HCIP-DATACOM · EVPN · SR

Huawei: EVPN all-active with an anycast gateway, over segment routing

The same three sites as the LDP lab, with six Huawei PEs. The core runs segment routing with IS-IS and no LDP at all: a prefix-SID on each loopback gives every router the label 16000 + index for it, and EVPN rides those labels. The core (IS-IS and LDP), the BGP sessions and Sites 2 and 3 are already configured, so you build Site 1 end to end. Each site has two PEs and two Cisco CE switches. Each CE has one LACP bundle to both of its PEs, and every PE has the same gateway on a Vbdif. Turn on SR on Site 1, then build its EVPN.

HCIP-Datacom track · Huawei VRP + Cisco switches · 8 objectives

Open in simulator More HCIP-Datacom labs

Objectives

The simulator ticks each one as soon as the network meets it.

On S1-PE1 and S1-PE2, enable segment routing: segment-routing globally, segment-routing mpls and segment-routing global-block 16000 23999 under isis 1, isis prefix-sid index 11 and 12 on LoopBack0, and tunnel-policy SR selecting sr-lsp. The path to a far PE uses SR, with no LDP anywhere (display segment-routing prefix mpls forwarding, display tunnel-info all).
On S1-CE1 and S1-CE2, build Port-channel 1 with LACP: four members, trunking VLANs 10 and 20, and the host port in its VLAN.
On S1-PE1 and S1-PE2, build Eth-Trunk 1 (to CE1) and Eth-Trunk 2 (to CE2) in mode lacp-static, each with one member on card 0/0 and one on 0/1. Add .10 and .20 mode l2 sub-interfaces with encapsulation dot1q vid.
Give each Eth-Trunk its ESI: 0000.1100.0000.0000.0101 for CE1 and 0000.1100.0000.0000.0102 for CE2, the same on both PEs.
Create EVPN instances E10 and E20 in bd-mode (route-distinguisher, vpn-target 65000: both, tnl-policy SR) and bridge domains 10 and 20 bound to them, joining the sub-interfaces.
Build Vbdif10 and Vbdif20: 192.168.10.1/24 and 192.168.20.1/24, with MACs 0000-5e00-0110 and 0000-5e00-0120, the same on every PE.
Filter the gateway MACs, so no PE learns them from another PE (mac-address blackhole bridge-domain ).
Ping from S1-PC1 to its gateway, to S2-PC1 at another site, and to S1-PC2 in the other subnet.

Start this lab

Before you start

An EVPN instance on Huawei uses SR only through a tunnel policy: without tnl-policy, display evpn vpn-instance names it as the last error. display current-configuration configuration isis shows just that block. With no LDP, BGP alone signals EVPN, and IS-IS alone carries the SIDs. A SID index must be unique in the domain, or both routers’ SIDs are ignored.

Concept

Segment routing: one label per destination, everywhere

With segment routing the IGP itself distributes labels. Each router gives its loopback a prefix-SID, an index into the SR global block (SRGB, 16000–23999 by default). Every SR router then reaches that loopback with the same label, 16000 + index. No LDP sessions are needed.

Concept

EVPN all-active: one bundle to two PEs

EVPN joins sites at Layer 2 with BGP routes instead of pseudowires. A CE can bundle links to two PEs, because the PEs share an Ethernet Segment Identifier (ESI): LACP sees one partner, and all links carry traffic. Route type 4 lets the PEs of a segment find each other and elect a designated forwarder (DF) per VLAN, which alone sends flooded frames to the CE. Split horizon stops a frame going back to the segment it came from.

Concept

Anycast gateway: one gateway on every PE

Each PE has a routed interface on the bridge domain (a BVI on IOS XR, a Vbdif on Huawei), and all of them use the same IP and MAC. A host always reaches a gateway at its own site, and keeps the same gateway if it moves. But the same MAC on every PE must not travel as an EVPN route: a PE would then see its own gateway MAC behind another PE, as if it had moved.