Preference-Based EVPN Designated Forwarder (DF) Election
updates
- rfc-8584 — Framework for Ethernet VPN Designated Forwarder Election Extensibility
Extracted elements (28)
The default DF Preference value is set to 32767 (midpoint of 0–65535) rather than 0 or 65535 so that operators have roughly equal headroom to assign preferences above or below the default without exhausting the range.
The default HRW and modulus-based DF algorithms are automated and IP-address-dependent, making them unsuitable for scenarios requiring deterministic, operator-controlled DF assignment. Preference-based algorithms allow operators to set explicit ordering without reconfiguring all PEs.
The document optionally allows a local policy on a per-Ethernet-Tag-range basis to override the signaled Highest-/Lowest-Preference algorithm for load balancing, without requiring new BGP signaling for each range. This avoids per-tag BGP advertisements in segments with thousands of tags.
When a recovering PE has a higher (or lower) administrative preference than the current DF, the non-revertive procedure has it inherit the current DF's preference with DP=0. This prevents it from winning DF election via the tiebreaker (DP=1 is preferred), avoiding unnecessary traffic disruption upon recovery.
Highest-Preference (Alg 2) and Lowest-Preference (Alg 3) are treated as distinct, incompatible algorithms. If PEs in the same Ethernet Segment advertise different algorithms (e.g., one Alg 2 and one Alg 3), the election falls back to the default (RFC 7432) algorithm, not an intermediate result.
This document does not modify the use of the P and B bits in Ethernet A-D per EVI routes (RFC 8214) advertised after DF election, regardless of whether revertive or non-revertive behavior is used.
When using Highest-Preference or Lowest-Preference with AC-DF capability, a PE is not considered a DF candidate until both its Ethernet A-D per ES and Ethernet A-D per EVI routes are received, consistent with RFC 8584 AC-DF procedures.
If a PE or Ethernet Segment comes back and the PE advertises a DF election algorithm different from the one configured in the rest of the PEs, all PEs in the Ethernet Segment MUST fall back to the default DF algorithm.
If the DF algorithm values in the Ethernet Segment routes across PEs are inconsistent (e.g., a mix of Highest-Preference and Lowest-Preference, or one PE using a different algorithm), the DF election MUST fall back to the default (modulus-based) DF algorithm per RFC 7432.
The default value of the DF Preference field MUST be 32767 (the midpoint of 0–65535), giving operators flexibility to assign values above or below the default.
The Don't Preempt Capability MAY be used with Highest-Preference or Lowest-Preference Algorithms. The AC-DF capability bit (Bit 1) MAY also be set along with the Don't Preempt Capability and these algorithms.
The Ethernet Tag value MUST NOT be zero.
The Preference value MUST be configured on a per-Ethernet-Segment basis and is normally configured from the management plane. The preference value MAY also be dynamically changed based on local policies reacting to events such as port bandwidth changes.
Use of virtual Ethernet Segments is RECOMMENDED when more than two PEs per Ethernet Segment exist and good per-Ethernet-Tag load-balancing of the DF function is desired.
When a local policy overrides the Highest-Preference or Lowest-Preference Algorithm for a range of Ethernet Tags, that local policy MUST be consistent across all PEs in the Ethernet Segment. Inconsistency may cause packet drops or packet duplication.
When two or more PEs advertise equal Preference values, an implementation MUST first select the PE advertising the Don't Preempt Capability (DP=1) as the Designated Forwarder, and then use the lowest originating router IP address as a secondary tiebreaker.
DF Preference is a 2-octet field (range 0–65535) indicating a PE's preference to become the Designated Forwarder. A numerically higher value is preferred under Highest-Preference Algorithm (Alg 2) and a lower value under Lowest-Preference Algorithm (Alg 3). The field is only meaningful for Alg 2 and Alg 3.
Highest-Preference Algorithm (Alg 2): candidate PEs are ordered from numerically highest to lowest preference value, and the top-ranked PE is elected Designated Forwarder. Ties are broken first by DP=1 then by lowest originating router IP address.
Lowest-Preference Algorithm (Alg 3): candidate PEs are ordered from numerically lowest to highest preference value, and the top-ranked PE is elected Designated Forwarder. Ties are broken first by DP=1 then by lowest originating router IP address.
The 'Don't Preempt' (DP) Capability is Bit 0 (D bit) in the 2-octet Bitmap field of the DF Election Extended Community. When set to 1, the advertising PE requests remote PEs not to preempt it as Designated Forwarder. Default value is 0, compatible with revertive behavior.
IANA allocated Bit 0 ('D' / Don't Preempt Capability) in the 'DF Election Capabilities' registry (2-octet Bitmap field in the DF Election Extended Community, under BGP Extended Communities), referencing RFC 9785.
IANA allocated two new values in the 'DF Alg' registry (created by RFC 8584): Alg 2 = Highest-Preference Algorithm and Alg 3 = Lowest-Preference Algorithm, both referencing RFC 9785.
IANA updated the 'EVPN Extended Community Sub-Types' registry entry for Sub-Type 0x06 (DF Election Extended Community) to add RFC 9785 as an additional reference alongside RFC 8584.
If a local policy overriding Highest-/Lowest-Preference is inconsistent across PEs in the Ethernet Segment for a given Ethernet Tag, packet drops or packet duplication may occur for that tag. Operators must ensure consistent local policy deployment.
The Highest-Preference and Lowest-Preference Algorithms give configuration-based control over DF election. A malicious user with access to PE configuration can change the preference value to redirect traffic through a chosen PE, an attack vector that does not exist in more automated algorithms like HRW.
The non-revertive capability is a security improvement: intentional link or node flapping by an attacker causes service disruption only once (when the PE transitions to Non-Designated Forwarder), not repeatedly. However, an attacker with configuration access can disable non-revertive behavior by advertising a conflicting DF algorithm, forcing fallback to the default.
The non-revertive DF election reuses the RFC 8584 Finite State Machine INIT→DF_WAIT states. When a PE recovers, it starts a boot-timer (node recovery) or hold-timer (port/EVC recovery) in the INIT state to gather remote Ethernet Segment routes before running DF election. It then selects reference PEs and may advertise a modified operational preference to avoid preemption.
The DF Election Extended Community (Type=0x06, Sub-Type=0x06) is 8 octets encoding RSV (3 bits), DF Alg (5 bits), Bitmap (2 octets), Reserved (1 octet), and DF Preference (2 octets). This document repurposes the last two reserved octets as the DF Preference field when Alg is 2 or 3.