IP Prefix Advertisement in Ethernet VPN (EVPN)
Extracted elements (27)
A separate route type (RT-5) is required instead of repurposing RT-2 (MAC/IP Advertisement) for IP prefix advertisement because RT-2 tightly couples prefixes to a specific MAC address. In the floating IP scenario, 1,000 prefixes associated with a floating IP would require mass withdrawal/readvertisement on ownership change if encoded in RT-2, but only a single RT-2 update is needed when RT-5 decouples the prefix from the MAC.
RT-5 uses the Overlay Index plus recursive resolution rather than direct next-hop encoding to achieve fast convergence. The indirection means that when the object (e.g., floating IP owner or ESI active TS) changes, only the resolution of the Overlay Index changes, not the prefix routes themselves.
Using an ESI as the Overlay Index in the Bump-in-the-Wire use case is preferred over a MAC address because it allows EVPN multihoming redundancy mechanisms (including mass withdrawal for fast failure detection from RFC 7432) to be directly reused for convergence.
Per RFC 7606 Section 5.4, a node that does not recognize RT-5 will ignore it. An NVE following RFC 9136 can therefore coexist in a BD with an RT-5-unaware NVE; regular RFC 7432 procedures apply between those NVEs.
A route where ESI, GW IP, MAC, and Label are all zero at the same time SHOULD be treated as withdraw.
In case two or more NVEs are attached to different BDs of the same tenant, they MUST support RT-5 for proper inter-subnet forwarding operation of the tenant.
Irrespective of recursive Overlay Index resolution, if there is no IGP or BGP route to the BGP next hop of an RT-5, BGP MUST NOT install the RT-5 even if the Overlay Index can be resolved.
The encoding of a MAC address used as an Overlay Index MUST be the 6-octet MAC address specified by IEEE 802.1Q. A route carrying an invalid MAC address (e.g., broadcast or multicast) MUST be treated as withdraw.
The ESI and GW IP fields MUST NOT both be non-zero at the same time. A route containing a non-zero GW IP and a non-zero ESI simultaneously SHOULD be treated as withdraw.
The Ethernet Segment Identifier MUST be a non-zero 10-octet identifier if the ESI is used as an Overlay Index; it MUST be all bytes zero otherwise.
The GW IP Address field MUST be all bytes zero if it is not used as an Overlay Index.
The Length field of the BGP EVPN NLRI for an EVPN IP Prefix route MUST be either 34 (IPv4) or 58 (IPv6). The IP prefix and gateway IP address MUST be from the same IP address family.
When sending, the MPLS label value SHOULD be zero if a recursive resolution based on an Overlay Index is used. If the received MPLS label is zero and the route does not contain an Overlay Index, it MUST be treated as withdraw per RFC 7606.
An Overlay Index is an identifier (ESI, IP address, or MAC address in the tenant address space) carried in the RT-5 and used by an NVE as the next hop for a given IP prefix, requiring recursive resolution at the installing NVE/PE to find the egress NVE. Recursive resolution applies upon IP-VRF installation, not upon BGP propagation.
In the Bump-in-the-Wire use case (Section 4.3), Layer 2 VAs without IP addresses use an ESI (or MAC) as the Overlay Index in RT-5. The EVPN Router's MAC Extended Community carries the TS MAC address for use as the inner destination MAC in the encapsulated packet.
In the Floating IP use case (Section 4.2), multiple NVEs advertise RT-5 routes for the same prefix using a shared floating IP (vIP23) as the GW IP Overlay Index. Ownership change requires only a single RT-2 update for the floating IP; the 1,000+ RT-5 prefix routes remain unchanged.
In the TS IP Address use case (Section 4.1), the NVE advertises RT-5 with GW IP = the VA's IP address as the Overlay Index, along with an RT-2 for the VA's MAC/IP. The DGW resolves SN prefixes via ARP to the VA's tunnel information, enabling fast convergence when the VA moves.
Recursive resolution of an ESI Overlay Index requires a received and installed RT-1 (Ethernet A-D per EVI) route specifying that ESI; a GW IP Overlay Index requires a received RT-2 with that IP in the IP Address field; a MAC Overlay Index requires a received RT-2 with that MAC in the MAC Address field.
Table 1 defines six valid RT-5 field combinations: non-zero ESI (zero GW IP) implies ESI Overlay Index; zero ESI with non-zero GW IP implies GW IP Overlay Index; zero ESI and GW IP with non-zero MAC and zero Label implies MAC Overlay Index; zero ESI and GW IP with non-zero Label implies no Overlay Index (interface-less model).
The Interface-ful IP-VRF-to-IP-VRF with unnumbered SBD IRB model (Section 4.4.3) omits IP addresses on SBD IRBs; RT-5 carries GW IP = 0 and the EVPN Router's MAC Extended Community with the SBD IRB MAC as the Overlay Index, resolved recursively to a MAC-only RT-2.
The Interface-less IP-VRF-to-IP-VRF model (Section 4.4.1) has GW IP = ESI = 0 with a non-zero MPLS label/VNI. IP-VRFs connect directly through NVO tunnels with no SBD; the EVPN Router's MAC Extended Community carries the NVE's MAC for inner destination addressing in Ethernet NVO tunnels.
The RT-5 route key consists of: RD, Ethernet Tag ID, IP prefix length, and IP prefix. The ESI, GW IP, MAC Extended Community, and MPLS label are not part of the route key.
IANA has registered value 5 in the 'EVPN Route Types' registry (defined by RFC 7432) with description 'IP Prefix', referencing RFC 9136.
Any action that filters or modifies the RT-2 or RT-1 routes used to convey Overlay Indexes will affect the recursive resolution of RT-5 routes and therefore alter forwarding to remote subnets. Operators must account for this dependency when applying route policies.
Blocking dynamic routing protocols on NVE/PE attachment circuits is a security advantage of this model: TSs and VAs that do not run dynamic routing protocols cannot interact with the infrastructure's routing protocols, reducing the attack surface compared to RFC 4364 PE/CE route distribution.
The EVPN IP Prefix Route NLRI for IPv4 has Length=34 and contains: RD (8 octets), Ethernet Segment Identifier (10 octets), Ethernet Tag ID (4 octets), IP Prefix Length (1 octet, 0–32), IP Prefix (4 octets), GW IP Address (4 octets), MPLS Label (3 octets).
The EVPN IP Prefix Route NLRI for IPv6 has Length=58 and contains the same fields as IPv4 but with IP Prefix (16 octets), GW IP Address (16 octets), and IP Prefix Length range 0–128.