EVPN Host Route Management for Large-Scale Stretched Campus Networks

• Helps enable campus networks with stretched bridge domains (VLANs) reach higher scale.

• Saves routing table resources and reduces route management overhead at the access and distribution layers to avoid traffic drops.

• Ensures optimal route selection for intersubnet traffic.

Large EVPN campus networks often have bridge domains (VLANs) stretched across multiple offices and locations using data center interconnection (DCI) features. On the access and distribution layer devices, routing table and route management resources can become strained as the network scales if those devices:

• Accumulate remote host route states.

• Perform distributed address resolution learning for the remote paths.

The core layer devices are usually higher capacity devices that support higher route scaling. To enable these networks to grow, you can optimize how the access, distribution, and core layers manage host routes. With a combination of routing policy options and configuration statements, you can configure the network to use a host route management model that maintains remote host routes only at the core layer. The distribution layer devices forward intersubnet traffic using only EVPN Type 5 subnet routes learned from the core layer. The access layer devices forward intersubnet traffic using only EVPN Type 5 subnet routes learned from the distribution layer. The access and distribution layer devices conserve routing table resources by not installing remote host routes.

With this host route management method, include routing policies on the distribution and access layer devices to:

• Ensure the EVPN Type 5 subnet routes are the preferred routes.

• Reject EVPN remote host routes the devices might receive.

With the resulting routing tables, the devices handle intersubnet traffic using the usual EVPN and Layer 3 (L3) routing processes.

• How the Host Route Management Model Works
• Host Route Management Options Summary

Distribution and access layer devices might also serve as edge devices that interconnect sites in a distributed campus network. However, with this host route management model, we want distribution and access layer devices to prefer and only use the core-advertised EVPN Type 5 subnet routes. As a result, those devices should block importing any Type 5 host routes (IPv4 /32 or IPv6 /128 routes) they might receive from other sites.

To configure the device to block importing any BGP protocol EVPN Type 5 host routes learned from any EVPN peer devices, use the sample policy and policy application here as a guide. In the campus architecture, the distribution layer EVPN peer devices are the core layer devices. The access layer peer devices are the distribution layer devices.

Sample BGP protocol policy to reject EVPN Type 5 host routes for an EVPN peer device:

Apply the policy as a BGP import policy for an EVPN peer device:

A device prefers directly connected routes by default. When an access or distribution device has a directly connected IRB route for a prefix that also exists as an EVPN Type 5 route, the connected route can become active and result in local routing at the edge. To maintain the remote host routing behavior in this model, modify the direct route preference on the distribution and access layer devices so the EVPN Type 5 route learned from the core layer is the preferred route. Then the forwarding plane uses the EVPN Type 5 subnet next hop, and forwards intersubnet traffic toward the core.

Configure this behavior by setting a routing policy for each VRF instance with policy terms that change the preference of the direct route for any of the VRF's local IRB routes. Set the route preference for IRB routes from that VRF instance and protocol direct to a higher value than the EVPN Type 5 route preference.

Apply the policy using the import-primary policy option at the [edit routing-instances T5-VRF-name routing-options interface-routes family {inet | inet6}] hierarchy level.

For example, for IPv4 intersubnet routes, see the following sample policy direct-rt-pref and import-primary policy option setting for VRF instance t5-vrf1, which has EVPN Type 5 routing enabled.

1. Configure a policy statement direct-rt-pref for VRF instance t5-vrf1. In the policy statement, match the VRF's direct local IRB routes and set a preference value of 180 for those routes:

2. Apply the policy statement in the VRF instance:

Note that when you use the import-primary option, the policy changes attributes of the primary routes. Simply deleting the import-primary statement doesn’t reverse those route attributes back to the default values. As a result, to remove an import-primary policy and revert back to default behavior, you must do either of the following:

• Modify the policy statement you configure with the import-primary policy to set the route preference to 0, which is the default direct route preference.

• Delete the import-primary statement, then add the direct routes again by shutting down the related interfaces and bringing those interfaces up again.

Large-scale campus networks distributed across multiple buildings or locations might have multiple tiers of EVPN Type-2 and Type-5 route stitching across DCI WAN connections. To save routing table resources on distribution devices with stitching stretching across multi-site DCI connections, configure the skip-install-wan-host-route option at the [edit forwarding-options evpn-vxlan] hierarchy level.

With this option, the device skips installing remote host routes (IPv4 /32 or IPv6 /128 routes) learned from the other sites.

The access layer devices install the EVPN Type 5 subnet routes they receive from the distribution layer (which came from the core layer). As a result, the access layer devices don't need to install EVPN Type 5 remote host routes (IPv4 /32 or IPv6 /128 routes). However, due to EVPN Type 2 and Type 5 coexistence rules, the access layer device installs Type 2 MAC-IP routes if Type 5 routes for the same destinations are not present.

To avoid installing Type 2 destination routes, even when equivalent Type 5 routes are not installed, configure the no-install-host-route option for the interconnection ESIs (I-ESIs) on the access layer devices that act as peer DCI stitching devices.

You can configure the no-install-host-route option either for a configured MAC-VRF EVI or for the default switch EVI.

For a configured MAC-VRF EVI:

For the default switch EVI:

The access layer devices might also receive EVPN Type 5 remote host routes from other edge devices across sites. See Block Importing any EVPN Type 5 Host Routes for how to also set up policies to reject any EVPN Type 5 remote host routes the devices might receive from other sites.