H3C S10500 Series User manual

H3C S10500 Switch Series
EVPN
Configuration Guide
Hangzhou H3C Technologies Co., Ltd.
http://www.h3c.com
Software version: S10500-CMW710-R7523P01
Document version: 6W100-20160830

Copyright © 2016, Hangzhou H3C Technologies Co., Ltd. and its licensors
All rights reserved
No part of this manual may be reproduced or transmitted in any form or by any means without prior written
consent of Hangzhou H3C Technologies Co., Ltd.
Trademarks
H3C, , H3CS, H3CIE, H3CNE,Aolynk, , H3Care, , IRF, NetPilot, Netflow, SecEngine,
SecPath, SecCenter, SecBlade, Comware, ITCMM and HUASAN are trademarks of Hangzhou H3C
Technologies Co., Ltd.
All other trademarks that may be mentioned in this manual are the property of their respective owners
Notice
The information in this document is subject to change without notice. Every effort has been made in the
preparation of this document to ensure accuracy of the contents, but all statements, information, and
recommendations in this document do not constitute the warranty of any kind, express or implied.

Preface
This configuration guide describes fundamentals and configuration of Ethernet Virtual Private
Network (EVPN). EVPN is a Layer 2 VPN technology that provides connectivity between distant
network sites across an IP network. EVPN uses MP-BGPin the control plane and VXLAN in the data
plane.
This preface includes the following topics about the documentation:
•Audience.
•Conventions.
•About the H3C S10500 documentation set.
•Obtaining documentation.
•Technical support.
•Documentation feedback.
Audience
This documentation is intended for:
•Network planners.
•Field technical support and servicing engineers.
•Network administrators working with the S10500 switch series.
Conventions
This section describes the conventions used in the documentation.
Port numbering in examples
The port numbers in the documentation are for illustration only and might be unavailable on your
device.
Command conventions
Convention Description
Boldface Bold text represents commands and keywords that you enter literally as shown.
Italic Italic text represents arguments that you replace with actual values.
[ ] Square brackets enclose syntax choices (keywords or arguments) that are optional.
{ x | y | ... }
Braces enclose a set of required syntax choices separated by vertical bars, from which
you select one.
[ x | y | ... ]
Square brackets enclose a set of optional syntax choices separated by vertical bars,
from which you select one or none.

Convention Description
{ x | y | ... } *
Asterisk marked braces enclose a set of required syntax choices separated by vertical
bars, from which you select at least one.
[ x | y | ... ] *
Asterisk marked square brackets enclose optional syntax choices separated by vertical
bars, from which you select one choice, multiple choices, or none.
&<1-n> The argument or keyword and argument combination before the ampersand (&) sign
can be entered 1 to n times.
# A line that starts with a pound (#) sign is comments.
GUI conventions
Convention Description
Boldface Window names, button names, field names, and menu items are in Boldface. For
example, the New User window appears; click OK.
> Multi-level menus are separated by angle brackets. For example, File > Create >
Folder.
Symbols
Convention Description
WARNING! An alert that calls attention to important information that if not understood or followed
can result in personal injury.
CAUTION: An alert that calls attention to important information that if not understood or followed
can result in data loss, data corruption, or damage to hardware or software.
IMPORTANT: An alert that calls attention to essential information.
NOTE: An alert that contains additional or supplementary information.
TIP: An alert that provides helpful information.
Network topology icons
Convention Description
Represents a generic network device, such as a router, switch, or firewall.
Represents a routing-capable device, such as a router or Layer 3 switch.
Represents a generic switch, such as a Layer 2 or Layer 3 switch, or a router that
supports Layer 2 forwarding and other Layer 2 features.
Represents an access controller, a unified wired-WLAN module, or the access
controller engine on a unified wired-WLAN switch.
Represents an access point.
Wireless terminator unit.
T
T

Convention Description
Wireless terminator.
Represents a mesh access point.
Represents omnidirectional signals.
Represents directional signals.
Represents a security product, such as a firewall, UTM, multiservice security
gateway, or load balancing device.
Represents a security card, such as a firewall, load balancing, NetStream, SSL VPN,
IPS, or ACG card.
About the H3C S10500 documentation set
The H3C S10500 documentation set includes the following categories of documents:
Category Documents Purposes
Product description and
specifications Marketing brochures Describes product specifications and benefits.
Hardware specifications
and installation
Compliance and safety
manual
Provides regulatory information and the safety
instructions that must be followed during
installation.
Quick start Guides you through initial installation and setup
procedures to help you quickly set up and use
your device with the minimum configuration.
Installation guide Provides a complete guide to hardware
installation and hardware specifications.
H3C Pluggable SFP
[SFP+][XFP] Transceiver
Modules Installation Guide
Guides you through installing SFP/SFP+/XFP
transceiver modules.
H3C CFP Transceiver
Modules Installation Guide Guides you through installing CFP transceiver modules.
H3C QSFP+ Transceiver
Modules Installation Guide Guides you through installing QSFP+ transceiver modules.
H3C Transceiver Modules
User Guide
Describes the transceiver modules available
for the H3C network products, their external
views, and specifications.
T
T

Category Documents Purposes
Software configuration
Configuration guides Describes software features and configuration
procedures.
Command references Provides a quick reference to all available
commands.
Configuration examples Describes typical network scenarios and
provide configuration examples and
instructions.
Operations and
maintenance
Troubleshooting Provides troubleshooting information for
common problems of using the product.
FAQ Covers the most frequently asked questions about the hardware, software and system
specifications.
Release notes
Provides information about the product
release, including the version history, hardware
and software compatibility matrix, version
upgrade information, technical support
information, and software upgrading.
System log messages Explains the system log messages.
Obtaining documentation
Access the most up-to-date H3C product documentation on the World Wide Web
at http://www.h3c.com.
Click the following links to obtain different categories of product documentation:
[Technical Documents]—Provides hardware installation, software upgrading, and software feature
configuration and maintenance documentation.
[Products & Solutions]—Provides information about products and technologies, as well as
solutions. [Software Download]—Provides the documentation released with the software version.
Technical support
[e-mail]
http://www.h3c.com
Documentation feedback
You can e-mail your comments about product documentation to [e-mail].
We appreciate your comments.

i
Contents
EVPN overview·······························································································1
EVPN network model·········································································································································1
MP-BGP extension for EVPN ····························································································································2
Configuration automation···································································································································3
Assignment of traffic to VXLANs························································································································3
Traffic from the local site to a remote site··································································································3
Traffic from a remote site to the local site··································································································4
Layer 2 forwarding ·············································································································································4
MAC learning ·············································································································································4
Unicast·······················································································································································4
Flood··························································································································································5
Layer 3 forwarding ·············································································································································6
Centralized EVPN gateway deployment····································································································6
Distributed EVPN gateway deployment·····································································································7
ARP flood suppression ····································································································································10
MAC mobility····················································································································································11
Configuring EVPN·························································································12
Hardware compatibility restrictions ··················································································································12
EVPN configuration task list·····························································································································12
Creating a VXLAN on a VSI·····························································································································12
Configuring an EVPN instance ························································································································13
Configuring BGP to advertise EVPN routes·····································································································13
Mapping an Ethernet service instance to a VSI·······························································································15
Configuring a centralized EVPN gateway········································································································16
Configuration restrictions and guidelines·································································································16
Configuration procedure···························································································································16
Configuring a distributed EVPN gateway·········································································································16
Configuration restrictions and guidelines·································································································16
Configuration prerequisites······················································································································16
Configuring a VSI interface as a gateway interface·················································································17
Configuring an L3 VXLAN ID for a VSI interface······················································································17
Configuring IP prefix route advertisement································································································18
Managing remote MAC address entries and remote ARP learning·································································19
Disabling remote MAC address learning and remote ARP learning························································19
Disabling MAC address advertisement····································································································20
Disabling learning of MAC addresses from ARP information···································································20
Enabling BGP EVPN route advertisement to the local site··············································································20
Confining floods to the local site ······················································································································21
Enabling ARP flood suppression ·····················································································································21
Displaying and maintaining EVPN ···················································································································22
EVPN configuration examples ·························································································································22
Centralized EVPN gateway configuration example··················································································22
Distributed EVPN gateway configuration example···················································································31
Index·············································································································41

1
EVPN overview
Ethernet Virtual Private Network (EVPN) is a Layer 2 VPN technology that provides both Layer 2 and
Layer 3 connectivity between distant network sites across an IP network. EVPN uses MP-BGP in the
control plane and VXLAN in the data plane. EVPN is typically used in data centers for multitenant
services.
EVPN provides the following benefits:
•Configuration automation—MP-BGP automates VTEP discovery, VXLAN tunnel
establishment, and VXLAN tunnel assignment to ease deployment.
•Separation of the control plane and the data plane—EVPN uses MP-BGPto advertise host
reachability information in the control plane and uses VXLAN to forward traffic in the data plane.
•Integrated bridging and routing (IBR)—MP-BGP advertises both Layer 2 and Layer 3 host
reachability information to provide optimal forwarding paths and minimize flooding.
EVPN network model
As shown in Figure 1, EVPN uses the VXLAN technology for traffic forwarding in the data plane. The
transport edge devices assign VMs to different VXLANs, and then forward traffic between sites for
VMs by using VXLAN tunnels. The transport edge devices are VXLAN tunnel endpoints (VTEPs).
They can be servers that host VMs or independent network devices.
A VTEP uses ESs, VSIs, and VXLAN tunnels to provide VXLAN services:
•Ethernet segment (ES)—An ES is a link that connects a site to a VTEP. Each ES is uniquely
identified by an Ethernet segment identifier (ESI). A site can be connected to a VTEP through
only one ES. The ES uses ESI 0.
•VSI—A virtual switch instance is a virtual Layer 2 switched domain. Each VSI provides
switching services only for one VXLAN. VSIs learn MAC addresses and forward frames
independently of one another. VMs in different sites have Layer 2 connectivity if they are in the
same VXLAN.A VXLAN is identified by a 24-bit VXLAN ID which is also called the virtual
network identifier (VNI). A VXLAN corresponds to an EVPN instance.
•VXLAN tunnel—Logical point-to-point tunnels between VTEPs over the transport network.
Each VXLAN tunnel can trunk multiple VXLANs.
All VXLAN processing is performed on VTEPs. The ingress VTEP encapsulates VXLAN traffic in the
VXLAN, outer UDP, and outer IP headers, and forwards the traffic through VXLAN tunnels. The
egress VTEP removes the VXLAN encapsulation and forwards the traffic to the destination.
Transport network devices (for example, the P device in Figure 1) forward VXLAN traffic only based
on the outer IP header of VXLAN packets.

2
Figure 1 EVPN network model
As shown in Figure 2, typically the EVPN transport network uses a layered structure. On the
transport network, leaf nodes act as VTEPs to provide VXLAN services, and spine nodes perform
forwarding for VXLAN traffic based on the outer IP header. If all VTEPs and transport network
devices of an EVPN network belong to the same AS, the spine nodes can act as route reflectors
(RRs) to reflect routes between the VTEPs. In this scenario, the spine nodes advertise and receive
EVPN routes, but do not perform VXLAN encapsulation and de-encapsulation.
Figure 2 Layered transport network
MP-BGP extension for EVPN
To support EVPN, MP-BGP introduces the EVPN subsequent address family under the L2VPN
address family and the following network layer reachability information (EVPN routes):
•Ethernet auto-discovery route—Advertises ES information in multihomed sites.
•MAC/IP advertisement route—Advertises MAC reachability information and host route
information (host ARP information).
•Inclusive multicast Ethernet tag (IMET) route—Advertises VTEP and VXLAN mappings for
automating VTEP discovery, VXLAN tunnel establishment, and VXLAN tunnel assignment.
•Ethernet segment route—Advertises ES and VTEP mappings.
VXLAN tunnel
VTEP
Server Server
Site 1 Site 2
VM
VM
VM
VSI/VXLAN 10
VSI/VXLAN 20
VSI/VXLAN 30
VM
VM
VM
VSI/VXLAN 10
VSI/VXLAN 20
VSI/VXLAN 30
Transport
network
P
ES ES
VTEP

3
•IP prefix advertisement route—Advertises external routes as IP prefixes.
MP-BGP uses the route distinguisher (RD) field to differentiate EVPN routes of different VXLANs and
uses route target attributes to control the advertisement and acceptance of EVPN routes. MP-BGP
supports the following types of route target attributes:
•Export target attribute—AVTEP sets the export target attribute for EVPN routes learned from
the local site before advertising them to remote VTEPs.
•Import target attribute—A VTEP checks the export target attribute of EVPN routes received
from remote VTEPs. The VTEP imports the EVPN routes only when their export target attribute
matches the local import target attribute.
Configuration automation
VTEPs use EVPN routes to discover VTEP neighbors, establish VXLAN tunnels, and assign the
tunnels to VXLANs.
•IMET route—VTEPs advertise the VXLAN IDs they have through IMET routes. If two VTEPs
have the same VXLAN ID, they automatically establish a VXLAN tunnel and assign the tunnel
to the VXLAN.
•MAC/IP advertisement route and IP prefix advertisement route—In the EVPN gateway
deployment, VTEPs advertise MAC/IP advertisement routes or IP prefix advertisement routes
with the export target attribute. If a VTEP receives a route of which the export target attribute
matches the local import target attribute, the VTEP establishes a VXLAN tunnel with the remote
VTEP and associates the tunnel with the L3 VXLAN ID of the corresponding VPN instance. For
more information about the L3 VXLAN ID, see "Distributed EVPN gateway deployment."
Assignment of traffic to VXLANs
Traffic from the local site to a remote site
The VTEP uses an Ethernet service instance to match a list of VLANs on a site-facing interface. The
VTEP assigns customer traffic to a VXLAN by mapping the Ethernet service instance to a VSI. An
Ethernet service instance is identical to an attachment circuit (AC) in L2VPN.
As shown in Figure 3, Ethernet service instance 1 matches VLAN 2 and is mapped to VSI A(VXLAN
10). When a frame from VLAN 2 arrives, the VTEPassigns the frame to VXLAN 10, and looks up VSI
A's MAC address table for the outgoing interface.
Figure 3 Identifying traffic from the local site

4
Traffic from a remote site to the local site
When a VXLAN packet arrives at a VXLAN tunnel interface, the VTEP uses the VXLAN ID in the
packet to identify its VXLAN.
Layer 2 forwarding
MAC learning
The VTEP performs Layer 2 forwarding based on a VSI's MAC address table. The VTEPlearns MAC
addresses by using the following methods:
•Local MAC learning—The VTEP automatically learns the source MAC addresses of frames
sent from the local site. The outgoing interfaces of local MAC address entries are site-facing
interfaces on which the MAC addresses are learned.
•Remote MAC learning—The VTEP uses MP-BGP to advertise local MAC reachability
information to remote sites and learn MAC reachability information from remote sites. The
outgoing interfaces of MAC address entries advertised from a remote site are VXLAN tunnel
interfaces.
Unicast
As shown in Figure 4, the VTEP performs typical Layer 2 forwarding for known unicast traffic within
the local site.
Figure 4 Intra-site unicast
As shown in Figure 5, the following process applies to a known unicast frame between sites:
1. The source VTEP encapsulates the Ethernet frame in the VXLAN/UDP/IP header.
In the outer IP header, the source IP address is the source VTEP's VXLAN tunnel source IP
address. The destination IP address is the VXLAN tunnel destination IP address.
2. The source VTEP forwards the encapsulated packet out of the outgoing VXLAN tunnel
interface found in the VSI's MAC address table.
3. The intermediate transport devices (P devices) forward the packet to the destination VTEP by
using the outer IP header.

5
4. The destination VTEP removes the headers on top of the inner Ethernet frame. It then performs
MAC address table lookup in the VXLAN's VSI to forward the frame out of the matching
outgoing interface.
Figure 5 Inter-site unicast
Flood
As shown in Figure 6, a VTEP floods a broadcast, multicast, or unknown unicast frame to all
site-facing interfaces and VXLAN tunnels in the VXLAN, except for the incoming interface. The
source VTEP replicates the flood frame, and then sends one replica to the destination IP address of
each VXLAN tunnel in the VXLAN. Each destination VTEP floods the inner Ethernet frame to all the
site-facing interfaces in the VXLAN. To avoid loops, the destination VTEPs do not flood the frame to
VXLAN tunnels.

6
Figure 6 Forwarding of flood traffic
Layer 3 forwarding
EVPN uses EVPN gateways to provide Layer 3 forwarding services for hosts in VXLANs. EVPN
provides the following EVPN gateway placement designs:
•Centralized EVPN gateway deployment—Use one VTEP to provide Layer 3 forwarding for
VXLANs. Typically, the gateway-collocated VTEP connects to other VTEPs and the external
network. To use this design, make sure the gateway has sufficient bandwidth and processing
capability.
•Distributed EVPN gateway deployment—Deploy one EVPN gateway on each VTEP to
provide Layer 3 forwarding for VXLANs at their respective sites. This design distributes the
Layer 3 traffic load across VTEPs. However, its configuration is more complex than the
centralized EVPN gateway design.
In either design, the gateways use virtual Layer 3 VSI interfaces as gateway interfaces for VXLANs.
Centralized EVPN gateway deployment
As shown in Figure 7, a VTEP acts as a gateway for VMs in the VXLANs. The VTEPboth terminates
the VXLANs and performs Layer 3 forwarding for the VMs. The network uses the following process
to forward Layer 3 traffic from a VM to the destination:
1. The VM sends an ARP request to obtain the MAC address of the VSI interface that acts as the
gateway, and then sends the Layer 3 traffic to the centralized EVPN gateway.
2. The local VTEP looks up the matching VSI's MAC address table and forwards the traffic to the
centralized EVPN gateway through a VXLAN tunnel.
3. The centralized EVPN gateway removes the VXLAN encapsulation and forwards the traffic at
Layer 3.
4. The centralized EVPN gateway forwards the replies sent by the destination node to the VM
based on the ARP entry for the VM.

7
Figure 7 Example of centralized EVPN gateway deployment
Distributed EVPN gateway deployment
As shown in Figure 8, each site's VTEP acts as a gateway to perform Layer 3 forwarding for the
VXLANs of the local site.A VTEP acts as a border gateway to the Layer 3 network for the VXLANs.
Figure 8 Distributed EVPN gateway placement design
VXLAN tunnel
VTEP 1 VTEP 2
Server Server
Site 1 Site 2
VM
VM
VM
VSI/VXLAN 10
VSI/VXLAN 20
VSI/VXLAN 30
VM
VM
VM
VSI/VXLAN 10
VSI/VXLAN 20
VSI/VXLAN 30
Transport
network
P
10.1.1.11
20.1.1.11
30.1.1.11
10.1.1.12
20.1.1.12
30.1.1.12
VXLAN tunnel
VXLANtunnel
VTEP 3/Centralized EVPN gateway
VSI/VXLAN 10
VSI/VXLAN 20
VSI/VXLAN 30
VSI-interface10
10.1.1.1/24
VSI-interface20
20.1.1.1/24
VSI-interface30
30.1.1.1/24
L3 network

8
A distributed EVPN gateway uses symmetric IBR for Layer 3 forwarding, which means both the
ingress and egress gateways perform Layer 2 and Layer 3 lookups. Symmetric IBR introduces the
following concepts:
•L3 VXLAN ID—Also called L3 VNI.An L3 VXLAN ID identifies the traffic of a routing domain
where devices have Layer 3 reachability. An L3 VXLAN ID is associated with one VPN instance.
Distributed EVPN gateways use VPN instances to isolate traffic of different services on VXLAN
tunnel interfaces.
•Router MAC address—Each distributed EVPN gateway has a unique router MAC address
used for inter-gateway forwarding. The MAC addresses in the inner Ethernet header of VXLAN
packets are router MAC addresses of distributed EVPN gateways.
As shown in Figure 9, each distributed EVPN gateway has the following types of VSI interfaces:
•VSI interface as a gateway interface of a VXLAN—The VSI interface acts as the gateway
interface for VMs in a VXLAN. The VSI interface is associated with a VSI and a VPN instance.
On different distributed EVPN gateways,the VSI interface of a VXLAN use the same IPaddress
to provide services.
•VSI interface associated with an L3 VXLAN ID—The VSI interface is associated with a VPN
instance and assigned an L3 VXLAN ID. VSI interfaces associatedwith the same VPN instance
share an L3 VXLAN ID.
A border gateway only has VSI interfaces that are associated with an L3 VXLAN ID.
Figure 9 Example of distributed EVPN gateway deployment
Layer 3 forwarding entry learning
A distributed EVPN gateway forwards Layer 3 traffic based on FIB entries generated from EVPN
routes and ARP information.
A VTEP advertises an external route imported in the EVPN address family through MP-BGP. A
remote VTEPadds the route to the FIB table of a VPN instance based on the L3 VXLAN ID carried in

9
the route. In the FIB entry, the outgoing interface is a VXLAN tunnel interface, and the next hop is the
peer VTEP address in the NEXT_HOP attribute of the route.
A VTEP has the following types ofARP information:
•Local ARP information—ARP information of VMs in the local site. The VTEP snoops GARP
packets, RARP packets, and ARP requests for the gateway MAC address to learn the ARP
information of the senders and generatesARP entries and FIB entries. In an ARP or FIB entry,
the outgoing interface is the site-facing interface where the packet is received, and the VPN
instance is the instance associated with the corresponding VSI interface.
•Remote ARP information—ARP information of VMs in remote sites. Each VTEP uses
MP-BGP to advertise its local ARP information with L3 VXLAN IDs in routes to remote sites. A
VTEP generates only FIB entries for the remote ARP information. In a FIB entry, the outgoing
interface is the VSI interface associated with the L3 VXLAN ID, the next hop is the peer VTEP
address in the NEXT_HOP attribute of the route, and the VPN instance is the instance
associated with the L3 VXLAN ID. The VTEP then creates an ARP entry for the next hop in the
FIB entry.
Traffic forwarding
A distributed EVPN gateway can work in one of the following mode:
•Switching and routing mode—Forwards Layer 2 traffic based on the MAC address table and
forwards Layer 3 traffic based on the FIB table. In this mode, you need to enable ARP flood
suppression on the distributed EVPN gateway to reduce flooding.
•Routing mode— Forwards both Layer 2 and Layer 3 traffic based on the FIB table. In this
mode, you need to enable local proxy ARP on the distributed EVPN gateway.
For more information about MAC address table-based Layer 2 forwarding, see "Unicast."
Figure 10 shows the intra-site Layer 3 forwarding process.
1. The source VM sends an ARP request to obtain the MAC address of the destination VM.
2. The gateway replies to the source VM with the MAC address of the VSI interface associated
with the source VM's VSI.
3. The source VM sends a Layer 3 packet to the gateway.
4. The gateway looks up the FIB table of the VPN instance associated with the source VM's VSI
and finds the matching outgoing site-facing interface.
5. The gateway processes the Ethernet header of the Layer 3 packet as follows:
{Replaces the destination MAC address with the destination VM's MAC address.
{Replaces the source MAC address with the VSI interface's MAC address.
6. The gateway forwards the Layer 3 packet to the destination VM.
Figure 10 Intra-site Layer 3 forwarding
Figure 11 shows the inter-site Layer 3 forwarding process.

10
7. The source VM sends an ARP request to obtain the MAC address of the destination VM.
8. The gateway replies to the source VM with the MAC address of the VSI interface associated
with the source VM's VSI.
9. The source VM sends a Layer 3 packet to the gateway.
10. The gateway looks up the FIB table of the VPN instance associated with the source VM's VSI
and finds the matching outgoing VSI interface.
11. The gateway processes the Ethernet header of the Layer 3 packet as follows:
{Replaces the destination MAC address with the destination gateway's router MAC address.
{Replaces the source MAC address with its own router MAC address.
12. The gateway adds VXLAN encapsulation to the Layer 3 packet and forwards the packet to the
destination gateway. The encapsulated VXLAN ID is the L3 VXLAN ID of the corresponding
VPN instance.
13. The destination gateway identifies the VPN instance of the packet based on the L3 VXLAN ID
and removes the VXLAN encapsulation. Then the gateway forwards the packet based on the
matching ARP entry.
Figure 11 Inter-site Layer 3 forwarding
ARP flood suppression
ARP flood suppression reduces ARP request broadcasts by enabling the VTEP to reply to ARP
requests on behalf of VMs.
As shown in Figure 12, this feature snoops ARPrequests, ARP responses, and BGPEVPN routes to
populate theARP flood suppression table with local and remote MAC addresses. If an ARP request
has a matching entry, the VTEP replies to the request on behalf of the VM. If no match is found, the
VTEP floods the request to both local and remote sites.
GW 1 P GW 2
DATA
Transport
network
Server 1
VM 1
IP 1
MAC 1
Server 2
VM 2
IP 2
MAC 2
GW IP
GW MAC (VSI interface MAC)
GW MAC 1 (Router MAC of GW 1)
VTEP IP 1
L3VNI 100
GW IP
GW MAC (VSI interface MAC)
GW MAC 2 (Router MAC of GW 2)
VTEP IP 2
L3VNI 100
SIP: IP 1
DIP: IP 2
SMAC: MAC 1
DMAC: GW MAC
DATA
SIP: IP 1
DIP: IP 2
SMAC: GW MAC 1
DMAC: GW MAC 2
VNI: 100
SIP: VTEP IP 1
DIP: VTEP IP 2
DATA
SIP: IP 1
DIP: IP 2
SMAC: GW MAC
DMAC: MAC 2

11
Figure 12 ARP flood suppression
ARP flood suppression uses the following workflow:
1. VM 1 sends an ARP request to obtain the MAC address of VM 7.
2. VTEP 1 creates a suppression entry for VM 1, and floods the ARP request in the VXLAN.
3. VTEP 2 and VTEP 3 de-encapsulate the ARP request. The VTEPs create a suppression entry
for VM 1, and broadcast the request in the local site.
4. VM 7 sends an ARP reply.
5. VTEP 2 creates a suppression entry for VM 7 and forwards the ARP reply to VTEP 1.
6. VTEP 1 de-encapsulates the ARP reply, creates a suppression entry for VM 7, and forwards the
ARP reply to VM 1.
7. VM 4 sends an ARP request to obtain the MAC address of VM 1 or VM 7.
8. VTEP 1 creates a suppression entry for VM 4 and replies to the ARP request.
9. VM 10 sends an ARP request to obtain the MAC address of VM 1.
10. VTEP 3 creates a suppression entry for VM 10 and replies to the ARP request.
MAC mobility
MAC mobility refers to that a VM or host moves from one ES to another. The source VTEP is
unaware of the MAC move event. To notify other VTEPs of the change, the destination VTEP
advertises a MAC/IP advertisement route for the MAC address. The source VTEPwithdraws the old
route for the MAC address after receiving the new route. The MAC/IP advertisement route has a
sequence number that increases when the MAC address moves. The sequence number identifies
the most recent move if the MAC address moves multiple times.

12
Configuring EVPN
Hardware compatibility restrictions
VXLAN transport-facing interfaces must be on the following SG interface modules:
•LSUM2QGS12SG0.
•LSUM2TGS32QSSG0.
•LSUM2TGS48SG0.
EVPN configuration task list
Tasks at a glance Remarks
(Required) Creating a VXLAN on a VSI N/A
(Required) Configuring an EVPN instance N/A
(Required) Configuring BGP to advertise EVPN routes N/A
(Required) Mapping an Ethernet service instance to a VSI Perform this task to assign customer
traffic to VXLANs.
(Optional.) Configuring an EVPN gateway:
•Configuring a centralized EVPN gateway
•Configuring a distributed EVPN gateway
Perform this task to provide Layer 3
connectivity for VXLANs.
(Optional.) Managing remote MAC address entries and remote ARP
learning N/A
(Optional.) Enabling BGP EVPN route advertisement to the local site Perform this task to advertise private
BGP EVPN routes to the local site.
(Optional.) Confining floods to the local site Perform this task to reduce flooding
to the transport network.
(Optional.) Enabling ARP flood suppression Perform this task to reduce ARP
request broadcasts.
Creating a VXLAN on a VSI
Step Command Remarks
1. Enter system view. system-view N/A
2. Enable L2VPN. l2vpn enable By default, L2VPN is disabled.
3. Create a VSI and enter
VSI view. vsi vsi-name By default, no VSIs exist.
4. (Optional.) Configure a
VSI description. description text By default, a VSI does not have a
description.
5. Enable the VSI. undo shutdown By default, a VSI is enabled.

13
Step Command Remarks
6. (Optional.) Set the MTU
for the VSI. mtu mtu The default MTU is 1500 bytes for a
VSI.
7. (Optional.) Enable MAC
address learning for the
VSI. mac-learning enable By default, MAC address learning is
enabled for a VSI.
8. Create a VXLAN and
enter VXLAN view. vxlan vxlan-id
By default, no VXLANs exist.
You can create only one VXLAN on
a VSI. The VXLAN ID must be
unique for each VSI.
Configuring an EVPN instance
You do not need to associate a VPN instance with a VXLAN that requires only Layer 2 connectivity.
The EVPN routes advertised by the device carry the RD and route targets configured for the EVPN
instance associated with the VXLAN.
To configure an EVPN instance:
Step Command Remarks
1. Enter system view. system-view N/A
2. Enter VSI view. vsi vsi-name N/A
3. Create an EVPN
instance and enter
EVPN instance view. evpn encapsulation vxlan By default, no EVPN instance exists.
4. Configure an RD for the
EVPN instance. route-distinguisher
{ route-distinguisher | auto } By default, no RD is configured for an EVPN instance.
5. Configure route target
attributes for the EVPN
instance.
vpn-target { vpn-target&<1-8> |
auto } [ both |
export-extcommunity |
import-extcommunity ]
By default, an EVPN instance does not
have route target attributes.
Make sure the following requirements
are met:
•The import targets of the EVPN
instance do not match the export
targets of the VPN instance
associated with the VXLAN.
•The export targets of the EVPN
instance do not match the import
targets of the VPN instance.
Configuring BGP to advertise EVPN routes
For more information about the following BGP commands, see Layer 3—IP Routing Command
Reference:
•peer allow-as-loop
•peer as-number
•peer enable
•peer reflect-client
•reflect between-clients
•reflector cluster-id