Professional Documents
Culture Documents
Xrdocs Io ncs5500 Tutorials BGP Evpn Based Port Active Multihoming
Xrdocs Io ncs5500 Tutorials BGP Evpn Based Port Active Multihoming
Xrdocs Io ncs5500 Tutorials BGP Evpn Based Port Active Multihoming
Paban Sarma
Technical Marketing Engineer, Cisco. Follow
Save to PDF
O N T H I S PA G E
I M P L E M E N TAT I O N O F B G P - E V P N B A S E D P O R T- A C T I V E M U LT I - H O M I N G
R E F E R E N C E TO P O LO GY
In port-active multi-homing, a host/CE is multihomed to one or more Leaf/PEs and only one of the Leaf is active and
forwards the tra c to and from the connected hosts. The rest of the Leaf remain in standby mode. Thus these mode
o ers an active-standby PE/Leaf redundancy for multihomed host/CE.
In this post we will cover the BGP-EVPN based Port-Active Multi-Homing of CE/Hosts. Similar to All active or Single
active mode, Ethernet Segment Identi er (ESI) is used to identify the links towards the same multihomed Host. Port-
active o ers active/standby redundant connectivity with forwarding for all tra c on a single link at a time with switchover
to the second link in case of active link’s failure. Port-Active load balancing mode keeps only one link towards the host as
active and rest of the link stays in LACP standby mode, thus creating a complete active standby multihoming for the
connected host/CEs. This is useful when we need protocol simpli cation from the host network.
Reference Topology
For this post, we will leverage EVPN control-plane and ISIS Segment Routing based forwarding that we con gured in a
previous post. However, the choice of transport is not mandatorily ISIS+SR and we can have OSPF as IGP and LDP
instead of SR as well.
As shown in the above topology, Host-1 is multi-homed to Leaf-1 and Leaf-2. For EVPN port multi-homing, the link
towards the Leaf will be a single ethernet bundle interface. This bundle may operate with di erent VLANs for di erent
services. EVPN port-active mode at the leaf1 and leaf2 will elect only one leaf as the active node and the bundle on that
leaf will be in active state. The bundle on the other leaf will move to standby state and signal LACP out of service towards
the host. As a result all tra c from the host H-1 will be able to forward the tra c only towards the active lacp link to
achieve port active redundancy for multihoming. The election of active Leaf is similar operation like all active DF election,
however in this case the election happens based on the ethernet segment identi er.
As per the reference topology Host-1 is multi-homed to Leaf-1 and Leaf-2 via LACP bundle-ethernet 1 going to both
Leaf-1 and Leaf-2. The host/CE with IP address 10.0.0.10/24 con gured on a vlan sub interface on the bundle. .
Following is the con guration of LAG on Host-1. The LAG on Host-1 will come up after we con gure lacp and port-active
multi-homing using EVPN Ether-Segment on the Leaf-1 and Leaf-2.
Host-1:
interface Bundle-Ether 1
description "Bundle to Leaf-1"
!
interface TenGigE0/0/2/0
description "Link to Leaf-1 ten0/0/0/47"
bundle id 1 mode active
!
interface TenGigE0/0/2/1
description "Link to Leaf-2 ten0/0/0/47"
bundle id 1 mode active
!
interface Bundle-Ether1.10
encapsulation dot1q 10
ipv4 address 10.0.0.10 255.255.255.0
!
Con gure Leaf-1 and Leaf-2 to provision port-active multi-homing to host-1. The set of links from Host-1 to the Leafs
will be con gured as the same Ethernet Segment on the Leafs.
Con gure the LACP bundles on the Leaf-1 and Leaf-2. Use below con guration for the Leafs.
Leaf-1:
interface TenGigE0/0/0/47
description "Link to Host-1"
bundle id 1 mode active
!
interface Bundle-Ether1
description "Bundle to Host-1 for port-active"
lacp system mac 1212.1212.1212
Leaf-2
interface TenGigE0/0/0/47
description "Link to Host-1"
bundle id 1 mode active
!
interface Bundle-Ether1
description "Bundle to Host-1 for port-active"
lacp system mac 1212.1212.1212
!
Con gure ESI for the bundle interface to enable multi-homing of the host. Use the identical ethernet-segment
con guration on both the Leafs. Con gure load-balancing mode to port-active using “port-active” keyword for ethernet-
segment.
Note: The configured ESI will be used for the selection of active port. Out of the 10 octet ESI, a modulo operation is performed
evpn
interface Bundle-Ether1
ethernet-segment
identifier type 0 12.12.12.12.12.12.12.12.12
load-balancing-mode port-active
Use “show bundle bundle-ether” CLI command to verify the state of the bundle interfaces on Leafs and Host-1.
Bundle-Ether1
Status: Up
Local links < active/standby/configured > : 1 / 0 / 1
Local bandwidth < effective/available> : 10000000 (10000000) kbps
MAC address (source): 00bc.601c.d0d9 (Chassis pool)
Inter-chassis link: No
Minimum active links / bandwidth: 1 / 1 kbps
Maximum active links: 64
Wait while timer: 2000 ms
Load balancing:
Link order signaling: Not configured
Hash type: Default
Locality threshold: None
LACP: Operational
Flap suppression timer: Off
Cisco extensions: Disabled
Non-revertive: Disabled
mLACP: Not configured
IPv4 BFD: Not configured
IPv6 BFD: Not configured
Bundle-Ether1
Status: LACP OOS (out of service)
Local links < active/standby/configured > : 0 / 1 / 1
Local bandwidth < effective/available > : 0 (0) kbps
MAC address (source): 00bc.600e.40dc (Chassis pool)
Inter-chassis link: No
Minimum active links / bandwidth: 1 / 1 kbps
Maximum active links: 64
Wait while timer: 2000 ms
Load balancing:
Link order signaling: Not configured
Hash type: Default
Locality threshold: None
LACP: Operational
Flap suppression timer: Off
Cisco extensions: Disabled
Non-revertive: Disabled
mLACP: Not configured
IPv4 BFD: Not configured
IPv6 BFD: Not configured
Port Device State Port ID B/W, kbps
-------------------- --------------- ----------- -------------- ----------
Te0/0/0/47 Local Standby 0x8000, 0x0001 10000000
Link is in standby due to bundle out of service state
Also, verify the port-active operation making one leaf active and one leaf standby by verifying the status of the ethernet
segment on each PE
LEAF1:
LEAF2:
Legend:
B - No Forwarders EVPN-enabled,
C - Backbone Source MAC missing (PBB-EVPN),
RT - ES-Import Route Target missing,
E - ESI missing,
H - Interface handle missing,
I - Name (Interface or Virtual Access) missing,
M - Interface in Down state,
O - BGP End of Download missing,
P - Interface already Access Protected,
Pf - Interface forced single-homed,
R - BGP RID not received,
S - Interface in redundancy standby state,
X - ESI-extracted MAC Conflict
SHG - No local split-horizon-group label allocated
Note In the example shown the ethernet segment Identifier is 00.12.12.12.12.12.12.12.12.12.12 and the portion impacting DF
election is 12.12.12.12 as highlighted. For Dual homing an odd-even modulo operation will gives a result of 0. Therefore Leaf1 is
our active PE as it has a lower BGP router ID of 1.1.1.1 compared to 2.2.2.2 of Leaf2.
Above output shows that the bundle interfaces are up and port active redundancy mode has created an active standby
Leaf redundancy for the dual homed Host-1. By default the ethernet segment signals bundle OOS on the non-DF PE.
The ES may also be con gured with ‘access-signal bundle-down’. This con guration is used to keep ES down instead of
OOS when EVPN cost-out/core-isolation and similar triggers are applied. In the Down signalling mode, the CE side is
able to switch ES from one to the other when LACP is not supported. The below snippet shows the con guration and CLI
output.
evpn
interface Bundle-Ether2
ethernet-segment
identifier type 0 18.44.18.44.18.44.18.44.00
load-balancing-mode port-active
!
access-signal bundle-down
Next, lets’ provision the EVPN layer-2 service over this redundancy.
Here we will con gure a EVPN layer-2 service between Leaf-1, Leaf-2 and Leaf-5 to provide a L2VPN between H1 and
H5. Post con guration we will check the status of ethernet segment. For detailed explanation of con guring BGP EVPN
based layer-2 service, refer to this post.
Here , the L2 service is con gured on VLAN 10 (sub-interface on the bundle) and only one VPN (EVI) is shown. We may
have multiple services running over di erent sub-interface (VLAN).
Leaf-1:
interface Bundle-Ether 1.10 l2transport
encapsulation dot1q 10
rewrite ingress tag pop 1 symmetric
!
l2vpn
bridge group bg-1
bridge-domain bd-10
interface Bundle-Ether 11.10
evi 10
!
!
evpn
evi 10
bgp
route-target import 1001:11
route-target export 1001:11
!
advertise-mac
!
!
!
Leaf-2:
l2vpn
bridge group bg-1
bridge-domain bd-10
interface Bundle-Ether 1.10
evi 10
!
!
evpn
evi 10
bgp
route-target import 1001:11
route-target export 1001:11
!
advertise-mac
!
!
Leaf-5:
Host-5 is single-homed to Leaf-5, below is the Host-5 con guration for reference.
Host-5:
interface TenGigE0/0/1/3.10
description "Link to Leaf-5"
ipv4 address 10.0.0.50 255.255.255.0
encapsulation dot1q 10
Once , the EVPN service is up, H1 will be able to reach H5 and vice-versa.
As we have con gured the BGP EVPN layer-2 service as well as the ethernet segment, we have already veri ed the port
active operation. Now using the same command again we can see in the service carving details and con rm that the
EVPN service is only active on the active PE.
LEAF1:
LEAF2:
RP/0/RP0/CPU0:Leaf-2#show evpn ethernet-segment interface bundle-Ether 1 detail
Thu Aug 13 11:58:50.921 UTC
Legend:
B - No Forwarders EVPN-enabled,
C - Backbone Source MAC missing (PBB-EVPN),
RT - ES-Import Route Target missing,
E - ESI missing,
H - Interface handle missing,
I - Name (Interface or Virtual Access) missing,
M - Interface in Down state,
O - BGP End of Download missing,
P - Interface already Access Protected,
Pf - Interface forced single-homed,
R - BGP RID not received,
S - Interface in redundancy standby state,
X - ESI-extracted MAC Conflict
SHG - No local split-horizon-group label allocated
Ping from Host-1 to Host-5 shows that the hosts can reach each other.
Host-1:
RP/0/RSP0/CPU0:Host-1#ping 10.0.0.50
Thu Aug 13 11:29:24.024 UTC
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.0.0.50, timeout is 2 seconds:
!!!!!
Let’s now take a look at the BGP EVPN control plane by checking the types of routes received on di erent leaf’s. We are
ltering the route for the speci c PE and speci c service using rd which is PE:EVI . for example , routes from leaf1 for EVI
10 will come with a RD of 1.1.1.1:10
From Above output from Leaf-1 clearly shows it has reached the RT2 (MAC) from Leaf-5. From Leaf2 it has only
received the ESI route.
Above output shows Leaf-2 has learnt ESI and MAC of host 1 from Leaf1 and from Leaf 5 it has learnt the MAC of host-
5.
Leaf-5 also learns the MAC of host1 only via Leaf1 as it was the only active PE and there is no aliasing in port active
multihoming.
Lastly, run “show evpn evi vpn-id 10 mac” command to verify the MAC address learnt for EVI 10. We see that Leaf-1
and Leaf-2 have learnt Host-5’s MAC address with Leaf-5 as the next-hop. However , Leaf5 has learnt Host-1’s MAC
with only Leaf-1 as nexthop.
The above output veri es the BGP-EVPN control plane for EVPN multipoint service over Port-active multihoming. Note:
As Leaf-2 sees Host-1's MAC reachable via Leaf-1, in case of another Host/ESI connected to Leaf-2 wants to reach to Host-1 it
Task 5: Con gure and Verify BGP-EVPN Distributed Anycast Gateway for IRB service
In this section we will demonstrate the Layer-3 inter-subnet routing use case over EVPN port active multihoming. Similar
to Host-1’s layer-2 reachability, Host-1’s IP will also only be reachable via Leaf-1 as next-hop. After we con gure BGP-
EVPN distributed anycast gateway for inter-subnet routing, we will observe the routing table of Leaf-5.
Con gure the BGP-EVPN Distributed Anycast Gateway on Leaf-1, Leaf-2 and Leaf-5. We will con gure the IRB service
over a di erent VLAN and show the coexistence of both service over the port active ESI. For detailed explanation of
EVPN distributed anycast gateway, refer to this post.
vrf 11
address-family ipv4 unicast
import route-target
11:11
!
export route-target
11:11
!
router bgp 65001
address-family vpnv4 unicast
!
vrf 11
rd auto
address-family ipv4 unicast
additional-paths receive
maximum-paths ibgp 10
redistribute connected
!
interface BVI11
host-routing
vrf 11
ipv4 address 111.0.0.1 255.255.255.0
mac-address 1001.1001.1001
!
On Leaf 5:
interface BVI11
host-routing
vrf 11
ipv4 address 111.0.1.1 255.255.255.0
mac-address 5001.5001.5001
We will also con gure a two di erent subnet on the Host’s and respective static routing towards the gateways.
HOST1:
interface Bundle-Ether1.11
ipv4 address 111.0.0.10 255.255.255.0
encapsulation dot1q 11
!
router static
address-family ipv4 unicast
111.0.0.0/16 111.0.0.1
!
!
HOST5:
interface TenGigE0/0/1/3.11
ipv4 address 111.0.1.50 255.255.255.0
encapsulation dot1q 11
!
router static
address-family ipv4 unicast
111.0.0.0/16 111.0.1.1
BGP-EVPN IRB control plane can be veri ed by observing the route tables on the Leaf node. As we can see the route for
remote host’s are learnt on Leaf1 and Leaf-5 via BGP. As Leaf-2 is in standby mode it lean’s route to Host-1 from Leaf-1
via BGP instead of learning directly.
As of now we have con gured 2 di erent services over the EVPN port-active multihoming and we see Leaf-1 as DF for
both of this service. This is due to the fact that load balancing happens per port/ESI and the bundle on the non DF nodes
are in LACP OOS status. If we see the Ethernet segment status on Leaf-1, we will see it as elected forwarder for all the
con gured services.
This concludes the BGP-EVPN based port-active implementation. We have shown example of both Layer2 bridging and
IRB services over port-active redundancy. However, this redundancy mode can be used for any other services like layer3
or legacy layer 2. For further technical details refer to our e-vpn.io webpage that has a lot of material explaining the core
concepts of EVPN, its operations and troubleshooting.
SHARE ON
Leave a Comment
What do you think?
3 Responses
1 Comment
1 Login
Name
A
Alfonso Nah − ⚑
3 years ago
Hi Paban.
what is the possible solution when the out put of the command "show evpn ethernet-
segment interface bundle-Ether 1 detail", is the following?
ES to BGP Gates : O
ES to L2FIB Gates : O
0 0 Reply ⥅
This site is maintained by Cisco Systems, Inc. employees. Powered by Jekyll & Minimal Mistakes.