Configuring Private VLANs in a BGP EVPN VXLAN Fabric - Cisco Manual PDF (EN)

Information About Private VLANs in a BGP EVPN VXLAN Fabric

ConfiguringPrivateVLANsinaBGPEVPNVXLAN Fabric Restrictions for Private VLANs in a BGP EVPN VXLAN Fabric, on page 1 Information About Private VLANs in a BGP EVPN VXLAN Fabric, on page 1 How to Configure Private VLANs in a BGP EVPN VXLAN Fabric, on page 7 Configuration Examples for Private VLANs in a BGP EVPN VXLAN Fabric, on page 11 Restrictions for Private VLANs in a BGP EVPN VXLAN Fabric Configuration of Private VLANs in a BGP EVPN VXLAN fabric must be done in the following order: 1. Configure VLAN with primary and secondary associations. 2. Enable EVPN separately in each of the primary, community, and isolated VLANs.

For more information, see Configuring an EVPN Instance on the VLAN on a VTEP . If there's an EVPN configuration already associated with a VLAN, you can't directly configure the PVLAN associations for this VLAN. First disassociate the EVPN configuration from the VLAN. Next, configure the PVLAN association. Then reconfigure EVPN in each of the newly configured primary, community, and isolated VLANs. Information About Private VLANs in a BGP EVPN VXLAN Fabric A private VLAN (PVLAN) divides a regular VLAN into logical partitions, allowing limited broadcast boundaries among selected port-groups on a single Layer 2 Ethernet switch.

The single Ethernet switch's PVLAN capabilities can be extended over the BGP EVPN VXLAN enabled network to build partitioned bridge-domain between port-groups across multiple Ethernet switches in the BGP EVPN VXLAN VTEP mode. The integration of PVLAN with a BGP EVPN VXLAN network enables the following benefits: • Microsegmented Layer 2 network segregation across one or more BGP EVPN VXLAN switches. • Partitioned and secured user-group Layer 2 network that limits the communication with dynamic or static port configuration assignments. • IP subnet pool conservation across BGP EVPN VXLAN network while extending segregated Layer 2 network across the fabric.

Configuring Private VLANs in a BGP EVPN VXLAN Fabric 1

Стр. 1

Extension of Private VLANs in a BGP EVPN VXLAN Fabric

• Conservation of Layer 2 overlay tunnels and peer networks with a single virtual network identifier (VNI) mapped to Primary VLAN. Primary and Secondary VLANs Each subdomain in a PVLAN is represented by a pair of VLANs: a primary VLAN and a secondary VLAN. A PVLAN can have multiple VLAN pairs, one pair for each subdomain. All VLAN pairs in a PVLAN share the same primary VLAN. The secondary VLAN ID differentiates one subdomain from another. A secondary VLAN can either be an isolated VLAN or a community VLAN. Primary and secondary VLANs have the following characteristics: • Primary VLAN: A PVLAN has only one primary VLAN. Every port in a PVLAN is a member of the primary VLAN.

The primary VLAN carries unidirectional traffic downstream from the promiscuous ports to the host (isolated and community) ports and to other promiscuous ports. • Isolated VLAN: A PVLAN has only one isolated VLAN. An isolated VLAN is a secondary VLAN that carries unidirectional traffic upstream from the hosts towards the promiscuous ports and the gateway. • Community VLAN: A community VLAN is a secondary VLAN that carries upstream traffic from the community ports to the promiscuous port gateways and to other host ports in the same community. You can configure multiple community VLANs in a PVLAN. Private VLAN Ports PVLAN ports are access ports that are one of these types: • Promiscuous:

A promiscuous port belongs to the primary VLAN. It can communicate with all interfaces, including the community and isolated host ports that belong to the secondary VLANs associated with the primary VLAN. • Isolated: An isolated port is a host port that belongs to an isolated secondary VLAN. It has complete Layer 2 separation from other ports within the same PVLAN, except for the promiscuous ports. PVLANs block all traffic to isolated ports except traffic from promiscuous ports. Likewise, PVLANs forward the traffic from an isolated port only to promiscuous ports. • Community: A community port is a host port that belongs to a community secondary VLAN.

Community ports communicate with other ports in the same community VLAN and with promiscuous ports. Community ports are isolated at Layer 2 from all other interfaces in external communities and also from isolated ports within their private VLAN. For more information about PVLANs and the steps to configure PVLANs, see "Configuring Private VLANs" module in the VLAN Configuration Guide for the applicable release. Extension of Private VLANs in a BGP EVPN VXLAN Fabric Private VLANs (PVLANs) partition a regular VLAN domain into subdomains and provide Layer 2 isolation between ports within the same PVLAN. Like a regular VLAN, a private VLAN can span multiple Layer 2 switches.

In a private VLAN that spans across multiple devices, traffic from an isolated port in Switch A does not reach an isolated port on Switch B. This is achieved by the trunk port carrying the primary VLAN and secondary VLANs to neighboring switches with dot1q tag in a traditional Layer 2 network. With BGP EVPN VXLAN enabled in the PVLANs on the VTEPs, the L2VNI segment preserves the PVLAN semantics and Configuring Private VLANs in a BGP EVPN VXLAN Fabric Primary and Secondary VLANs Configuring Private VLANs in a BGP EVPN VXLAN Fabric 2

Стр. 2

Known Unicast Traffic Forwarding

provides the Layer 2 isolation for the stretched PVLAN segment across the VTEPs in the overlay fabric. PVLAN extension with BGP EVPN VXLAN allows you to: • Seamlessly migrate and join (or stretch) the PVLAN domain like any regular VLAN. • Access to centralized common services such as printer or DHCP through the promiscuous port on any VTEP in the EVPN overlay. • Maintain community and isolated VLAN semantics in the overlay fabric across all the VTEPs. The EVPN fabric provides a logical single switch view for the respective Layer 2 domain. The following image shows PVLAN extension in a BGP EVPN VXLAN fabric with two VTEPs: Figure 1:

PVLAN Extension in a BGP EVPN VXLAN Fabric Traffic Forwarding for Private VLANs in a BGP EVPN VXLAN Fabric You can forward known unicast and broadcast, unknown unicast, and multicast (BUM) traffic between PVLANs in a BGP EVPN VXLAN fabric. On the Source VTEP, the forwarding process on the access PVLAN ports (promiscuous, isolated, community) adheres to the baseline PVLAN forwarding. With BGP EVPN VXLAN enabled in the PVLAN domain, the remote host routes are learned and programmed in the hardware of the respective PVLANs. The following sections illustrate the forwarding scenarios for unicast and BUM traffic between local and remote hosts for each of the secondary VLANs.

Known Unicast Traffic Forwarding The sending VTEP bridges a known unicast packet with the corresponding secondary VLAN’s virtual network identifier (VNI) ID. The packet arrives on the receiving VTEP. After decapsulation, receiving VTEP processes the packet in the same way as a packet from a local PVLAN host port. The packet gets mapped to the respective community, isolated, or primary VLAN. The following images illustrate the known unicast traffic forwarding scenarios for PVLANs in a BGP EVPN VXLAN fabric: Configuring Private VLANs in a BGP EVPN VXLAN Fabric Traffic Forwarding for Private VLANs in a BGP EVPN VXLAN Fabric Configuring Private VLANs in a BGP EVPN VXLAN Fabric 3

Стр. 3

Known Unicast Traffic Forwarding

Figure 2: Unicast Traffic from Promiscuous Port : H14 to H8 Figure 3: Unicast Traffic from Isolated Port: H1 to H13 Configuring Private VLANs in a BGP EVPN VXLAN Fabric Known Unicast Traffic Forwarding Configuring Private VLANs in a BGP EVPN VXLAN Fabric 4

Стр. 4