A Network Virtualization Overlay Solution Using Ethernet VPN (EVPN)
updated by
- rfc-9746 — BGP EVPN Multihoming Extensions for Split-Horizon Filtering
Extracted elements (27)
In the DCI using ASBR (inter-AS Option B) scenario, BGP next-hop rewriting by ASBRs causes mass withdrawal per ES to fail because the receiving PE cannot correlate Ethernet A-D per ES routes with MAC routes (different RDs). The functionality falls back to mass withdrawal per EVI level, which is slower but much faster than per-MAC withdrawal.
RT auto-derivation is only applicable for 2-octet AS numbers. For 4-octet AS numbers, the RT must be manually configured because a 3-octet VNI field cannot fit within the 2-octet local administrator field of the RT format.
The DCI using Gateways approach reduces MAC-VRF and IP-VRF size at NVEs by using default IP routes and unknown MAC routes, forwarding unknown traffic to GWs that maintain all VPN routes. This also results in faster convergence because failure-related BGP routes do not need to propagate to remote NVEs in remote DCs.
VNI-to-EVI mapping offers two options: single broadcast domain per EVI (Option 1, akin to VLAN-Based Service) enables BGP RT constraint to limit route propagation, while multiple broadcast domains per EVI (Option 2, akin to VLAN-aware bundle service) avoids per-VNI RD/RT provisioning overhead at the cost of importing routes to NVEs not interested in a given VNI.
VXLAN and NVGRE encapsulations do not include the ESI label used for split-horizon filtering in standard EVPN/MPLS. Therefore, an alternative 'Local Bias' approach is used: the egress NVE examines the source IP address in the tunnel header and filters frames on all local interfaces connected to ESs shared with the ingress NVE.
If the BGP Encapsulation Extended Community is not present in an EVPN route advertisement, either MPLS encapsulation or a statically configured encapsulation is assumed. An advertising node that only supports MPLS encapsulation does not need to advertise any encapsulation tunnel types.
Transient packet duplication may occur in All-Active multihomed scenarios when unknown unicast flooding and ingress replication are both enabled and traffic arrives before the ingress PE learns the MAC via BGP. To avoid this, VXLAN-GPE encapsulation should be used with the BUM Traffic Bit set.
When a PE advertises multiple encapsulation types, an ingress NVE can send a frame to an egress NVE only if the intersection of their supported encapsulation sets is non-empty; it is the ingress NVE's discretion which encapsulation to use from that intersection.
A mix of PE devices using MPLS over GRE (running RFC 7432 split-horizon filtering) and PE devices using VXLAN/NVGRE (running local-bias procedures) on the same Ethernet segment MUST NOT be configured.
A PE advertising multiple supported encapsulations MUST advertise encapsulations that use the same EVPN procedures including split-horizon filtering. A PE MUST NOT advertise VXLAN and MPLS encapsulations together because the MPLS field is set to either an MPLS label or VNI but not both, and some EVPN procedures differ.
For VLAN-Aware Bundle Service (multiple VNIs per MAC-VRF), the Ethernet Tag field in MAC Advertisement, Ethernet A-D per EVI, and IMET routes MUST identify a bridge table within a MAC-VRF, and the set of Ethernet Tags for that EVI must be configured consistently on all PEs within that EVI.
For VLAN-Based Service (single VNI per MAC-VRF), the Ethernet Tag field in MAC/IP Advertisement, Ethernet A-D per EVI, and IMET routes MUST be set to zero, consistent with VLAN-Based Service in RFC 7432.
For VXLAN and NVGRE encapsulations with locally assigned VNIs, each PE MUST advertise an IMET route to other PEs in an EVPN instance for the multicast tunnel type it uses. For globally assigned VNIs, each PE MUST advertise an IMET route for ingress replication or a PIM-SSM tunnel.
If a PE becomes detached from a given ES, in addition to withdrawing its Ethernet A-D per ES routes, it MUST also withdraw its previously advertised Ethernet A-D per EVI routes for that ES.
The BGP Encapsulation Extended Community defined in RFC 5512 MUST be included with all EVPN routes (MAC Advertisement, Ethernet A-D per EVI, Ethernet A-D per ESI, IMET, and Ethernet Segment) advertised by an egress PE to indicate the data-plane encapsulation type.
The Next Hop field of the MP_REACH_NLRI attribute MUST be set to the IPv4 or IPv6 address of the NVE.
When a remote PE receives the withdrawal of an Ethernet A-D per EVI route (in inter-AS Option B scenarios), it SHOULD remove the withdrawing PE as a next hop for all MAC addresses associated with that <ES, EVI, BD>.
When MPLS over GRE is used, the GRE Checksum and Sequence Number fields MUST NOT be included, and the corresponding C and S bits in the GRE header MUST be set to zero.
Aliasing uses the Ethernet A-D per EVI route to signal reachability to a locally attached ES even when no MAC addresses have been learned from that segment, enabling remote NVEs to load-balance across all NVEs connected to the multihomed ES.
Fast Convergence and Mass Withdrawal uses Ethernet A-D routes per ES. Upon a failure in connectivity to an attached segment, the NVE withdraws the corresponding Ethernet A-D per ES route, triggering all receiving NVEs to update next-hop adjacencies for all MAC addresses associated with that ES.
NVGRE encapsulation is based on GRE and mandates inclusion of the optional GRE Key field carrying the VSID. There is a one-to-one mapping between VSID and tenant VID, and inclusion of an inner VLAN tag is prohibited.
Split-horizon filtering for VXLAN/NVGRE uses the 'Local Bias' mechanism: every NVE tracks IP addresses of other NVEs sharing multihomed ESs, and filters incoming multi-destination frames on all local interfaces connected to ESs shared with the ingress NVE based on the source IP in the tunnel header.
The MPLS Label1 field in MAC/IP Advertisement routes, the MPLS label field in Ethernet A-D per EVI routes, and the MPLS label field in the PMSI Tunnel attribute of IMET routes are used to carry the VNI. The entire 24-bit field is used to encode the VNI value for both local and global VNIs.
VXLAN encapsulation uses UDP with an 8-byte header following the UDP header, providing a 24-bit VNI that typically maps one-to-one to the tenant VID. In the default mode, the ingress VTEP does not include an inner VLAN tag and the egress VTEP discards frames with an inner VLAN tag.
This document registers five new values in the 'BGP Tunnel Encapsulation Attribute Tunnel Types' registry: value 8 (VXLAN Encapsulation), 9 (NVGRE Encapsulation), 10 (MPLS Encapsulation), 11 (MPLS in GRE Encapsulation), and 12 (VXLAN GPE Encapsulation).
The security considerations of VXLAN (RFC 7348) and NVGRE (RFC 7637) apply to the data-plane aspects of this document. As with RFC 5512, any modification of encapsulation header information, tunnel type selection, or tunnel-to-payload mapping may lead to user data packets being misrouted, misdelivered, or dropped.
The auto-derived RT for VXLAN/NVGRE uses a 6-byte field: a 2-octet Global Administrator sub-field (AS number) and a 4-octet Local Administrator sub-field encoding a 1-bit auto-derivation flag (A), a 3-bit Type field identifying the VNI space (0=VID, 1=VXLAN, 2=NVGRE, 3=I-SID, 4=EVI, 5=dual-VID), a 4-bit Domain-ID, and a 3-octet Service ID (VNI/VSID).