INTEGRATOR · EVPN · SR

EVPN over segment routing across IOS XR and Huawei, with Nexus P routers

Sites 1 and 3 use IOS XR PEs, Site 2 uses Huawei PEs, and a Nexus 7704 and a Nexus 9504 are the P routers. The core runs segment routing with IS-IS and no LDP at all: a prefix-SID on each loopback gives every router the label 16000 + index for it, and EVPN rides those labels. The Nexus switches run SR but know nothing of EVPN. Sites 1 and 3, the core and the BGP sessions are already configured. Build Site 2 so that it joins the same SR domain and the same EVPN.

Integrator track · Cisco IOS XR, Huawei VRP, Cisco Nexus + Cisco switches · 8 objectives

Open in simulator More Integrator labs

Objectives

The simulator ticks each one as soon as the network meets it.

On S2-PE1 and S2-PE2, enable segment routing: segment-routing globally, segment-routing mpls and segment-routing global-block 16000 23999 under isis 1, isis prefix-sid index 21 and 22 on LoopBack0, and tunnel-policy SR selecting sr-lsp. The path to a far PE uses SR, with no LDP anywhere (display segment-routing prefix mpls forwarding, display tunnel-info all).
On S2-CE1 and S2-CE2, build Port-channel 1 with LACP: four members, trunking VLANs 10 and 20, and the host port in its VLAN.
On S1-PE1 and S1-PE2, build Eth-Trunk 1 (to CE1) and Eth-Trunk 2 (to CE2) in mode lacp-static, each with one member on card 0/0 and one on 0/1. Add .10 and .20 mode l2 sub-interfaces with encapsulation dot1q vid.
Give each Eth-Trunk its ESI: 0000.1100.0000.0000.0201 for CE1 and 0000.1100.0000.0000.0202 for CE2, the same on both PEs.
Create EVPN instances E10 and E20 in bd-mode with vpn-target 65000: both and tnl-policy SR, the same route-targets the IOS XR PEs use, and bridge domains 10 and 20 bound to them.
Build Vbdif10 and Vbdif20 with the same gateway IPs and MACs as the IOS XR PEs: 192.168.10.1 and 0000-5e00-0110, 192.168.20.1 and 0000-5e00-0120.
Filter the gateway MACs, so no PE learns them from another PE (mac-address blackhole bridge-domain ).
Ping from S2-PC1 to its gateway, to S1-PC1 at another site, and to S2-PC2 in the other subnet.

Start this lab

Before you start

Every router in an SR domain needs the same global block, or its labels differ, and a unique SID index. Route-targets are what join the vendors. show running-config segment-routing on P1 shows the Nexus side. Real interworking still needs testing for each pair of releases. With no LDP, BGP alone signals EVPN, and IS-IS alone carries the SIDs. A SID index must be unique in the domain, or both routers’ SIDs are ignored.

Concept

Segment routing: one label per destination, everywhere

With segment routing the IGP itself distributes labels. Each router gives its loopback a prefix-SID, an index into the SR global block (SRGB, 16000–23999 by default). Every SR router then reaches that loopback with the same label, 16000 + index. No LDP sessions are needed.

Concept

EVPN all-active: one bundle to two PEs

EVPN joins sites at Layer 2 with BGP routes instead of pseudowires. A CE can bundle links to two PEs, because the PEs share an Ethernet Segment Identifier (ESI): LACP sees one partner, and all links carry traffic. Route type 4 lets the PEs of a segment find each other and elect a designated forwarder (DF) per VLAN, which alone sends flooded frames to the CE. Split horizon stops a frame going back to the segment it came from.

Concept

Anycast gateway: one gateway on every PE

Each PE has a routed interface on the bridge domain (a BVI on IOS XR, a Vbdif on Huawei), and all of them use the same IP and MAC. A host always reaches a gateway at its own site, and keeps the same gateway if it moves. But the same MAC on every PE must not travel as an EVPN route: a PE would then see its own gateway MAC behind another PE, as if it had moved.