2. Computers & electronics
  3. Networking
  4. Aruba
  5. EVPN

Aruba EVPN Configuration Guide

  • Hello! I'm here to assist you with information about the HPE FlexFabric 5940 and 5930 Switch Series EVPN Configuration Guide. This document provides extensive details on configuring EVPN using VXLAN and MP-BGP, covering features such as centralized and distributed gateway options, multihoming, multicast, ARP flood suppression and MAC mobility. I have read through the document and can answer your questions about how to set up and use these switches.
  • What is EVPN?
    What is a VTEP?
    What is the purpose of the L3 VXLAN ID in distributed EVPN gateway deployment?
HPE FlexFabric 5940 & 5930 Switch Series
EVPN Configuration Guide
P
art number: 5200-4858c
Software
version: Release 2609 and later
Document version: 6W103-20200310
© Copyright 2020 Hewlett Packard Enterprise Development LP
The information contained herein is subject to change without notice. The only warranties for Hewlett Packard
Enterprise products and services are set forth in the express warranty statements accompanying such
products and services. Nothing herein should be construed as constituting an additional warranty. Hewlett
Packard Enterprise shall not be liable for technical or editorial errors or omissions contained herein.
Confidential computer software. Valid license from Hewlett Packard Enterprise required for possession, use, or
copying. Consistent with FAR 12.211 and 12.212, Commercial Computer Software, Computer Software
Documentation, and Technical Data for Commercial Items are licensed to the U.S. Government under vendor’s
standard commercial license.
Links to third-party websites take you outside the Hewlett Packard Enterprise website. Hewlett Packard
Enterprise has no control over and is not responsible for information outside the Hewlett Packard Enterprise
website.
Acknowledgments
Intel®, Itanium®, Pentium®, Intel Inside®, and the Intel Inside logo are trademarks of Intel Corporation in the
United States and other countries.
Microsoft® and Windows® are either registered trademarks or trademarks of Microsoft Corporation in the
United States and/or other countries.
Adobe® and Acrobat® are trademarks of Adobe Systems Incorporated.
Java and Oracle are registered trademarks of Oracle and/or its affiliates.
UNIX® is a registered trademark of The Open Group.
i
Contents
EVPN overview ······························································································ 1
EVPN network model ········································································································································· 1
Layered transport network ································································································································· 2
MP-BGP extension for EVPN····························································································································· 2
Configuration automation ··································································································································· 3
Assignment of traffic to VXLANs ························································································································ 3
Traffic from the local site to a remote site ·································································································· 3
Traffic from a remote site to the local site ·································································································· 4
Layer 2 forwarding ············································································································································· 4
MAC learning ············································································································································· 4
Unicast ······················································································································································· 4
Flood ·························································································································································· 6
Layer 3 forwarding ············································································································································· 6
Centralized EVPN gateway deployment ···································································································· 7
Distributed EVPN gateway deployment ····································································································· 7
RD and route target selection of BGP EVPN routes ························································································ 11
EVPN multihoming ··········································································································································· 12
Overview ·················································································································································· 12
DF election ··············································································································································· 13
Split horizon ············································································································································· 13
Redundancy mode ··································································································································· 14
IP aliasing ················································································································································· 14
EVPN multicast ················································································································································ 14
Multicast in single-homed sites ················································································································ 15
Multicast in multihomed sites ··················································································································· 15
ARP flood suppression····································································································································· 16
MAC mobility ···················································································································································· 17
EVPN distributed relay ····································································································································· 18
Configuring EVPN························································································ 20
Feature and hardware compatibility ················································································································· 20
Configuration restrictions and guidelines ········································································································· 20
VXLAN tunnel configuration restrictions and guidelines ·········································································· 20
EVPN gateway configuration restrictions and guidelines ········································································· 20
EVPN configuration task list ····························································································································· 21
Setting the VXLAN hardware resource mode ·································································································· 22
Overview ·················································································································································· 22
Configuration restrictions and guidelines ································································································· 22
Configuration procedure ··························································································································· 22
Creating a VXLAN on a VSI ····························································································································· 22
Configuring an EVPN instance ························································································································ 23
Configuring EVPN multihoming························································································································ 24
Configuration restrictions and guidelines ································································································· 24
Assigning an ESI to an interface ·············································································································· 24
Setting the DF election delay ··················································································································· 24
Disabling advertisement of EVPN multihoming routes············································································· 25
Configuring BGP to advertise BGP EVPN routes ···························································································· 25
Mapping ACs to a VSI ······································································································································ 27
Mapping a static Ethernet service instance to a VSI ················································································ 27
Mapping dynamic Ethernet service instances to VSIs ············································································· 28
Configuring a centralized EVPN gateway ········································································································ 29
Configuration restrictions and guidelines ································································································· 29
Configuration procedure ··························································································································· 29
Configuring a distributed EVPN gateway ········································································································· 30
Configuration restrictions and guidelines ································································································· 30
Configuration prerequisites ······················································································································ 30
Configuring a VSI interface ······················································································································ 30
ii
Configuring an L3 VXLAN ID for a VSI interface······················································································ 31
Configuring IP prefix route advertisement ································································································ 33
Disabling generation of IP prefix advertisement routes for the subnets of a VSI interface ······················ 34
Managing remote MAC address entries and remote ARP or ND learning ······················································· 35
Disabling remote MAC address learning and remote ARP or ND learning ·············································· 35
Disabling MAC address advertisement ···································································································· 35
Disabling learning of MAC addresses from ARP or ND information ························································ 36
Disabling ARP information advertisement ································································································ 36
Enabling conversational learning for forwarding entries ·················································································· 37
Overview ·················································································································································· 37
Configuration restrictions and guidelines ································································································· 37
Enabling conversational learning for remote MAC address entries ························································· 37
Enabling conversational learning for host route FIB entries····································································· 37
Enabling BGP EVPN route advertisement to the local site ·············································································· 38
Confining floods to the local site ······················································································································ 38
Enabling ARP flood suppression······················································································································ 39
Enabling packet statistics for automatically created VXLAN tunnels ······························································· 39
Configuring EVPN distributed relay ················································································································· 40
Overview ·················································································································································· 40
Configuration restrictions and guidelines ································································································· 40
Configuration prerequisites ······················································································································ 41
Configuration procedure ··························································································································· 41
Displaying and maintaining EVPN ··················································································································· 41
EVPN configuration examples ························································································································· 42
Centralized IPv4 EVPN gateway configuration example ········································································· 42
Distributed IPv4 EVPN gateway configuration example ·········································································· 51
Distributed IPv6 EVPN gateway configuration example ·········································································· 60
IPv4 EVPN distributed relay configuration example (Ethernet aggregate link as IPL) ····························· 71
IPv4 EVPN distributed relay configuration example (VXLAN tunnel as IPL) ··········································· 81
IPv4 EVPN multihoming configuration example ······················································································· 93
EVPN multicast configuration example ·································································································· 104
Configuring EVPN-DCI ·············································································· 112
Overview ························································································································································ 112
EVPN-DCI network model ······················································································································ 112
Working mechanisms ····························································································································· 112
EVPN-DCI dual-homing ························································································································· 112
Feature and hardware compatibility ··············································································································· 113
EVPN-DCI configuration task list ··················································································································· 113
Configuration prerequisites ···························································································································· 114
Enabling DCI ·················································································································································· 114
Enabling route nexthop replacement and route router MAC replacement ····················································· 114
Configuring VXLAN mapping ························································································································· 115
Overview ················································································································································ 115
Configuration restrictions and guidelines ······························································································· 116
Configuration procedure ························································································································· 116
Configuring EVPN-DCI dual-homing ·············································································································· 116
Overview ················································································································································ 116
Configuration restrictions and guidelines ······························································································· 116
Configuration procedure ························································································································· 116
EVPN-DCI configuration examples ················································································································ 117
Basic EVPN-DCI configuration example ································································································ 117
EVPN-DCI intermediate VXLAN mapping configuration example ························································· 122
EVPN-DCI IPv4 Layer 3 communication configuration example ··························································· 128
EVPN-DCI IPv6 Layer 3 communication configuration example ··························································· 134
EVPN-DCI dual-homing configuration example ····················································································· 141
Document conventions and icons ······························································ 152
Conventions ··················································································································································· 152
Network topology icons ·································································································································· 153
iii
Support and other resources ····································································· 154
Accessing Hewlett Packard Enterprise Support····························································································· 154
Accessing updates ········································································································································· 154
Websites ················································································································································ 155
Customer self repair ······························································································································· 155
Remote support ······································································································································ 155
Documentation feedback ······················································································································· 155
Index ·········································································································· 157
1
EVPN overview
Ethernet Virtual Private Network (EVPN) is a Layer 2 VPN technology that provides both Layer 2 and
Layer 3 connectivity between distant network sites across an IP network. EVPN uses MP-BGP in the
control plane and VXLAN in the data plane. EVPN is typically used in data centers for multitenant
services.
EVPN provides the following benefits:
•
Configuration automation—MP-BGP automates VTEP discovery, VXLAN tunnel
establishment, and VXLAN tunnel assignment to ease deployment.
•
Separation of the control plane and the data plane—EVPN uses MP-BGP to advertise host
reachability information in the control plane and uses VXLAN to forward traffic in the data plane.
•
Integrated routing and bridging (IRB)—MP-BGP advertises both Layer 2 and Layer 3 host
reachability information to provide optimal forwarding paths and minimize flooding.
EVPN network model
As shown in Figure 1, EVPN uses the VXLAN technology for traffic forwarding in the data plane. The
transport edge devices assign VMs to different VXLANs, and then forward traffic between sites for
VMs by using VXLAN tunnels. The transport edge devices are VXLAN tunnel endpoints (VTEPs).
They can be servers that host VMs or independent network devices.
A VTEP uses ESs, VSIs, and VXLAN tunnels to provide VXLAN services:
•
Ethernet segment (ES)—An ES is a link that connects a site to a VTEP. Each ES is uniquely
identified by an Ethernet segment identifier (ESI).
•
VSI—A virtual switch instance is a virtual Layer 2 switched domain. Each VSI provides
switching services only for one VXLAN. VSIs learn MAC addresses and forward frames
independently of one another. VMs in different sites have Layer 2 connectivity if they are in the
same VXLAN. A VXLAN is identified by a 24-bit VXLAN ID which is also called the virtual
network identifier (VNI). A VXLAN corresponds to an EVPN instance.
•
VXLAN tunnel—A VXLAN tunnel is a logical point-to-point tunnel between VTEPs over the
transport network. Each VXLAN tunnel can trunk multiple VXLANs.
All VXLAN processing is performed on VTEPs. The ingress VTEP encapsulates VXLAN traffic in the
VXLAN, outer UDP, and outer IP headers, and forwards the traffic through VXLAN tunnels. The
egress VTEP removes the VXLAN encapsulation and forwards the traffic to the destination.
Transport network devices (for example, the P device in Figure 1) forward VXLAN traffic only based
on the outer IP header of VXLAN packets.
2
Figure 1 EVPN network model
Layered transport network
As shown in Figure 2, typically the EVPN transport network uses a layered structure. On the
transport network, leaf nodes act as VTEPs to provide VXLAN services, and spine nodes perform
forwarding for VXLAN traffic based on the outer IP header. If all VTEPs and transport network
devices of an EVPN network belong to the same AS, the spine nodes can act as route reflectors
(RRs) to reflect routes between the VTEPs. In this scenario, the spine nodes advertise and receive
BGP EVPN routes, but do not perform VXLAN encapsulation and de-encapsulation.
Figure 2 Layered transport network
MP-BGP extension for EVPN
To support EVPN, MP-BGP introduces the EVPN subsequent address family under the L2VPN
address family and the following network layer reachability information (BGP EVPN routes):
•
Ethernet auto-discovery route—Advertises ES information in multihomed sites.
•
MAC/IP advertisement route—Advertises MAC reachability information and host route
information (host ARP or ND information).
VXLAN tunnel
VTEP
Server Server
Site 1 Site 2
VM
VM
VM
VSI/VXLAN 10
VSI/VXLAN 20
VSI/VXLAN 30
VM
VM
VM
VSI/VXLAN 10
VSI/VXLAN 20
VSI/VXLAN 30
Transport
network
P
ES ES
VTEP
VTEP
Server Server
Site 1 Site 2
Transport
network
VTEP
RR RR
Leaf
Spine
3
•
Inclusive multicast Ethernet tag (IMET) route—Advertises VTEP and VXLAN mappings for
automating VTEP discovery, VXLAN tunnel establishment, and VXLAN tunnel assignment.
•
Ethernet segment route—Advertises ES and VTEP mappings.
•
IP prefix advertisement route—Advertises BGP IPv4 or IPv6 unicast routes as IP prefixes.
•
Selective multicast Ethernet tag (SMET) route—Advertises IGMP multicast group
information among VTEPs in an EVPN network. A VTEP advertises an SMET route only when
receiving a membership report for an IGMP multicast group for the first time. The VTEP does
not advertise an SMET route if subsequent membership reports for the multicast group use the
same IGMP version as the first membership report.
•
IGMP join synch route—Advertises IGMP membership reports among redundant VTEPs for
an ES.
•
IGMP leave synch route—Advertises IGMP leave group messages for withdrawal of IGMP
join synch routes among redundant VTEPs for an ES.
MP-BGP uses the route distinguisher (RD) field to differentiate BGP EVPN routes of different
VXLANs and uses route targets to control the advertisement and acceptance of BGP EVPN routes.
MP-BGP supports the following types of route targets:
•
Export targets—A VTEP sets the export targets for BGP EVPN routes learned from the local
site before advertising them to remote VTEPs.
•
Import targets—A VTEP checks the export targets of BGP EVPN routes received from remote
VTEPs. The VTEP imports the BGP EVPN routes only when their export targets match the local
import targets.
Configuration automation
VTEPs use BGP EVPN routes to discover VTEP neighbors, establish VXLAN tunnels, and assign
the tunnels to VXLANs.
•
IMET route—VTEPs advertise their VXLAN IDs through IMET routes. If two VTEPs have the
same VXLAN ID, they automatically establish a VXLAN tunnel and assign the tunnel to the
VXLAN.
•
MAC/IP advertisement route and IP prefix advertisement route—In the EVPN gateway
deployment, VTEPs advertise MAC/IP advertisement routes or IP prefix advertisement routes
which carry export targets. When a VTEP receives a route, it compares the export targets of the
route with the local import targets. If the route targets match, the VTEP establishes a VXLAN
tunnel with the remote VTEP and associates the tunnel with the L3 VXLAN ID of the
corresponding VPN instance. For more information about the L3 VXLAN ID, see "Distributed
EVPN gateway deployment."
Assignment of traffic to VXLANs
Traffic from the local site to a remote site
The VTEP uses an Ethernet service instance to match customer traffic on a site-facing interface. The
VTEP assigns customer traffic to a VXLAN by mapping the Ethernet service instance to a VSI.
An Ethernet service instance is identical to an attachment circuit (AC) in L2VPN. An Ethernet service
instance matches a list of VLANs on a Layer 2 Ethernet interface by using a frame match criterion.
The frame match criterion specifies the characteristics of traffic from the VLANs, such as tagging
status and VLAN IDs.
As shown in Figure 3, Ethernet service instance 1 matches VLAN 2 and is mapped to VSI A (VXLAN
10). When a frame from VLAN 2 arrives, the VTEP assigns the frame to VXLAN 10 and looks up VSI
A's MAC address table for the outgoing interface.
4
Figure 3 Identifying traffic from the local site
Traffic from a remote site to the local site
When a VXLAN packet arrives at a VXLAN tunnel interface, the VTEP uses the VXLAN ID in the
packet to identify its VXLAN.
Layer 2 forwarding
MAC learning
The VTEP performs Layer 2 forwarding based on a VSI's MAC address table. The VTEP learns MAC
addresses by using the following methods:
•
Local MAC learning—The VTEP automatically learns the source MAC addresses of frames
sent from the local site. The outgoing interfaces of local MAC address entries are site-facing
interfaces on which the MAC addresses are learned.
•
Remote MAC learning—The VTEP uses MP-BGP to advertise local MAC reachability
information to remote sites and learn MAC reachability information from remote sites. The
outgoing interfaces of MAC address entries advertised from a remote site are VXLAN tunnel
interfaces.
Unicast
As shown in Figure 4, the VTEP performs typical Layer 2 forwarding for known unicast traffic within
the local site.
Server
Service instance 1:
VLAN 2 VSI A
VXLAN 10
VLAN 2
VM 1
VM 2
VM 3
Service instance 2:
VLAN 3
Service instance 3:
VLAN 4
VLAN 3
VLAN 4
VSI B
VXLAN 20
VSI C
VXLAN 30
VTEP
5
Figure 4 Intra-site unicast
As shown in Figure 5, the following process applies to a known unicast frame between sites:
1. The source VTEP encapsulates the Ethernet frame in the VXLAN/UDP/IP header.
In the outer IP header, the source IP address is the source VTEP's VXLAN tunnel source IP
address. The destination IP address is the VXLAN tunnel destination IP address.
2. The source VTEP forwards the encapsulated packet out of the outgoing VXLAN tunnel
interface found in the VSI's MAC address table.
3. The intermediate transport devices (P devices) forward the packet to the destination VTEP by
using the outer IP header.
4. The destination VTEP removes the headers on top of the inner Ethernet frame. It then performs
MAC address table lookup in the VXLAN's VSI to forward the frame out of the matching
outgoing interface.
Figure 5 Inter-site unicast
VXLAN tunnel
VTEP 1 VTEP 2
Transport
network
P
Server 1
VM 1
VM 2
VM 3
Server 3
VM 7
VM 8
VM 9
MAC table on VTEP 1
VXLAN/VSI MAC Interface
VXLAN 10/VSI A MAC 1Interface A, VLAN 2
VXLAN 10/VSI A MAC 4 Interface B, VLAN 3
Server 2
VM 4
VM 5
VM 6
Interface A
Interface B
VTEP 1 VTEP 2
Transport
network
P
Server 1
VM 1
VM 2
VM 3
Server 3
VM 7
VM 8
VM 9
MAC table on VTEP 1
VXLAN/VSI MAC Interface
VXLAN 10/VSI A MAC 1 Interface A, VLAN 2
VXLAN 10/VSI A MAC 7 Tunnel 1
Server 2
VM 4
VM 5
VM 6
Interface A
Interface B
MAC table on VTEP 2
VXLAN/VSI MAC Interface
VXLAN 10/VSI A MAC 1 Tunnel 1
VXLAN 10/VSI A MAC 7 Interface A, VLAN 3
Interface A
VXLAN tunnel 1
6
Flood
As shown in Figure 6, a VTEP floods a broadcast, multicast, or unknown unicast frame to all
site-facing interfaces and VXLAN tunnels in the VXLAN, except for the incoming interface. The
source VTEP replicates the flood frame, and then sends one replica to the destination IP address of
each VXLAN tunnel in the VXLAN. Each destination VTEP floods the inner Ethernet frame to all the
site-facing interfaces in the VXLAN. To avoid loops, the destination VTEPs do not flood the frame to
VXLAN tunnels.
Figure 6 Forwarding of flood traffic
Layer 3 forwarding
EVPN uses EVPN gateways to provide Layer 3 forwarding services for hosts in VXLANs. EVPN
provides the following EVPN gateway placement designs:
•
Centralized EVPN gateway deployment—Uses one VTEP to provide Layer 3 forwarding for
VXLANs. Typically, the gateway-collocated VTEP connects to other VTEPs and the external
network. To use this design, make sure the gateway has sufficient bandwidth and processing
capability.
•
Distributed EVPN gateway deployment—Deploys one EVPN gateway on each VTEP to
provide Layer 3 forwarding for VXLANs at their respective sites. This design distributes the
Layer 3 traffic load across VTEPs. However, its configuration is more complex than the
centralized EVPN gateway design.
In either design, the gateways use virtual Layer 3 VSI interfaces as gateway interfaces for VXLANs.
NOTE:
A
centralized EVPN gateway can provide services only for IPv4 sites. A
distributed EVPN gateway
can provide services for both IPv4 sites and IPv6 sites.
This section uses IPv4
sites as examples to
describe the Layer 3 forwarding process of EVPN networks.
VTEP 1 VTEP 2
Transport network
P
Server 1
VM 1
VM 2
VM 3
Server 3
VM 7
VM 8
VM 9
Server 2
VM 4
VM 5
VM 6
VXLAN tunnel
VXLAN tunnel
VTEP 3
VXLAN tunnel
Server 4
VM 10
VM 11
VM 12
Replicate and
encapsulate
7
Centralized EVPN gateway deployment
As shown in Figure 7, a VTEP acts as a gateway for VMs in the VXLANs. The VTEP both terminates
the VXLANs and performs Layer 3 forwarding for the VMs. The network uses the following process
to forward Layer 3 traffic from a VM to the destination:
1. The VM sends an ARP request to obtain the MAC address of the VSI interface that acts as the
gateway, and then sends the Layer 3 traffic to the centralized EVPN gateway.
2. The local VTEP looks up the matching VSI's MAC address table and forwards the traffic to the
centralized EVPN gateway through a VXLAN tunnel.
3. The centralized EVPN gateway removes the VXLAN encapsulation and forwards the traffic at
Layer 3.
4. The centralized EVPN gateway forwards the replies sent by the destination node to the VM
based on the ARP entry for the VM.
Figure 7 Example of centralized EVPN gateway deployment
Distributed EVPN gateway deployment
As shown in Figure 8, each site's VTEP acts as a gateway to perform Layer 3 forwarding for the
VXLANs of the local site. A VTEP acts as a border gateway to the Layer 3 network for the VXLANs.
VXLAN tunnel
VTEP 1 VTEP 2
Server Server
Site 1 Site 2
VM
VM
VM
VSI/VXLAN 10
VSI/VXLAN 20
VSI/VXLAN 30
VM
VM
VM
VSI/VXLAN 10
VSI/VXLAN 20
VSI/VXLAN 30
Transport
network
P
10.1.1.11
20.1.1.11
30.1.1.11
10.1.1.12
20.1.1.12
30.1.1.12
VXLAN tunnel
VXLAN tunnel
VTEP 3/Centralized EVPN gateway
VSI/VXLAN 10
VSI/VXLAN 20
VSI/VXLAN 30
VSI-interface10
10.1.1.1/24
VSI-interface20
20.1.1.1/24
VSI-interface30
30.1.1.1/24
L3 network
8
Figure 8 Distributed EVPN gateway placement design
Symmetric IRB
A distributed EVPN gateway uses symmetric IRB for Layer 3 forwarding, which means both the
ingress and egress gateways perform Layer 2 and Layer 3 lookups. Symmetric IRB introduces the
following concepts:
•
L3 VXLAN ID—Also called L3 VNI. An L3 VXLAN ID identifies the traffic of a routing domain
where devices have Layer 3 reachability. An L3 VXLAN ID is associated with one VPN instance.
Distributed EVPN gateways use VPN instances to isolate traffic of different services on VXLAN
tunnel interfaces.
•
Router MAC address—Each distributed EVPN gateway has a unique router MAC address
used for inter-gateway forwarding. The MAC addresses in the inner Ethernet header of VXLAN
packets are router MAC addresses of distributed EVPN gateways.
VSI interfaces
As shown in Figure 9, each distributed EVPN gateway has the following types of VSI interfaces:
•
VSI interface as a gateway interface of a VXLAN—The VSI interface acts as the gateway
interface for VMs in a VXLAN. The VSI interface is associated with a VSI and a VPN instance.
On different distributed EVPN gateways, the VSI interface of a VXLAN uses the same IP
address to provide services.
•
VSI interface associated with an L3 VXLAN ID—The VSI interface is associated with a VPN
instance and assigned an L3 VXLAN ID. VSI interfaces associated with the same VPN instance
share an L3 VXLAN ID.
A border gateway only has VSI interfaces that are associated with an L3 VXLAN ID.
9
Figure 9 Example of distributed EVPN gateway deployment
Layer 3 forwarding entry learning
A distributed EVPN gateway forwards Layer 3 traffic based on FIB entries generated from BGP
EVPN routes and ARP information.
A VTEP advertises an external route imported in the EVPN address family through MP-BGP. A
remote VTEP adds the route to the FIB table of a VPN instance based on the L3 VXLAN ID carried in
the route. In the FIB entry, the outgoing interface is the VXLAN tunnel interface where the route is
received, and the next hop is the peer VTEP address in the NEXT_HOP attribute of the route.
A VTEP has the following types of ARP information:
•
Local ARP information—ARP information of VMs in the local site. The VTEP snoops GARP
packets, RARP packets, and ARP requests for the gateway MAC address to learn the ARP
information of the senders and generates ARP entries and FIB entries. In an ARP or FIB entry,
the outgoing interface is the site-facing interface where the packet is received, and the VPN
instance is the instance associated with the corresponding VSI interface.
•
Remote ARP information—ARP information of VMs in remote sites. Each VTEP uses
MP-BGP to advertise its local ARP information with L3 VXLAN IDs in routes to remote sites. A
VTEP generates only FIB entries for the remote ARP information. A FIB entry contains the
following information:
Outgoing interface: VSI interface associated with the L3 VXLAN ID.
Next hop: Peer VTEP address in the NEXT_HOP attribute of the route.
VPN instance: VPN instance associated with the L3 VXLAN ID.
The VTEP then creates an ARP entry for the next hop in the FIB entry.
Traffic forwarding
A distributed EVPN gateway can work in one of the following mode:
VXLAN tunnel
GW 1 GW 2
Server Server
Site 1 Site 2
VM 1
VM 2
VSI/VXLAN 10
VSI/VXLAN 20
VM 4
VM 5
VSI/VXLAN 10
VSI/VXLAN 20
P
10.1.1.11
20.1.1.11
10.1.1.12
20.1.1.12
VXLAN tunnel
VXLAN tunnel
Border
gateway
L3 network
VSI-interface10
10.1.1.1/24
VPN instance: vpna
VSI-interface20
20.1.1.1/24
VPN instance: vpna
VSI-interface1
VPN instance: vpna
L3VNI: 1000
VSI-interface1
VPN instance: vpna
L3VNI: 1000
10
•
Switching and routing mode—Forwards Layer 2 traffic based on the MAC address table and
forwards Layer 3 traffic based on the FIB table. In this mode, you need to enable ARP flood
suppression on the distributed EVPN gateway to reduce flooding.
•
Routing mode— Forwards both Layer 2 and Layer 3 traffic based on the FIB table. In this
mode, you need to enable local proxy ARP on the distributed EVPN gateway.
For more information about MAC address table-based Layer 2 forwarding, see "Unicast."
Figure 10 shows the intra-site Layer 3 forwarding process.
1. The source VM sends an ARP request to obtain the MAC address of the destination VM.
2. The gateway replies to the source VM with the MAC address of the VSI interface associated
with the source VM's VSI.
3. The source VM sends a Layer 3 packet to the gateway.
4. The gateway looks up the FIB table of the VPN instance associated with the source VM's VSI
and finds the matching outgoing site-facing interface.
5. The gateway processes the Ethernet header of the Layer 3 packet as follows:
Replaces the destination MAC address with the destination VM's MAC address.
Replaces the source MAC address with the VSI interface's MAC address.
6. The gateway forwards the Layer 3 packet to the destination VM.
Figure 10 Intra-site Layer 3 forwarding
Figure 11 shows the inter-site Layer 3 forwarding process.
7. The source VM sends an ARP request to obtain the MAC address of the destination VM.
8. The gateway replies to the source VM with the MAC address of the VSI interface associated
with the source VM's VSI.
9. The source VM sends a Layer 3 packet to the gateway.
10. The gateway looks up the FIB table of the VPN instance associated with the source VM's VSI
and finds the matching outgoing VSI interface.
11. The gateway processes the Ethernet header of the Layer 3 packet as follows:
Replaces the destination MAC address with the destination gateway's router MAC address.
Replaces the source MAC address with its own router MAC address.
12. The gateway adds VXLAN encapsulation to the Layer 3 packet and forwards the packet to the
destination gateway. The encapsulated VXLAN ID is the L3 VXLAN ID of the corresponding
VPN instance.
13. The destination gateway identifies the VPN instance of the packet based on the L3 VXLAN ID
and removes the VXLAN encapsulation. Then the gateway forwards the packet based on the
matching ARP entry.
GW 1
DATA
Server 1
VM 1
IP 1
MAC 1
Server 2
VM 2
IP 2
MAC 2
GW IP
GW MAC (VSI interface MAC)
SIP: IP 1
DIP: IP 2
SMAC: MAC 1
DMAC: GW MAC
DATA
SIP: IP 1
DIP: IP 2
SMAC: GW MAC
DMAC: MAC 2
11
Figure 11 Inter-site Layer 3 forwarding
Communication between private and public networks
A distributed EVPN gateway uses the public instance to perform Layer 3 forwarding for the public
network and to enable communication between private and public networks. The public instance is
similar to a VPN instance. A distributed EVPN gateway processes traffic of the public instance in the
same way it does for a VPN instance. For the public instance to work correctly, you must configure
an RD, an L3 VXLAN ID, and route targets for it. If a VSI interface is not associated with any VPN
instance, the VSI interface belongs to the public instance.
RD and route target selection of BGP EVPN
routes
As shown in Table 1, you can configure RDs and route targets for BGP EVPN routes in multiple
views.
Table 1 Supported views for RD and route target configuration
Item
Views
RD
• EVPN instance view of a VSI
• VPN instance view
• Public instance view
Route targets
• EVPN instance view of a VSI
• VPN instance view
• IPv4 VPN view of a VPN instance
• IPv6 VPN view of a VPN instance
• EVPN view of a VPN instance
• Public instance view
• IPv4 VPN view of the public instance
• IPv6 VPN view of the public instance
• EVPN view of the public instance
NOTE:
Route targets configured in VPN instance view apply to IPv4 VPN, IPv6 VPN, and
GW 1 P GW 2
DATA
Transport
network
Server 1
VM 1
IP 1
MAC 1
Server 2
VM 2
IP 2
MAC 2
GW IP
GW MAC (VSI interface MAC)
GW MAC 1 (Router MAC of GW 1)
VTEP IP 1
L3VNI 100
GW IP
GW MAC (VSI interface MAC)
GW MAC 2 (Router MAC of GW 2)
VTEP IP 2
L3VNI 100
SIP: IP 1
DIP: IP 2
SMAC: MAC 1
DMAC: GW MAC
DATA
SIP: IP 1
DIP: IP 2
SMAC: GW MAC 1
DMAC: GW MAC 2
VNI: 100
SIP: VTEP IP 1
DIP: VTEP IP 2
DATA
SIP: IP 1
DIP: IP 2
SMAC: GW MAC
DMAC: MAC 2
12
Item
Views
EVPN. Route targets configured in IPv4 VPN view apply only to IPv4 VPN. Route
targets configured in IPv6 VPN view apply only to IPv6 VPN. Route targets configured
in EVPN view o
f a VPN instance apply only to EVPN. Route targets configured in IPv4
VPN view, IPv6 VPN view, or EVPN view of a VPN instance take precedence over
those in VPN instance view. The precedence order for different views of a VPN
instance also applies to the views of the public instance.
The device selects RDs and route targets for BGP EVPN routes by using the following rules:
•
IMET routes and MAC/IP advertisement routes that contain only MAC addresses—The
device uses the RD and route targets configured in EVPN instance view when advertising and
accepting the routes.
•
MAC/IP advertisement routes that contain ARP or ND information—The device uses the
following settings when advertising the routes:
RD and export route targets configured in EVPN instance view.
Export route targets configured for EVPN on a VPN instance or the public instance (VPN
instance view, EVPN view of a VPN instance or the public instance, and public instance
view).
The device uses the import route targets configured for EVPN on a VPN instance or the public
instance when accepting the routes.
•
IP prefix advertisement routes—The device uses the route targets configured for IPv4 VPN
or IPv6 VPN on a VPN instance or the public instance when advertising and accepting the
routes.
EVPN multihoming
IMPORTANT:
T
his feature is available in R2612 and later.
This feature is not supported on the HPE FlexFabric 5930 switch series.
Overview
As shown in Figure 12, EVPN supports deploying multiple VTEPs at a site for redundancy and high
availability. On the redundant VTEPs, Ethernet links connected to the site form an Ethernet segment
(ES) that is uniquely identified by an Ethernet segment identifier (ESI).
Figure 12 EVPN multihoming
VTEP 1
VXLAN tunnel
VXLAN tunnel
VTEP 3
Server 1 Server 2
Site 1 Site 2
Transport
network
P
ES
VTEP 2
VXLAN tunnel
13
DF election
To prevent redundant VTEPs from sending duplicate flood traffic to a multihomed site, a designated
forwarder (DF) is elected from the VTEPs for each AC to forward flood traffic to the AC. VTEPs that
fail the election are assigned the backup designated forwarder (BDF) role. BDFs of an AC do not
forward flood traffic to the AC.
A remote VTEP takes part in the DF election of a multihomed site. Redundant VTEPs of the site send
Ethernet segment routes to the remote VTEP to advertise ES and VTEP IP mappings. Then, the
VTEPs select a DF for each AC based on the ES and VTEP IP mappings by using the following
procedure:
1. Arrange source IP addresses in Ethernet segment routes with the same ESI in ascending order
and assign a sequence number to each IP address, starting from 0.
2. Divide the lowest VLAN ID permitted on an AC by the number of the redundant VTEPs, and
match the reminder to the sequence numbers of IP addresses.
3. Assign the DF role to the VTEP that uses the IP address with the matching sequence number.
The following uses AC 1 in Figure 13 as an example to explain the DF election procedure:
4. VTEP 1 and VTEP 2 send Ethernet segment routes to VTEP 3.
5. Sequence numbers 0 and 1 are assigned to IP addresses 1.1.1.1 and 2.2.2.2 in the Ethernet
segment routes, respectively.
6. The VTEPs divide 4 (the lowest VLAN ID permitted by AC 1) by 2 (the number of redundant
VTEPs), and match the reminder 0 to the sequence numbers of the IP addresses.
7. The DF role is assigned to VTEP 1 at 1.1.1.1.
Figure 13 DF election
Split horizon
In a multihomed site, a VTEP forwards multicast, broadcast, and unknown unicast frames received
from ACs out of all site-facing interfaces and VXLAN tunnels in the corresponding VXLAN, except for
the incoming interface. As a result, the other VTEPs at the site receive these flood frames and
forward them to site-facing interfaces, which causes duplicate floods and loops. EVPN introduces
split horizon to resolve this issue. Split horizon disables a VTEP to forward flood traffic received from
another local VTEP to site-facing interfaces if an ES on that local VTEP has the same ESI as these
interfaces. As shown in Figure 14, both VTEP 1 and VTEP 2 have ES 1. When receiving flood traffic
from VTEP 1, VTEP 2 does not forward the traffic to interfaces with ESI 1.
VTEP 1
DF of AC 1
VTEP 3
Server 1 Server 2
Site 1 Site 2
Transport
network
P
ES
VTEP 2
DF of AC 2
VLAN 4
VLAN 7
Flood traffic of
VLANs 4 and 7
VLANs 4 and 7
Loop0
1.1.1.1/32
Loop0
2.2.2.2/32
AC 2 permits VLAN 7
AC 1 permits VLAN 4
VLANs 4 and 7
14
Figure 14 Split horizon
Redundancy mode
The device supports the all-active redundancy mode of EVPN multihoming. This mode allows all
redundant VTEPs at a multihomed site to forward broadcast, multicast, and unknown unicast traffic.
•
For flood frames received from remotes sites, a VTEP forwards them to the ACs of which it is
the DF.
•
For flood frames received from the local site, a VTEP forwards them out of all site-facing
interfaces and VXLAN tunnels in the corresponding VXLAN, except for the incoming interfaces.
For flood frames to be sent out of a VXLAN tunnel interface, a VTEP replicates each flood frame
and sends one replica to all the other VTEPs in the corresponding VXLAN.
IP aliasing
In all-active redundancy mode, all redundant VTEPs of an ES advertise the ES to remote VTEPs
through MP-BGP. IP aliasing allows a remote VTEP to add the IP addresses of all the redundant
VTEPs as the next hops for the MAC or ARP information received from one of these VTEPs. This
mechanism creates ECMP routes between the remote VTEP and the redundant VTEPs.
EVPN multicast
IMPORTANT:
T
his feature is available in R2612 and later.
This feature is not supported on the HPE FlexFabric 5930 switch series.
VXLAN tunnel
VXLAN tunnel
VTEP 1
VTEP 3
Server 1 Server 2
Site 1 Site 2
Transport
network
P
ES1
VTEP 2
VXLAN tunnel
Server 3
Site 3
Server 4
Site 4
Flood traffic of ES 1
Flood traffic of ES 2
ES2
15
EVPN supports multicast forwarding. In an EVPN network, VTEPs create and maintain multicast
forwarding entries based on received IGMP membership reports and leave group messages to
reduce IGMP floods.
Multicast in single-homed sites
As shown in Figure 15, VTEPs at single-homed sites create multicast forwarding entries by using the
following procedure:
1. VTEP 1 receives the IGMP membership report sent by Server 1.
2. VTEP 1 creates a multicast forwarding entry and advertises information about the multicast
group to VTEP 2 and VTEP 3 through an SMET route.
3. VTEP 2 and VTEP 3 create multicast forwarding entries based on the SMET route. The next
hop in the entries is VTEP 1.
Figure 15 Multicast in single-homed sites
Multicast in multihomed sites
The IGMP membership reports and leave group messages sent from a multihomed site are received
by multiple VTEPs. To ensure consistency of multicast forwarding entries, redundant VTEPs
advertise IGMP join synch and leave synch routes to synchronize multicast information for each ES.
As shown in Figure 16, if the DF receives the first membership report for an IGMP multicast group,
the following route advertisement and withdrawal process takes place:
1. VTEP 1 (DF) receives an IGMP membership report.
2. VTEP 1 sends an SMET route to VTEP 2 and VTEP 3, and sends an IGMP join synch route to
VTEP 2.
3. An IGMP leave group message is sent from Site 1, and one of the following processes occurs:
If VTEP 1 (DF) receives the message, it sends an IGMP leave synch route to VTEP 2 and
withdraws the SMET route and IGMP join synch route that it has advertised.
If VTEP 2 (BDF) receives the message, it sends an IGMP leave synch route to VTEP 1.
Then VTEP 1 withdraws the SMET route and IGMP join synch route that it has advertised.
As shown in Figure 16, if the BDF receives the first membership report for an IGMP multicast group,
the following route advertisement and withdrawal process takes place:
4. VTEP 2 (BDF) receives an IGMP membership report.
VXLAN tunnel
VXLAN tunnel
VTEP 1
VTEP 3
Server 1
Server 3
Site 1
Site 3
Transport
network
P
VTEP 2
VXLAN tunnel
Server 2
Site 2
IGMP membership reports
SMET routes
/