BGP MPLS-Based Ethernet VPN
updated by
- rfc-8584 — Framework for Ethernet VPN Designated Forwarder Election Extensibility
- rfc-9161 — Operational Aspects of Proxy ARP/ND in Ethernet Virtual Private Networks
- rfc-9572 — Updates to EVPN Broadcast, Unknown Unicast, or Multicast (BUM) Procedures
- rfc-9573 — MVPN/EVPN Tunnel Aggregation with Common Labels
- rfc-9746 — BGP EVPN Multihoming Extensions for Split-Horizon Filtering
Extracted elements (27)
Aliasing allows a PE to signal reachability to an EVI/ES even when it has learned no MAC addresses from that segment, using an Ethernet A-D per EVI route. This solves the problem where LAG hashing causes only one PE to learn a CE's MACs, enabling all attached PEs to receive load-balanced traffic from remote PEs.
In EVPN, MAC address learning between PEs occurs in the BGP control plane rather than the data plane as in traditional VPLS. This enables policies, load balancing to multihomed CEs, and faster convergence because failures are signaled via BGP route withdrawals rather than per-MAC updates.
Single-homing PEs that do not support multihoming SHOULD still process Ethernet A-D routes for fast convergence and aliasing/backup path purposes to interoperate correctly with multihoming PEs and benefit from faster convergence and load balancing.
An Ethernet segment SHOULD have a non-reserved ESI that is unique network-wide across all EVPN instances on all PEs. When the CE is not managed, the operator MUST configure a network-wide unique ESI, which is required to enable auto-discovery and Designated Forwarder election.
Each PE MUST advertise an Inclusive Multicast Ethernet Tag route to handle multi-destination (BUM) traffic. This route MUST carry a PMSI Tunnel attribute per RFC 6514 with the Tunnel Type set to the P-tunnel technology in use (e.g., Ingress Replication or P2MP tree).
For a MAC/IP Advertisement route with a non-reserved ESI, the receiving PE MUST NOT install forwarding state until both the MAC/IP Advertisement route AND the associated set of Ethernet A-D per ES routes have been received, preventing accidental MAC installation during mass withdraw periods.
For All-Active redundancy, every BUM packet from a non-DF PE MUST be encapsulated with the ESI label of the originating segment. A DF PE receiving its own ESI label MUST drop the packet and not forward it onto the CE segment (split-horizon filtering).
The Ethernet A-D per EVI route MUST NOT be used for traffic forwarding by a remote PE until it also receives the associated set of Ethernet A-D per ES routes, to handle race conditions and prevent forwarding via a PE that has not yet established segment connectivity.
The RD MUST be set to the advertising MAC-VRF's RD, MUST be unique across all MAC-VRFs on a PE, and it is RECOMMENDED to use Type 1 RD comprising the PE's IP address (typically loopback) followed by a PE-unique number.
Two BGP speakers MUST use BGP Capabilities Advertisements (capability code 1, multiprotocol BGP, AFI 25, SAFI 70) to confirm mutual EVPN support before exchanging labeled EVPN NLRI.
When a PE receives an ARP Request from a CE and holds the MAC/IP binding, the PE SHOULD perform ARP proxy by responding directly, minimizing ARP flooding over the MPLS network. If multiple IP addresses are bound to one MAC, multiple MAC/IP Advertisement routes MUST be generated.
When the advertising PE uses ingress replication, the ESI label MUST be downstream assigned; when using P2MP MPLS LSPs, the ESI label MUST be upstream assigned. Penultimate hop popping MUST be disabled on P2MP LSPs used in the EVPN MPLS transport.
For fast convergence, each PE advertises Ethernet A-D per ES routes for each locally attached Ethernet segment. Upon a failure, the PE withdraws these routes, causing all receiving PEs to update next-hop adjacencies for all MAC addresses on that segment in a single BGP operation rather than per-MAC withdrawals.
Six ESI types are defined: Type 0 (operator-configured arbitrary 9-octet value), Type 1 (LACP: CE System MAC + Port Key), Type 2 (MSTP: Root Bridge MAC + Bridge Priority), Type 3 (PE MAC + Local Discriminator), Type 4 (Router ID + Local Discriminator), and Type 5 (AS number + Local Discriminator).
The Default Gateway Extended Community (Opaque Type 0x03, Sub-Type 0x0d) is advertised with MAC/IP Advertisement routes to identify a PE acting as the inter-subnet default gateway. Receiving PEs MUST create MAC forwarding state that applies IP forwarding to packets destined to that MAC address.
IANA assigned SAFI 70 (EVPN) and created an EVPN Route Types registry (values 1–4 defined). New BGP Extended Community Sub-Types under Type 0x06 were assigned: Sub-Type 0x00 (MAC Mobility), 0x01 (ESI Label), 0x02 (ES-Import Route Target). The Default Gateway extended community was assigned Sub-Type 0x0d under Opaque Type 0x03.
EVPN's security depends on the integrity of the BGP control plane. Injection of fraudulent MAC/IP Advertisement routes could redirect traffic; rogue Ethernet Segment routes could disrupt DF election and split-horizon filtering, potentially causing BUM traffic loops. Operators should apply BGP security mechanisms (e.g., authentication, route filtering) to protect EVPN route exchange.
Designated Forwarder election ('service carving'): (1) PE advertises Ethernet Segment route; (2) PE starts a 3-second timer; (3) on expiry, PEs build an ordered list by originating IP address and assign ordinals 0..N-1; (4) PE with ordinal i is DF for <ES, VLAN V> when (V mod N) = i. Re-triggered on link failure, PE failure, or commissioning/decommissioning.
An Ethernet Segment Identifier (ESI) is a 10-octet integer in network byte order. The first octet is the ESI Type (T); the remaining 9 octets form the ESI Value. ESI 0 denotes a single-homed site; ESI {0xFF repeated 10 times} is reserved as MAX-ESI.
The ES-Import Route Target (Type 0x06, Sub-Type 0x02) is an 8-octet transitive extended community carrying a 6-octet ES-Import value. For ESI Types 1, 2, and 3, it is auto-derived from the high-order 6 octets of the ESI Value, enabling all PEs on a multihomed segment to import Ethernet Segment routes.
The ESI Label Extended Community (Type 0x06, Sub-Type 0x01) is an 8-octet transitive community: Type (1 octet), Sub-Type (1 octet), Flags (1 octet, low-order bit = Single-Active mode), Reserved (2 octets), ESI Label (3 octets). Enables split-horizon filtering for multihomed sites.
The Ethernet Auto-discovery Route NLRI contains: RD (8 octets), ESI (10 octets), Ethernet Tag ID (4 octets), MPLS Label (3 octets). For BGP route key processing, only the ESI and Ethernet Tag ID are part of the prefix; the MPLS Label is a route attribute.
The Ethernet Tag ID is a 32-bit field identifying a particular broadcast domain (e.g., a VLAN). The value 0xFFFFFFFF is reserved as MAX-ET. For VLAN-based and VLAN bundle service interfaces, the Ethernet Tag ID in all EVPN routes MUST be set to 0.
The EVPN NLRI format is: Route Type (1 octet), Length (1 octet), Route Type specific field (variable). It is carried in MP-BGP with AFI 25 (L2VPN) and SAFI 70 (EVPN). Four route types are defined: Ethernet A-D (1), MAC/IP Advertisement (2), Inclusive Multicast Ethernet Tag (3), Ethernet Segment (4).
The Inclusive Multicast Ethernet Tag Route NLRI contains: RD (8 octets), Ethernet Tag ID (4 octets), IP Address Length (1 octet, in bits), Originating Router's IP Address (4 or 16 octets). Used to establish P-tunnels for BUM traffic distribution.
The MAC/IP Advertisement Route NLRI contains: RD (8 octets), ESI (10 octets), Ethernet Tag ID (4 octets), MAC Address Length (1 octet, value 48 bits), MAC Address (6 octets), IP Address Length (1 octet), IP Address (0, 4, or 16 octets), MPLS Label1 (3 octets), MPLS Label2 (0 or 3 octets).
The MAC Mobility Extended Community (Type 0x06, Sub-Type 0x00) is 8 octets: Flags (1 octet, low-order Sticky/static bit), Reserved (1 octet), Sequence Number (4 octets). A higher sequence number wins when multiple PEs advertise the same MAC, and the Sticky flag prevents MAC moves.