Updates to EVPN Broadcast, Unknown Unicast, or Multicast (BUM) Procedures
updates
- rfc-7432 — BGP MPLS-Based Ethernet VPN
Extracted elements (25)
For EVPN inter-region segmentation, RBRs change the BGP next hop when re-advertising I/S-PMSI A-D routes instead of using the S-NH-EC (as required by RFC 7524 for MVPNs/VPLSs). This makes the procedure transparent to ingress and egress PEs and provides a consistent approach across both inter-AS and inter-region segmentation.
For inter-AS segmentation, EVPNs use a different approach than VPLS: each ASBR re-advertises its received Inter-AS A-D route to IBGP peers and becomes the root of its own intra-AS segment, rather than requiring complicated procedures for ASBRs to elect a single propagating ASBR. This matches MVPN behavior.
Inter-region segmentation extends the inter-area concept by defining a region as a BGP peer group rather than an IGP area, allowing more flexible deployment scenarios including single-area networks and ASes with external links included in a region. This enables segmentation even when ASBRs don't support it natively.
Tunnel segmentation reduces forwarding and control plane burden: instead of ingress-replicating to all PEs in an AS, a PE only replicates to local PEs and ABRs/RBRs which further replicate downstream. Smaller regions also improve tunnel aggregation efficiency and reduce BIER subdomain size.
Legacy PEs not supporting the new segmentation procedures will fail: a legacy ingress PE tries to send traffic directly to all PEs including remote ASes (bypassing segmentation), and a legacy egress PE won't send Leaf A-D routes so ASBRs won't know to forward external traffic to them.
An egress NVE MAY omit the Leaf A-D route in response to an S-PMSI A-D route with the L flag set if it has already advertised a corresponding SMET route; the source NVE MUST use the SMET route in lieu of the Leaf A-D route.
If a received Inter-AS A-D route has the L flag set in its PTA, a receiving PE MUST originate a corresponding Leaf A-D route. A receiving ASBR MUST originate a corresponding Leaf A-D route only if it received/imported downstream Leaf A-D routes or has non-null downstream forwarding state.
The Administrator sub-field of the Type 1 RD in Type 9 and Type 10 EVPN NLRIs MUST match that of the RD in all current non-Leaf A-D EVPN routes from the same advertising router for a given EVI.
The upstream RBR MUST (auto-)configure an RT with the Global Administrator field set to the Next Hop in the re-advertised I/S-PMSI A-D route and with the Local Administrator field set to 0, enabling constrained BGP route distribution per RFC 4684.
To address backward-compatibility, an upgraded PE MUST indicate in its per-PE I-PMSI A-D route that it supports the new procedures by setting a flag bit in the EVPN Multicast Flags Extended Community. All per-PE I-PMSI A-D routes are restricted to the local AS.
To support multihoming with segmentation, ESI labels SHOULD be allocated from a Domain-wide Common Block (DCB) per RFC 9573 for all tunnel types including Ingress Replication tunnels, so existing multihoming procedures work as-is across segmentation regions.
When an ASBR re-advertises a per-region I-PMSI A-D route into an AS where a designated ASBR is needed for legacy PEs, it MUST include a Designated Forwarder (DF) Election EC with the AC-DF bit cleared. If no legacy PEs exist in the AS, the ASBR MUST NOT include the EC.
When an ASBR re-advertises an Inter-AS A-D route for EVPNs, the PTA MUST specify the tunnel for the segment. If and only if the ASBR needs to know the leaves to establish the tunnel, the ASBR MUST set the L flag to 1 in the PTA and MUST be (auto-)configured with an import RT for Leaf A-D routes.
When using ingress replication and an ASBR re-advertises IMET A-D routes to IBGP peers, it MUST advertise the same label for all those routes for the same Ethernet Tag ID and EVI. When building the flooding list, if multiple routes have the same (nexthop, label) tuple, they MUST only be added as a single branch.
With inter-AS segmentation, an ingress PE MUST determine the leaves in its AS from the BGP next hops in all received IMET A-D routes rather than from the Originating Router's IP Address field, so it does not need to set the L flag.
Per-region I-PMSI A-D routes aggregate all per-PE I-PMSI routes from an AS/region into a single route originated by RBRs, reducing the number of inter-region routes and tunnels. Multiple RBRs for the same region each advertise such a route with the same Region ID and Ethernet Tag ID.
Selective multicast uses S-PMSI A-D routes and Leaf A-D routes (as defined for VPLS in RFC 7117) for EVPN, applicable when operators don't want to track all (C-S,C-G) states or when tunnel types other than ingress replication or BIER are used.
The Region ID in the per-region I-PMSI route NLRI is encoded as an Extended Community: a two-octet AS uses Transitive Two-Octet AS-specific EC (sub-type 0x09), a four-octet AS uses Transitive Four-Octet AS-specific EC (sub-type 0x09), and an area ID uses a Transitive IPv4-Address-specific EC.
This document defines three new EVPN route types: Type 9 (Per-Region I-PMSI A-D route), Type 10 (S-PMSI A-D route), and Type 11 (Leaf A-D route), extending the EVPN NLRI format defined in RFC 7432.
IANA has assigned Bit 8 ('Segmentation Support') in the 'Multicast Flags Extended Community' registry created by RFC 9251, with IETF as the Change Controller.
IANA has assigned three new values in the 'EVPN Route Types' registry: Value 9 (Per-Region I-PMSI A-D route), Value 10 (S-PMSI A-D route), and Value 11 (Leaf A-D route), all referencing RFC 9572.
The selective forwarding and tunnel segmentation procedures specified in this document are based on existing procedures from RFC 6513, RFC 6514, RFC 7117, and RFC 7524. When applied to EVPNs, they do not introduce new security concerns beyond those already discussed in those references or in RFC 7432.
The Leaf A-D route (Type 11) contains a variable-length Route Key (the full NLRI of the triggering PMSI A-D route), followed by Originator's Address Length (1 octet) and Originator's Address (4 or 16 octets).
The Per-Region I-PMSI A-D route (Type 9) consists of an RD field (8 octets), Ethernet Tag ID (4 octets), and Region ID (8 octets). The Region ID is encoded in the same way as an Extended Community.
The S-PMSI A-D route (Type 10) extends the RFC 7117 format by adding an Ethernet Tag ID (4 octets) and Originator's Address Length (1 octet) plus Originator's Address (4 or 16 octets). Multicast Source and Group fields are variable length, prefixed by length octets.