EVPN Introduction

EVPN Introduction
• Nurul Islam Roman, Optus, Australia

What is EVPN?
• Full form is Ethernet VPN
• Carry layer 2 traffic over (Overlay) a Layer 3 network (Underlay)
• In theory EVPN could use any data plane encapsulation method
• MPLS, VXLAN, MPLS-over-GRE/UDP etc
• In practise it is used with MPLS and VXLAN data plane encapsulation
so far.
• So EVPN is a control plane technology and data plane can be MPLS or
VXLAN

Traditional Network
• L2 Segmentation using VLAN
• Multiple VLAN on a switch
• One IP subnet for each VLAN
• SVI/Sub-if to do inter-VLAN routing

Challenges for New Demand
• Dot 1Q encap/Q-in-Q tunnel to
extend VLAN across multiple physical
Switches
• Redundant path is STP block
• Etherchannel to bundle multiple link
• No control plane to learn MAC
• Dataplane support MAC learning
(ARP)

Challenges for New Demand
• Expand L2 network across DC, Sites
or wider geographic region
• Can we extend the trunk link or is
this a practical solution?
• Current infrastructure is a routed
network and proven to be very
stable.
• Can a tunnelling technology address
these challenges?
• MAC address learning- Control Plane
• Data (Frame) forwarding- Data Plane

Do we already have a solution for these?
• Cisco FabricPath
• IETF TRILL (TRansparent
Interconnection of Lots of Links)
• Need a link state routing protocol
• VPWS/VPLS and so on
• BGP base to exchange label
• L2 MAC learning still data plane driven
• No large-scale deployment

VPLS (Martini & Kompella)Model
• Each tenant is represented by a VSI or similar
• Each VSI is an extended bridge domain within a
carrier MPLS network
• Full mesh VC tunnel among VSI
• MP-BGP l2-vpn address family control plane
protocol is to exchange VPN labels only
• Tunnel label and VC label
• MAC address learning is still
Flooding/Forwarding based
• Scaling issue for carrier network for large scale
deployment
• Bandwidth cost limiting the scale
• Need separate control plane protocol for L3
VPN

VPLS (Martini & Kompella)Model- Continue
• L2 and L3 VPN on different address
family
• VPNv4 AFI
• l2VPN AFI
• Client L2 and L3 gateways are not
integrated
• Gateway deployment design introduce
scalability issue for future growth
• Introduce new integrated control plane
protocol EVPN to address these
challenges

Will EVPN be a Replacement of Current L2
VPN Technologies?
• Current Layer 2 VPN technologies experiencing limitations
• VPWS, VPLS has scaling issues for large scale deployment
• Use dataplane forwarding to learn MAC address
• Routing services require separate config which sometime can cause hairpin
routing limitation
• Improved Network Efficiency
• No more data plane traffic to simulate ARP flooding instead use MP-BGP to
exchange MAC address via L3 underlay
• Integrated Layer 2/Layer 3 Functionality introducing IRB

Will EVPN be an Open Standard?
• There are a number of RFC covers EVPN technology
• BGP based widely used EVPN RFC is RFC7432
• A number of vendors started implementing EVPN since the early
stage of the RFC process.
• E.g. draft-ietf-l2vpn-evpn stage
• Juniper QFX, MX and EX product range
• Cisco Nexus product range
• Interoperability among the vendors are still a challenge

VxLAN Data Plane Encapsulation Protocol
• VXLAN - Virtual eXtensible Local Area Network
• VNI - VXLAN Network Identifier
• VXLAN Segment ID 24bit will map to VLAN ID
• VTEP -VXLAN Tunnel End Point
• A device (E.G. a PE) originates and/or terminates
VXLAN tunnels
• VXLAN Segment
• VXLAN Layer 2 overlay network span across VTEP
• VXLAN Gateway
• L2: Forward L2 traffic across same VLANs on VTEP
• L3: Forward L3 traffic between different VLAN on
VTEP

VxLAN Data Plane- Inside VxLAN Header
• 64 bit length
• VNI 24 bit
• I flag bit is set to 1
for valid VNI
• R flag is reserved
and need to be 0

VXLAN End Host Discovery
• Option 1: Flood & Learn
• Similar to VPLS, the original implementation
of VxLAN relies on the data plane flood and
learn discovery scheme.
• Option 2: Separate Control Plane Learning
• To address the scalability concern of flood and
learn discovery, other controller-less control
plane discovery scheme such BGP EVPN and
OVSDB have been defined by IETF
• Other SDN controller-based discovery scheme
such as Cisco APIC or Juniper Contrail is an
example.

EVPN Data Plane Encapsulation Options

MPLS Label for Data Plane Encapsulation
• Probably be a topic for future
bdNOG tutorial/Workshop

BGP EVPN Building Blocks
• EVPN – Ethernet VPN
• EVI -EVPN Instance
• Span customer EVPN across PE devices
• MAC-VRF
• Virtual Routing and Forwarding table for
MAC addresses on a PE
• IP-VRF
• Virtual Routing and Forwarding table for IP
addresses on a PE
• ES -Ethernet Segment
• Multihome customer site via a set of
Ethernet links
• DF –Designated Forwarder

BGP EVPN Building Blocks- Continue
• VTEP -VXLAN Tunnel End Point
• A device (E.G. a PE) originates
and/or terminates VXLAN tunnels
• NVE -Network Virtualization Edges
• Tunnel interface for VTEP
• NVGRE -Network Virtualization
using Generic Routing
Encapsulation

Overlay and Underlay Network
• Underlay
• The underlay is the Layer 3 IP network
that routes encapsulated frame/packet
as normal IP traffic
• Overlay
• An overlay network is a service built on
top of a physical network. It decouples
network services from the underlaying
infrastructure by further encapsulation
of packet/frame inside another packet

BUM Traffic
• Broadcast
• Unknown Unicast
• Multicast
• Two way to facilitate host MAC address
learning
• Flood & learn
• BGP EVPN control plane

BUM Traffic
• Flood and learn is old way
• BGP EVPN is new way
• Facilitate only for known MAC
• BUM traffic steel need a solution
• IP Multicast underlay. L2 VNI mapped to IP
multicast group. VTEP send PIM join/prune
message
• Enable Ingress Replication (IR) or Head-End
Replication (HER). Ingress router build as a flood
list to forward BUM traffic to all remote VTEP
(Recently introduced)

EVPN Service Model
• EVPN service model or deployment scenarios specifies 3 ways VLAN-to-
VNI Mapping can be achieved
1. VLAN-Based Service Interface
2. VLAN Bundle Service Interface / Port-Based Service Interface
3. VLAN-Aware Bundle Service Interface
• Most vendors however, only support option 1 and 3 from the list above

EVPN Service Model
1. VLAN-Based Service Interface
• Has a one-to-one mapping between a VLAN ID on the interface and a MAC-VRF
• EVPN instance consists of only a single broadcast domain.
2. VLAN Bundle Service Interface
• Has a many-to-one mapping between VLANs and a MAC-VRF, and the MAC-VRF consists of a single bridge
table.
• EVPN instance corresponds to multiple broadcast domains
3. VLAN-Aware Bundle Service Interface
• EVPN instance consists of multiple broadcast domains with
• Each VLAN having its own bridge table.

EVPN Route Types 1
• Known as Ethernet Auto-Discovery
Route
• Used for remote VTEP auto discovery
• Used for advertising split-horizon label
• Provides fast convergence through
mass withdrawal
• An Ethernet Tag ID is a 32-bit field
containing either a 12-bit or 24-bit
identifier
• Identifies a particular broadcast domain
for instance VLAN in an EVPN instance.

EVPN Route Types 2
• Known as MAC/IP advertisement route
• Used to provides end-host reachability
information

EVPN Route Types 3
• Known as Inclusive Multicast Ethernet
Tag (IMET) route
• Used to create the distribution list for
ingress replication
• Used to set up paths for BUM traffic
per VLAN per EVI basis
• Used to discover the multicast tunnels
among the endpoints associated with a
given EVI

EVPN Route Types 4
• Known as Ethernet segment Route
• Used for Ethernet Segment auto-
discovery by allowing VNE with the
same ESI to discover each other
• It allows for designated forwarder (DF)
election

EVPN Route Types 5
• Known as IP Prefix Route
• Used to decouple IP Prefix from
MAC/IP route to provide IP prefix
advertisement

Distributed Anycast Gateway
• Gateway is closer to the end-hosts
• Eliminate traffic hair pinning and
unnecessary traffic backhauling to
centralized gateway
• Uses Anycast Gateway MAC (AGM)
address to prevent traffic block-holed
resulting from MAC mobility

Ethernet Segment Identifier (ESI) LAG
• Gateway is closer to the end-hosts
• Eliminate traffic hair pinning and
unnecessary traffic backhauling to
centralized gateway
• Use an Ethernet Segment Identifier to
tag the MAC on local interface
• Uses Anycast Gateway MAC (AGM)
address to prevent traffic block-holed
resulting from MAC mobility

Integrated Routing and Bridging (IRB)
• (IRB) allows the device in an EVPN to
perform both bridging and routing on
single bridge domain.
• Bridge domain performs bridging when
it forwards traffic to the same subnet &
VLAN
• Bridge Domain Interface performs
routing when it forwards traffic to a
different subnet & VLAN

Integrated Routing and Bridging (IRB)
• Two Types of IRB Operation
• Asymmetric IRB- via L2 VRF
• Symmetric IRB- via L3 VRF by exchanging routes

Hands on
• Lets do a quick LAB demo

Lab Topology
• Two Spine
• Two Leaves
• Four Host
• Two VLANs
• VLAN 10
• VLAN 20
• Two Subnets
• VLAN 10: 10.10.1.0/24
• VLAN 20: 10.20.1.0/24

Underlay Config
• Interface
interface eth1/1
no switchport
ip unnumbered loop0
mtu 9216
no shut
interface eth1/2
no switchport
ip unnumbered loop0
mtu 9216
no shut
interface loopback 0
description *** VTEP ***
ip address 192.168.0.1/32

Underlay Config
• OSPF
router ospf OSPF_UNDERLAY
log-adjacency-change
ip router ospf
OSPF_UNDERLAY area 0.0.0.0
interface ethernet1/1-2
medium p2p
ip router ospf
OSPF_UNDERLAY area 0.0.0.0

Underlay Config
• Forward BUM Traffic using IP Multicast (PIM)
int loopback 1
ip address 1.2.3.4/32
ip router ospf OSPF_UNDERLAY area
0.0.0.0
ip pim sparse-mode
ip pim rp-address 1.2.3.4 group-list
224.0.0.0/4
ip pim ssm range 232.0.0.0/8
ip pim anycast-rp 1.2.3.4 192.168.0.1
ip pim anycast-rp 1.2.3.4 192.168.0.2
ip pim sparse-mode
interface e1/1-2
ip pim sparse-mode

Overlay Config- L2 VPN
• Spine to be used for overlay RR only
router bgp 64520
log-neighbor-changes
address-family ipv4 unicast
address-family l2vpn evpn
retain route-target all
template peer VXLAN_OVERLAY
remote-as 64520
update-source loop0
send-community extended
route-reflector-client
soft-reconfiguration inbound
send-community
route-reflector-client
neighbor 192.168.0.3
inherit peer VXLAN_OVERLAY
inherit peer VXLAN_OVERLAY

Overlay Config- Leaf Contain Main EVPN Config
• Enable VTEP Interface
Interface nve1
no shut
host-reachability
protocol bgp
source-interface loop0
sh interface nve1
(Verify)

• Verify VTEP Interface
Leaf-1# sh interface nve 1
nve1 is up
admin state is up, Hardware: NVE
MTU 9216 bytes
Encapsulation VXLAN
Auto-mdix is turned off
RX
ucast: 0 pkts, 0 bytes - mcast: 0 pkts, 0 bytes
TX
ucast: 0 pkts, 0 bytes - mcast: 0 pkts, 0 bytes

• BGP EVPN Config
router bgp 64520
log-neighbor-changes
address-family ipv4
unicast
retain route-target all
template peer
VXLAN_RR_OVERLAY
remote-as 64520
update-source loop0

• BGP EVPN Config
soft-reconfiguration
inbound
send-community
inherit peer VXLAN_RR_OVERLAY
inherit peer VXLAN_RR_OVERLAY

• Verify BGP EVPN Signalling Status
Leaf-1# sh bgp ipv4 uni nei 192.168.0.1 | inc "Address
family L2VPN EVPN"
Address family L2VPN EVPN: advertised received
Leaf-1# sh bgp ipv4 uni nei 192.168.0.2 | inc "Address
family L2VPN EVPN"
Address family L2VPN EVPN: advertised received

Anycast Gateway
• Configuration & Verification
hardware access-list tcam region arp-ether 256
fabric forwarding anycast-gateway-mac 0000.0011.1234
Leaf-1# show fabric forwarding internal topo-info |
grep Anycast
Forward Mode : Anycast Gateway
Forward Mode : Anycast Gateway

Switch VLAN & VxLAN Related Config
• Required VLAN and VNI Map
vlan 10
vn-segment 100010
vlan 20
vn-segment 100020

• L2 Gateway
interface vlan10
no shutdown
ip address 10.10.1.254/24
fabric forwarding mode
anycast-gateway
interface vlan20
no shutdown
ip address 10.20.1.254/24
anycast-gateway

• L2 VRF/MAC VRF
evpn
vni 100010 l2
rd auto
route-target import auto
route-target export auto
evpn
vni 100020 l2
rd auto
route-target import auto
route-target export auto

• Access port config
interface e1/7
switchport mode access
switchport access vlan 10
no shut
interface e1/6
switchport mode access
switchport access vlan 20
no shut

• Verify L2VRF table for each VNI
Leaf-1# show bgp l2vpn evpn vni-id 100010
[*** Snip ***]
Network Next Hop Metric LocPrf Weight
Path
Route Distinguisher: 192.168.0.3:32777 (L2VNI 100010)
*>l[2]:[0]:[0]:[48]:[0050.7966.6805]:[0]:[0.0.0.0]/216
192.168.0.3 100 32768 i
*>i[2]:[0]:[0]:[48]:[0050.7966.6807]:[0]:[0.0.0.0]/216
192.168.0.4 100 0 i
*>l[2]:[0]:[0]:[48]:[0050.7966.6805]:[32]:[10.10.1.1]/272
192.168.0.3 100 32768 i
*>i[2]:[0]:[0]:[48]:[0050.7966.6807]:[32]:[10.10.1.2]/272
192.168.0.4 100 0 i

[*** Snip ***]
Network Next Hop Metric LocPrf Weight
Path
*>l[2]:[0]:[0]:[48]:[0050.7966.6806]:[0]:[0.0.0.0]/216
192.168.0.3 100 32768 i
*>i[2]:[0]:[0]:[48]:[0050.7966.6808]:[0]:[0.0.0.0]/216
192.168.0.4 100 0 i
*>l[2]:[0]:[0]:[48]:[0050.7966.6806]:[32]:[10.20.1.1]/272
192.168.0.3 100 32768 i
*>i[2]:[0]:[0]:[48]:[0050.7966.6808]:[32]:[10.20.1.2]/272
192.168.0.4 100 0 i

• Verify MAC VRF Table
Leaf-1# sh system internal l2fwder mac
[*** Snip ***]
VLAN MAC Address Type age Secure NTFY Ports
---------+-----------------+--------+---------+------+----+------------------
* 20 0050.7966.6808 static - F F (0x47000001) nve-peer1
192.168
* 10 0050.7966.6805 dynamic 00:00:26 F F Eth1/7
G 20 5001.0003.0007 static - F F sup-eth1(R)
* 20 0050.7966.6806 dynamic 00:03:56 F F Eth1/6
192.168
1 1 -00:00:00:11:12:34 - 1

• Verify MAC VRF Table
Leaf-2# sh system internal l2fwder mac
[*** Snip ***]
VLAN MAC Address Type age Secure NTFY Ports
---------+-----------------+--------+---------+------+----+------------------
* 20 0050.7966.6808 dynamic 00:04:57 F F Eth1/6
192.168
192.168
* 10 0050.7966.6807 dynamic 00:00:55 F F Eth1/7
1 1 -00:00:00:11:12:34 - 1

• L3 gateway VLAN & VNI
VLAN 555
vn-segment 500555

• L3 VRF config
vrf context CUST1
vni 500555
rd auto
address-family ipv4
unicast
route-target both auto
route-target both auto
evpn

• IRB Interface config
interface vlan 555
no shutdown
vrf member CUST1
ip forward

• Allow L3 VNI through the VTEP
interface nve1
member vni 500555
associate-vrf

• BGP config VRF context
router bgp 64520
vrf CUST1
log-neighbor-change
address-family ipv4
unicast
network 10.10.1.0/24
network 10.20.1.0/24
advertise l2vpn evpn

• Assign anycast GW to L3 VRF
interface vlan10
vrf member CUST1
ip address 10.10.1.254/24
anycast-gateway
interface vlan20
vrf member CUST1
ip address 10.20.1.254/24
anycast-gateway

Config Verification- L3 VPN
[Snip]
Network Next Hop Metric LocPrf Weight Path
*>i[2]:[0]:[0]:[48]:[0050.7966.6807]:[32]:[10.10.1.2]/272
192.168.0.4 100 0 i
*>i[2]:[0]:[0]:[48]:[0050.7966.6808]:[32]:[10.20.1.2]/272
192.168.0.4 100 0 i
* i[5]:[0]:[0]:[24]:[10.10.1.0]:[0.0.0.0]/224
192.168.0.4 100 0 i
*>l 192.168.0.3 100 32768 i
* i[5]:[0]:[0]:[24]:[10.20.1.0]:[0.0.0.0]/224
192.168.0.4 100 0 i
*>l 192.168.0.3 100 32768 i

Config Verification- L3 VPN
[Snip]
Network Next Hop Metric LocPrf Weight Path
*>i[2]:[0]:[0]:[48]:[0050.7966.6805]:[32]:[10.10.1.1]/272
192.168.0.3 100 0 i
*>i[2]:[0]:[0]:[48]:[0050.7966.6806]:[32]:[10.20.1.1]/272
192.168.0.3 100 0 i
*>l[5]:[0]:[0]:[24]:[10.10.1.0]:[0.0.0.0]/224
192.168.0.4 100 32768 i
* i 192.168.0.3 100 0 i
*>l[5]:[0]:[0]:[24]:[10.20.1.0]:[0.0.0.0]/224
192.168.0.4 100 32768 i
* i 192.168.0.3 100 0 i

Hands on
• L3 VPN Juniper vQFX10K

Juniper vQFX10K- Config
• Underlay (Spine Interface)
set interfaces lo0 unit 0 description "*** SPINE LOOPBACK ***"
set interfaces lo0 unit 0 family inet address 172.16.0.1/32
set interfaces xe-0/0/0 mtu 9216
set interfaces xe-0/0/0 unit 0 description "SPINE-1-LEAF-1***"
set interfaces xe-0/0/0 unit 0 family inet address
192.168.0.1/30
set interfaces xe-0/0/1 unit 0 family inet address
192.168.0.5/30

• Underlay (Spine OSPF)
set routing-options router-id 172.16.0.1
set protocols ospf area 0.0.0.0 interface lo0.0
passive
set protocols ospf area 0.0.0.0 interface xe-0/0/0.0
interface-type p2p
interface-type p2p

• Underlay (Leaf Interface)
• Leaf 1
set interfaces lo0 unit 0 description "*** VTEP NEXT-HOP ***"
set interfaces xe-0/0/0 unit 0 family inet address 192.168.0.2/30
• Leaf 2
set interfaces lo0 unit 0 description "*** VTEP NEXT-HOP ***"
set interfaces xe-0/0/0 unit 0 family inet address 192.168.0.6/30

• Underlay (Leaf OSPF)
• Leaf 1
set protocols ospf area 0.0.0.0 interface lo0.0 passive
set protocols ospf area 0.0.0.0 interface xe-0/0/0.0 interface-
type p2p
• Leaf 2
set protocols ospf area 0.0.0.0 interface lo0.0 passive
set protocols ospf area 0.0.0.0 interface xe-0/0/0.0 interface-
type p2p

• Overlay (Leaf BGP)
• Leaf 1
set protocols bgp group OVERLAY type internal
set protocols bgp group OVERLAY local-address 172.16.1.1
set protocols bgp group OVERLAY family evpn signaling
set protocols bgp group OVERLAY neighbor 172.16.1.2 description LEAF-2
set protocols bgp group OVERLAY neighbor 172.16.1.2 peer-as 65500
set protocols bgp group OVERLAY neighbor 172.16.1.2 local-as 65500
• Leaf 2
set protocols bgp group OVERLAY type internal
set protocols bgp group OVERLAY local-address 172.16.1.2
set protocols bgp group OVERLAY family evpn signaling
set protocols bgp group OVERLAY neighbor 172.16.1.1 description LEAF-2
set protocols bgp group OVERLAY neighbor 172.16.1.1 peer-as 65500
set protocols bgp group OVERLAY neighbor 172.16.1.1 local-as 65500

• Overlay (Leaf VxLAN Encap)
• Leaf 1
set protocols evpn encapsulation vxlan
set protocols evpn multicast-mode ingress-replication
• Leaf 2
set protocols evpn encapsulation vxlan
set protocols evpn multicast-mode ingress-replication

• Overlay (Leaf L3 VRF Config)
• Leaf 1
set routing-instances CUST_A instance-type vrf
set routing-instances CUST_A interface irb.100
set routing-instances CUST_A interface lo0.1
set routing-instances CUST_A route-distinguisher 172.16.1.1:5000
set routing-instances CUST_A vrf-target target:300:5000
set routing-instances CUST_A protocols evpn ip-prefix-routes advertise direct-nexthop
set routing-instances CUST_A protocols evpn ip-prefix-routes encapsulation vxlan
set routing-instances CUST_A protocols evpn ip-prefix-routes vni 5000
• Leaf 2
set routing-instances CUST_A instance-type vrf
set routing-instances CUST_A interface irb.400
set routing-instances CUST_A interface lo0.1
set routing-instances CUST_A route-distinguisher 172.16.1.2:5000
set routing-instances CUST_A vrf-target target:300:5000
set routing-instances CUST_A protocols evpn ip-prefix-routes advertise direct-nexthop
set routing-instances CUST_A protocols evpn ip-prefix-routes encapsulation vxlan
set routing-instances CUST_A protocols evpn ip-prefix-routes vni 5000

• Overlay (Leaf Switch Option Config)
• Leaf 1
set switch-options vtep-source-interface lo0.0
set switch-options route-distinguisher 172.16.1.1:1
set switch-options vrf-target target:7777:7777
• Leaf 2
set switch-options vtep-source-interface lo0.0
set switch-options route-distinguisher 172.16.1.2:1
set switch-options vrf-target target:7777:7777

• Overlay (Leaf VLAN to VNI Map Config)
• Leaf 1
set vlans v100 vlan-id 100
set vlans v100 l3-interface irb.100
set vlans v100 vxlan vni 10010
set vlans v100 vxlan ingress-node-replication
• Leaf 2
set vlans v400 vlan-id 400
set vlans v400 l3-interface irb.400
set vlans v400 vxlan vni 10040
set vlans v400 vxlan ingress-node-replication

• Overlay (Leaf Host Switchport Config)
• Leaf 1
set interfaces irb unit 100 family inet address
10.10.10.254/24
set interfaces xe-0/0/11 unit 0 family ethernet-
switching vlan members v100
• Leaf 2
set interfaces irb unit 400 family inet address
40.40.40.254/24
set interfaces xe-0/0/11 unit 0 family ethernet-
switching vlan members v400

EVPN Introduction

More Related Content

What's hot

Similar to EVPN Introduction

More from Bangladesh Network Operators Group

Recently uploaded

In this document

EVPN Introduction