Cisco Configuring EVPN VXLAN Layer 2 Overlay Network: Comprehensive Guide

Broadcast, Unknown Unicast, and Multicast Traffic

Configuring EVPN VXLAN Layer 2 Overlay Network Information About EVPN VXLAN Layer 2 Overlay Network, on page 1 How to Configure EVPN VXLAN Layer 2 Overlay Network, on page 4 Verifying EVPN VXLAN Layer 2 Overlay Network, on page 13 Configuration Examples for EVPN VXLAN Layer 2 Overlay Network, on page 15 Information About EVPN VXLAN Layer 2 Overlay Network An EVPN VXLAN Layer 2 overlay network allows host devices in the same subnet to send bridged or Layer 2 traffic to each other. The network forwards the bridged traffic using a Layer 2 virtual network instance (VNI).

Broadcast, Unknown Unicast, and Multicast Traffic Multidestination Layer 2 traffic in a VXLAN network is typically referred to as broadcast, unknown unicast, and multicast (BUM) traffic. In a BGP EVPN VXLAN fabric, the underlay network forwards the BUM traffic to all the endpoints connected to a common Layer 2 broadcast domain in the VXLAN overlay. The following image shows the flow of BUM traffic through a Layer 2 VNI. The network forwards BUM traffic from host device 1 to all the VTEPs which in turn send the traffic to all the host devices in the same subnet. Configuring EVPN VXLAN Layer 2 Overlay Network 1

Page 1

Ingress Replication

Figure 1: BUM Traffic through Layer 2 VNI The MP-BGP EVPN control plane uses two different methods to forward BUM traffic in a VXLAN network: • Underlay Multicast • Ingress Replication Underlay Multicast SSM is not supported for BUM Underlay Multicast. Restriction In underlay multicast, the underlay network replicates the traffic through a multicast group. Forwarding BUM traffic using underlay multicast requires the configuration of IP multicast in the underlay network. A single copy of the BUM traffic moves from the ingress or source VTEP towards the underlay transport network.

The network forwards this copy along the multicast tree so that it reaches all egress or destination VTEPs participating in the given multicast group. Various branch points in the network replicate the copy as it travels along the multicast tree. The branch points replicate the copy only if the receivers are part of the multicast group associated with the VNI. BUM traffic forwarding through underlay multicast is achieved by mapping a Layer 2 VNI to the multicast group. This mapping must be configured on all the VTEPs associated with the Layer 2 VNI. When a VTEP joins the multicast group, it receives all the traffic that is forwarded on that group.

If the VTEP receives traffic in a VNI that is not associated with it, it simply drops the traffic. This approach maintains a single link within the network, thus providing an efficient way to forward BUM traffic. Ingress Replication Ingress replication, or headend replication, is a unicast approach to handle multidestination Layer 2 overlay BUM traffic. Ingress replication involves an ingress device replicating every incoming BUM packet and Configuring EVPN VXLAN Layer 2 Overlay Network Underlay Multicast Configuring EVPN VXLAN Layer 2 Overlay Network 2

Page 2

Flooding Suppression

sending them as a separate unicast to the remote egress devices. Ingress replication happens through EVPN route type 3, also called as inclusive multicast ethernet tag (IMET) route. BGP EVPN ingress replication uses IMET route for auto-discovery of remote peers in order to set up the BUM tunnels over VXLAN. Using ingress replication to handle BUM traffic can result in scaling issues as an ingress device needs to replicate the BUM traffic as many times as there are VTEPs associated with the Layer 2 VNI. Ingress Replication Operation IMET routes carry the remote or egress VNIs advertised from the remote peers, which can be different from the local VNI.

The network creates a VXLAN tunnel adjacency when an ingress device receives IMET ingress replication routes from remote NVE peers. The tunnel adjacency is a midchain adjacency which contains IP or UDP encapsulation for the VXLAN Tunnel. If there is more than one VNI along the tunnel, then multiple VNIs share the tunnel. Ingress replication on EVPN can have multiple unicast tunnel adjacencies and different egress VNIs for each remote peer. The network builds a flooded replication list with the routes advertised by each VTEP. The dynamic replication list stores all the remote destination peers discovered on a BGP IMET route in the same Layer 2 VNI.

The replication list gets updated every time you configure the Layer 2 VNI at a remote peer. The network removes the tunnel adjacency and VXLAN encapsulation from the replication list every time a remote NVE peer withdraws the IMET ingress replication route. The network deletes the tunnel adjacency when there is no NVE peer using it. Any BUM traffic that reaches the ingress device gets replicated after the replication list is built. The ingress device forwards the replicated traffic throughout the network to all the remote peers in the same VNI. BUM Traffic Rate Limiting You can use a policer to set the flood rate limit of the BUM traffic in the network to a predefined value.

This prevents the flood rate from going beyond the limit and saves the network bandwidth. To set the flood rate limit, configure a policy with a Layer 2 miss filter on the NVE interface of a VTEP. Ensure that the policy is applied on the NVE interface for egress traffic. All the Layer 2 member VNIs under this NVE share the same policy. Any new Layer 2 VNI that is added under the NVE shares this configured policy. See Example: Configuring BUM Traffic Rate Limiting, on page 59 for a sample topology and configuration example. Flooding Suppression EVPN allows the distribution of the binding between IPv4 or IPv6 addresses and MAC addresses among the VTEPs of the network.

It distributes the MAC-IP binding among all the VTEPs that participate in the EVPN instance associated with the MAC-IP routes. The MAC address associated with the IPv4 or IPv6 addresses is locally known even though it is learned from a remote VTEP. Locally connected endpoints send an Address Resolution Protocol (ARP) or an IPv6 neighbor discovery request when they look for a remote endpoint. The MAC-IP binding distribution allows a VTEP to perform a lookup in the local cache when it receives an ARP or an IPv6 neighbor discovery request. If the MAC-IP address information for the remote end point is available, the VTEP can use this information to avoid flooding the ARP request.

If the MAC or IP address information for the remote end point is not available, the request floods throughout the fabric. Flooding suppression avoids the flooding of ARP and IPv6 neighbor discovery (ND) packets over the EVPN VXLAN network. It suppresses the flooding to both the local and remote host or access devices. The network suppresses the flooding by implementing an ARP or neighbor discovery relay. This is achieved by using the Configuring EVPN VXLAN Layer 2 Overlay Network BUM Traffic Rate Limiting Configuring EVPN VXLAN Layer 2 Overlay Network 3

Page 3

How to Configure EVPN VXLAN Layer 2 Overlay Network

known MAC address for the specified IPv4 or IPv6 address to convert broadcast and multicast requests to unicast requests. Flooding suppression is enabled by default on an EVPN-enabled VLAN. An EVPN VXLAN network suppresses the flooding for the following types of traffic: ARP Flooding Suppression VTEPs send ARP requests as broadcast packets. ARP requests represent a large percentage of Layer 2 broadcast traffic. Flooding suppression converts them to unicast packets and reduces the network flood. IPv6 Neighbor Discovery Flooding Suppression The IPv6 neighbor discovery process enables the discovery of a neighbor and helps the peers to determine each other's link-layer addresses.

It also verifies the reachability of a neighbor and tracks the neighboring routers. IPv6 neighbor discovery uses Internet Control Message Protocol (ICMP) messages and solicited-node multicast addresses to achieve these functions. Flooding suppression suppresses all multicast neighbor solicitation packets among Internet Control Message Protocol version 6 (ICMPv6) packets. In certain scenarios where proxy ARP or proxy ND is required (for example, if the Distributed Anycast Gateway SVI interface is enabled with proxy ARP or proxy ND), use the flooding-suppression address-resolution disable command to explicitly disable the flooding suppression.

How to Configure EVPN VXLAN Layer 2 Overlay Network The following figure shows a sample topology of an EVPN VXLAN Network. Host device 1 and host device 3 are part of the same subnet. The network forwards BUM traffic from host device 1 to host device 3 using a Layer 2 VNI through either underlay multicast or ingress replication methods. Note In a two-VTEP topology, a spine switch is not mandatory. For information about configuration of spine switches in an EVPN VXLAN network, see Configuring Spine Switches in a BGP EVPN VXLAN Fabric module. Perform the following set of procedures to configure an EVPN VXLAN Layer 2 overlay network and forward the BUM traffic:

Configuring EVPN VXLAN Layer 2 Overlay Network How to Configure EVPN VXLAN Layer 2 Overlay Network Configuring EVPN VXLAN Layer 2 Overlay Network 4

Page 4