Optimized Ingress Replication Solution for Ethernet VPNs (EVPNs)
Extracted elements (31)
PFLs are decoupled from the AR role and can be used independently with regular ingress replication. The primary motivation is NVO networks where certain NVEs learn all MAC/IP addresses via EVPN control plane and use proxy ARP/ND, making broadcast and unknown unicast delivery to those NVEs unnecessary.
The AR-IP and IR-IP are kept as distinct IP addresses on an AR-REPLICATOR so that the data plane can unambiguously determine whether an incoming overlay packet must be forwarded in Assisted Replication mode (replicate to all tunnels) or Ingress Replication mode (replicate to ACs only). Conflating the two addresses requires using the VNI/VSID as the differentiator instead (Section 8 procedures), which is a special case for lower-end nodes.
The selective AR mode is more efficient than non-selective AR in multi-stage IP fabrics by limiting replication at each AR-REPLICATOR to only the AR-LEAFs that explicitly requested replication (via Leaf A-D routes). The trade-off is additional BGP signaling overhead and an extra outer source IP address lookup at the AR-REPLICATOR.
Unknown unicast traffic is intentionally excluded from the Assisted Replication path and MUST follow the same forwarding path as known unicast traffic. This design choice prevents packet reordering that would otherwise arise if BM and unicast traffic took different paths through the network.
A mix of selective and non-selective AR-LEAFs SHOULD NOT coexist in the same BD. If a non-selective AR-LEAF sends BM traffic to a selective AR-REPLICATOR, that traffic will not be replicated to AR-LEAFs outside the selective AR-LEAF-set, causing incomplete BM delivery.
RNVEs (non-AR NVEs) ignore the new PMSI Tunnel Attribute flags and the Assisted Replication Tunnel type (0x0A) because they are unaware of the new definitions. They also ignore Leaf A-D routes due to the IP-address-specific Route Target. This provides backward compatibility: a BD may contain both AR-capable and non-AR NVEs simultaneously.
When EVPNs use MPLSoGRE or MPLSoUDP encapsulation, the ESI-label-based split-horizon procedure per RFC 7432 does not work for multihomed ESs on AR-LEAF nodes. Local bias combined with tunnel source IP address preservation is the recommended mechanism for split-horizon in non-selective and selective AR.
A selective AR-LEAF MUST advertise a Leaf A-D route after receiving a Replicator-AR route with L=1. It MUST locally select a single selective AR-REPLICATOR, send a Leaf A-D route scoped to that AR-REPLICATOR's IP-address-specific Route Target, and send all BM packets for the BD to that AR-REPLICATOR.
An NVE/PE configured as an AR-REPLICATOR for a BD MUST advertise a Replicator-AR route for the BD and MAY advertise a Regular-IR route. The AR-REPLICATOR MUST NOT generate a Regular-IR route if it does not have local ACs.
AR-LEAF nodes SHALL send service-level BM control plane packets (IGMP, MLD, PIM, link-local multicast) using regular ingress replication procedures, not via the AR-REPLICATOR path. AR-REPLICATORs MUST NOT replicate these control plane packets to other overlay tunnels, since they will arrive on the IR-IP address.
For BUM traffic received on an AR-REPLICATOR overlay tunnel with AR-IP as the IP DA, local bias MUST be followed: traffic is treated as if received on a local AC that is part of the Ethernet Segment and is forwarded to all local ESs regardless of DF/NDF state.
For single-IP AR-REPLICATORs (where AR-IP equals IR-IP), the Replicator-AR route MUST advertise a different VNI/VSID (AR-VNI) than the one in the Regular-IR route (IR-VNI), using different Route Distinguishers. The AR-REPLICATOR performs Ingress or Assisted Replication forwarding mode based on an ingress VNI lookup rather than the tunnel IP DA.
If an AR-LEAF has no available AR-REPLICATOR for the BD (all are down, all have withdrawn Replicator-AR routes, or none was ever discovered), the AR-LEAF MUST fall back to regular ingress replication based on the remote Regular-IR Inclusive Multicast Ethernet Tag routes per RFC 7432.
If the AR-REPLICATOR preserves the original tunnel source IP address of the AR-LEAF when replicating, uRPF checks in the IP fabric based on the tunnel source IP address MUST be disabled.
In selective AR mode, an AR-REPLICATOR MUST NOT behave as a selective AR-REPLICATOR if at least one AR-REPLICATOR in the BD advertises the Replicator-AR route with L=0; in that case all AR-REPLICATORs MUST fall back to non-selective AR mode.
Use of an AR-REPLICATOR-activation-timer (default 3 seconds, SHOULD be configurable) on AR-LEAF nodes is RECOMMENDED. The AR-LEAF runs this timer before programming a newly selected AR-REPLICATOR, using regular ingress replication in the interim, to allow the AR-REPLICATOR time to program the AR-LEAF nodes.
When an AR-REPLICATOR is selected for a given flow or BD, the AR-LEAF MUST send all BM packets to that AR-REPLICATOR using the forwarding information in the Replicator-AR route with Tunnel Type 0x0A; the underlay destination IP address MUST be the AR-IP advertised by the chosen AR-REPLICATOR.
When an AR-REPLICATOR receives a BM packet on an overlay tunnel and the outer IP DA matches its IR-IP, the AR-REPLICATOR MUST skip all overlay tunnels from the flooding list and replicate only to local ACs, preserving standard ingress replication behavior per RFC 7432.
Pruned Flooding Lists (PFLs) allow any BD node to signal BM=1 ('prune me from the BM flooding list') or U=1 ('prune me from the Unknown unicast flooding list') in Regular-IR, Replicator-AR, or Leaf A-D routes. A receiving node marks the corresponding overlay tunnel entry and skips it when replicating the respective traffic type, reducing unnecessary replication to disinterested NVEs.
Selective AR creates AR-LEAF-sets per AR-REPLICATOR, enabling single-hop trees (AR-LEAF→AR-REPLICATOR→AR-LEAF within the same set) and two-hop trees (AR-LEAF→AR-REPLICATOR→AR-REPLICATOR→AR-LEAF across different sets). A selective AR-REPLICATOR maintains two flooding lists: one using IR-IPs for AC-sourced BM traffic, and one using the selective AR-LEAF-set plus AR-REPLICATOR-set (AR-IPs) for tunnel-sourced BM traffic.
The Leaf Auto-Discovery (Leaf A-D) route from RFC 9572 is used in selective AR mode. An AR-LEAF advertises it in response to a Replicator-AR route with L=1, including the PMSI Tunnel Attribute with Tunnel Type set to Assisted Replication Tunnel, T=AR-LEAF, and a downstream-assigned MPLS label or VNI. The Route Target is an IP-address-specific extended community derived from the AR-IP in the received Replicator-AR route.
The Regular-IR route is an EVPN Inclusive Multicast Ethernet Tag route using ingress replication tunnel type (0x06). When advertised by an AR-LEAF, the T field MUST be set to 10 (AR-LEAF). The Next Hop is the IR-IP address. An AR-REPLICATOR MUST NOT generate a Regular-IR route if it has no local ACs; if advertised, T MUST be set to 0.
The Replicator-AR route is an Inclusive Multicast Ethernet Tag route advertised by AR-REPLICATORs. Its Originating Router's IP Address MUST be a common loopback; Tunnel Type MUST be Assisted Replication Tunnel (0x0A); T MUST be set to 01 (AR-REPLICATOR); L MUST be 0 for non-selective AR and 1 for selective AR. The Next Hop address (AR-IP) MUST differ from the IR-IP unless single-IP procedures (Section 8) apply.
Three roles are defined for nodes in an AR-enabled Broadcast Domain: AR-REPLICATOR (capable of replicating incoming BM traffic from an overlay tunnel to other overlay tunnels and local ACs), AR-LEAF (an NVE/PE with poor replication performance that sends all BM traffic to an AR-REPLICATOR), and RNVE (a regular NVE/PE without AR capabilities that performs standard ingress replication per RFC 8365).
IANA allocated three entries in the 'P-Multicast Service Interface (PMSI) Tunnel Attribute Flags' registry: bits 3–4 for the Assisted Replication Type (T) field, bit 5 for the Broadcast and Multicast (BM) flag, and bit 6 for the Unknown (U) flag, all referencing RFC 9574.
IANA allocated value 0x0A in the 'P-Multicast Service Interface Tunnel (PMSI Tunnel) Tunnel Types' registry for the Assisted Replication Tunnel type, as referenced in RFC 9574.
An attack on an AR-REPLICATOR — or a change to its advertised AR type — will redirect or block BM traffic for all AR-LEAFs that selected it. If no alternative AR-REPLICATOR is available, affected AR-LEAF nodes are forced into standard ingress replication mode, degrading performance since AR-LEAFs are typically low-replication-capability devices.
Incorrect implementation of the AR forwarding procedures could produce BM traffic loops, where an AR-LEAF receives back a BM frame it originated. Correct use of distinct tunnel IP DAs (AR-IP vs. IR-IP) or VNIs prevents loops; both non-selective and selective modes rely on this mechanism, so implementation errors are the primary risk.
PFLs should be used carefully: intentional or unintentional misconfiguration of BM/U flags on a leaf node may result in that node failing to receive required broadcast, multicast, or unknown unicast traffic. A mix of mistakenly configured selective and non-selective AR-REPLICATORs could cause packet duplication, though the document specifies a fallback to non-selective mode for inconsistent configurations.
The Inclusive Multicast Ethernet Tag route NLRI is used without modification: RD (8 octets), Ethernet Tag ID (4 octets), IP Address Length (1 octet), and Originating Router's IP Address (4 or 16 octets). The PMSI Tunnel Attribute carries the new Assisted Replication Tunnel type and the new T/BM/U flag bits alongside the existing Tunnel Type, MPLS Label, and Tunnel Identifier fields.
The PMSI Tunnel Attribute Flags field (8 bits) is extended with four new bits: bits 3–4 form the Assisted Replication Type (T) field (00=RNVE, 01=AR-REPLICATOR, 10=AR-LEAF, 11=RESERVED), bit 5 is the Broadcast and Multicast (BM) flag ('prune me from the BM flooding list' when set), and bit 6 is the Unknown (U) flag ('prune me from the Unknown flooding list' when set). Bits 5 and 6 together are called the PFLs flags.