VXLAN is the default and recommended overlay encapsulation protocol in Contrail Networking. It’s widely supported, uses standard UDP ports, provides a 24-bit segment ID (VNI) for massive scale, and offers good performance in software and hardware. While MPLS over GRE is supported, VXLAN is the typical choice for new deployments.

The Contrail Analytics Node collects and correlates flow data, routing tables, and events from all components. Using tools like `contrail-logs` or the Analytics UI, you can trace a flow’s path, see which routing rules were applied, and identify where the packet was dropped or misrouted between virtual networks.

Network Policies in Contrail are the fundamental construct for defining and enforcing connectivity rules between resources (like virtual networks). They operate at the abstraction level of ‘from this network, to that network, allow this protocol/port.’ They are applied before security groups and are the key tool for implementing intent-based segmentation between projects or applications.

In the integrated OpenStack-Contrail model, the user interacts with the OpenStack API (or Horizon dashboard). Creating a network in OpenStack triggers the Contrail plugin to create the corresponding virtual network object in the Contrail Controller. The subnet is then created within that OpenStack network, and Contrail manages the associated IP Address Management (IPAM).

Contrail uses IP Address Management (IPAM) blocks to define the pools of addresses for virtual networks. Even if the VN is conceptually dual-stack, if the associated IPAM wasn’t configured with an IPv6 subnet or block, the vRouters will not have the necessary IPv6 addressing or routing information programmed, causing IPv6 traffic to fail.

The ‘Network Operator’ role provides read-only access to network-related data and analytics across the entire deployment. This includes viewing topology, monitoring flows, and checking configurations without the permission to create, modify, or delete any objects, making it ideal for NOC personnel or auditors.

The Contrail Control Plane is designed for high availability. vRouters maintain established forwarding paths in their kernel tables. While the Configuration node is down, existing flows continue to forward (data plane). However, new flow setups, routing updates, or API requests that require the config node will fail until it’s restored or another node in the cluster takes over its functions.

The recommended Contrail pattern for tiered applications is to place each tier in its own virtual network (for clear isolation). You then define Contrail Network Policies that explicitly state the permitted communication paths: e.g., ‘from Web-VN to App-VN, allow TCP 8080’ and ‘from App-VN to DB-VN, allow TCP 3306’. This creates a clear, auditable, and enforceable intent-based policy map.

The Contrail Controller cluster includes a BGP speaker function. It peers with physical network devices (Top-of-Rack switches, core routers, etc.). It learns external routes and advertises the overlay network routes (via the vRouters) to the physical network, enabling seamless L3 connectivity between virtual and physical workloads.

VXLAN is the default and recommended overlay encapsulation protocol in Contrail Networking. It’s widely supported, uses standard UDP ports, provides a 24-bit segment ID (VNI) for massive scale, and offers good performance in software and hardware. While MPLS over GRE is supported, VXLAN is the typical choice for new deployments.0