Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 
 

Symmetric Integrated Routing and Bridging with EVPN Type 2 Routes in EVPN-VXLAN Fabrics

SUMMARY This page provides an overview of symmetric integrated routing and bridging (IRB) with EVPN over Virtual Extensible LAN (VXLAN) tunnels. We also introduce the elements you configure to enable symmetric EVPN Type 2 routing.

Overview of Symmetric EVPN Routing with Type 2 Routes

The Internet Engineering Task Force (IETF) open standard document RFC 9135, Integrated Routing and Bridging in EVPN, defines two operational models for inter-subnet forwarding in EVPN:

  • An asymmetric model.

  • A symmetric model.

By default in EVPN-VXLAN networks, Junos OS devices use the asymmetric IRB model with EVPN Type 2 routes to send traffic between subnets across the VXLAN tunnels. On supporting devices, you can alternatively enable the devices to use a symmetric model with EVPN Type 2 routes for inter-subnet routing. We support symmetric EVPN Type 2 routing in an EVPN-VXLAN fabric with an edge-routed bridging (ERB) overlay.

These models can also apply to EVPN Type 5 (IP prefix) routes. We support EVPN Type 5 routing on Junos OS devices using only the symmetric IRB model. This is the default behavior when you configure a routing instance to use Type 5 routes with the ip-prefix-routes statement. See Understanding EVPN Pure Type 5 Routes for an overview of EVPN Type 5 routes and other EVPN route types. See EVPN Type 5 Route with VXLAN Encapsulation for EVPN-VXLAN for details on how Type 5 routes work.

Benefits of the Symmetric Model

  • Avoids scaling issues inherent in the asymmetric model when your network has a large number of VLANs. On each device, you only need to configure the VLANs that serve the connected hosts on that device. With the asymmetric model, you must configure the device with all destination VLANs in the network.

  • Simplifies traffic monitoring by using the same tunnel identifier (VXLAN network identifier [VNI]) for inter-subnet routing in both directions for a particular tenant. The asymmetric routing model requires different VNIs in each direction in that case.

Asymmetric and Symmetric IRB Models

For intra-subnet forwarding in ERB overlay fabrics, leaf devices serving as VXLAN tunnel end points (VTEPs) forward VXLAN traffic the same way in both the asymmetric and symmetric models. The source and destination VLAN and VNI are the same on both sides of the tunnel. The VTEPs bridge the traffic to and from the tunnel.

For inter-subnet routing, both models use IRB interfaces for routing, but the two models differ in configuration and benefits.

The next sections describe more about how the two models work, with focus on the symmetric model. We also cover tradeoffs for using either model.

Asymmetric Model

With the asymmetric model, leaf devices serving as VXLAN tunnel end points (VTEPs) both route and bridge to initiate the VXLAN tunnel (tunnel ingress). However, when exiting the VXLAN tunnel (tunnel egress), the VTEPs can only bridge the traffic to the destination VLAN.

With this model, VXLAN traffic must use the destination VNI in each direction. The source VTEP always routes the traffic to the destination VLAN and sends it using the destination VNI. When the traffic arrives at the destination VTEP, that device forwards the traffic on the destination VLAN.

This model requires you to configure all source and destination VLANs and their corresponding VNIs on each leaf device, even if a leaf doesn’t host traffic for some of those VLANs. As a result, this model can have scaling issues when the network has a large number of VLANs. However, when you have fewer VLANs, this model can have lower latency over the symmetric model. Configuration is also simpler than with the symmetric model.

Symmetric Model

With the symmetric IRB routing model, the VTEPs do routing and bridging on both the ingress and egress sides of the VXLAN tunnel. As a result, VTEPs can do inter-subnet routing for the same tenant virtual routing and forwarding (VRF) instance with the same VNI in both directions. We implement this model for EVPN Type 2 routes the same way as for EVPN Type 5 routes (which we support using only the symmetric model). The VTEPs use a dedicated Layer 3 traffic VNI in both directions for each tenant VRF instance.

Figure 1 illustrates the symmetric model with switches serving as leaf devices in an ERB overlay configuration. The EVPN instances on the leaf devices use the MAC-VRF instance type at Layer 2. You configure each MAC-VRF instance (with one or more VLANs) with IRB interfaces to route traffic to a associated tenant VRF instance at Layer 3 (L3 VRF).

You configure an extra VLAN with an IRB interface, mapped to a VNI, for each tenant L3 VRF instance. That VNI is the Layer 3 transit VNI between VTEPs for the tenant VXLAN traffic. The tenant L3 VRF instance routes the traffic onto the Layer 3 transit VNI. The symmetric model uses the Layer 3 transit VNI in both directions regardless of the destination VLAN and its corresponding VNI.

Figure 1: Symmetric IRB Model on Leaf Devices in an ERB Overlay Fabric Symmetric IRB Model on Leaf Devices in an ERB Overlay Fabric

This model requires that the network has established Layer 3 connectivity between all source and destination VTEPs for EVPN type 2 routing. You configure EVPN Type 5 routing in the tenant VRF instance to provide the Layer 3 connectivity.

Figure 1 shows how a leaf device on one VLAN symmetrically routes tenant traffic to another leaf device on a different VLAN, as follows:

  1. A tenant host sends traffic on the source VLAN to the remote tenant host in the EVPN-VXLAN network on a different VLAN.

  2. The source (ingress) leaf device routes the source VLAN traffic through the tenant L3 VRF onto the VXLAN tunnel. The tunnel VNI is the Layer 3 transit VNI.

  3. The Layer 3 network infrastructure tunnels the traffic to the destination VTEP using the Layer 3 transit VNI.

  4. The destination (egress) leaf device routes the traffic from the Layer 3 transit VNI onto the destination VLAN.

  5. The destination leaf device bridges the traffic on the destination VLAN to the destination host.

Note:

Figure 1 shows MAC-VRF instances with the VLAN-based service type (one instance serves one VLAN). However, we support either VLAN-based or VLAN-aware bundle service types with symmetric Type 2 routing.

EVPN Type 2 Route Enhancements to Support the Symmetric Routing Model

EVPN Type 2 routes are MAC/IP advertisement routes that are described in RFC 7432, BGP MPLS-Based Ethernet VPN. To support the symmetric routing model, we implement the EVPN Router's MAC extended community that is described in RFC 9135, Integrated Routing and Bridging in EVPN. This extended community Type field value is 0x06 (EVPN) with Sub-Type field 0x03, and includes the device's MAC address. For symmetric IRB routing, EVPN leaf devices send this extended community (along with the tunnel type encapsulation extended community) in the EVPN Type 2 route advertisements.

The EVPN Type 2 MAC/IP route advertisement also includes two label fields for:

  • The VNI corresponding to the Layer 2 routing instance—the MAC-VRF EVPN instance

  • The VNI corresponding to the Layer 3 routing instance—in this case, the Layer 3 transit VNI.

When you enable symmetric IRB routing on an EVPN leaf device, the device checks that received Type 2 route advertisements have the proper fields. The device logs an error and rejects Type 2 routes that don't include the Layer 3 (IP) VNI value, which we require for symmetric IRB routing.

Trade-offs with the Symmetric Model

For inter-subnet routing, the symmetric model enables better scaling over the asymmetric model in configurations with a large number of VLANs. With the symmetric model, you can configure each VTEP with only the VLANs that serve its connected hosts. However, you also need an additional Layer 3 transit VLAN and VNI for each tenant virtual routing and forwarding (VRF) instance.

When your EVPN-VXLAN network has a large number of VLANs, the symmetric model helps to avoid the scaling issues inherent in the asymmetric model. With the asymmetric model, you must configure destination VLANs on a device even if none of its connected hosts use those VLANs. With the symmetric model, you can configure each device only with the VLANs its connected hosts use. However, if the network serves most or all VLANs on all devices in any case, your configuration can be simpler using the asymmetric model.

Enable Symmetric IRB with EVPN Type 2 Routes

Junos OS devices use the asymmetric model with EVPN Type 2 routes by default, or you can enable the symmetric model with EVPN Type 2 routes.

We support EVPN Type 2 symmetric routing as follows:

  • In an EVPN-VXLAN fabric with an edge-routed bridging (ERB) overlay.

  • With EVPN instances configured using MAC-VRF routing instances with VLAN-based or VLAN-aware bundle service types (see MAC-VRF Routing Instance Type Overview).

Note:

QFX5210 switches support symmetric EVPN Type 2 routing, but those switches only support EVPN-VXLAN using a loopback port solution for VXLAN routing in and out of tunnels (RIOT).

See Using a RIOT Loopback Port to Route Traffic in an EVPN-VXLAN Network for details on how that implementation works, including the configuration steps to enable symmetric EVPN Type 2 routing with EVPN-VXLAN on those switches.

The steps below apply to all other supported platforms.

Here are the high-level steps to enable symmetric EVPN Type 2 routing on leaf devices in an EVPN-VXLAN fabric with an ERB overlay.

  1. On the leaf devices that serve as VTEPs, configure the base MAC-VRF EVPN instance(s), tenant L3 VRF instances, associated VLANs, and corresponding IRB interfaces for your EVPN-VXLAN network.
  2. Configure EVPN Type 5 routing in the EVPN-VXLAN network to establish Layer 3 connectivity between all leaf devices serving as VTEPs.

    In this step, you configure the L3 VRF instances to use EVPN Type 5 routes with a corresponding VNI to advertise the direct next hops for VXLAN traffic. For example:

    The device uses the L3 VRF EVPN Type 5 VNI as the L3 transit VNI for symmetric EVPN Type 2 routing.

    Note:

    ACX7100 routers don't support asymmetric VNI values on either side of a VXLAN tunnel for a given VRF. To support EVPN Type 5 routing and symmetric IRB routing with EVPN Type 2 routes on ACX7100 routers, you must configure the same L3 VNI value for a particular VRF on each of the leaf devices. On other platforms, the L3 VNI can be different on either side of the tunnel for a given VRF.

  3. Enable symmetric Type 2 routing in the L3 VRF instances using the irb-symmetric-routing vni vni statement at the [edit routing instances name protocols evpn] hierarchy.

    For example:

    Specify the transit VNI value (l3-vni) as the same VNI you configure in step 2 when you enable EVPN Type 5 routing for each L3 VRF.