CCNP DC · EVPN L3 (SYMMETRIC IRB)

Nexus: EVPN Layer 3 with an anycast gateway

The BGP EVPN fabric carries VLAN 10 (VNI 10010) on L1 and VLAN 20 (VNI 10020) on L2, but nothing routes between them. Add a tenant VRF with a Layer 3 VNI: each leaf is the anycast gateway of its subnet, and traffic between subnets is routed into VNI 50000, carried to the other leaf and routed again there (symmetric IRB).

CCNP Data Center track · Cisco Nexus (NX-OS-style) · 6 objectives

Open in simulator More CCNP Data Center labs

Objectives

The simulator ticks each one as soon as the network meets it.

On L1 and L2 enable feature interface-vlan and feature fabric forwarding, and set fabric forwarding anycast-gateway-mac 2020.0000.00aa.
Create vrf context TENANT with vni 50000, rd auto and, under address-family ipv4 unicast, route-target both auto evpn.
Map VLAN 500 to vn-segment 50000; interface vlan 500 is a member of VRF TENANT with ip forward and no shutdown; add member vni 50000 associate-vrf under interface nve1.
Gateways: on L1 interface vlan 10 (192.168.10.1/24), on L2 interface vlan 20 (192.168.20.1/24), each with vrf member TENANT, fabric forwarding mode anycast-gateway and no shutdown.
show ip route vrf TENANT on L1: 192.168.20.20/32 via 2.2.2.2 with segid 50000.
Ping PC2 (192.168.20.20) from PC1.

Start this lab

Before you start

The L3 VNI is one VNI for the whole VRF: it needs a VLAN, an SVI with ip forward and the associate-vrf line on nve1, and the same number on every leaf. Each leaf advertises its hosts as type-2 MAC/IP routes with the VRF route-target, so the other leaf has a /32 for every remote host.

Concept

EVPN Layer 3: anycast gateway and symmetric IRB

With a tenant VRF and a Layer 3 VNI, every leaf is the default gateway of its subnets (the same anycast IP and MAC everywhere) and routes between them. Traffic for a host on another leaf is routed into the VRF’s L3 VNI, carried across the underlay to that leaf and routed again there: symmetric integrated routing and bridging.

Concept

BGP EVPN: a control plane for VXLAN

BGP EVPN replaces flood-and-learn with BGP routes in the L2VPN EVPN address family. Each VTEP advertises an inclusive-multicast route (type 3) per VNI, so the others know to replicate to it, and a MAC route (type 2) per local host, so remote MACs are known before any traffic flows. A spine is usually the iBGP route reflector.