Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 
ON THIS PAGE
 

EVPN-VXLAN Forwarding Consistency and Hash Verification

EVPN-VXLAN forwarding consistency and hash verification compares MAC and MAC-IP state across control and forwarding planes per VLAN to pinpoint out-of-sync issues.

You can use the request system evpn forwarding vlans command to perform EVPN-VXLAN cross-module forwarding consistency and hash verification. This command compares EVPN Type 2 MAC and MAC-IP reachability states across the control plane, kernel programming, and forwarding programming layers. This command displays an In-Sync or Out-of-Sync summary per VLAN. You can also add the detail option to review MAC table and MAC-IP table discrepancies and the associated error indicators.

You can limit the scope of the verification to reduce runtime and isolate issues by specifying a routing instance, VLAN, or a module (mac-table or mac-ip-table). You can also generate per-VLAN hash values with the request system evpn hash-values vlans command to quickly correlate states across subsystems. Use these commands to troubleshoot state divergence without changing EVPN-VXLAN forwarding behavior.

Benefits of Forwarding Consistency and Hash Verification

  • Identifies per-VLAN mismatches between the control plane, kernel programming, and forwarding programming so you can pinpoint synchronization gaps that can lead to traffic loss or duplication.

  • Separates VLANs with consistent programming from VLANs that require investigation by reporting an In-Sync or Out-of-Sync result per VLAN.

  • Provides entry-level discrepancy reporting with error indicators to help you identify the MAC or MAC-IP reachability entries that require investigation.

  • Detects conditions where routing instances or bridge domains remain in a deleted state, which can prevent expected EVPN-VXLAN programming even when configuration appears correct.

  • Supplies per-VLAN hash values for quick correlation of state across subsystems, enabling faster checks for change or divergence without requiring full entry output.

Overview

When you run the request system evpn forwarding vlans command, the device performs a per-VLAN comparison of EVPN Type 2 reachability states across subsystems that must be consistent for correct forwarding: the EVPN control plane view, the kernel programming view, and the forwarding programming view. Differences between these views can indicate forwarding issues. For example, if a MAC or MAC-IP entry exists in one layer but is missing, stale, or resolved differently in another layer, traffic might be misdirected, intermittently reachable, or dropped.

Use request system evpn forwarding vlans for a broad health check. To narrow the scope, specify a routing instance and VLAN, for example:

  • request system evpn forwarding vlans instance instance_name vlan vlan_name

To focus the analysis on a specific table, specify a module in the CLI command, for example:

  • request system evpn forwarding vlans module mac-table

or

  • request system evpn forwarding vlans module mac-ip-table

You can add the detail option to change from a VLAN-level result to entry-level reporting so you can identify which MAC or MAC-IP items fail consistency checks.

To detect state drift without collecting full tables, run the request system evpn hash-values vlans command. The device returns per-VLAN hash values derived from EVPN VLAN data as represented across the relevant subsystems. Use the values to compare VLAN state at a glance or to establish a baseline during stable operation.

These commands can consume significant resources, so the CLI might prompt you to confirm before it runs them. You can limit the scope of the request to minimize impact. Use the no-confirm option only when you determine that running the analysis is safe under current conditions.

These commands evaluate a point-in-time state, so results are most reliable after the system reaches steady state. During convergence, MAC movement, or control plane churn, transient differences can appear as components reconcile their state.

Operational Guidance for the request system evpn Commands

Use a summary-to-detail workflow to move from detection to isolation. Start with request system evpn forwarding vlans to identify affected VLANs. Then run a narrower request, such as request system evpn forwarding vlans instance instance_name vlan vlan_name detail, to retrieve inconsistent entries and their error indicators.

If you suspect the issue is limited to one reachability category, run module-specific checks to reduce output. For example, use request system evpn forwarding vlans module mac-ip-table detail to focus on MAC-IP reachability consistency.

Use hash values for quick correlation. Run request system evpn hash-values vlans to capture per-VLAN hash values, then rerun the command after a suspected change to identify which VLANs diverged. For commands that prompt for resource usage, prefer scoping with instance, vlan, and module before using the no-confirm option.

If you automate collection and post-process results, you can request XML output with standard CLI piping, for example request system evpn forwarding vlans detail | display xml or request system evpn hash-values vlans | display xml. Parse the summary and entry elements to integrate the output into troubleshooting procedures.

Related Documentation