Login
- Table of Contents
- Related Documents
-
| Title | Size | Download |
|---|---|---|
| 02-EVPN VXLAN configuration | 353.56 KB |
Contents
Assignment of traffic to VXLANs
Traffic from the local site to a remote site
Traffic from a remote site to the local site
Centralized EVPN gateway deployment
Distributed EVPN gateway deployment
Restrictions and guidelines: EVPN VXLAN configuration
Configuring BGP to advertise BGP EVPN routes
Restrictions and guidelines for BGP EVPN route advertisement
Enabling BGP to advertise BGP EVPN routes
Configuring route advertisement settings
Mapping a Layer 3 interface to a VSI
Configuring a centralized EVPN gateway
Configuring a distributed EVPN gateway
Restrictions and guidelines for distributed EVPN gateway configuration
Prerequisites for distributed EVPN gateway configuration
Configuring an L3 VXLAN ID for a VSI interface
Configuring IP prefix route advertisement
Managing remote MAC address entries and remote ARP learning
Disabling remote MAC address learning and remote ARP learning
Disabling MAC address advertisement
Disabling learning of MAC addresses from ARP information
Configuring BGP EVPN route redistribution and advertisement
Redistributing MAC/IP advertisement routes into BGP unicast routing tables
Enabling BGP EVPN route advertisement to the local site
Enabling ARP flood suppression
Verifying and maintaining EVPN VXLAN
Displaying EVPN running status and statistics
Verifying MAC address information and ARP information
EVPN VXLAN overview
EVPN VXLAN uses EVPN routes for VXLAN tunnel establishment and assignment and MAC reachability information advertisement in the control plane and uses VXLAN for forwarding in the data plane.
EVPN network model
As shown in Figure 1, EVPN uses the VXLAN technology for traffic forwarding in the data plane. The transport edge devices assign user terminals to different VXLANs, and then forward traffic between sites for user terminals by using VXLAN tunnels. The transport edge devices are VXLAN tunnel endpoints (VTEPs). They can be servers that host VMs or independent network devices.
Supported user terminals include PCs, wireless terminals, and VMs on servers.
|
|
NOTE: This document uses VMs as examples to describe the mechanisms of EVPN. The mechanisms do not differ between different kinds of user terminals. |
A VTEP uses ESs, VSIs, and VXLAN tunnels to provide VXLAN services:
· Ethernet segment (ES)—An ES is a link that connects a site to a VTEP. Each ES is uniquely identified by an Ethernet segment identifier (ESI).
· VSI—A virtual switch instance is a virtual Layer 2 switched domain. Each VSI provides switching services only for one VXLAN. VSIs learn MAC addresses and forward frames independently of one another. User terminals in different sites have Layer 2 connectivity if they are in the same VXLAN. A VXLAN is identified by a 24-bit VXLAN ID which is also called the virtual network identifier (VNI). A VXLAN corresponds to an EVPN instance.
· VXLAN tunnel—Logical point-to-point tunnels between VTEPs over the transport network. Each VXLAN tunnel can trunk multiple VXLANs.
All VXLAN processing is performed on VTEPs. The ingress VTEP encapsulates VXLAN traffic in the VXLAN, outer UDP, and outer IP headers, and forwards the traffic through VXLAN tunnels. The egress VTEP removes the VXLAN encapsulation and forwards the traffic to the destination. Transport network devices (for example, the P device in Figure 1) forward VXLAN traffic only based on the outer IP header of VXLAN packets.
Configuration automation
If EVPN is used for Layer 2 forwarding, VTEPs use the following BGP EVPN routes to discover VTEP neighbors, establish VXLAN tunnels, and assign the tunnels to VXLANs:
· IMET route—VTEPs advertise their VXLAN IDs through IMET routes. If two VTEPs have the same VXLAN ID, they automatically establish a VXLAN tunnel and assign the tunnel to the VXLAN.
· MAC/IP advertisement route—VTEPs advertise local MAC addresses and VXLAN IDs through MAC/IP advertisement routes. If two VTEPs have the same VXLAN ID, they automatically establish a VXLAN tunnel and assign the tunnel to the VXLAN.
If EVPN is used for Layer 3 forwarding, VTEPs use the following BGP EVPN routes to discover VTEP neighbors, establish VXLAN tunnels, and assign the tunnels to VXLANs:
· IMET route—VTEPs advertise the VXLAN IDs they have through IMET routes. If two VTEPs have the same VXLAN ID, they automatically establish a VXLAN tunnel and assign the tunnel to the VXLAN.
· MAC/IP advertisement route and IP prefix advertisement route—In the EVPN gateway deployment, VTEPs advertise MAC/IP advertisement routes or IP prefix advertisement routes which carry the export targets. When a VTEP receives a route, it compares the export targets of the route with the local import targets. If the route targets match, the VTEP establishes a VXLAN tunnel with the remote VTEP and associates the tunnel with the L3 VXLAN ID of the corresponding VPN instance. For more information about the L3 VXLAN ID, see "Distributed EVPN gateway deployment."
Assignment of traffic to VXLANs
Traffic from the local site to a remote site
The VTEP uses a Layer 3 interface to match customer traffic. The VTEP assigns customer traffic to a VXLAN by mapping the Layer 3 interface to a VSI.
A Layer 3 interface is identical to an attachment circuit (AC) in L2VPN.
Traffic from a remote site to the local site
When a VXLAN packet arrives at a VXLAN tunnel interface, the VTEP uses the VXLAN ID in the packet to identify its VXLAN.
Layer 2 forwarding
MAC learning
The VTEP performs Layer 2 forwarding based on a VSI's MAC address table. The VTEP learns MAC addresses by using the following methods:
· Local MAC learning—The VTEP automatically learns the source MAC addresses of frames sent from the local site. The outgoing interfaces of local MAC address entries are site-facing interfaces on which the MAC addresses are learned.
· Remote MAC learning—The VTEP uses MP-BGP to advertise local MAC reachability information to remote sites and learn MAC reachability information from remote sites. The outgoing interfaces of MAC address entries advertised from a remote site are VXLAN tunnel interfaces.
Unicast
As shown in Figure 2, the VTEP performs typical Layer 2 forwarding for known unicast traffic within the local site.
As shown in Figure 3, the following process applies to a known unicast frame between sites:
1. The source VTEP encapsulates the Ethernet frame in the VXLAN/UDP/IP header.
In the outer IP header, the source IP address is the source VTEP's VXLAN tunnel source IP address. The destination IP address is the VXLAN tunnel destination IP address.
2. The source VTEP forwards the encapsulated packet out of the outgoing VXLAN tunnel interface found in the VSI's MAC address table.
3. The intermediate transport devices (P devices) forward the packet to the destination VTEP by using the outer IP header.
4. The destination VTEP removes the headers on top of the inner Ethernet frame. It then performs MAC address table lookup in the VXLAN's VSI to forward the frame out of the matching outgoing interface.
Flood
As shown in Figure 4, a VTEP floods a broadcast, multicast, or unknown unicast frame to all site-facing interfaces and VXLAN tunnels in the VXLAN, except for the incoming interface. The source VTEP replicates the flood frame, and then sends one replica to the destination IP address of each VXLAN tunnel in the VXLAN. Each destination VTEP floods the inner Ethernet frame to all the site-facing interfaces in the VXLAN. To avoid loops, the destination VTEPs do not flood the frame to VXLAN tunnels.
Figure 4 Forwarding of flood traffic
Centralized EVPN gateway deployment
Centralized EVPN gateway deployment uses one VTEP to provide Layer 3 forwarding for VXLANs. The VTEP uses virtual Layer 3 VSI interfaces as gateway interfaces for VXLANs. Typically, the gateway-collocated VTEP connects to other VTEPs and the external network. To use this design, make sure the gateway has sufficient bandwidth and processing capability. A centralized EVPN gateway can provide services only for IPv4 sites.
As shown in Figure 5, a VTEP acts as a gateway for VMs in the VXLANs. The VTEP both terminates the VXLANs and performs Layer 3 forwarding for the VMs. The network uses the following process to forward Layer 3 traffic from a VM to the destination:
1. The VM sends an ARP request to obtain the MAC address of the VSI interface that acts as the gateway, and then sends the Layer 3 traffic to the centralized EVPN gateway.
2. The local VTEP looks up the matching VSI's MAC address table and forwards the traffic to the centralized EVPN gateway through a VXLAN tunnel.
3. The centralized EVPN gateway removes the VXLAN encapsulation and forwards the traffic at Layer 3.
4. The centralized EVPN gateway forwards the replies sent by the destination node to the VM based on the ARP entry for the VM.
Figure 5 Example of centralized EVPN gateway deployment
Distributed EVPN gateway deployment
About distributed EVPN gateway deployment
As shown in Figure 6, each site's VTEP acts as a gateway to perform Layer 3 forwarding for the VXLANs of the local site. A VTEP acts as a border gateway to the Layer 3 network for the VXLANs.
Figure 6 Distributed EVPN gateway placement design
Symmetric IRB
A distributed EVPN gateway uses symmetric IRB for Layer 3 forwarding, which means both the ingress and egress gateways perform Layer 2 and Layer 3 lookups. Symmetric IRB introduces the following concepts:
· L3 VXLAN ID—Also called L3 VNI. An L3 VXLAN ID identifies the traffic of a routing domain where devices have Layer 3 reachability. An L3 VXLAN ID is associated with one VPN instance. Distributed EVPN gateways use VPN instances to isolate traffic of different services on VXLAN tunnel interfaces.
· Router MAC address—Each distributed EVPN gateway has a unique router MAC address used for inter-gateway forwarding. The MAC addresses in the inner Ethernet header of VXLAN packets are router MAC addresses of distributed EVPN gateways.
VSI interfaces
As shown in Figure 7, each distributed EVPN gateway has the following types of VSI interfaces:
· VSI interface as a gateway interface of a VXLAN—The VSI interface acts as the gateway interface for VMs in a VXLAN. The VSI interface is associated with a VSI and a VPN instance. On different distributed EVPN gateways, the VSI interface of a VXLAN use the same IP address to provide services.
· VSI interface associated with an L3 VXLAN ID—The VSI interface is associated with a VPN instance and assigned an L3 VXLAN ID. VSI interfaces associated with the same VPN instance share an L3 VXLAN ID.
A border gateway only has VSI interfaces that are associated with an L3 VXLAN ID.
Figure 7 Example of distributed EVPN gateway deployment
Layer 3 forwarding entry learning
A distributed EVPN gateway forwards Layer 3 traffic based on FIB entries generated from BGP EVPN routes and ARP information.
A VTEP advertises an external route imported in the EVPN address family through MP-BGP. A remote VTEP adds the route to the FIB table of a VPN instance based on the L3 VXLAN ID carried in the route. In the FIB entry, the outgoing interface is a VXLAN tunnel interface, and the next hop is the peer VTEP address in the NEXT_HOP attribute of the route.
A VTEP has the following types of ARP information:
· Local ARP information—ARP information of VMs in the local site. The VTEP snoops GARP packets, RARP packets, and ARP requests for the gateway MAC address to learn the ARP information of the senders and generates ARP entries and FIB entries. In an ARP or FIB entry, the outgoing interface is the site-facing interface where the packet is received, and the VPN instance is the instance associated with the corresponding VSI interface.
· Remote ARP information—ARP information of VMs in remote sites. Each VTEP uses MP-BGP to advertise its local ARP information with L3 VXLAN IDs in routes to remote sites. A VTEP generates only FIB entries for the remote ARP information. A FIB entry contains the following information:
¡ Outgoing interface: VSI interface associated with the L3 VXLAN ID.
¡ Next hop: Peer VTEP address in the NEXT_HOP attribute of the route.
¡ VPN instance: VPN instance associated with the L3 VXLAN ID.
The VTEP then creates an ARP entry for the next hop in the FIB entry.
Traffic forwarding
A distributed EVPN gateway can work in one of the following mode:
· Switching and routing mode—Forwards Layer 2 traffic based on the MAC address table and forwards Layer 3 traffic based on the FIB table. In this mode, you need to enable ARP flood suppression on the distributed EVPN gateway to reduce flooding.
· Routing mode— Forwards both Layer 2 and Layer 3 traffic based on the FIB table. In this mode, you need to enable local proxy ARP on the distributed EVPN gateway.
For more information about MAC address table-based Layer 2 forwarding, see "Unicast."
Figure 8 shows the intra-site Layer 3 forwarding process.
1. The source VM sends an ARP request to obtain the MAC address of the destination VM.
2. The gateway replies to the source VM with the MAC address of the VSI interface associated with the source VM's VSI.
3. The source VM sends a Layer 3 packet to the gateway.
4. The gateway looks up the FIB table of the VPN instance associated with the source VM's VSI and finds the matching outgoing site-facing interface.
5. The gateway processes the Ethernet header of the Layer 3 packet as follows:
¡ Replaces the destination MAC address with the destination VM's MAC address.
¡ Replaces the source MAC address with the VSI interface's MAC address.
6. The gateway forwards the Layer 3 packet to the destination VM.
Figure 8 Intra-site Layer 3 forwarding
Figure 9 shows the inter-site Layer 3 forwarding process.
1. The source VM sends an ARP request to obtain the MAC address of the destination VM.
2. The gateway replies to the source VM with the MAC address of the VSI interface associated with the source VM's VSI.
3. The source VM sends a Layer 3 packet to the gateway.
4. The gateway looks up the FIB table of the VPN instance associated with the source VM's VSI and finds the matching outgoing VSI interface.
5. The gateway processes the Ethernet header of the Layer 3 packet as follows:
¡ Replaces the destination MAC address with the destination gateway's router MAC address.
¡ Replaces the source MAC address with its own router MAC address.
6. The gateway adds VXLAN encapsulation to the Layer 3 packet and forwards the packet to the destination gateway. The encapsulated VXLAN ID is the L3 VXLAN ID of the corresponding VPN instance.
7. The destination gateway identifies the VPN instance of the packet based on the L3 VXLAN ID and removes the VXLAN encapsulation. Then the gateway forwards the packet based on the matching ARP entry.
Figure 9 Inter-site Layer 3 forwarding
Communication between private and public networks
A distributed EVPN gateway uses the public instance to perform Layer 3 forwarding for the public network and to enable communication between private and public networks. The public instance is similar to a VPN instance. A distributed EVPN gateway processes traffic of the public instance in the same way it does for a VPN instance. For the public instance to work correctly, you must configure an RD, an L3 VXLAN ID, and route targets for it. If a VSI interface is not associated with any VPN instance, the VSI interface belongs to the public instance.
ARP flood suppression
ARP flood suppression reduces ARP request broadcasts by enabling the VTEP to reply to ARP requests on behalf of VMs.
As shown in Figure 10, this feature snoops ARP requests, ARP responses, and BGP EVPN routes to populate the ARP flood suppression table with local and remote MAC addresses. If an ARP request has a matching entry, the VTEP replies to the request on behalf of the VM. If no match is found, the VTEP floods the request to both local and remote sites.
Figure 10 ARP flood suppression
ARP flood suppression uses the following workflow:
1. VM 1 sends an ARP request to obtain the MAC address of VM 7.
2. VTEP 1 creates a suppression entry for VM 1, floods the ARP request in the VXLAN, and sends the suppression entry to VTEP 2 and VTEP 3 through BGP EVPN.
3. VTEP 2 and VTEP 3 de-encapsulate the ARP request and broadcast the request in the local site.
4. VM 7 sends an ARP reply.
5. VTEP 2 creates a suppression entry for VM 7, forwards the ARP reply to VTEP 1, and sends the suppression entry to VTEP 1 and VTEP 3 through BGP EVPN.
6. VTEP 1 de-encapsulates the ARP reply and forwards the ARP reply to VM 1.
7. VM 4 sends an ARP request to obtain the MAC address of VM 1.
8. VTEP 1 creates a suppression entry for VM 4 and replies to the ARP request.
9. VM 10 sends an ARP request to obtain the MAC address of VM 1.
10. VTEP 3 creates a suppression entry for VM 10 and replies to the ARP request.
MAC mobility
MAC mobility refers to that a VM or host moves from one ES to another. The source VTEP is unaware of the MAC move event. To notify other VTEPs of the change, the destination VTEP advertises a MAC/IP advertisement route for the MAC address. The source VTEP withdraws the old route for the MAC address after receiving the new route. The MAC/IP advertisement route has a sequence number that increases when the MAC address moves. The sequence number identifies the most recent move if the MAC address moves multiple times.
Configuring EVPN VXLAN
Restrictions and guidelines: EVPN VXLAN configuration
Make sure the following VXLAN tunnels are not associated with the same VXLAN when they have the same tunnel destination IP address:
· A VXLAN tunnel automatically created by EVPN.
· A manually created VXLAN tunnel.
For more information about manual tunnel configuration, see VXLAN Configuration Guide.
As a best practice to ensure correct traffic forwarding, configure the same MAC address for all VSI interfaces on an EVPN gateway.
EVPN VXLAN tasks at a glance
To configure EVPN VXLAN, perform the following tasks:
1. Configuring a VXLAN on a VSI
2. Configuring an EVPN instance
3. Configuring BGP to advertise BGP EVPN routes
a. Enabling BGP to advertise BGP EVPN routes
b. (Optional.) Configuring route advertisement settings
c. (Optional.) Maintaining BGP sessions
5. Configuring an EVPN gateway
Choose one of the following tasks:
¡ Configuring a centralized EVPN gateway
¡ Configuring a distributed EVPN gateway
6. (Optional.) Managing remote MAC address entries and remote ARP learning
¡ Disabling remote MAC address learning and remote ARP learning
¡ Disabling MAC address advertisement
¡ Disabling learning of MAC addresses from ARP information
7. (Optional.) Configuring BGP EVPN route redistribution and advertisement
¡ Redistributing MAC/IP advertisement routes into BGP unicast routing tables
¡ Enabling BGP EVPN route advertisement to the local site
8. (Optional.) Configuring flood suppression
¡ Disabling flooding for a VSI
¡ Enabling ARP flood suppression
Configuring a VXLAN on a VSI
Restrictions and guidelines
For more information about the VXLAN commands in this task, see VXLAN Command Reference.
Procedure
1. Enter system view.
system-view
2. Enable L2VPN.
l2vpn enable
By default, L2VPN is disabled.
3. Create a VSI and enter VSI view.
vsi vsi-name
4. Configure a VSI description.
description text
By default, a VSI does not have a description.
5. Enable the VSI.
undo shutdown
By default, a VSI is enabled.
6. Create a VXLAN and enter VXLAN view.
vxlan vxlan-id
You can create only one VXLAN on a VSI. The VXLAN ID must be unique for each VSI.
Configuring an EVPN instance
About this task
You do not need to associate a VPN instance with a VXLAN that requires only Layer 2 connectivity. The BGP EVPN routes advertised by the device carry the RD and route targets configured for the EVPN instance associated with the VXLAN.
Procedure
1. Enter system view.
system-view
2. Enter VSI view.
vsi vsi-name
3. Create an EVPN instance and enter EVPN instance view.
evpn encapsulation vxlan
4. Configure an RD for the EVPN instance.
route-distinguisher { route-distinguisher | auto }
By default, no RD is configured for an EVPN instance.
5. Configure route targets for the EVPN instance.
vpn-target { vpn-target&<1-8> | auto } [ both | export-extcommunity | import-extcommunity ]
By default, an EVPN instance does not have route targets.
Make sure the following requirements are met:
¡ The import targets of the EVPN instance do not match the export targets of the VPN instance associated with the VXLAN or the public instance.
¡ The export targets of the EVPN instance do not match the import targets of the VPN instance associated with the VXLAN or the public instance.
For more information about VPN instance configuration and public instance configuration, see "Configuring an L3 VXLAN ID for a VSI interface."
Configuring BGP to advertise BGP EVPN routes
Restrictions and guidelines for BGP EVPN route advertisement
For more information about BGP commands in this task, see Layer 3—IP Routing Command Reference.
Enabling BGP to advertise BGP EVPN routes
1. Enter system view.
system-view
2. Configure a global router ID.
router id router-id
By default, no global router ID is configured.
3. Enable a BGP instance and enter BGP instance view.
bgp as-number [ instance instance-name ]
By default, BGP is disabled and no BGP instances exist.
4. Specify remote VTEPs as BGP peers.
peer { group-name | ipv4-address [ mask-length ] } as-number as-number
5. Create the BGP EVPN address family and enter BGP EVPN address family view.
address-family l2vpn evpn
6. Enable BGP to exchange BGP EVPN routes with a peer or peer group.
peer { group-name | ipv4-address [ mask-length ] } enable
By default, BGP does not exchange BGP EVPN routes with peers.
Configuring route advertisement settings
1. Enter system view.
system-view
2. Enter BGP instance view.
bgp as-number [ instance instance-name ]
3. Enter BGP EVPN address family view.
address-family l2vpn evpn
4. Permit the local AS number to appear in routes from a peer or peer group and set the number of appearances.
peer { group-name | ipv4-address [ mask-length ] } allow-as-loop [ number ]
By default, the local AS number is not allowed in routes from peers.
5. Enable route target filtering for BGP EVPN routes.
policy vpn-target
By default, route target filtering is enabled for BGP EVPN routes.
6. Configure BGP route reflection settings:
a. Configure the device as an RR and specify a peer or peer group as its client.
peer { group-name | ipv4-address [ mask-length ] } reflect-client
By default, no RR or client is configured.
b. (Optional.) Enable BGP EVPN route reflection between clients.
reflect between-clients
By default, BGP EVPN route reflection between clients is enabled.
c. (Optional.) Configure the cluster ID of the RR.
reflector cluster-id { cluster-id | ipv4-address }
By default, an RR uses its own router ID as the cluster ID.
d. (Optional.) Create a reflection policy for the RR to filter reflected BGP EVPN routes.
rr-filter { ext-comm-list-number | ext-comm-list-name }
By default, an RR does not filter reflected BGP EVPN routes.
7. Configure the device to not change the next hop of routes advertised to an EBGP peer or peer group.
peer { group-name | ipv4-address [ mask-length ] } next-hop-invariable
By default, the device uses its address as the next hop of routes advertised to EBGP peers.
8. Apply a routing policy to routes received from or advertised to a peer or peer group.
peer { group-name | ipv4-address [ mask-length ] } route-policy route-policy-name { export | import }
By default, no routing policies are applied to routes received from or advertised to peers or peer groups.
9. Advertise the COMMUNITY attribute to a peer or peer group.
peer { group-name | ipv4-address [ mask-length ] } advertise-community
By default, the device does not advertise the COMMUNITY attribute to peers or peer groups.
10. Configure the BGP additional path feature:
¡ Configure BGP additional path capabilities.
peer { group-name | ipv4-address [ mask-length ] } additional-paths { receive | send } *
By default, no BGP Additional Paths capabilities are configured.
¡ Set the maximum number of Add-Path optimal routes that can be advertised to a peer or peer group.
peer { group-name | ipv4-address [ mask-length ] } advertise additional-paths best number
By default, a maximum of one Add-Path optimal route can be advertised to a peer or peer group.
¡ Set the maximum number of Add-Path optimal routes that can be advertised to all peers.
additional-paths select-best best-number
By default, a maximum of one Add-Path optimal route can be advertised to all peers.
Maintaining BGP sessions
Perform the following tasks in user view:
· Reset BGP sessions of the BGP EVPN address family.
reset bgp [ instance instance-name ] { as-number | ipv4-address [ mask-length ] | all | external | group group-name | internal } l2vpn evpn
· Soft-reset BGP sessions of the BGP EVPN address family.
refresh bgp [ instance instance-name ] { ipv4-address [ mask-length ] | all | external | group group-name | internal } { export | import } l2vpn evpn
Mapping ACs to a VSI
Mapping a Layer 3 interface to a VSI
About this task
To assign the customer traffic on a Layer 3 interface to a VXLAN, map the interface to the VXLAN's VSI. The VSI uses its MAC address table to forward the customer traffic.
For more information about the VXLAN commands in this task, see VXLAN Command Reference.
Restrictions and guidelines
Link aggregation group membership is mutually exclusive with VSI mappings on a Layer 3 interface. Do not map a VSI to a Layer 3 interface that is in a Layer 3 aggregation group.
Procedure
1. Enter system view.
system-view
2. Enter Layer 3 interface view.
interface interface-type interface-number
3. Map the Layer 3 interface to a VSI.
xconnect vsi vsi-name [ track track-entry-number&<1-3> ]
By default, a Layer 3 interface is not mapped to any VSI.
Configuring a centralized EVPN gateway
Restrictions and guidelines
If an EVPN network contains a centralized EVPN gateway, you must enable ARP flood suppression on VTEPs. Typically remote ARP learning is disabled in an EVPN network. When ARP requests for the gateway MAC address are sent to the centralized EVPN gateway through VXLAN tunnels, the gateway does not respond to the requests. If ARP flood suppression is disabled on VTEPs, VMs cannot obtain the MAC address of the gateway.
Procedure
1. Enter system view.
system-view
2. Create a VSI interface and enter VSI interface view.
interface vsi-interface vsi-interface-id
For more information about this command, see VXLAN Command Reference.
3. Assign an IPv4 address to the VSI interface.
ip address ip-address { mask | mask-length } [ sub ]
By default, no IPv4 address is assigned to a VSI interface.
4. Return to system view.
quit
5. Enter VSI view.
vsi vsi-name
6. Specify the VSI interface as the gateway interface for the VSI.
gateway vsi-interface vsi-interface-id
By default, no gateway interface is specified for a VSI.
For more information about this command, see VXLAN Command Reference.
Configuring a distributed EVPN gateway
Restrictions and guidelines for distributed EVPN gateway configuration
Make sure a VSI interface uses the same MAC address to provide service on distributed EVPN gateways connected to IPv4 sites. Make sure a VSI interface uses different link-local addresses to provide service on distributed EVPN gateways connected to both IPv4 and IPv6 sites.
If both ARP flood suppression and local proxy ARP are enabled on a distributed EVPN gateway, only local proxy ARP takes effect. As a best practice, do not use these features together on distributed EVPN gateways.
On a distributed EVPN gateway, make sure the VSI interfaces configured with L3 VXLAN IDs use the same MAC address. To modify the MAC address of a VSI interface, use the mac-address command.
Prerequisites for distributed EVPN gateway configuration
For a VXLAN to access the external network, specify the VXLAN's VSI interface on the border gateway as the next hop on distributed EVPN gateways by using one of the following methods:
· Configure a static route.
· Configure a routing policy, and apply the policy by using the apply default-next-hop or apply next-hop command. For more information about configuring routing policies, see routing policy configuration in Layer 3—IP Routing Configuration Guide.
Configuring a VSI interface
About this task
To save Layer 3 interface resources on a distributed EVPN gateway, multiple VSIs can share one VSI interface. You can assign multiple IPv4 addresses (one primary address and multiple secondary addresses) or multiple IPv6 addresses to the VSI interface for the VSIs to use as gateway addresses.
When VSIs share a VSI interface, you must specify the subnet of each VSI for the VSI interface to identify the VSI of a packet. The subnets must be unique.
Procedure
1. Enter system view.
system-view
2. Create a VSI interface and enter VSI interface view.
interface vsi-interface vsi-interface-id
For more information about this command, see VXLAN Command Reference.
3. Assign an IP address to the VSI interface.
IPv4:
ip address ip-address { mask | mask-length } [ sub ]
IPv6:
See IPv6 basics in Layer 3—IP Services Configuration Guide.
By default, no IP address is assigned to a VSI interface.
4. Assign a MAC address to the VSI interface.
mac-address mac-address
By default, VSI interfaces use the bridge MAC address of the device.
To ensure correct forwarding after VM migration, you must assign the same MAC address to the VSI interfaces of a VXLAN on all distributed gateways.
5. Specify the VSI interface as a distributed gateway.
distributed-gateway local
By default, a VSI interface is not a distributed gateway.
For more information about this command, see VXLAN Command Reference.
6. (Optional.) Enable local proxy ARP.
local-proxy-arp enable [ ip-range startIP to endIP ]
By default, local proxy ARP is disabled.
For more information about the command, see proxy ARP commands in Layer 3—IP Services Command Reference.
7. Return to system view.
quit
8. Enter VSI view.
vsi vsi-name
9. Specify the VSI interface as the gateway interface for the VSI.
gateway vsi-interface vsi-interface-id
By default, no gateway interface is specified for a VSI.
For more information about this command, see VXLAN Command Reference.
10. Assign a subnet to the VSI.
gateway subnet { ipv4-address wildcard-mask | ipv6-address prefix-length }
By default, no subnet exists on a VSI.
For more information about this command, see VXLAN Command Reference.
Configuring an L3 VXLAN ID for a VSI interface
Restrictions and guidelines for L3 VXLAN ID configuration
The L3 VXLAN ID of a VSI interface cannot be the same as the VXLAN ID specified by using the mapping vni command. For more information about this command, see "Configuring EVPN-DCI."
Configuring an L3 VXLAN ID for the VSI interface of a VPN instance
1. Enter system view.
system-view
2. Configure a VPN instance:
a. Create a VPN instance and enter VPN instance view.
ip vpn-instance vpn-instance-name
b. Configure an RD for the VPN instance.
route-distinguisher route-distinguisher
By default, no RD is configured for a VPN instance.
c. Configure route targets for the VPN instance.
vpn-target { vpn-target&<1-8> [ both | export-extcommunity | import-extcommunity ]
By default, a VPN instance does not have route targets.
d. (Optional.) Apply an export routing policy to the VPN instance.
export route-policy route-policy
By default, no export routing policy is applied to a VPN instance.
e. (Optional.) Apply an import routing policy to the VPN instance.
import route-policy route-policy
By default, no import routing policy is applied to a VPN instance. The VPN instance accepts a route when the export route targets of the route match local import route targets.
3. Configure EVPN on the VPN instance:
a. Enter VPN instance EVPN view.
address-family evpn
b. Configure route targets for EVPN on the VPN instance.
vpn-target vpn-target&<1-8> [ both | export-extcommunity | import-extcommunity ]
By default, EVPN does not have route targets on a VPN instance.
Make sure the following requirements are met:
- The import targets of EVPN do not match the export targets of the VPN instance.
- The export targets of EVPN do not match the import targets of the VPN instance.
c. (Optional.) Apply an export routing policy to EVPN on the VPN instance.
export route-policy route-policy
By default, no export routing policy is applied to EVPN on a VPN instance.
d. (Optional.) Apply an import routing policy to EVPN on the VPN instance.
import route-policy route-policy
By default, no import routing policy is applied to EVPN on a VPN instance. The VPN instance accepts a route when the route targets of the route match local import route targets.
4. Execute the following commands in sequence to return to system view.
a. quit
b. quit
5. Create a VSI interface and enter VSI interface view.
interface vsi-interface vsi-interface-id
6. Associate the VSI interface with the VPN instance.
ip binding vpn-instance vpn-instance-name
By default, a VSI interface is not associated with a VPN instance. The interface is on the public network.
7. Configure an L3 VXLAN ID for the VSI interface.
l3-vni vxlan-id
By default, no L3 VXLAN ID is configured for a VSI interface.
A VPN instance can have only one L3 VXLAN ID. If multiple L3 VXLAN IDs are configured for a VPN instance, the VPN instance uses the lowest one. To view the L3 VXLAN ID of a VPN instance, use the display evpn routing-table command.
Configuring an L3 VXLAN ID for the VSI interface of the public instance
1. Enter system view.
system-view
2. Create the public instance and enter its view.
ip public-instance
3. Configure an RD for the public instance.
route-distinguisher route-distinguisher
By default, no RD is configured for the public instance.
4. Configure an L3 VXLAN ID for the public instance.
l3-vni vxlan-id
By default, the public instance does not have an L3 VXLAN ID.
The public instance can have only one L3 VXLAN ID. To modify the L3 VXLAN ID for the public instance, you must first delete the original L3 VXLAN ID.
5. Enter IPv4 address family view, IPv6 address family view, or EVPN view.
¡ Enter IPv4 address family view.
address-family ipv4
¡ Enter IPv6 address family view.
address-family ipv6
¡ Enter EVPN view.
address-family evpn
6. Configure route targets for IPv4 VPN, IPv6 VPN, or EVPN.
vpn-target vpn-target&<1-8> [ both | export-extcommunity | import-extcommunity ]
By default, IPv4 VPN, IPv6 VPN, and EVPN do not have route targets on the public instance.
Make sure the following requirements are met:
¡ The import targets of an EVPN instance do not match the export targets of the public instance.
¡ The export targets of an EVPN instance do not match the import targets of the public instance.
7. Execute the following commands in sequence to return to system view.
a. quit
b. quit
8. Enter VSI interface view.
interface vsi-interface vsi-interface-id
9. Configure an L3 VXLAN ID for the VSI interface.
l3-vni vxlan-id
By default, no L3 VXLAN ID is configured for a VSI interface.
Of the VSI interfaces associated with the public instance, a minimum of one VSI interface must use the same L3 VXLAN ID as the public instance.
Configuring IP prefix route advertisement
About this task
If IGP routes are imported to the BGP-VPN IPv4 or IPv6 unicast address family and the corresponding VPN instance has an L3 VXLAN ID, the device advertises the imported routes as IP prefix advertisement routes.
If IGP routes are imported to the BGP IPv4 or IPv6 unicast address family and the public instance has an L3 VXLAN ID, the device advertises the imported routes as IP prefix advertisement routes.
A VTEP compares the export route targets of received IP prefix advertisement routes with the import route targets configured for IPv4 VPN or IPv6 VPN on a VPN instance or the public instance. If the route targets match, the VTEP accepts the routes and adds the routes to the routing table of the VPN instance or public instance.
Restrictions and guidelines
This feature is supported only by distributed EVPN gateway deployment.
For more information about the BGP commands in this task, see Layer 3—IP Routing Command Reference.
Procedure
1. Enter system view.
system-view
2. Enter BGP instance view.
bgp as-number [ instance instance-name ]
3. Enter BGP address family view.
¡ Enter BGP IPv4 unicast address family view.
address-family ipv4 [ unicast ]
¡ Execute the following commands in sequence to enter BGP-VPN IPv4 unicast address family view.
ip vpn-instance vpn-instance-name
address-family ipv4 [ unicast ]
¡ Enter BGP IPv6 unicast address family view.
address-family ipv6 [ unicast ]
¡ Execute the following commands in sequence to enter BGP-VPN IPv6 unicast address family view.
ip vpn-instance vpn-instance-name
address-family ipv6 [ unicast ]
4. Enable BGP to redistribute routes from an IGP protocol.
import-route protocol [ { process-id | all-processes } [ allow-direct | med med-value | route-policy route-policy-name ] * ]
By default, BGP does not redistribute IGP routes.
5. (Optional.) Enable default route redistribution into the BGP routing table.
default-route imported
By default, default route redistribution into the BGP routing table is disabled.
6. (Optional.) Configure ECMP VPN route redistribution:
a. Return to BGP instance view.
quit
b. Enter BGP EVPN address family view.
address-family l2vpn evpn
c. Enable ECMP VPN route redistribution.
vpn-route cross multipath
By default, ECMP VPN route redistribution is disabled. If multiple routes have the same prefix and RD, BGP only imports the optimal route into the EVPN routing table.
ECMP VPN route redistribution enables BGP to import all routes that have the same prefix and RD into the EVPN routing table.
Managing remote MAC address entries and remote ARP learning
Disabling remote MAC address learning and remote ARP learning
About this task
By default, the device learns MAC information and ARP information of remote user terminals from packets received on VXLAN tunnel interfaces. The automatically learned remote MAC and ARP information might conflict with the remote MAC and ARP information advertised through BGP. As a best practice to avoid the conflicts, disable remote MAC address learning and remote ARP learning on the device.
For more information about the VXLAN commands in this task, see VXLAN Command Reference.
Procedure
1. Enter system view.
system-view
2. Disable remote MAC address learning.
vxlan tunnel mac-learning disable
By default, remote MAC address learning is enabled.
3. Disable remote ARP learning.
vxlan tunnel arp-learning disable
By default, remote ARP learning is enabled.
Disabling MAC address advertisement
About this task
The MAC information and ARP information advertised by the VTEP overlap. To avoid duplication, disable MAC address advertisement and withdraw the MAC addresses advertised to remote VTEPs.
Procedure
1. Enter system view.
system-view
2. Enter VSI view.
vsi vsi-name
3. Enter EVPN instance view.
evpn encapsulation vxlan
4. Disable MAC address advertisement and withdraw advertised MAC addresses.
mac-advertising disable
By default, MAC address advertisement is enabled.
Disabling learning of MAC addresses from ARP information
About this task
The MAC information and ARP information advertised by a remote VTEP overlap. To avoid duplication, disable the learning of MAC addresses from ARP information. EVPN will learn remote MAC addresses only from the MAC information advertised from remote sites.
Procedure
1. Enter system view.
system-view
2. Enter VSI view.
vsi vsi-name
3. Enter EVPN instance view.
evpn encapsulation vxlan
4. Disable the EVPN instance from learning MAC addresses from ARP information.
arp mac-learning disable
By default, an EVPN instance learns MAC addresses from ARP information.
Configuring BGP EVPN route redistribution and advertisement
Redistributing MAC/IP advertisement routes into BGP unicast routing tables
About this task
This task enables the device to redistribute received MAC/IP advertisement routes that contain ARP or ND information into a BGP unicast routing table.
· If you perform this task for the BGP IPv4 or IPv6 unicast address family, the device will redistribute the routes into the BGP IPv4 or IPv6 unicast routing table. In addition, the device will advertise the routes to the local site.
· If you perform this task for the BGP-VPN IPv4 or IPv6 unicast address family, the device will redistribute the routes into the BGP-VPN IPv4 or IPv6 unicast routing table of the corresponding VPN instance. To advertise the routes to the local site, you must configure the advertise l2vpn evpn command.
Procedure (BGP instance view)
1. Enter system view.
system-view
2. Enter BGP instance view.
bgp as-number [ instance instance-name ]
3. Enter BGP IPv4 or IPv6 unicast address family view.
address-family { ipv4 | ipv6 }
4. Redistribute MAC/IP advertisement routes that contain ARP or ND information into the BGP IPv4 or IPv6 unicast routing table.
import evpn mac-ip
By default, MAC/IP advertisement routes that contain ARP or ND information are not redistributed into the BGP IPv4 or IPv6 unicast routing table.
Procedure (BGP-VPN instance view)
1. Enter system view.
system-view
2. Enter BGP instance view.
bgp as-number [ instance instance-name ]
3. Enter BGP-VPN instance view.
ip vpn-instance vpn-instance-name
4. Enter BGP-VPN IPv4 or IPv6 unicast address family view.
address-family { ipv4 | ipv6 }
5. Redistribute MAC/IP advertisement routes that contain ARP or ND information into the BGP-VPN IPv4 or IPv6 unicast routing table.
import evpn mac-ip
By default, MAC/IP advertisement routes that contain ARP or ND information are not redistributed into the BGP-VPN IPv4 or IPv6 unicast routing table.
Enabling BGP EVPN route advertisement to the local site
About this task
This feature enables the device to advertise private BGP EVPN routes to the local site after the device adds the routes to the routing table of a VPN instance.
Procedure (IPv4)
1. Enter system view.
system-view
2. Enter BGP instance view.
bgp as-number [ instance instance-name ]
3. Enter BGP-VPN instance view.
ip vpn-instance vpn-instance-name
4. Enter BGP-VPN IPv4 unicast address family view.
address-family ipv4 [ unicast ]
5. Enable BGP EVPN route advertisement to the local site.
advertise l2vpn evpn
By default, BGP EVPN route advertisement to the local site is enabled.
Procedure (IPv6)
1. Enter system view.
system-view
2. Enter BGP instance view.
bgp as-number [ instance instance-name ]
3. Enter BGP-VPN instance view.
ip vpn-instance vpn-instance-name
4. Enter BGP-VPN IPv6 unicast address family view.
address-family ipv6 [ unicast ]
5. Enable BGP EVPN route advertisement to the local site.
advertise l2vpn evpn
By default, BGP EVPN route advertisement to the local site is enabled.
Disabling flooding for a VSI
About this task
By default, the VTEP floods broadcast, unknown unicast, and unknown multicast frames received from the local site to the following interfaces in the frame's VXLAN:
· All site-facing interfaces except for the incoming interface.
· All VXLAN tunnel interfaces.
When receiving broadcast, unknown unicast, and unknown multicast frames on VXLAN tunnel interfaces, the device floods the frames to all site-facing interfaces in the frames' VXLAN.
To confine a kind of flood traffic, disable flooding for that kind of flood traffic on the VSI bound to the VXLAN.
You can use selective flood to exclude a remote MAC address from the remote flood suppression done by using the flooding disable command. The VTEP will flood the frames destined for the specified MAC address to remote sites when floods are confined to the local site.
For more information about the VXLAN commands in this task, see VXLAN Command Reference.
Procedure
1. Enter system view.
system-view
2. Enter VSI view.
vsi vsi-name
3. Disable flooding for the VSI.
flooding disable { all | { broadcast | unknown-multicast | unknown-unicast } * }
By default, flooding is enabled for a VSI.
4. (Optional.) Enable selective flood for a MAC address.
selective-flooding mac-address mac-address
Enabling ARP flood suppression
About this task
Use ARP flood suppression to reduce ARP request broadcasts.
The aging timer is fixed at 25 minutes for ARP flood suppression entries. If the flooding disable command is configured, set the MAC aging timer to a higher value than the aging timer for ARP flood suppression entries on all VTEPs. This setting prevents the traffic blackhole that occurs when a MAC address entry ages out before its ARP flood suppression entry ages out. To set the MAC aging timer, use the mac-address timer command.
When remote ARP learning is disabled for VXLANs, the device does not use ARP flood suppression entries to respond to ARP requests received on VXLAN tunnels.
To delete ARP flood suppression entries, use the reset arp suppression vsi command instead of the reset arp command. For more information about the reset arp suppression vsi command, see VXLAN Command Reference. For more information about the reset arp command, see ARP commands in Layer 3—IP Services Command Reference.
Procedure
1. Enter system view.
system-view
2. Enter VSI view.
vsi vsi-name
3. Enable ARP flood suppression.
arp suppression enable
By default, ARP flood suppression is disabled.
For more information about this command, see VXLAN Command Reference.
Verifying and maintaining EVPN VXLAN
Displaying EVPN running status and statistics
Perform display tasks in any view.
· Display BGP peer group information.
display bgp [ instance instance-name ] group l2vpn evpn [ group-name group-name ]
For more information about this command, see basic BGP commands in Layer 3—IP Routing Command Reference.
· Display BGP peer or peer group information.
display bgp [ instance instance-name ] peer l2vpn evpn [ ipv4-address mask-length | { ipv4-address | group-name group-name } log-info | [ ipv4-address ] verbose ]
For more information about this command, see basic BGP commands in Layer 3—IP Routing Command Reference.
· Display information about BGP update groups.
display bgp [ instance instance-name ] update-group l2vpn evpn [ ipv4-address ]
For more information about this command, see basic BGP commands in Layer 3—IP Routing Command Reference.
· Display information about peers that are automatically discovered through BGP.
display evpn auto-discovery { imet [ peer ip-address ] [ vsi vsi-name ] | macip-prefix [ nexthop next-hop ] [ count ] }
· Display EVPN routing table information.
display evpn routing-table [ ipv6 ] { public-instance | vpn-instance vpn-instance-name } [ count ]
· Display BGP EVPN routes.
display bgp [ instance instance-name ] l2vpn evpn [ peer ipv4-address { advertised-routes | received-routes } [ statistics ] | route-distinguisher route-distinguisher [ route-type { auto-discovery | es | imet | ip-prefix | mac-ip } ] [ evpn-route route-length [ advertise-info ] ] | route-type { auto-discovery | es | imet | ip-prefix | mac-ip } | statistics ]
Verifying MAC address information and ARP information
Perform display tasks in any view.
· Display EVPN MAC address entries.
display evpn route mac [ local | remote ] [ vsi vsi-name ] [ count ]
· Display EVPN ARP entries.
display evpn route arp [ local | remote ] [ public-instance | vpn-instance vpn-instance-name ] [ count ]
· Display ARP flood suppression entries.
display evpn route arp suppression [ local | remote ] [ vsi vsi-name ] [ count ]