Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 
ON THIS PAGE
 

Appendix: Bridged Overlay Example

Note:

Please review the known limits of this approach shared in Layer 2 WAN Router Attach Details! Do not use this option in larger production EVPN Fabrics as these limits can impact your future growth.

Using a bridged overlay across the entire fabric is a valid option for smaller deployments. It is particularly useful when migrating from legacy MC-LAG configurations without changing the WAN router implementation. Another advantage is the ability to use DHCP server and relay functions on the WAN router, since all VLANs connected to the fabric can send requests directly via broadcast to WAN router.

When a bridged overlay is used on the EVPN fabric side, an ESI-LAG configuration is required, which means the WAN router must support the following:

  • Support for IEEE 802.3ad link aggregation.
  • Support for active LACP.
  • Support for a first-hop redundancy protocol, such as VRRP, so the default gateway IP on the LAN side can move between active WAN router nodes..

The fully virtual lab example referenced below was built with the following setup:

  • The WAN router consisted of a pair of SRX Series Firewalls.
  • The SRX devices were managed through the Juniper Mist cloud as WAN Edge spokes in standalone mode.
  • The SRX devices were virtual SRX3 VMs with AppID licenses.
  • Chassis cluster mode was enabled on the SRX devices, with HA links configured for state synchronization.
  • The EVPN multihoming fabric used two collapsed core vJunos-switch VMs and two access vJunos-switch VMs. Instructions for using vJunos-switch VMs with the Juniper Mist cloud are available in the following NCE.
  • Linux-based desktop VMs were connected to the access switches to emulate wired clients.
  • The topology and interface connections are shown in the image below

Figure : EVPN Multihoming with Bridged Overlay

When using SRX Series Firewalls in chassis cluster mode, special attention must be given to the LAG configuration toward the EVPN fabric. This is necessary because VRRP is not used in an SRX chassis cluster. The recommended design operates as follows:

  • A single reth interface aggregates all four links on the SRX chassis cluster.
  • The reth interface is configured for LAG with active LACP.
  • All four SRX chassis cluster interfaces operate with active LACP at the same time.
  • The SRX chassis cluster determines which node is active.
    • The standby node does not respond to ARP requests.
    • Only the ae0 or ae1 interfaces on the fabric learn the active SRX remote MAC address.
  • You need two fabric ae* LAGs.
    • They are required to be ESI-LAGs from fabric nodes.
    • They must use the same AE index key toward the corresponding SRX cluster node.
Figure 1: SRX chassis cluster to EVPN Fabric redundancy SRX chassis cluster to EVPN Fabric redundancy

Fabric Configuration

The full workflow for fabric creation is intentionally not shown here, as the focus is on the components required to understand bridged overlay operation and the necessary changes. For more details on EVPN multihoming deployment, refer to the following JVD.

Switch Template

Below is the JSON file that was used as the switch template for this fabric.

In this example, six VLANs have been created. Only the name and VLAN ID should be configured for each. Do not assign any IPv4 or IPv6 subnets, as doing so would defeat the purpose of using a bridged overlay.

  • Network=1
    • Name=vlan1031
    • VLAN ID=1031
  • Network=2
    • Name=vlan1033
    • VLAN ID=1033
  • Network=3
    • Name=vlan1081
    • VLAN ID=1081
  • Network=4
    • Name=vlan1088
    • VLAN ID=1088
  • Network=5
    • Name=vlan1091
    • VLAN ID=1091
  • Network=6
    • Name=vlan1099
    • VLAN ID=1099

Next, configure a port profile. Instead of using a predefined profile such as “uplink,” create a custom one to control which VLANs from the fabric are shared with the WAN router in case of misconfiguration. Configure the port profile as follows:

  • Name=fabric-uplink
  • Port Enabled=Checked
  • Mode=Trunk
  • Port Network=None
  • Trunk Networks=vlan1031 and vlan1033 and vlan1081 and vlan1088 and vlan1091 and vlan1099

Fabric Configuration

When creating the EVPN multihoming fabric, the default settings can be used without any changes. Proceed through the steps until you reach the Configure Networks page, where you should perform the following actions:

  • Import the six VLANs from the switch template
  • Ensure that under Other IP Configuration no IP address is shown as none of your networks should have any subnet defined, just the VLAN ID.
  • VRF configuration:
    • Disabled=Checked
    • Instances=None configured.
  • DHCP Relay=Disabled
  • Access ESI-LAG Name=fabric
  • Trunk Networks=Ensure your six VLANs are automatically added.

Finalize the campus fabric configuration dialogue.

Check the created fabric.

Add the wired client port configuration for the access switches, which is not shown here.

Now, create on the collapsed-core switches core1 and core2 in the fabric uplink configuration.

On core1 and core2, configure the following port configuration:

  • First uplink port:
    • Port ID=ge-0/0/3
    • Interface=L2 interface
    • Configuration Profile=fabric-uplink
    • Port Aggregation=Enabled
    • AE Index=0 (all links to WAN router node0 have this ID)
    • ESI-LAG=Checked MANDATORY
  • Second uplink port:
    • Port ID=ge-0/0/4
    • Interface=L2 interface
    • Configuration Profile=fabric-uplink
    • Port Aggregation=Enabled
    • AE Index=1 (all links to WAN router node1 have this ID)
    • ESI-LAG=Checked MANDATORY

WAN Router Setup

Before configuring the WAN Edge template, you need to do the following

  • Deploy two SKU SRX Series Firewalls with HA links needed as standalone firewalls.
  • Add the necessary AppID licenses to the devices.
  • Change the site configuration to My SRX devices have an App Track license=Checked
  • Adopt or claim the SRX Series Firewalls until they appear in the Juniper Mist inventory.
  • Select two SRX Series Firewalls in the inventory and choose Assign to Site. Enable cluster mode during the site assignment.
  • Wait 15 minutes.
  • Go to WAN-Edges -> Site and review the WAN Edge cluster status. Ensure that AppSecure is running as below.

Now you can build a WAN Edge Template (or Hub-Profile).

Below is the JSON file that was used as the WAN Edge template

If you are not using the JSON file, follow the manual setup described below. Under Organization -> Applications, add a custom application for “fabric” that includes all RFC1918 networks, and another for default route injection, which is currently required to advertise a default route toward the EVPN fabric. Create the following applications:

  • Name=fabric
  • Type=Custom Apps
  • IP Addresses=10.0.0.0/8 and 172.16.0.0/12 and 192.168.0.0/16

Under Organization -> Networks add the subnets for each of the six VLANs.

  • Network=1
    • Name=vlan1031
    • Subnet IP Address=10.31.31.0
    • Prefix Length=24
    • VLAN ID=1031
    • Access to Mist Cloud=Enabled
  • Network=2
    • Name=vlan1033
    • Subnet IP Address=10.33.33.0
    • Prefix Length=24
    • VLAN ID=1033
    • Access to Mist Cloud=Enabled
  • Network=3
    • Name=vlan1081
    • Subnet IP Address=10.81.81.0
    • Prefix Length=24
    • VLAN ID=1081
    • Access to Mist Cloud=Enabled
  • Network=4
    • Name=vlan1088
    • Subnet IP Address=10.88.88.0
    • Prefix Length=24
    • VLAN ID=1088
    • Access to Mist Cloud=Enabled
  • Network=5
    • Name=vlan1091
    • Subnet IP Address=10.91.91.0
    • Prefix Length=24
    • VLAN ID=1091
    • Access to Mist Cloud=Enabled
  • Network=6
    • Name=vlan1099
    • Subnet IP Address=10.99.99.0
    • Prefix Length=24
    • VLAN ID=1099
    • Access to Mist Cloud=Enabled

In our design, we used dynamic IP addresses on the WAN interfaces for our lab.

Figure 2: WAN-Interfaces for our Lab example WAN-Interfaces for our Lab example

Next is the configuration of the LAN interfaces. Configure the following six LAN IP gateways:

  • Gateway=1
    • Network=vlan1031
    • IP Address=10.31.31.1
    • Prefix Length=24
  • Gateway=2
    • Network=vlan1033
    • IP Address=10.33.33.1
    • Prefix Length=24
  • Gateway=3
    • Network=vlan1081
    • IP Address=10.81.81.1
    • Prefix Length=24
  • Gateway=4
    • Network=vlan1088
    • IP Address=10.88.88.1
    • Prefix Length=24
  • Gateway=5
    • Network=vlan1091
    • IP Address=10.91.91.1
    • Prefix Length=24
  • Gateway=6
    • Network=vlan1099
    • IP Address=10.99.99.1
    • Prefix Length=24

Next, enable DHCP and configure a DHCP server for each VLAN. The complete DHCP server configuration for all VLANs is shown below:

  • VLAN=1
    • Network=vlan1031
    • DHCP=Server
    • IP Start=10.31.31.10
    • IP End=10.31.31.250
    • Gateway=10.31.31.1
    • DNS Servers=8.8.8.8,9.9.9.9
  • VLAN=2
    • Network=vlan1033
    • DHCP=Server
    • IP Start=10.33.33.10
    • IP End=10.33.33.250
    • Gateway=10.33.33.1
    • DNS Servers=8.8.8.8,9.9.9.9
  • VLAN=3
    • Network=vlan1081
    • DHCP=Server
    • IP Start=10.81.81.10
    • IP End=10.81.81.250
    • Gateway=10.81.81.1
    • DNS Servers=8.8.8.8,9.9.9.9
  • VLAN=4
    • Network=vlan1088
    • DHCP=Server
    • IP Start=10.88.88.10
    • IP End=10.88.88.250
    • Gateway=10.88.88.1
    • DNS Servers=8.8.8.8,9.9.9.9
  • VLAN=5
    • Network=vlan1091
    • DHCP=Server
    • IP Start=10.91.91.10
    • IP End=10.91.91.250
    • Gateway=10.91.91.1
    • DNS Servers=8.8.8.8,9.9.9.9
  • VLAN=6
    • Network=vlan1099
    • DHCP=Server
    • IP Start=10.99.99.10
    • IP End=10.99.99.250
    • Gateway=10.99.99.1
    • DNS Servers=8.8.8.8,9.9.9.9

Then configure the LAG with the LAN interfaces towards fabric like that shown below:

  • Interface=ge-0/0/2,ge-0/0/3,ge-7/0/2,ge-7/0/3
  • Port Aggregation=Checked/Enabled
    • Disable LACP=Unchecked
    • Enable Force Up=Unchecked
    • AE Index=0
  • Redundant=Checked/Enabled
    • Redundant Index=3
    • Redundant Group=3
    • Primary Node=node0
  • Networks=vlan1031 and vlan1033 and vlan1081 and vlan1088 and vlan1091 and vlan1099

The result should look like the image below.

Figure 3: SRX chassis cluster LAN-interfaces SRX chassis cluster LAN-interfaces

The traffic steering rules are straightforward, as shown below:

  • Create a LAN traffic steering rule using ECMP that includes all six VLAN interfaces.
  • Create a WAN traffic steering rule that includes both WAN interfaces.
Figure 4: Traffic Steering Traffic Steering
Note:

If you are using two physical SSR devices as the WAN router, do not set LAN in the first application policy rule as shown below. Leave the traffic steering field empty in the first application policy rule.

For application policies, configure the following:

  • Rule=1
    • Name=branch-hairpin
    • Network=vlan1031 and vlan1033 and vlan1081 and vlan1088 and vlan1091 and vlan1099
    • Application=fabric
    • Traffic Steering=LAN
  • Rule=2
    • Name=towards-internet
    • Network=vlan1031 and vlan1033 and vlan1081 and vlan1088 and vlan1091 and vlan1099
    • Application=any
    • Traffic Steering=WAN

On the SRX, add the configuration below to allow pinging the LAN interfaces assigned to the SRX chassis cluster. This is recommended for troubleshooting, and some applications may require it.

Testing Your Configuration

The following steps validate the configuration and traffic flow through the design.

Begin with the desktop1 VM connected to the access1 switch.

The following section reviews the status of the collapsed core1 switch through a remote console session.

The following section reviews the status of the SRX chassis cluster using a remote console.