Symmetric Integrated Routing and Bridging with EVPN Type 2 Routes in EVPN-VXLAN Fabrics

Benefits of the Symmetric Model

• Avoids scaling issues inherent in the asymmetric model when your network has a large number of VLANs. On each device, you only need to configure the VLANs that serve the connected hosts on that device. With the asymmetric model, you must configure the device with all destination VLANs in the network.

• Simplifies traffic monitoring by using the same tunnel identifier (VXLAN network identifier [VNI]) for inter-subnet routing in both directions for a particular tenant. The asymmetric routing model requires different VNIs in each direction in that case.

Asymmetric and Symmetric IRB Models

For intra-subnet forwarding in ERB overlay fabrics, leaf devices serving as VXLAN tunnel end points (VTEPs) forward VXLAN traffic the same way in both the asymmetric and symmetric models. The source and destination VLAN and VNI are the same on both sides of the tunnel. The VTEPs bridge the traffic to and from the tunnel.

For inter-subnet routing, both models use IRB interfaces for routing, but the two models differ in configuration and benefits.

The next sections describe more about how the two models work, with focus on the symmetric model. We also cover tradeoffs for using either model.

Asymmetric Model

With the asymmetric model, leaf devices serving as VXLAN tunnel end points (VTEPs) both route and bridge to initiate the VXLAN tunnel (tunnel ingress). However, when exiting the VXLAN tunnel (tunnel egress), the VTEPs can only bridge the traffic to the destination VLAN.

With this model, VXLAN traffic must use the destination VNI in each direction. The source VTEP always routes the traffic to the destination VLAN and sends it using the destination VNI. When the traffic arrives at the destination VTEP, that device forwards the traffic on the destination VLAN.

This model requires you to configure all source and destination VLANs and their corresponding VNIs on each leaf device, even if a leaf doesn’t host traffic for some of those VLANs. As a result, this model can have scaling issues when the network has a large number of VLANs. However, when you have fewer VLANs, this model can have lower latency over the symmetric model. Configuration is also simpler than with the symmetric model.

Symmetric Model

With the symmetric IRB routing model, the VTEPs do routing and bridging on both the ingress and egress sides of the VXLAN tunnel. As a result, VTEPs can do inter-subnet routing for the same tenant virtual routing and forwarding (VRF) instance with the same VNI in both directions. We implement this model for EVPN Type 2 routes the same way as for EVPN Type 5 routes (which we support using only the symmetric model). The VTEPs use a dedicated Layer 3 traffic VNI in both directions for each tenant VRF instance.

Figure 1 illustrates the symmetric model with switches serving as leaf devices in an ERB overlay configuration. The EVPN instances on the leaf devices use the MAC-VRF instance type at Layer 2. You configure each MAC-VRF instance (with one or more VLANs) with IRB interfaces to route traffic to a associated tenant VRF instance at Layer 3 (L3 VRF).

You configure an extra VLAN with an IRB interface, mapped to a VNI, for each tenant L3 VRF instance. That VNI is the Layer 3 transit VNI between VTEPs for the tenant VXLAN traffic. The tenant L3 VRF instance routes the traffic onto the Layer 3 transit VNI. The symmetric model uses the Layer 3 transit VNI in both directions regardless of the destination VLAN and its corresponding VNI.

This model requires that the network has established Layer 3 connectivity between all source and destination VTEPs for EVPN type 2 routing. You configure EVPN Type 5 routing in the tenant VRF instance to provide the Layer 3 connectivity.

Figure 1 shows how a leaf device on one VLAN symmetrically routes tenant traffic to another leaf device on a different VLAN, as follows:

1. A tenant host sends traffic on the source VLAN to the remote tenant host in the EVPN-VXLAN network on a different VLAN.

2. The source (ingress) leaf device routes the source VLAN traffic through the tenant L3 VRF onto the VXLAN tunnel. The tunnel VNI is the Layer 3 transit VNI.

3. The Layer 3 network infrastructure tunnels the traffic to the destination VTEP using the Layer 3 transit VNI.

4. The destination (egress) leaf device routes the traffic from the Layer 3 transit VNI onto the destination VLAN.

5. The destination leaf device bridges the traffic on the destination VLAN to the destination host.

Note:

Figure 1 shows MAC-VRF instances with the VLAN-based service type (one instance serves one VLAN). However, we support either VLAN-based or VLAN-aware bundle service types with symmetric Type 2 routing.

EVPN Type 2 Route Enhancements to Support the Symmetric Routing Model

EVPN Type 2 routes are MAC/IP advertisement routes that are described in RFC 7432, BGP MPLS-Based Ethernet VPN. To support the symmetric routing model, we implement the EVPN Router's MAC extended community that is described in RFC 9135, Integrated Routing and Bridging in EVPN. This extended community Type field value is 0x06 (EVPN) with Sub-Type field 0x03, and includes the device's MAC address. For symmetric IRB routing, EVPN leaf devices send this extended community (along with the tunnel type encapsulation extended community) in the EVPN Type 2 route advertisements.

The EVPN Type 2 MAC/IP route advertisement also includes two label fields for:

• The VNI corresponding to the Layer 2 routing instance—the MAC-VRF EVPN instance

• The VNI corresponding to the Layer 3 routing instance—in this case, the Layer 3 transit VNI.

When you enable symmetric IRB routing on an EVPN leaf device, the device checks that received Type 2 route advertisements have the proper fields. The device logs an error and rejects Type 2 routes that don't include the Layer 3 (IP) VNI value, which we require for symmetric IRB routing.

Trade-offs with the Symmetric Model

For inter-subnet routing, the symmetric model enables better scaling over the asymmetric model in configurations with a large number of VLANs. With the symmetric model, you can configure each VTEP with only the VLANs that serve its connected hosts. However, you also need an additional Layer 3 transit VLAN and VNI for each tenant virtual routing and forwarding (VRF) instance.

When your EVPN-VXLAN network has a large number of VLANs, the symmetric model helps to avoid the scaling issues inherent in the asymmetric model. With the asymmetric model, you must configure destination VLANs on a device even if none of its connected hosts use those VLANs. With the symmetric model, you can configure each device only with the VLANs its connected hosts use. However, if the network serves most or all VLANs on all devices in any case, your configuration can be simpler using the asymmetric model.