HPE FlexFabric 5950 Series User manual

HPE FlexFabric 5950 Switch Series
EVPN Configuration Guide
P
art number: 5200-2204a
Software
version: Release 6123 and later
Document version: 6W101-20170120

© Copyright 2017 Hewlett Packard Enterprise Development LP
The information contained herein is subject to change without notice. The only warranties for Hewlett Packard
Enterprise products and services are set forth in the express warranty statements accompanying such
products and services. Nothing herein should be construed as constituting an additional warranty. Hewlett
Packard Enterprise shall not be liable for technical or editorial errors or omissions contained herein.
Confidential computer software. Valid license from Hewlett Packard Enterprise required for possession, use, or
copying. Consistent with FAR 12.211 and 12.212, Commercial Computer Software, Computer Software
Documentation,and Technical Data for Commercial Items are licensed to the U.S. Government under vendor’s
standard commercial license.
Links to third-party websites take you outside the Hewlett Packard Enterprise website. Hewlett Packard
Enterprise has no control over and is not responsible for information outside the Hewlett Packard Enterprise
website.
Acknowledgments
Intel®, Itanium®, Pentium®, Intel Inside®, and the Intel Inside logo are trademarks of Intel Corporation in the
United States and other countries.
Microsoft® and Windows® are trademarks of the Microsoft group of companies.
Adobe® andAcrobat® are trademarks of Adobe Systems Incorporated.
Java and Oracle are registered trademarks of Oracle and/or its affiliates.
UNIX® is a registered trademark of The Open Group.

i
Contents
EVPN overview················································································1
EVPN network model··················································································································1
Layered transport network ···········································································································2
MP-BGP extension for EVPN ·······································································································2
Configuration automation·············································································································3
Assignment of traffic to VXLANs····································································································3
Traffic from the local site to a remote site··················································································3
Traffic from a remote site to the local site··················································································4
Layer 2 forwarding ·····················································································································4
MAC learning ·····················································································································4
Unicast······························································································································4
Flood································································································································6
Layer 3 forwarding ·····················································································································6
Centralized EVPN gateway deployment ···················································································6
Distributed EVPN gateway deployment····················································································7
RD and route target selection of BGP EVPN routes·········································································11
ARP flood suppression··············································································································12
MAC mobility ··························································································································13
Configuring EVPN··········································································14
Configuration restrictions and guidelines·······················································································14
VXLAN tunnel configuration restrictions and guidelines ·····························································14
EVPN gateway configuration restrictions and guidelines····························································14
EVPN configuration task list ·······································································································14
Setting the VXLAN hardware resource allocation mode····································································15
Creating a VXLAN on a VSI ······································································································· 15
Configuring an EVPN instance····································································································16
Configuring BGP to advertise BGP EVPN routes ············································································17
Mapping an Ethernet service instance to a VSI···············································································18
Configuring a centralized EVPN gateway······················································································19
Configuration restrictions and guidelines ················································································19
Configuration prerequisites·································································································· 19
Configuration procedure ····································································································· 20
Configuring a distributed EVPN gateway······················································································· 20
Configuration restrictions and guidelines ················································································20
Configuration prerequisites·································································································· 20
Configuring a VSI interface··································································································21
Configuring an L3 VXLAN ID for a VSI interface·······································································22
Configuring IP prefix route advertisement ···············································································24
Managing remote MAC address entries and remote ARP learning······················································25
Disabling remote MAC address learning and remote ARP learning ··············································25
Disabling MAC address advertisement···················································································25
Disabling learning of MAC addresses from ARP information·······················································26
Enabling BGP EVPN route advertisement to the local site ································································26
Confining floods to the local site··································································································27
Enabling ARP flood suppression ································································································· 27
Displaying and maintaining EVPN ·······························································································28
EVPN configuration examples ····································································································28
Centralized EVPN gateway configuration example ···································································28
Distributed EVPN gateway configuration example ····································································37
Private-public network communication example ·······································································47
Configuring EVPN-DCI····································································59
Overview································································································································ 59
EVPN-DCI network model···································································································59
Working mechanisms········································································································· 59
Configuration restrictions and guidelines·······················································································59

ii
EVPN-DCI configuration task list·································································································59
Configuration prerequisites ········································································································60
Enabling DCI ·························································································································· 60
Enabling route nexthop replacement and route router MAC replacement ·············································60
Configuring VXLAN mapping······································································································61
Overview························································································································· 61
Configuration restrictions and guidelines ················································································62
Configuration procedure ····································································································· 62
EVPN-DCI configuration examples ······························································································62
Basic EVPN-DCI configuration example·················································································62
EVPN-DCI intermediate VXLAN mapping configuration example·················································68
EVPN-DCI Layer 3 communication configuration example ·························································75
Document conventions and icons ······················································83
Conventions ···························································································································83
Network topology icons ············································································································· 84
Support and other resources ····························································85
Accessing Hewlett Packard Enterprise Support ··············································································85
Accessing updates···················································································································85
Websites ·························································································································85
Customer self repair···········································································································86
Remote support ················································································································ 86
Documentation feedback ···································································································· 86
Index···························································································87

1
EVPN overview
Ethernet Virtual Private Network (EVPN) is a Layer 2 VPN technology thatprovides both Layer 2 and
Layer 3 connectivity between distant network sites across an IP network. EVPN uses MP-BGP in the
control plane and VXLAN in the data plane. EVPN is typically used in data centers for multitenant
services.
EVPN provides the following benefits:
•Configuration automation—MP-BGP automates VTEP discovery, VXLAN tunnel
establishment, and VXLAN tunnel assignment to ease deployment.
•Separation of the control plane and the data plane—EVPN uses MP-BGP to advertise host
reachability information in the control plane and uses VXLAN to forward traffic in the data plane.
•Integrated routing and bridging (IRB)—MP-BGP advertises both Layer 2 and Layer 3 host
reachability information to provide optimal forwarding paths and minimize flooding.
EVPN network model
As shown in Figure 1, EVPN uses the VXLAN technology for traffic forwarding in the data plane. The
transport edge devices assign VMs to different VXLANs, and then forward traffic between sites for
VMs by using VXLAN tunnels. The transport edge devices are VXLAN tunnel endpoints (VTEPs).
They can be servers that host VMs or independent network devices.
A VTEP uses ESs, VSIs, and VXLAN tunnels to provide VXLAN services:
•Ethernet segment (ES)—An ES is a link that connects a site to a VTEP. Each ES is uniquely
identified by an Ethernet segment identifier (ESI).A site can be connected to a VTEP through
only one ES. The ES uses ESI 0.
•VSI—A virtual switch instance is a virtual Layer 2 switched domain. Each VSI provides
switching services only for one VXLAN. VSIs learn MAC addresses and forward frames
independently of one another. VMs in different sites have Layer 2 connectivity if they are in the
same VXLAN. A VXLAN is identified by a 24-bit VXLAN ID which is also called the virtual
network identifier (VNI). A VXLAN corresponds to an EVPN instance.
•VXLAN tunnel—A VXLAN tunnel is a logical point-to-point tunnel between VTEPs over the
transport network. Each VXLAN tunnel can trunk multiple VXLANs.
All VXLAN processing is performed on VTEPs. The ingress VTEP encapsulates VXLAN traffic in the
VXLAN, outer UDP, and outer IP headers, and forwards the traffic through VXLAN tunnels. The
egress VTEP removes the VXLAN encapsulation and forwards the traffic to the destination.
Transport network devices (for example, the P device in Figure 1) forward VXLAN traffic only based
on the outer IP header of VXLAN packets.

2
Figure 1 EVPN network model
Layered transport network
As shown in Figure 2, typically the EVPN transport network uses a layered structure. On the
transport network, leaf nodes act as VTEPs to provide VXLAN services, and spine nodes perform
forwarding for VXLAN traffic based on the outer IP header. If all VTEPs and transport network
devices of an EVPN network belong to the same AS, the spine nodes can act as route reflectors
(RRs) to reflect routes between the VTEPs. In this scenario, the spine nodes advertise and receive
BGP EVPN routes, but do not perform VXLAN encapsulation and de-encapsulation.
Figure 2 Layered transport network
MP-BGP extension for EVPN
To support EVPN, MP-BGP introduces the EVPN subsequent address family under the L2VPN
address family and the following network layer reachability information (BGP EVPN routes):
•Ethernet auto-discovery route—Advertises ES information in multihomed sites.
•MAC/IP advertisement route—Advertises MAC reachability information and host route
information (host ARP information).
VXLAN tunnel
VTEP
Server Server
Site 1 Site 2
VM
VM
VM
VSI/VXLAN 10
VSI/VXLAN 20
VSI/VXLAN 30
VM
VM
VM
VSI/VXLAN 10
VSI/VXLAN 20
VSI/VXLAN 30
Transport
network
P
ES ES
VTEP
VTEP
Server Server
Site 1 Site 2
Transport
network
VTEP
RR RR
Leaf
Spine

3
•Inclusive multicast Ethernet tag (IMET) route—Advertises VTEP and VXLAN mappings for
automating VTEP discovery, VXLAN tunnel establishment, and VXLAN tunnel assignment.
•Ethernet segment route—Advertises ES and VTEP mappings.
•IP prefix advertisement route—Advertises BGP IPv4 unicast routes as IP prefixes.
The current software version does not support Ethernet auto-discovery routes and ES routes.
MP-BGP uses the route distinguisher (RD) field to differentiate BGP EVPN routes of different
VXLANs and uses route targets to control the advertisement and acceptance of BGP EVPN routes.
MP-BGP supports the following types of route targets:
•Export targets—A VTEP sets the export targets for BGP EVPN routes learned from the local
site before advertising them to remote VTEPs.
•Import targets—AVTEP checks the export targets of BGP EVPN routes received from remote
VTEPs. The VTEP imports the BGP EVPN routes only when their export targets match the local
import targets.
Configuration automation
VTEPs use BGP EVPN routes to discover VTEP neighbors, establish VXLAN tunnels, and assign
the tunnels to VXLANs.
•IMET route—VTEPs advertise their VXLAN IDs through IMET routes. If two VTEPs have the
same VXLAN ID, they automatically establish a VXLAN tunnel and assign the tunnel to the
VXLAN.
•MAC/IP advertisement route and IP prefix advertisement route—In the EVPN gateway
deployment, VTEPs advertise MAC/IP advertisement routes or IP prefix advertisement routes
which carry export targets. When a VTEPreceives a route, it compares the export targets of the
route with the local import targets. If the route targets match, the VTEP establishes a VXLAN
tunnel with the remote VTEP and associates the tunnel with the L3 VXLAN ID of the
corresponding VPN instance. For more information about the L3 VXLAN ID, see "Distributed
EVPN gateway deployment."
Assignment of traffic to VXLANs
Traffic from the local site to a remote site
The VTEP uses an Ethernet service instance to match customer traffic on a site-facing interface. The
VTEP assigns customer traffic to a VXLAN by mapping the Ethernet service instance to a VSI.
An Ethernet service instance is identical to an attachment circuit (AC) in L2VPN. An Ethernet service
instance matches a list of VLANs on a Layer 2 Ethernet interface by using a frame match criterion.
The frame match criterion specifies the characteristics of traffic from the VLANs, such as tagging
status and VLAN IDs.
As shown in Figure 3, Ethernet service instance 1 matches VLAN 2 and is mapped to VSIA(VXLAN
10). When a frame from VLAN 2 arrives, the VTEP assigns the frame to VXLAN 10 and looks up VSI
A's MAC address table for the outgoing interface.

4
Figure 3 Identifying traffic from the local site
Traffic from a remote site to the local site
When a VXLAN packet arrives at a VXLAN tunnel interface, the VTEP uses the VXLAN ID in the
packet to identify its VXLAN.
Layer 2 forwarding
MAC learning
The VTEP performs Layer 2 forwarding based on a VSI's MAC address table. The VTEP learns MAC
addresses by using the following methods:
•Local MAC learning—The VTEP automatically learns the source MAC addresses of frames
sent from the local site. The outgoing interfaces of local MAC address entries are site-facing
interfaces on which the MAC addresses are learned.
•Remote MAC learning—The VTEP uses MP-BGP to advertise local MAC reachability
information to remote sites and learn MAC reachability information from remote sites. The
outgoing interfaces of MAC address entries advertised from a remote site are VXLAN tunnel
interfaces.
Unicast
As shown in Figure 4, the VTEP performs typical Layer 2 forwarding for known unicast traffic within
the local site.
Server
Service instance 1:
VLAN 2 VSI A
VXLAN 10
VLAN 2
VM 1
VM 2
VM 3
Service instance 2:
VLAN 3
Service instance 3:
VLAN 4
VLAN 3
VLAN 4
VSI B
VXLAN 20
VSI C
VXLAN 30
VTEP

5
Figure 4 Intra-site unicast
As shown in Figure 5, the following process applies to a known unicast frame between sites:
1. The source VTEP encapsulates the Ethernet frame in the VXLAN/UDP/IP header.
In the outer IP header, the source IP address is the source VTEP's VXLAN tunnel source IP
address. The destination IP address is the VXLAN tunnel destination IP address.
2. The source VTEP forwards the encapsulated packet out of the outgoing VXLAN tunnel
interface found in the VSI's MAC address table.
3. The intermediate transport devices (P devices) forward the packet to the destination VTEP by
using the outer IP header.
4. The destination VTEP removes the headers on top ofthe inner Ethernet frame. It then performs
MAC address table lookup in the VXLAN's VSI to forward the frame out of the matching
outgoing interface.
Figure 5 Inter-site unicast
VXLAN tunnel
VTEP 1 VTEP 2
Transport
network
P
Server 1
VM 1
VM 2
VM 3
Server 3
VM 7
VM 8
VM 9
MAC table on VTEP 1
VXLAN/VSI MAC Interface
VXLAN 10/VSI A MAC 1 Interface A, VLAN 2
VXLAN 10/VSI A MAC 4 Interface B, VLAN 3
Server 2
VM 4
VM 5
VM 6
Interface A
Interface B
VTEP 1 VTEP 2
Transport
network
P
Server 1
VM 1
VM 2
VM 3
Server 3
VM 7
VM 8
VM 9
MAC table on VTEP 1
VXLAN/VSI MAC Interface
VXLAN 10/VSI A MAC 1 Interface A, VLAN 2
VXLAN 10/VSI A MAC 7 Tunnel 1
Server 2
VM 4
VM 5
VM 6
Interface A
Interface B
MAC table on VTEP 2
VXLAN/VSI MAC Interface
VXLAN 10/VSI A MAC 1 Tunnel 1
VXLAN 10/VSI A MAC 7 Interface A, VLAN 3
Interface A
VXLAN tunnel 1

6
Flood
As shown in Figure 6, a VTEP floods a broadcast, multicast, or unknown unicast frame to all
site-facing interfaces and VXLAN tunnels in the VXLAN, except for the incoming interface. The
source VTEP replicates the flood frame, and then sends one replica to the destination IP address of
each VXLAN tunnel in the VXLAN. Each destination VTEP floods the inner Ethernet frame to all the
site-facing interfaces in the VXLAN. To avoid loops, the destination VTEPs do not flood the frame to
VXLAN tunnels.
Figure 6 Forwarding of flood traffic
Layer 3 forwarding
EVPN uses EVPN gateways to provide Layer 3 forwarding services for hosts in VXLANs. EVPN
provides the following EVPN gateway placement designs:
•Centralized EVPN gateway deployment—Uses one VTEP to provide Layer 3 forwarding for
VXLANs. Typically, the gateway-collocated VTEP connects to other VTEPs and the external
network. To use this design, make sure the gateway has sufficient bandwidth and processing
capability.
•Distributed EVPN gateway deployment—Deploys one EVPN gateway on each VTEP to
provide Layer 3 forwarding for VXLANs at their respective sites. This design distributes the
Layer 3 traffic load across VTEPs. However, its configuration is more complex than the
centralized EVPN gateway design.
In either design, the gateways use virtual Layer 3 VSI interfaces as gateway interfaces for VXLANs.
Centralized EVPN gateway deployment
As shown in Figure 7, a VTEPacts as a gateway for VMs in the VXLANs. The VTEP both terminates
the VXLANs and performs Layer 3 forwarding for the VMs. The network uses the following process
to forward Layer 3 traffic from a VM to the destination:
VTEP 1 VTEP 2
Transport network
P
Server 1
VM 1
VM 2
VM 3
Server 3
VM 7
VM 8
VM 9
Server 2
VM 4
VM 5
VM 6
VXLAN tunnel
VXLAN tunnel
VTEP 3
VXLAN tunnel
Server 4
VM 10
VM 11
VM 12
Replicate and
encapsulate

7
1. The VM sends an ARP request to obtain the MAC address of the VSI interface that acts as the
gateway, and then sends the Layer 3 traffic to the centralized EVPN gateway.
2. The local VTEP looks up the matching VSI's MAC address table and forwards the traffic to the
centralized EVPN gateway through a VXLAN tunnel.
3. The centralized EVPN gateway removes the VXLAN encapsulation and forwards the traffic at
Layer 3.
4. The centralized EVPN gateway forwards the replies sent by the destination node to the VM
based on the ARP entry for the VM.
Figure 7 Example of centralized EVPN gateway deployment
Distributed EVPN gateway deployment
As shown in Figure 8, each site's VTEP acts as a gateway to perform Layer 3 forwarding for the
VXLANs of the local site.A VTEP acts as a border gateway to the Layer 3 network for the VXLANs.
VXLAN tunnel
VTEP 1 VTEP 2
Server Server
Site 1 Site 2
VM
VM
VM
VSI/VXLAN 10
VSI/VXLAN 20
VSI/VXLAN 30
VM
VM
VM
VSI/VXLAN 10
VSI/VXLAN 20
VSI/VXLAN 30
Transport
network
P
10.1.1.11
20.1.1.11
30.1.1.11
10.1.1.12
20.1.1.12
30.1.1.12
VXLAN tunnel
VXLAN tunnel
VTEP 3/Centralized EVPN gateway
VSI/VXLAN 10
VSI/VXLAN 20
VSI/VXLAN 30
VSI-interface10
10.1.1.1/24
VSI-interface20
20.1.1.1/24
VSI-interface30
30.1.1.1/24
L3 network

8
Figure 8 Distributed EVPN gateway placement design
Symmetric IRB
A distributed EVPN gateway uses symmetric IRB for Layer 3 forwarding, which means both the
ingress and egress gateways perform Layer 2 and Layer 3 lookups. Symmetric IRB introduces the
following concepts:
•L3 VXLAN ID—Also called L3 VNI. An L3 VXLAN ID identifies the traffic of a routing domain
where devices have Layer 3 reachability. An L3 VXLAN ID is associated with oneVPN instance.
Distributed EVPN gateways use VPN instances to isolate traffic of different services on VXLAN
tunnel interfaces.
•Router MAC address—Each distributed EVPN gateway has a unique router MAC address
used for inter-gateway forwarding. The MAC addresses in the inner Ethernet header of VXLAN
packets are router MAC addresses of distributed EVPN gateways.
VSI interfaces
As shown in Figure 9, each distributed EVPN gateway has the following types of VSI interfaces:
•VSI interface as a gateway interface of a VXLAN—The VSI interface acts as the gateway
interface for VMs in a VXLAN. The VSI interface is associated with a VSI and a VPN instance.
On different distributed EVPN gateways, the VSI interface of a VXLAN uses the same IP
address to provide services.
•VSI interface associated with an L3 VXLAN ID—The VSI interface is associated with a VPN
instance and assigned an L3 VXLAN ID. VSI interfaces associated with the same VPN instance
share an L3 VXLAN ID.
A border gateway only has VSI interfaces that are associated with an L3 VXLAN ID.
VXLAN tunnel
VXLAN tunnel
VTEP
Server
Site 1
L3 network
VXLAN tunnel VXLAN tunnel
Server
Site 2
Server
Site 3
Server
Site 4
Server
Site 5
Server
Site 6
VTEP/Distributed
EVPN gateway
Border gateway
VTEP/Distributed
EVPN gateway
VTEP/Distributed
EVPN gateway

9
Figure 9 Example of distributed EVPN gateway deployment
Layer 3 forwarding entry learning
A distributed EVPN gateway forwards Layer 3 traffic based on FIB entries generated from BGP
EVPN routes and ARP information.
A VTEP advertises an external route imported in the EVPN address family through MP-BGP. A
remote VTEPadds the route to the FIB table of a VPN instance based on the L3 VXLAN ID carried in
the route. In the FIB entry, the outgoing interface is the VXLAN tunnel interface where the route is
received, and the next hop is the peer VTEP address in the NEXT_HOP attribute of the route.
A VTEP has the following types of ARP information:
•Local ARP information—ARP information of VMs in the local site. The VTEP snoops GARP
packets, RARP packets, and ARP requests for the gateway MAC address to learn theARP
information of the senders and generates ARP entries and FIB entries. In an ARP or FIB entry,
the outgoing interface is the site-facing interface where the packet is received, and the VPN
instance is the instance associated with the corresponding VSI interface.
•Remote ARP information—ARP information of VMs in remote sites. Each VTEP uses
MP-BGP to advertise its local ARP information with L3 VXLAN IDs in routes to remote sites. A
VTEP generates only FIB entries for the remoteARP information. A FIB entry contains the
following information:
Outgoing interface: VSI interface associated with the L3 VXLAN ID.
Next hop: Peer VTEP address in the NEXT_HOP attribute of the route.
VPN instance: VPN instance associated with the L3 VXLAN ID.
The VTEP then creates an ARP entry for the next hop in the FIB entry.
Traffic forwarding
A distributed EVPN gateway can work in one of the following mode:
VXLAN tunnel
GW 1 GW 2
Server Server
Site 1 Site 2
VM 1
VM 2
VSI/VXLAN 10
VSI/VXLAN 20
VM 4
VM 5
VSI/VXLAN 10
VSI/VXLAN 20
P
10.1.1.11
20.1.1.11
10.1.1.12
20.1.1.12
VXLAN tunnel
VXLAN tunnel
Border
gateway
L3 network
VSI-interface10
10.1.1.1/24
VPN instance: vpna
VSI-interface20
20.1.1.1/24
VPN instance: vpna
VSI-interface1
VPN instance: vpna
L3VNI: 1000
VSI-interface1
VPN instance: vpna
L3VNI: 1000

10
•Switching and routing mode—Forwards Layer 2 traffic based on the MAC address table and
forwards Layer 3 traffic based on the FIB table. In this mode, you need to enable ARP flood
suppression on the distributed EVPN gateway to reduce flooding.
•Routing mode— Forwards both Layer 2 and Layer 3 traffic based on the FIB table. In this
mode, you need to enable local proxyARP on the distributed EVPN gateway.
For more information about MAC address table-based Layer 2 forwarding, see "Unicast."
Figure 10 shows the intra-site Layer 3 forwarding process.
1. The source VM sends an ARP request to obtain the MAC address of the destination VM.
2. The gateway replies to the source VM with the MAC address of the VSI interface associated
with the source VM's VSI.
3. The source VM sends a Layer 3 packet to the gateway.
4. The gateway looks up the FIB table of the VPN instance associated with the source VM's VSI
and finds the matching outgoing site-facing interface.
5. The gateway processes the Ethernet header of the Layer 3 packet as follows:
Replaces the destination MAC address with the destination VM's MAC address.
Replaces the source MAC address with the VSI interface's MAC address.
6. The gateway forwards the Layer 3 packet to the destination VM.
Figure 10 Intra-site Layer 3 forwarding
Figure 11 shows the inter-site Layer 3 forwarding process.
1. The source VM sends an ARP request to obtain the MAC address of the destination VM.
2. The gateway replies to the source VM with the MAC address of the VSI interface associated
with the source VM's VSI.
3. The source VM sends a Layer 3 packet to the gateway.
4. The gateway looks up the FIB table of the VPN instance associated with the source VM's VSI
and finds the matching outgoing VSI interface.
5. The gateway processes the Ethernet header of the Layer 3 packet as follows:
Replaces the destination MAC address with the destination gateway's router MAC address.
Replaces the source MAC address with its own router MAC address.
6. The gateway adds VXLAN encapsulation to the Layer 3 packet and forwards the packet to the
destination gateway. The encapsulated VXLAN ID is the L3 VXLAN ID of the corresponding
VPN instance.
7. The destination gateway identifies the VPN instance of the packet based on the L3 VXLAN ID
and removes the VXLAN encapsulation. Then the gateway forwards the packet based on the
matching ARP entry.
GW 1
DATA
Server 1
VM 1
IP 1
MAC 1
Server 2
VM 2
IP 2
MAC 2
GW IP
GW MAC (VSI interface MAC)
SIP: IP 1
DIP: IP 2
SMAC: MAC 1
DMAC: GW MAC
DATA
SIP: IP 1
DIP: IP 2
SMAC: GW MAC
DMAC: MAC 2

11
Figure 11 Inter-site Layer 3 forwarding
Communication between private and public networks
A distributed EVPN gateway uses the public instance to perform Layer 3 forwarding for the public
network and to enable communication between private and public networks. The public instance is
similar to a VPN instance.Adistributed EVPN gateway processes traffic of the public instance in the
same way it does for a VPN instance. For the public instance to work correctly, you must configure
an RD, an L3 VXLAN ID, and route targets for it. If a VSI interface is not associated with any VPN
instance, the VSI interface belongs to the public instance.
RD and route target selection of BGP EVPN
routes
As shown in Table 1, you can configure RDs and route targets for BGP EVPN routes in multiple
views.
Table 1 Supported views for RD and route target configuration
Item Views
RD
•EVPN instance view of a VSI
•VPN instance view
•Public instance view
Route targets
•EVPN instance view of a VSI
•VPN instance view
•IPv4 VPN view of a VPN instance
•EVPN view of a VPN instance
•IPv4 VPN view of the public instance
•EVPN view of the public instance
NOTE:
Route targets configured in VPN instance view apply to IPv4 VPN and EVPN. Route
targets configured in IPv4 VPN view apply only to IPv4 VPN. Route targets configured
in EVPN view of a VPN instance apply only to EVPN. Route targets configured in IPv4
VPN view or EVPN view of a VPN instance take precedence over those in VPN
GW 1 P GW 2
DATA
Transport
network
Server 1
VM 1
IP 1
MAC 1
Server 2
VM 2
IP 2
MAC 2
GW IP
GW MAC (VSI interface MAC)
GW MAC 1 (Router MAC of GW 1)
VTEP IP 1
L3VNI 100
GW IP
GW MAC (VSI interface MAC)
GW MAC 2 (Router MAC of GW 2)
VTEP IP 2
L3VNI 100
SIP: IP 1
DIP: IP 2
SMAC: MAC 1
DMAC: GW MAC
DATA
SIP: IP 1
DIP: IP 2
SMAC: GW MAC 1
DMAC: GW MAC 2
VNI: 100
SIP: VTEP IP 1
DIP: VTEP IP 2
DATA
SIP: IP 1
DIP: IP 2
SMAC: GW MAC
DMAC: MAC 2

12
Item Views
instance view.
The device selects RDs and route targets for BGP EVPN routes by using the following rules:
•IMET routes and MAC/IP advertisement routes that contain only MAC addresses—The
device uses the RD and route targets configured in EVPN instance view when advertising and
accepting the routes.
•MAC/IP advertisement routes that contain ARP information—The device uses the
following settings when advertising the routes:
RD and export route targets configured in EVPN instance view.
Export route targets configured for EVPN on a VPN instance or the public instance (VPN
instance view, and EVPN view of a VPN instance or the public instance).
The device uses the import route targets configured for EVPN on a VPN instance or the public
instance when accepting the routes.
•IP prefix advertisement routes—The device uses the route targets configured for IPv4 VPN
on a VPN instance or the public instance (VPN instance view, and IPv4 VPN view of a VPN
instance or the public instance) when advertising and accepting the routes.
ARP flood suppression
ARP flood suppression reduces ARP request broadcasts by enabling the VTEP to reply to ARP
requests on behalf of VMs.
As shown in Figure 12, this feature snoops ARPrequests, ARPresponses, and BGP EVPN routes to
populate theARP flood suppression table with local and remote MAC addresses. If an ARP request
has a matching entry, the VTEP replies to the request on behalf of the VM. If no match is found, the
VTEP floods the request to both local and remote sites.
Figure 12 ARP flood suppression
ARP flood suppression uses the following workflow:
(1)
VTEP 1 VTEP 2
Transport network
P
Server 1
VM 1
VM 2
VM 3
Server 3
VM 7
VM 8
VM 9
Server 2
VM 4
VM 5
VM 6
VXLAN tunnel
VXLAN tunnel
VTEP 3
VXLAN tunnel
Server 4
VM 10
VM 11
VM 12
(2)
(2)
(3)
(3)
(4)
(5)
(6)
(7)
(8)
(9) (10)
(2)

13
1. VM 1 sends an ARP request to obtain the MAC address of VM 7.
2. VTEP 1 creates a suppression entry for VM 1 and floods the ARP request in the VXLAN.
3. VTEP 2 and VTEP 3 de-encapsulate the ARP request. The VTEPs create a suppression entry
for VM 1 and broadcast the request in the local site.
4. VM 7 sends an ARP reply.
5. VTEP 2 creates a suppression entry for VM 7 and forwards the ARP reply to VTEP 1.
6. VTEP 1 de-encapsulates the ARP reply, creates asuppression entry for VM 7, and forwards the
ARP reply to VM 1.
7. VM 4 sends an ARP request to obtain the MAC address of VM 1 or VM 7.
8. VTEP 1 creates a suppression entry for VM 4 and replies to the ARP request.
9. VM 10 sends an ARP request to obtain the MAC address of VM 1.
10. VTEP 3 creates a suppression entry for VM 10 and replies to the ARP request.
MAC mobility
MAC mobility refers to the movement of a VM or host from one ES to another. The source VTEP is
unaware of the MAC move event. To notify other VTEPs of the change, the destination VTEP
advertises a MAC/IP advertisement route for the MAC address. The source VTEP withdraws the old
route for the MAC address after receiving the new route. The MAC/IP advertisement route has a
sequence number that increases when the MAC address moves. The sequence number identifies
the most recent move if the MAC address moves multiple times.

14
Configuring EVPN
Configuration restrictions and guidelines
VXLAN tunnel configuration restrictions and guidelines
Make sure the following VXLAN tunnels are not associated with the same VXLAN when they have
the same tunnel destination IP address:
•A VXLAN tunnel automatically created by EVPN.
•A manually created VXLAN tunnel.
For more information about manual tunnel configuration, see VXLAN Configuration Guide.
EVPN gateway configuration restrictions and guidelines
Configuration Restrictions and guidelines
Ethernet service
instance and
access mode
•Use the Ethernet access mode if an Ethernet service instance uses
the encapsulation untagged criterion. Use the VLAN access mode if an
Ethernet service instance uses another criterion.
•You cannot configure an Ethernet service instance to match frames by both outer
and inner VLAN IDs.
Priority trust mode
An EVPN gateway processes the DSCP precedence in frames received from an AC
as follows:
•For Layer 3 forwarding, the gateway always uses the DSCP precedence for
priority mapping, regardless of whether you configure the qos trust dscp
command on the incoming interface.
•For Layer 2 forwarding, the gateway uses the DSCP precedence for priority
mapping only when the qos trust dscp command is configured on the incoming
interface.
MAC address entry
aging timer To reduce flood traffic in a VSI, set the MAC aging timer to a value that is equal to or higher than the ARP entry aging timer.
EVPN configuration task list
Tasks at a glance Remarks
(Required) Setting the VXLAN hardware resource allocation mode Set the VXLAN hardware resource
allocation mode based on the role of
the device in the network.
(Required) Creating a VXLAN on a VSI N/A
(Required) Configuring an EVPN instance N/A
(Required) Configuring BGP to advertise BGP EVPN routes N/A
(Required) Mapping an Ethernet service instance to a VSI Perform this task to assign customer
traffic to VXLANs.
(Optional.) Configuring an EVPN gateway:
•Configuring a centralized EVPN gateway Perform this task to provide Layer 3
connectivity for VXLANs.

15
Tasks at a glance Remarks
•Configuring a distributed EVPN gateway
(Optional.) Managing remote MAC address entries and remote ARP
learning N/A
(Optional.) Enabling BGP EVPN route advertisement to the local site Perform this task to advertise private
BGP EVPN routes to the local site.
(Optional.) Confining floods to the local site Perform this task to reduce flooding
to the transport network.
(Optional.) Enabling ARP flood suppression Perform this task to reduce ARP
request broadcasts.
Setting the VXLAN hardware resource allocation
mode
The device supports the following VXLAN hardware resource allocation modes:
•l2gw—Layer 3 gateway mode. In this mode, VXLAN-DCI is not supported, and you can create
more ACs and VXLAN tunnels than in border mode.
•border—Border mode. In this mode, VXLAN-DCI is supported, and you can create less ACs
and VXLAN tunnels than in Layer 3 gateway mode.
You must set the VXLAN hardware resource allocation mode to border on EDs of an EVPN-DCI
network.
For the hardware resource allocation mode to take effect, you must reboot the device.
To set the VXLAN hardware resource allocation mode:
Step Command Remarks
1. Enter system view. system-view N/A
2. Set the VXLAN hardware
resource allocation mode. hardware-resource vxlan { l3gw
| border }
By default, the VXLAN
hardware resource allocation
mode is l3gw.
For more information about this
command, see VXLAN
Command Reference.
Creating a VXLAN on a VSI
For more information about the VXLAN commands in this task, see VXLAN Command Reference.
To create a VXLAN on a VSI:
Step Command Remarks
1. Enter system view. system-view N/A
2. Enable L2VPN. l2vpn enable By default, L2VPN is disabled.
3. Create a VSI and enter
VSI view. vsi vsi-name By default, no VSIs exist.

16
Step Command Remarks
4. (Optional.) Configure a
VSI description. description text By default, a VSI does not have a
description.
5. (Optional.) Set the
broadcast, multicast, or
unknown unicast
restraint bandwidth for
the VSI.
restrain { broadcast | multicast
| unknown-unicast } bandwidth
The default broadcast restraint
bandwidth, multicast restraint
bandwidth, and unknown unicast
restraint bandwidth are 4294967295
kbps.
6. Enable the VSI. undo shutdown By default, a VSI is enabled.
7. Create a VXLAN and
enter VXLAN view. vxlan vxlan-id
By default, no VXLANs exist.
You can create only one VXLAN on
a VSI. The VXLAN ID must be
unique for each VSI.
Configuring an EVPN instance
You do not need to associate a VPN instance with a VXLAN that requires only Layer 2 connectivity.
The BGP EVPN routes advertised by the device carry the RD and route targets configured for the
EVPN instance associated with the VXLAN.
To configure an EVPN instance:
Step Command Remarks
1. Enter system view.
system-view
N/A
2. Enter VSI view.
vsi
vsi-name N/A
3. Create an EVPN
instance and enter
EVPN instance view. evpn encapsulation vxlan By default, no EVPN instance
exists.
4. Configure an RD for
the EVPN instance. route-distinguisher { route-distinguisher
| auto } By default, no RD is configured for an EVPN instance.
5. Configure route
targets for the EVPN
instance.
vpn-target { vpn-target&<1-8> | auto }
[ both | export-extcommunity
| import-extcommunity ]
By default, an EVPN instance
does not have route targets.
Make sure the following
requirements are met:
•The import targets of the
EVPN instance do not match
the export targets of the VPN
instance associated with the
VXLAN or the public instance.
•The export targets of the
EVPN instance do not match
the import targets of the VPN
instance associated with the
VXLAN or the public instance.
For more information about VPN
instance and public instance
configuration, see "Configuring an
L3 VXLAN ID for a VSI interface."