Ethernet VPN (Evpn) : Overlay Networks For Ethernet Services
Ethernet VPN (Evpn) : Overlay Networks For Ethernet Services
Ethernet VPN (Evpn) : Overlay Networks For Ethernet Services
2
COPYRIGHT © 2014 ALCATEL-LUCENT. ALL RIGHTS RESERVED.
ETHERNET SERVICES TECHNOLOGY CONTINUES TO EVOLVE
HIGHER SPEEDS AND ADVANCED CARRIER-GRADE SERVICES
1973 1982 1983 1989 1995 1998 1998 2000 ~2001 2003 2005 2007 2008 2010 2011 2012 2013+
IEEE
Ethernet IEEE IEEE IEEE IEEE
Ethernet 802.3ba
Switch- 802.3z 802.3ad 802.3ae VPLS 802.1aq
II (40 GE,
ing (GE) (LAG) (10 GE) (SPB)
100 GE)
―The widespread adoption of Ethernet L2VPN services and the advent of new applications for the technology (e.g.,
data center interconnect) have culminated in a new set of requirements that are not readily addressable by the
current Virtual Private LAN Service (VPLS) solution.‖ — draft-ietf-l2vpn-evpn-req
3
COPYRIGHT © 2014 ALCATEL-LUCENT. ALL RIGHTS RESERVED.
WHY ANOTHER VPN TECHNOLOGY?
• MPLS/VPLS and PBB are both proven technologies for Ethernet services, but
- The control plane approach hasn’t changed
- Still relies on flooding and learning to build the Layer 2 forwarding database (FDB)
• EVPN introduces a new model for delivery of Ethernet services
- Inherits a decade of VPLS operational experience in production networks
- Incorporates flexibility for service delivery over Layer 3 networks
- Abstracts and separates the control and data planes: MP-BGP carries MAC/IP routing information, choice
of data plane encapsulation
• Enables network operators to meet emerging needs in their networks
- Data center interconnect (DCI)
- Cloud and virtualization services
- Integrated Layer 2 and Layer 3 VPN services
- Overlay technologies that simplify topologies, and remove protocols from the network
4
COPYRIGHT © 2014 ALCATEL-LUCENT. ALL RIGHTS RESERVED.
EVPN KEY OPERATIONAL BENEFITS
Integrated • Delivering Layer 2 and Layer 3 services over the same interface, VLAN and VPN
Services • L3VPN-like operation for scalability and control
5
COPYRIGHT © 2014 ALCATEL-LUCENT. ALL RIGHTS RESERVED.
EVPN STATUS
draft-allan-l2vpn-mldp-evpn
draft-boutros-l2vpn-evpn-vpws
• Hot new technology in the IETF L2VPN WG draft-boutros-l2vpn-vxlan-evpn
draft-ietf-l2vpn-evpn
• Many mature base I-Ds and new I-Ds draft-ietf-l2vpn-evpn-req
draft-ietf-l2vpn-pbb-evpn
- draft-ietf-l2vpn-evpn base specification: WG last call for -07 draft-ietf-l2vpn-spbm-evpn
on May 9, 2014 draft-ietf-l2vpn-trill-evpn
draft-jain-l2vpn-evpn-lsp-ping
- draft-ietf-l2vpn-evpn-req: no more changes expected draft-li-l2vpn-evpn-mcast-state-ad
draft-li-l2vpn-evpn-pe-ce
- draft-ietf-l2vpn-pbb-evpn: no more changes expected draft-li-l2vpn-segment-evpn
• Diverse authors on requirements and base specification draft-rabadan-l2vpn-dci-evpn-overlay
draft-rabadan-l2vpn-evpn-prefix-advertisement
- Vendors: Alcatel-Lucent, Cisco, Juniper draft-rp-l2vpn-evpn-usage
draft-sajassi-l2vpn-evpn-etree
- Network operators: Arktan, AT&T, Bloomberg, Verizon draft-sajassi-l2vpn-evpn-inter-subnet-forwarding
• Shipping implementations draft-sajassi-l2vpn-evpn-ipvpn-interop
draft-sajassi-l2vpn-evpn-vpls-integration
- Alcatel-Lucent draft-salam-l2vpn-evpn-oam-req-frmwk
draft-sd-l2vpn-evpn-overlay
- Cisco draft-vgovindan-l2vpn-evpn-bfd
draft-zhang-l2vpn-evpn-selective-mcast
- Juniper draft-zheng-l2vpn-evpn-pm-framework
6
COPYRIGHT © 2014 ALCATEL-LUCENT. ALL RIGHTS RESERVED.
EVPN DATA PLANES
ONE EVPN CONTROL PLANE WITH MULTIPLE DATA PLANE OPTIONS
• EVPN over MPLS for E-LAN • EVPN with PBB PE • EVPN over NVO tunnels
services functionality for scaling very (VXLAN, NVGRE, MPLSoGRE)
• All-active multihoming for large networks over MPLS for data center fabric
VPWS • All-active multihoming for encapsulations
• RSVP-TE or LDP MPLS PBB-VPLS • Provides Layer 2 and Layer 3
protocols DCI and overlays over simple
IP networks
7
COPYRIGHT © 2014 ALCATEL-LUCENT. ALL RIGHTS RESERVED.
EVPN CONTROL PLANE LEARNING WITH MP-BGP
• Brings proven and inherent BGP control plane scalability to Route Distinguisher (8 octets)
MAC routes
Ethernet Segment Identifier (10 octets)
- Consistent signaled FDB in any size network instead of flooding
- Even more scalability and hierarchy with route reflectors Ethernet Tag ID (4 octets)
• BGP advertises MACs and IPs for next hop resolution with EVPN MAC Address Length (1 octet)
NLRI
MAC Address (6 octets)
- AFI = 25 (L2VPN) and SAFI = 70 (EVPN)
- Fully supports IPv4 and IPv6 in the control and data plane IP Address Length (1 octet)
• Offers greater control over MAC learning
IP Address (0 or 4 or 16 octets)
- What is signaled, from where and to whom
MPLS Label1 (3 octets)
- Ability to apply MAC learning policies
• Maintains virtualization and isolation of EVPN instances MPLS Label2 (0 or 3 octets)
• Enables traffic load balancing for multihomed CEs with ECMP MAC Advertisement Route
MAC routes (Light Blue Fields are Not Used in all Data Planes)
8
COPYRIGHT © 2014 ALCATEL-LUCENT. ALL RIGHTS RESERVED.
EVPN CONCEPTS OVERVIEW
All-Active Mode
Customer Edge (CE) Multihomed, Two or More
Host, Router or Switch PE PE Active PEs
EVI 1 EVI 1
CE
EVI 1 EVI 1
MAC/IP
EVPN Instance (EVI) MAC/IP
PE PE LAG
Identifies a VPN Ethernet Segment
Identifier (ESI)
Ethernet Tag Links that Connect the CE
Broadcast or Bridge Domain in the EVI to PEs (ESIs are Unique
Across the Network)
Data Plane Encapsulation
MPLS or IP
9
COPYRIGHT © 2014 ALCATEL-LUCENT. ALL RIGHTS RESERVED.
EVPN SERVICE INTERFACES OVERVIEW
VID11 EVI 1 VID 12 VID 11 Bridge Domain 1 VID 11 VID 11 Bridge Domain 1 VID 12
Service Interface VID 21 EVI 2 VID 22 VID 21 VID 21 VID 21 Bridge Domain 2 VID 22
EVI 1 EVI 1
Diagram VID 31 EVI 3 VID 32 VID 31 VID 31 VID 31 Bridge Domain 3 VID 32
VID 41 EVI 4 VID 42 VID 41 VID 41 VID 41 Bridge Domain 4 VID 42
Mapping Between
1:1 N:1 N:1
VLAN ID and EVI
Customer VID
Single Multiple Multiple
per EVI
Bridge Domains
Single Single Multiple
per EVI
Overlapping MACs
Across VLANs
VLAN Translation
10
COPYRIGHT © 2014 ALCATEL-LUCENT. ALL RIGHTS RESERVED.
AGENDA
11
COPYRIGHT © 2014 ALCATEL-LUCENT. ALL RIGHTS RESERVED.
EVPN OPERATION
12
COPYRIGHT © 2014 ALCATEL-LUCENT. ALL RIGHTS RESERVED.
EVPN OPERATION
ALL-ACTIVE MULTIHOMING AND DESIGNATED FORWARDER ELECTION
DF
BUM From
Core to CE
Duplicate BUM X
Flooding Blocks
BUM Flooding
BUM From
CE to Core
Echoed BUM X
Traffic Blocks
Echo
• Ensures that BUM traffic from an ESI is not replicated back to the same ESI to an all-active CE
• PE advertises a split horizon label for each all-active Ethernet segment
• When an ingress PE floods BUM traffic, it pushes the split horizon label to identify the source
Ethernet segment
• Egress PEs use this label for split horizon filtering and drop packets with the label destined to the
Ethernet segment
• Implicit split horizon for core, since PEs won’t flood received BUM traffic back into core
14
COPYRIGHT © 2014 ALCATEL-LUCENT. ALL RIGHTS RESERVED.
EVPN OPERATION
PROXY ARP/ND AND UNKNOWN UNICAST FLOODING SUPPRESSION
Proxy
?MAC/IP
ARP/ND MAC Provisioning
or
Snooping
• ARP/ND is a security issue and a scalability issue in • EVPN can reduce or suppress unknown unicast
large networks flooding since all active MACs and IPs are advertised
- Unknown unicast traffic levels, especially in large data
by PEs
center and IXP networks - PEs proxy ARP/ND based on MAC route table to CEs
• We really don’t need it anymore in orchestrated or - ARP/ND/DHCP snooping optimizes and reduces unknown
provisioned networks where all MACs/IPs are known unicast flooding, useful in dynamic data center networks
- Provisioning MAC addresses can reduce or eliminate
unknown unicast flooding entirely
- Can disable learning and snooping for programmatic
network control
15
COPYRIGHT © 2014 ALCATEL-LUCENT. ALL RIGHTS RESERVED.
EVPN OPERATION
ALIASING
Knows MAC is Reachable
via Ethernet Segment
MAC MAC/IP
Learned
• Provides load balancing to all-active CE when the MAC address is only learned by one PE
- First MAC learning by PE is usually from a Layer 2 broadcast (ARP/ND/DHCP)
- Broadcasts are sent on the primary link in a LAG
- Can have periods of time when the MAC is only learned by the PE connected to the primary link
• PEs advertise the ESI in MAC routes with all-active mode
• Remote PEs can load balance traffic across all PEs advertising the same ESI
- Multipathing to CE always works, does not depend on random learning situations or hashing at CE
• Can also be used for a backup path in single-active mode with a standby link
16
COPYRIGHT © 2014 ALCATEL-LUCENT. ALL RIGHTS RESERVED.
EVPN OPERATION
MAC MOBILITY
?
MAC/IP
Seq#
• MAC addresses may move between ESIs • Each MAC is advertised with a MAC mobility
sequence number in an extended community with
• If local learning is used, the PE may not detect that
the MAC route
a MAC address has moved and won’t send a
withdraw for it - PE selects the MAC route with the highest sequence
number
• New PE sends a new MAC route - Triggers withdraw from PE advertising MAC route with
• Now there are two routes for the MAC address: an the lower sequence number
old wrong one and a new correct one - Lowest PE IP address is used as the tie breaker if the
sequence number is the same
17
COPYRIGHT © 2014 ALCATEL-LUCENT. ALL RIGHTS RESERVED.
EVPN OPERATION
MAC DUPLICATION
? ?
MAC/IP
Seq#
• In certain bad situations, the same MAC could be • If five (N) moves (M) are detected in 180 s, then
learned by two PEs the MAC is considered duplicated (default timers)
- MAC duplication • PEs stop advertising its route, PEs will use the route
- Rapid movement with the highest sequence number for forwarding
- Loops
• Condition can be cleared manually or by
• MAC duplication detection mechanism uses a implementing a retry timer to clear it
configurable timer and move counter automagically
- Provides per-MAC duplication control vs. per-port control
in Layer 2 bridging
18
COPYRIGHT © 2014 ALCATEL-LUCENT. ALL RIGHTS RESERVED.
EVPN OPERATION
MAC MASS-WITHDRAW
Withdraw
ESI
• Provides rapid convergence when a link failure • Remote PEs remove failed PE from the path
affects many MAC addresses for all MAC addresses associated with an ESI
• PEs advertise two routes • Functions as a MAC mass-withdraw and speeds
- MAC/IP address and its ESI
convergence during link failures
- Connectivity to ESIs • No need to wait for individual MAC addresses
• If a failure affects an ESI, the PE simply to be withdrawn
withdraws the route for the ESI
19
COPYRIGHT © 2014 ALCATEL-LUCENT. ALL RIGHTS RESERVED.
EVPN OPERATION
DEFAULT GATEWAY INTER-SUBNET FORWARDING
GW GW
Inefficient
GW Routing GW
• EVPN supports inter-subnet forwarding when • Local PEs respond to ARP/ND requests for
IP routing is required default gateway
• No additional separate L3VPN functionality is • Enables efficient routing at local PE
needed, uses EVPN default gateway
• Avoids tromboning traffic across remote PEs to
• One or more PEs is configured as the default be routed after a MAC moves, if all default
gateway, 0.0.0.0 or :: MAC route is advertised gateways use the same MAC address
with default gateway extended community
20
COPYRIGHT © 2014 ALCATEL-LUCENT. ALL RIGHTS RESERVED.
EVPN MULTIPROTOCOL LABEL SWITCHING (MPLS) DATA PLANE
DRAFT-IETF-L2VPN-EVPN (EVPN-MPLS)
BGP
Control Plane
PE
MPLS
MAC/IP Data Plane
• EVPN over an MPLS data plane is the original EVPN solution in the base specification
• Requires IGP, RSVP-TE or LDP, BGP
• No pseudowires
• MPLS runs in the core network’s control plane and data plane
• Core network supports all the MPLS features we know and love, since EVPN uses MPLS as
the data plane (TE, FRR, …)
21
COPYRIGHT © 2014 ALCATEL-LUCENT. ALL RIGHTS RESERVED.
PROVIDER BACKBONE BRIDGES (PBB) EVPN DATA PLANE
DRAFT-IETF-L2VPN-PBB-EVPN (PBB-EVPN)
BEB BGP
PE Control Plane
PBB MAC
C-MAC
Mapping
MPLS
B-MAC Data Plane
• PBB-EVPN combines IEEE 802.1ah PBB with • Scales EVPN networks to a very large number
EVPN of MACs
• PEs are PBB Backbone Edge Bridges (BEB) - PEs only advertise backbone MACs with BGP
- Customer MAC and backbone MAC mapping is
• Reduces number of MACs in EVPN by learned in the data plane
aggregating customer MACs with backbone
- Useful for providing services to networks where
MACs the MACs are not under your control
- Same concept as route aggregation in IP • MPLS runs in the control plane and data plane
22
COPYRIGHT © 2014 ALCATEL-LUCENT. ALL RIGHTS RESERVED.
EVPN VIRTUAL EXTENSIBLE LAN (VXLAN) DATA PLANE
DRAFT-SD-L2VPN-EVPN-OVERLAY (EVPN-VXLAN)
BGP
Control Plane
PE
VXLAN
MAC/IP Data Plane
• EVPN-VXLAN uses EVPN over a VXLAN data plane • VXLAN provides the Layer 2 overlay over IP
- VXLAN is typically used for data center extension over - IP reachability is required between PEs
WAN - EVPN uses BGP control plane for MAC route
- Can also be used as an overlay in any IP network for advertisements
IP/Ethernet services - VXLAN data plane uses UDP to encapsulate the VXLAN
- Useful when MPLS is unavailable or unwanted header and Layer 2 frame
- Alternative to NVGRE or MPLSoGRE (NVO3) • Provides all the benefits of EVPN for DCI and
- PIM is not needed with ingress BUM replication virtualized networks
23
COPYRIGHT © 2014 ALCATEL-LUCENT. ALL RIGHTS RESERVED.
VXLAN DATA PLANE FLEXIBILITY
IPv4 or IPv6 UDP VXLAN
Payload
Header Header Header
• VXLAN encapsulates Ethernet in IP
- Runs over IPv4 or IPv6 and uses UDP
IP Network
- Source port in ranges 49152 – 65535 is a hash of fields from
(IP FRR, ECMP, IGP)
the encapsulated frame to provide load balancing entropy
- Destination port is 4789
- 8 byte VXLAN header provides 24 bit VXLAN Network Identifier
(VNI) and flags
• VXLAN is routable with IP, so the underlay network may
IP Network
be any network that uses existing resiliency and load
balancing mechanisms
- ECMP
- IGPs/BGP
- IP FRR
• VXLAN tunnel endpoints can be on network equipment or
computing infrastructure
IP Network
- Deliver a VPN to a hypervisor attached to a VM
24
COPYRIGHT © 2014 ALCATEL-LUCENT. ALL RIGHTS RESERVED.
AGENDA
25
COPYRIGHT © 2014 ALCATEL-LUCENT. ALL RIGHTS RESERVED.
LAYER 2 OR LAYER 3 DATA CENTER INTERCONNECT
2001:db8:414c::1/128 2001:db8:414c::1/128
00:0c:29:89:ac:0b 00:0c:29:89:ac:0b
• Enables scalable Layer 2 or Layer 3 DCI • Provides all the benefits of EVPN for DCI and
services for virtualized data centers virtualized networks
• IP/MAC mobility for VMs that move between - All-active multihoming
data centers - Eliminates ARP/ND flooding for MAC learning
- Faster moves while maintaining correct FDB on all - Integrated Layer 2 switching and Layer 3 routing
routers over the same interface or VLAN
• EVPN enables service providers to offer • EVPN service can be provided over any core
integrated Layer 2 and Layer 3 services network
- Single interface, single VLAN to customer - MPLS core can use EVPN-MPLS
- One technology for both services, no need for - IP core can use EVPN-VXLAN
multiple VPN protocols
- All-active or single-active PE to CE connection
27
COPYRIGHT © 2014 ALCATEL-LUCENT. ALL RIGHTS RESERVED.
SITE TO SITE NETWORKS OVER IP
FLEXIBLE LAYER 2 AND LAYER 3 NETWORKS
BGP Control Plane
CE CE
PE
Service SP B
PE
Provider
A SP C PE
CE
• EVPN-VXLAN works over any IP service to • VPN routing between endpoints can be
provide a flexible site to site network controlled with BGP and routing policies to
service providers
• Just requires IP connectivity between sites, no
MPLS or any special configuration by IP service • Routing and MAC/IP advertisement within
provider EVPN controlled via IBGP between PEs
- Service provider network is transparent to EVPN
- EVPN overlay is transparent to service providers
28
COPYRIGHT © 2014 ALCATEL-LUCENT. ALL RIGHTS RESERVED.
SUMMARY
29
COPYRIGHT © 2014 ALCATEL-LUCENT. ALL RIGHTS RESERVED.
QUESTIONS?
EVPN REQUIREMENTS AND BENEFITS
VPN Requirements VPLS EVPN What does it do for me?
Address Control Plane Address Learning
Learning in the Core Greater Scalability and Control
Active-Standby Multihoming
(Service-Based Load Balancing) Standby Redundancy
Resiliency
All-Active Multihoming
(Flow-Based Load Balancing) Active Redundancy and Link Utilization
Flow
Proxy ARP/ND Security and MAC Provisioning
Optimization
MAC Mobility Virtualization and Advanced Services
31
COPYRIGHT © 2014 ALCATEL-LUCENT. ALL RIGHTS RESERVED.
EVPN NLRI ROUTE TYPES AND EXTENDED COMMUNITIES
Route Type Route Description Route Usage Reference
Endpoint Discovery, Aliasing,
1 Ethernet Auto-Discovery (A-D) Route draft-ietf-l2vpn-evpn
Mass-Withdraw
32
COPYRIGHT © 2014 ALCATEL-LUCENT. ALL RIGHTS RESERVED.
INTERNET EXCHANGE POINT
PEERING FABRIC MAC/IP
?
MAC/IP
IP or IP/MPLS
Core Network
Proxy
ARP/ND
• Provides Layer 2 interconnection over an EVPN • Enables precise fine-grained control over MAC
peering fabric addresses
- IP/MPLS core network with MPLS data plane - Static MAC provisioning and proxy ARP/ND from
- IP core network with VXLAN data plane PEs can reduce or eliminate unknown unicast
• Supports single or all-active multihoming to - Per-MAC loop control vs per-port or per-VLAN
isolates potential loops
the peering fabric VLAN
- Works together with edge port hygiene features
• Supports PNIs and/or other overlay VLANs to provide a clean and secure peering fabric
33
COPYRIGHT © 2014 ALCATEL-LUCENT. ALL RIGHTS RESERVED.
INTERNET EXCHANGE POINT
PEERING FABRIC Port Hygiene at
Edge Ports
EVPN
Peering
Fabric
• EVPN provides the technology for the peering fabric and MAC/IP management over the
core
• Still need to use existing port security mechanisms and follow BCPs for port hygiene
and allowed traffic
- Typically allow IPv4, IPv6, ARP and block unwanted traffic types
- MAC address locking
- BUM control
34
COPYRIGHT © 2014 ALCATEL-LUCENT. ALL RIGHTS RESERVED.