Integrated Routing and Bridging in Ethernet VPN (EVPN)
Extracted elements (27)
IRB functionality is placed on PEs/NVEs to avoid inefficient centralized L3 gateway backhauling and hair-pinning of inter-subnet tenant traffic. Each PE with IRB capability can locally bridge intra-subnet traffic and locally route inter-subnet traffic on a packet-by-packet basis.
Recursive route resolution for subnet prefixes behind TSs means that when a TS moves, only its MAC/IP Advertisement route needs updating; subnet prefix advertisements do not need to be re-advertised because the resolution automatically updates forwarding to the new NVE.
Symmetric IRB performs lookups at both ingress and egress PEs (MAC then IP at ingress, IP then MAC at egress), enabling IP-only tunnels and eliminating the need for ingress PEs to maintain ARP entries for remote hosts. Asymmetric IRB performs all three lookups at the ingress PE only, requiring all PEs to maintain ARP entries and bridge tables for all subnets including non-locally-attached ones.
Symmetric and asymmetric IRB modes may coexist in the same network. The egress PE signals its desired forwarding mode via the presence of a non-zero Label2 field and an IP-VRF Route Target in the MAC/IP Advertisement route; absence of both indicates asymmetric mode.
Each PE participating in asymmetric IRB MUST maintain ARP entries for remote hosts as well as MAC-VRFs/BTs and IRB interfaces for ALL subnets in an IP-VRF, including subnets that may not be locally attached.
For asymmetric IRB, the MAC/IP Advertisement route Length field MUST be either 37 (IPv4) or 49 (IPv6), and the MPLS Label2 field MUST NOT be included in this route.
For symmetric IRB, the MAC/IP Advertisement route (RT-2) Length field MUST be either 40 (IPv4) or 52 (IPv6), and the route MUST be advertised with two Route Targets: one for the MAC-VRF and one for the IP-VRF.
If a receiving NVE receives an EVPN RT-2 with only Label1 and a single IP-VRF Route Target, or with only a single MAC-VRF Route Target but both Label1 and Label2, or with a MAC address length of zero, it MUST apply the treat-as-withdraw approach per RFC 7606 and SHOULD log an error.
If a receiving PE only supports asymmetric IRB mode but receives a MAC/IP Advertisement route with the MPLS Label2 field, it MUST ignore the MPLS Label2 field and install the MAC address and (IP, MAC) association using asymmetric procedures.
If anycast MAC auto-derivation is used for IRB interfaces, the anycast MAC MUST be auto-derived from VRRP ranges: 00-00-5E-00-01-{VRID} for IPv4 and 00-00-5E-00-02-{VRID} for IPv6, with a default VRID of 1.
If option 2 (per-PE MAC with shared anycast IP) is used for IRB interface addressing, then the IRB interface MAC address MUST be the one used in the initial ARP reply or ND Neighbor Advertisement for that TS.
In asymmetric IRB, the MPLS or NVO tunnel used for inter-subnet forwarding MUST be of type Ethernet, because the egress PE performs only a MAC lookup and requires the destination TS's MAC address in the encapsulation.
In global VNI mode, the VNI value from received Label2 MUST be the same as the locally configured VNI for the IP-VRF; if they do not match, the route MUST NOT be used and an error message SHOULD be logged.
In symmetric IRB, PEs MUST advertise local subnet routes as EVPN RT-5 to enable inter-subnet routing across PEs where not all subnets are provisioned at all PEs. These subnet routes bootstrap host (IP, MAC) learning via gleaning procedures.
The EVPN Router's MAC Extended Community MUST be added to RT-2 routes when an Ethernet NVO tunnel is used for symmetric IRB. If an IP NVO tunnel type is used, this extended community is not required.
For subnets behind Tenant Systems, NVEs advertise EVPN RT-5 (IP Prefix routes) with the TS's overlay IP address as the Gateway Address field and MPLS Label=0. Receiving NVEs use recursive route resolution to resolve the subnet prefix to its advertising NVE.
In symmetric IRB data plane operation, for Ethernet NVO tunnels, the ingress PE sets the inner Ethernet header's source MAC to its own router MAC and destination MAC to the egress PE's router MAC (learned via EVPN Router's MAC Extended Community), using Label2 as the VNI/MPLS label.
In symmetric IRB, the MPLS Label2 field in the MAC/IP Advertisement route is set to an MPLS label or VNI corresponding to the tenant's IP-VRF. A non-zero Label2 signals symmetric IRB mode to receiving PEs.
IRB interfaces support two options for default gateway addressing: (1) all PEs use the same anycast default gateway IP and MAC addresses, or (2) all PEs use the same anycast IP but their own MAC address aliased via the Default Gateway extended community from RFC 7432.
Symmetric IRB supports two VNI assignment modes for NVO tunnels: downstream mode (VNI from received Label2 is downstream-assigned) and global mode (VNI must match locally configured IP-VRF VNI across all PEs).
The EVPN IRB PE model consists of an IP-VRF connected to one or more MAC-VRFs via IRB interfaces, where each MAC-VRF contains one or more bridge tables (one per VLAN/BD), and each bridge table is connected to the IP-VRF via a dedicated IRB interface.
Upon a TS move in symmetric IRB, the source NVE removes the (IP, MAC) entry from its local ARP table after updating its MAC-VRF and IP-VRF tables. In asymmetric IRB, the source NVE instead updates its ARP table with the new target NVE adjacency information.
IANA allocated Sub-Type value 0x03 in the 'EVPN Extended Community Sub-Types' registry for the 'EVPN Router's MAC Extended Community' defined in this document (RFC 9135).
EVPN RT-5 uses an Overlay Index requiring recursive resolution to an EVPN RT-2 route. Any action that filters or modifies the RT-2 route used as the Overlay Index will affect RT-5 resolution and therefore forwarding of packets to remote subnets.
The VPN scheme does not provide confidentiality, source authentication, integrity, or replay protection; these must be provided by out-of-scope mechanisms. A security advantage is that dynamic routing protocols can be blocked on NVE/PE ACs, preventing tenants from interacting with the infrastructure's routing protocols.
Host mobility triggers one of three procedures depending on TS behavior: (1) TS sends gratuitous ARP to target NVE triggering MAC Mobility per RFC 7432 with incremented sequence number; (2) TS sends data without ARP, causing data-plane MAC learning and subsequent ARP probing; (3) silent TS detected only by age-out timer on source NVE triggering ARP probe.
The EVPN Router's MAC Extended Community is an 8-octet transitive extended community with Type=0x06 (EVPN) and Sub-Type=0x03, carrying a 6-octet MAC address. Only one instance MUST be attached per route; receivers process only the first if multiple are present.