switch may enter an IP address that does not exist as an IP interface on the target device. In this case, OmniVista automatically creates the IP interface using default values.

• When creating an L3VPN, bind it to a VRF. The system resolves the VRF in this priority order:

  • VRF ID is provided as the primary key.

  • VRF Name is provided if VRF ID is null or 0.

  • If VRF Name is given but neither ID nor name matches an existing VRF template, the system auto-creates a VRF template with default values.

  • If neither VRF Name nor VRF ID is defined, an error displays. L3 VPN can be created from device-discovered VRF names (via polling) even if the VRF template was not explicitly created in OmniVista Cirrus User Interface.

• The organization administrator can create, edit, and delete L3 VPN bindings. The administrator can assign and remove devices. Users with view-only rights can see L3 VPN data, including device configuration status, but cannot create, update, or delete configurations. The server validates all write operations regardless of client-side restrictions. Unauthorized requests return a 403 response.

The Create L3VPN screen provides the following step-by-step process for creating a L3VPN:

• Basic Information - Configures the VRF name, L3 VPN network address, subnet mask and the ISID.

• Switch Selection - Select the Switch or LAN devices from the available list to create a L3 VPN.

Complete the following sections of the Create L3VPN screen, then click on Create Button.

Basic Information

Complete the fields as described below for configuring basic information:

• VRF Name - Enter or select an existing VRF name. If you enter a name that does not exist, a new VRF is automatically created with default settings (Max profile, no VRRP).

• SPB ISID for L3VPN Tunnel - Select from the drop-down list the available SPB ISID number and the corresponding Service ID. You can click on the Create button to configure a new SPB service profile.

• L3VPN Network Address - Enter the gateway IP address for the L3VPN interface. (Both IPv4 and IPv6 formats are supported. The system auto-detects the address type).

• L3VPN Subnet Mask - Enter the Subnet mask address for the L3VPN interface. (Range= 3 to 128 for IPv6 addresses).

Switch Selection

Select the switch devices from the available list to receive the L3VPN configuration. You can select multiple target switch devices.

Once devices are selected, the Selected Devices table appears below, showing per-device configuration.

The following field values are displayed:

• Device Name - The name of the selected switch.

• Friendly Name - The name assigned to the device is derived from the Preferred Device Naming convention specified in the user preference settings. By default, the Friendly Name is set to IP Address (System Name).

• L3VPN Interface - The IP interface assigned to this device for the L3 VPN. The system auto-assigns incremented IP addresses based on the gateway address.

• Route Export - The export route-map name. (Default = all-routes)

• Route Import - Enable or disable route import for this device.

• VRF to IPVPN Binding - The binding relationship between the VRF, IP interface, and SPB service.

A Corresponding CLI Commands section at the bottom shows the exact commands that will be sent to each device. Click on Create tab to complete the configuration. The new L3 VPN appears in the list with status PENDING, updating to SUCCESS or FAIL as devices respond.

Editing an L3 VPN

Use one of the following methods to access the Edit L3VPN configuration screen:

• Select the profile to edit by clicking on the checkbox next to the profile, click on Actions, then select Edit from the drop-down menu.

• Click on the pencil icon under the “Actions” column next to the profile that you want to edit.

The following Edit L3VPN configuration screen displays. Edit the fields as described above, then click on Save.

Deleting an L3 VPN

To delete a L3 VPN configuration, use one of the following methods to select the L3 VPN you want to delete:

• Select the name to delete by clicking on the checkbox next to the list, click on Actions, then select Delete from the drop-down menu.

• Click on the trash can icon under the “Actions” column next to the list that you want to delete.

The following confirmation prompt appears:

Click on Delete to proceed. The system removes the L3 VPN binding from all assigned devices.

Polling L3 VPN Data

The Poll Data button on the L3 VPN list page lets you manually refresh L3 VPN configuration data from all managed devices. This ensures the displayed data reflects the network's current state without waiting for the next automatic polling cycle.

To access Poll Data option, click on the tab as shown below:

The system retrieves the latest L3 VPN configuration from all managed switches. The L3VPN table updates with this information.

Viewing L3 VPN Bindings

The L3VPN List displays basic and detailed information for all configured L3 VPN bindings across the organization. Click on an entry in the list to view additional information about an l3 VPN binding.

The following information is displayed:

• VRF - The VRF instance associated with this L3 VPN binding.

• SPB ISID for L3VPN Tunnel - The SPB service ISID used for the L3 VPN tunnel. If the corresponding Service Profile is not found, a warning indicator is displayed.

• Assigned Devices - The switch devices where this L3 VPN is configured, grouped by site.

• L3 VPN Network Address - The gateway IP address of the L3 VPN interface.

• Subnet Mask - The subnet mask (IPv4) or prefix length (IPv6) for the gateway interface.

• Gateway Type - Specifies the type of Gateway. (IPv4 or IPv6).

• Config Status - The provisioning status of the binding on assigned devices.

Display Assigned Device Configuration Details

The L3VPN Profile List displays information for the configured L3 VPN Profiles. You can click on the entry Name to view the assigned device configuration details of a specific profile as shown below.

The following screen appears:

The following information is displayed for each of the L3 VPN Profile:

• Device Friendly Name - The name assigned to the device is derived from the Preferred Device Naming convention specified in the user preference settings. By default, the Friendly Name is set to IP Address (System Name).

• Config Status - The configuration status of the device. (Successful or Failed or Pending).

  • Pending - The configuration is being pushed to the device and is still not receiving a response from the device.

  • Failed - The configuration failed to apply to the device. Possible reasons include a timeout while applying the configuration due to the device being unreachable or a network issue, or the configuration being invalid and rejected by the device. Check alerts to identify the specific reason.

  • Successful - The configuration is pushed to the device successfully.

• L3VPN Interface - The IP interface assigned to this device for the L3 VPN.

• VRF to IPVPN Binding - Displays the binding relationship between the VRF, IP interface, and SPB service.

• Route Import - Displays route import for this device. (enabled or disabled).

Troubleshooting/FAQs

The Create button is disabled on the L3 VPN form.

Consider the following steps while creating the L3 VPN Binding:

• Entered VRF name is valid.

• ISID is selected from the dropdown.

• Gateway IP Address is a valid IPv4 or IPv6 address.

• Subnet Mask (IPv4) or Prefix Length (IPv6) is valid.

• All selected devices have an L3 VPN Interface configured.

A warning icon appears next to the SPB ISID column in the L3 VPN list.

This means the Service Profile for the ISID was not found. The SPB service may have been deleted or is not synchronized. Click Poll Data to refresh or check that the SPB Service Profile exists.

Device shows offline warning in edit mode.

When a device's management connectivity is off, its configuration row locks. The device cannot receive new commands until it reconnects. A banner at the top of the Switch Selection section shows which devices are offline.

The configuration status shows FAIL after creating an L3 VPN.

The device did not respond within the expected timeout window due to following reasons:

• The device is unreachable or overloaded.

• The device does not support the requested configuration (check firmware version).

• A conflicting configuration already exists on the device.

Try removing the failed device assignment and re-adding it. If the issue persists, verify device connectivity and firmware compatibility.

I see "Invalid subnet mask" or "Invalid prefix length" notification.

For IPv4: The subnet mask must be in valid dotted-decimal format (e.g., 255.255.255.0).

For IPv6: The prefix length must be a whole number between 3 and 128.

IPv6 is not valid when sent from User Interface to device.

When the user configures an IPv6 address via the User Interface screen and sends it to the device, the device may reject the request and return an "invalid IPv6" error response. Some of the IPv6 formats accepted by the User Interface are not recognized as valid by the device firmware, causing the device to reject the configuration.