BGP EVPN IN ENTERPRÍE

#CiscoLive
BGP EVPN Solution in

Enterprise Campus
Catalyst 9000
Minhaj Uddin, Technical Marketing Engineer

BRKENS- 2003
#CiscoLive
Agenda
• Introduction and Overview
• Product Matrix and Scale
• Underlay Network
• Overlay Network
• Fabric Interworking
• Multicast over VXLAN
• Wireless Integration and Services
• Conclusion
#CiscoLive BRKENS-2003 © 2021 Cisco and/or its affiliates. All rights reserved. Cisco Public 3
Enterprise fabric architectures
SD-Access BGP EVPN
VPLS MPLS Multi-VRF
Intent
Border Core
Intent-based
networking Distribution
BGP-EVPN
Spine EVPN
Infrastructure
Leaf ⋯ Access
 Leading architecture for enterprise providing seamless mobility and  Industry based solution providing interoperability with 3rd party devices
enhanced security  Solution for Brownfield environments – MPLS, VPLS, Multi-VRF, GRE.
 Integrated Automation, Assurance Analytics capabilities driven from  Single Overlay Solution from campus to datacenter, all the way to cloud
Cisco DNA-Center  DIY based provisioning and automation for fabric deployment
 Integrated Wireless capabilities driving consistent policies across
wired and wireless networks #CiscoLive BRKENS-2003 © 2021 Cisco and/or its affiliates. All rights reserved. Cisco Public 4
2010
Introduced in IETF
2011
PBB-EVPN
EVPN-VPWS
EVPN-Overlay
EVPN-ETREE
2013
EVPN IRB
EVPN DCI
Cisco
2015
Virtual ES
Patent
IR Enhancement DRAFT | RFC | Authors Filed | Issued
IGMP Agg
…
2016+ 137 10 37 400+ 150+
L3VPN MH
EVPN IRB
DF Algorithm
…
BGP EVPN Drivers in Enterprise
Network Extension Network Segmentation
Core Core
 Bridge connection between across Core network  Routed connection at first-hop gateway
 User devices are virtually in common L2 segment  User devices are segmented across Core network
 Logical topologies with deterministic overlay  Logical overlay IP routed network providing flexible topology
Layer 2 network infrastructure. support
BGP EVPN Solution For Enterprise
Classic Classic Traditional Classic
Catalyst Overlays Layer 2 Competitors
BGP
EVPN
Catalyst
9000
ASR Nexus ASR

1000 9000 9000
VxLAN Overview
VXLAN Concepts
• VXLAN Overlay
• A VXLAN Overlay or VXLAN segment is a Layer-2 broadcast domain identified by the VNID
that extends or tunnels traffic from one VTEP to another.
• VXLAN Tunnel End Point (VTEP)
• A VTEP is a device that provides both encapsulation and de-capsulation of classical
Ethernet and VXLAN packets to and from a VXLAN segment
• Each VTEP may have the following types of interfaces:
• Switchport interfaces on the local LAN segment to support localendpoints
• Layer-3 interfaces to the transport IP network
• SVI interfaces
• VXLAN Gateway
• A VTEP that bridges traffic between VXLAN segments
VxLAN Packet Structure
F
Outer MAC Outer UDP VxLAN
Outer IP Header Original Layer-2 C
Header Header Header
Frame S
14 Bytes
(4 bytes optional) 8 Bytes Hash of inner L2/l3/L4 headers of
Destination NH MAC Source Port original frame. Enables entropy
16 for ECMP Load balancing
48 Address Addr
16 VxLAN Port UDP 4789
48 Source Address
16 UDP Length
VLAN Type
16 Checksum
0x8100 16
16 VLAN ID Tag
Src and Dst
16 Ether Type Addresses of
20 Bytes 8 Bytes
0x0800
VTEP 16M possible
IP Header Misc. VxLAN
72
Data 8 RRRR1RRR segments
Src VTEP MAC 8 Protocol 0x11 Reserved
24
Addr 16 Header
24 VNI
Checksum
32
Source IP 8 Reserved
32
Destination IP
EVPN Primer --- MP-BGP Review
Virtual Routing and Forwarding (VRF)
Layer-3 segmentation for tenants’ routing
space BGP advertisement:
VPN-IPv4 Addr = RD:16.1/16
Route Distinguisher (RD): BGP Next-Hop = PE1
8-byte field, VRF parameters; unique value to eBGP:
Route Target = 100:1
Label=42
eBGP:
make 16.1/16 16.1/16
IP Subnet IP Subnet
VPN IP routes unique: RD + VPN IP prefix
P P
Selective distribute VPN routes: CE1
PE1 Blue VPN PE2
CE2
Route Target (RT): 8-byte field, VRF parameter,

unique value to define the import/export rules
for VPNv4 routes ipVRvFrfpabrlaume-evtpenrs:
NRaDm1e:1=0b0lue-vpn
RroDu=te1-t:a1r0g0etexport 1:100
Imropuotert-tRaroguettei-mTaprogret1=:110000:1
Export Route-Target =100:1
VPN Address-Family:
Distribute the MP-BGP VPN
routes
EVPN Control Plane
EVPN Control Plane -- Host and Subnet Route Distribution
BGP Update Spine

• Host-MAC
• Host-IP
• Internal IP Subnet
• External Prefixes
VTEP VTEP VTEP VTEP Leaf
 Use MP-BGP with EVPN Address Family on leaf nodes to distribute

internal host MAC/IP addresses, subnet routes and external reachability
information
 MP-BGP enhancements to carry up to 100s of thousands of routes with
reduced convergence time
BGP EVPN System Role
Layer 2 Layer 3 Layer 2 Layer 3
802.1Q | VPLS VRF | MPLS 802.1Q | VPLS VRF | MPLS
BORDER :
A gateway point of between EVPN
fabric and external network domain.
INTERMEDIATE :
A Layer 2 or Layer 3 (IP/MPLS) Border-Gateway :
Underlay network system providing A gateway point of
basic transport and forwarding plane. between two or more BGP
EVPN administrative
domain boundary.
SPINE :
An BGP EVPN reflects the L2/L3 VPN
prefixes providing hierarchical neighbor
peering, learning and distribution point.
VTEP :
An origination and termination point
of VXLAN enabled overlay network. Fabric-Domain-A Fabric-Domain-B
SITE-A SITE-B
C9K VXLAN BGP EVPN Solution
End-to-End Design and Interoperability
Datacenter Shared Services DMZ
Spine
External
Nexus Platforms ASR Platforms Handoff
EVPN
Distribution VTEP Access VTEP Multi-homing – StackWise Virtual Wireless Deployment
Site1 Site2 Site3
Campus
VTEP SVL
VTEP
Trunk
VTEP
Local Mode
Cisco BGP EVPN Strategy and Solution
Goals : Single Unified Solution
IOS-XE IOS-XE NXOS

IOS-XR
 Common cross-OS goals to have single unified BGP EVPN solution

 Consistent end-to-end solution architecture with feature parities across any network tier
 Any system in any role providing complete interoperability inside and outside EVPN fabric domain
BGP EVPN Inter-Domain Routing
Data-Center
VM VM VM VM VM VM VM VM VM
⋯ ⋯ ⋯
Leaf
⋯
Spine
Campus
Spine
Single Site – Inter-domain EVPN fabric

Hierarchical control-plane for better scale
Leaf ⋯ Spine and Leaf BGP peering in separate domain
Spine-to-Spine BGP Peering
Extended
EVPN prefix exchange Next-Hop-Unchanged
Segmented BGP EVPN Peers
Product Matrix
and Scale
Catalyst 9000 – Product Support and Role
Catalyst 9000 Role
Catalyst 9200 Unsupported

Catalyst 9300 Leaf | Spine
Catalyst 9500H Leaf | Spine | Border
Catalyst 9600 Leaf | Spine | Border
Catalyst 9000 – BGP EVPN Scale Matrix
C9300 C9400 – Sup1XL C9500 C9500-H C9600
EVPN Bridge-Domain (VLAN) 225 225 225 225 225
Core VLAN 225 225 225 225 225
VNI 225 225 225 225 225
VTEP Peers 200 200 200 200 200
MAC ( Local + Remote) 32000 64000 64000 80000 80000
VRF 255 255 255 1000 1000
Routes (v4 / v6) 8000 / 4000 144000 / 56000 64000 / 32000 200000 / 100000 200000 / 100000
Host Routes (v4 / v6) 24000 / 12000 48000 / 24000 48000 / 24000 80000 / 40000 80000 / 40000
Refer to Product Datasheet for other feature scale
Underlay
Network
Unicast Routing
Internal BGP External BGP
RR
Spine
BGP-65001
BGP-65001 IGP BGP-65002
RRC RRC
Leaf
⋯ ⋯ BGP-65003
Any choice of IGP to build Underlay unicast routing Single Routing Protocol for Underlay and Overlay
Spine and Leaf may be direct/in-direct attachment IPv4 AF to build Underlay and advertise routes.
Route-Reflector on Spine and Leaf’s as Clients L2VPN AF to build EVPN peering
Multicast Routing Underlay Multicast
RP
Spine
Multicast
Leaf
⋯
Multicast
Underlay Group-Range-1
Multicast RP integrated on Spine or separate system
BUM Group-Range-2 Non-overlapping Multicast Group for different purpose
Recommended to large scale EVPN deployments
Overlay Group-Range-3
Default MDT Group Range for Overlay TRM Multicast
Overlay Network
Topologies
L3VNI – Network Segmentation and Routing
10.1.0.0/24 10.2.0.0/24
Production WAN
Border
Routing
• First-Hop Distributed Gateway at Access
IP • Access Network policy enforcement point
• Network address routing across fabric
Route Route
• Data plane segmentation thru VXLAN
• IPv4 / v6 support
Leaf
VLAN-A VLAN-B
10.0.1.0/24 10.0.2.0/24
IRB – Distributed AnyCast Gateway
10.1.0.0/24 10.2.0.0/24
Production WAN
Border
Routing + Bridging
• First-Hop Distributed Anycast Gateway at Access
IP • Bridge in same VLAN across Leaf’s in fabric
• Route locally based on local routing policy
Route Route
• Access Network policy enforcement point
• Host + Network address routing across fabric
Leaf • Data plane segmentation thru VXLAN
Bridge
VLAN-A
10.0.1.0/24
AnyCast MAC | IPv4 | IPv6
IRB – Centralized Gateway
10.1.0.0/24 10.2.0.0/24
Production WAN
Border Leaf
Route Route
VLAN-A Remote Routing + Bridging
10.0.1.0/24
• Multi-Hop Centralized Gateway
• Route remotely based on remote routing policy
• Host address routing across fabric
Layer 2 Leaf • Data plane segmentation thru VXLAN
Bridge
L2 – Layer 2 Network Extensions
VLAN-A Route 10.1.0.0/24 10.2.0.0/24 Route
10.0.1.0/24
IP Gateway
Production WAN
Border Leaf
Bridging
• IP Gateway beyond EVPN fabric
• Route outside fabric based on remote routing policy
• Host address routing across fabric
Layer 2 Leaf • Data plane segmentation thru VXLAN
Bridge
L2 – Hub-n-Spoke Network Extension
VLAN-A Route 10.1.0.0/24
10.0.1.0/24
Border Leaf
Bridging
• IP Gateway beyond EVPN fabric
IP • Border L2 Leaf Hub. Layer 2 Leaf Spokes.
• Point-to-Point L2VNIs to Hub
• Route outside fabric based on remote routing policy
Layer 2 Leaf • Host address routing across fabric
• Data plane segmentation thru VXLAN
Private VLAN Integration with EVPN Differentiated
features
Routing + Private VLAN Bridging ( Community VLAN)

10.1.0.0/24 10.2.0.0/24
Production WAN
Border
IP
VLAN-A (Primary)
10.0.1.0/24 Route
Route
Bridge Bridge
Promiscuous
Community VLAN 201 Community VLAN 202
#CiscoLive © 2021 Cisco and/or its affiliates. All rights reserved. Cisco Public
EVPN Fabric
InterWorking
Catalyst 9000 – L3 Leaf Design Alternatives
Design 1 – Dual-Home Standalone Leaf Design 2 – Dual-Home StackWise Virtual Leaf
EVPN EVPN
Distributed
Leaf
Access
 Layer 3 Multipath requirement varies based on Leaf design – Standalone vs StackWise Virtual
 The Standalone mode support traditional L2 with challenges, FHRP, variable scale/performance and redundancy
 The StackWise Virtual mode enables hardware accelerated multi-homing Active/Active load sharing with protocol-
independent and deterministic network resiliency without operational complexities.
Catalyst 9000 – L2 Leaf Design Support
Dual-Home StackWise Virtual Leaf
EVPN
Distributed
Leaf
Access
 Layer 2 Multipath in Standalone Mode is not supported.

 Cisco StackWise Virtual technologies supports Active/Active Layer 2 Multi-homing without any additional protocol
dependencies and operational complexities
 Cisco StackWise Virtual member switch supports distributed VXLAN forwarding with BGP control-plane protocol
redundancy using standard SSO/NSF
Catalyst 9000 – Layer 2 Border-Leaf Support
VPLS 802.1Q
Bridging Bridging
+
Routing
Border-Leaf
EVPN
 Layer 2 Network Extension to classic STP or ”stitched” across VPLS enabled overlay network
 Single system solution supporting interworking function between EVPN and MPLS LDP overlay infrastructure
 Full IRB support for 802.1Q handoff and Bridging-only support for VPLS handoff
Catalyst 9000 – Layer 3 Border-Leaf Support
MPLS PE Multi-VRF
MPLS VRF-Lite
MPLS PE
Border-Leaf
EVPN
 Layer 3 Network Segmentation to per-hop Multi-VRF with 802.1Q based segmentation.

 Full EVPN to MPLS VPN route and label propagation support for IPv4 and IPv6 prefixes between two overlay
networks.
Catalyst 9000 – Multi-Function Role Support
L2 Overlay L3 Overlay
VPLS 802.1Q MPLS VRF-Lite
Border-Leaf
Border-Leaf Spine
EVPN EVPN
 Layer 3 Network Segmentation to per-hop Multi-VRF with 802.1Q based segmentation.

 Full EVPN to MPLS VPN route and label propagation support for IPv4 and IPv6 prefixes between two overlay
networks.
Multicast over
VXLAN
Tenant Routed Multicast Architecture
Core
Spine
EVPN
Tenant Routed Multicast
Access PIM RP
Leaf
S R S R S R
 TRM enables Multicast over VXLAN enabled network for Layer 3 network segments. NXOS Compatible
 Integrated PIM RP and PIM-SM in Underlay support enables fabric-enabled source and receivers Multicast
forwarding topologies.
 VTEP provides integrated PIM RP function
Tenant Routed Multicast Architecture
PIM RP
Core
Spine
IP
EVPN
S R
Access
Leaf
S R S R S R
 Layer 2 TRM support planned for future release. By default Multicast applications follows flood-n-learn mechanics.
TRM / MPLS mVPN Interworking
PIM RP
Core
Spine
MPLS
EVPN
S R
Access
Leaf
S R S R S R
 Layer 2 TRM support planned for future release. By default Multicast applications follows flood-n-learn mechanics.
EVPN Overlay
Network
Services
Wireless Integration in EVPN Networks
Data-Center Shared-Services WAN DMZ
VM VM VM VM VM VM VM VM VM WAN Internet
⋯ ⋯ ⋯
VM VM VM
⋯ ⋯
EVPN
StackWise Virtual
Local-Mode
• Transparent Wireless network integration into BGP EVPN fabric network
• Underlay CAPWAP communication between AP and WLC. User Policy enforcement maintains at WLC.
• VTEP in Wireless aggregation can overlay network traffic based on routing policy.
VXLAN QoS Management
Untrusted
No Trust I
Marking DSCP > DSCP
Policing IP
Queueing E
Trusted
Trust DSCP, 802.1P I
Marking
Policing DSCP > EXP MPLS
Queueing E
Leaf Intermediate Spine Border

Conditional – Trusted
Conditional Trust I
Marking
Policing L2
DSCP > 802.1P
Queueing E
Per-Hop Underlay QoS
• Trust-Boundary and policy enforcement at network edge.
• Per-hop Underlay QoS policy provides differentiated service treatment for combined underlay and overlay traffic class
• QoS policy and marking at Border supports default or user-defined policy with interworking external network domain
Per-VNI BUM Rate-Limiter
EVPN EVPN EVPN

L2VNI
50001
Per-VNI BUM Limit
L2 BUM L2 BUM L2 BUM
50002
e.g. 25 Mbps
50003
Distribution
Leaf Multicast BUM
Per-VNI ( MBPS )
L2 Flood L2 Flood
Access
Leaf
L2 Flood L2 Flood Storm-Control

L2 Flood
Per-Port ( % | BPS | PPS)
• Protect BUM traffic at network edge ports limiting flood across Layer 2 and EVPN fabric network domain
• Deterministic per VNI Multicast BUM traffic flood protecting Enterprise backbone network performance
• MQC QoS based policer associated to L2VNI performing Multicast-based replication mode
VXLAN Aware Flexible NetFlow
vtep3 Host
4.4.4.4/32 Gateway 20.1.1.200/24
Border/VTEP
vtep2 1.1.1.1/32
Access
3.3.3.3/32
Host vtep1 VXLAN tunnel

10.1.1.11/24 2.2.2.2 VNID 6000
Flow record fields Packet data

Source Address 10.1.1.11
Destination Address 20.1.1.200
Source Port 47321
Destination Port 80
• Maximum 128K VxLAN enabled flows per Catalyst 9600/9500-H IP Protocol 6
• Supports v4 and v6 protocols TCP Flags 0x1A

Source SGT 0
• Bi-directional flow detection over the NVE interface Interface nve10
Flow direction input
• Rapid Overlay network data flow learning rate support (every 500ms)
VNID 6000
VXLAN Flags I
VXLAN SRC VTEP 1.1.1.1
VXLAN DST VTEP 2.1.1.1
Bonjour Overlay Network Challenges
tv VLAN VxLAN VLAN
L2 Access Bldg-VTEP-GW VTEP WLC
BUM on VLAN : BUM on EVPN : BUM on VLAN :
• Flood-n-Learn • Flood-n-Learn with IR or • Flood-n-Learn

MR
• Transparent L2 • Transparent L2
flooding within • IR : 1 mDNS frame = 1 flooding within
same VLAN Unicast frame to 1 VTEP same VLAN
• Bonjour gateway • MR : 1 mDNS frame = 1 • Bonjour gateway

function in-effective Multicast frame to L2VNI function in-effective
• Extended mDNS flood-domain across network infrastructure
• Ingress-Replication model to handle BUM traffic on EVPN may impact backbone network performance
• Multicast-Replication model is better but still not scalable when expecting 20000-25000 pps mDNS per VTEP in the network
Distributed Bonjour Overlay Network Architecture
IP
tv VLAN VxLAN VLAN
L2 Access Bldg-VTEP-GW VTEP WLC
Peer Agent Agent Peer
• Eliminate mDNS with end-to-end service-routing architecture

• Extended mDNS suppression and flood-control management at L2 boundary – Wired/Wireless or VPLS
• Policy based distributed Bonjour cache management at first-hop BGP EVPN VTEP and Wired/Wireless gateway
• Scalable control-plane architecture for Wired/Wireless and BGP EVPN without impacting end-to-end performance
Catalyst 9000
EVPN Reference
Configuration Guide
BGP EVPN VXLAN Overview
Configuring EVPN VXLAN Layer 2 Overlay Network
Configuring EVPN VXLAN Layer 3 Overlay Network
Configuring EVPN VXLAN Integrated Routing and Bridging
Configuring Tenant Routed Multicast
Troubleshooting BGP EVPN VXLAN
Feature History and Information for BGP EVPN VXLAN
Completed Chapters
Reference
https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst9600/software/release/17-2/configuration_guide/vxlan/b_172_bgp_evpn_vxlan_9600_cg.html
Thank you
#CiscoLive
#CiscoLive

BGP EVPN IN ENTERPRÍE

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

BGP EVPN IN ENTERPRÍE

Uploaded by

Copyright:

Available Formats

#CiscoLive

BGP EVPN Solution in

Minhaj Uddin, Technical Marketing Engineer

VPLS MPLS Multi-VRF

ASR Nexus ASR

Route Target (RT): 8-byte field, VRF parameter,

BGP Update Spine

 Use MP-BGP with EVPN Address Family on leaf nodes to distribute

Site1 Site2 Site3

IOS-XE IOS-XE NXOS

 Common cross-OS goals to have single unified BGP EVPN solution

Single Site – Inter-domain EVPN fabric

Segmented BGP EVPN Peers

Catalyst 9000 Role

Catalyst 9200 Unsupported

EVPN Bridge-Domain (VLAN) 225 225 225 225 225

Core VLAN 225 225 225 225 225

VNI 225 225 225 225 225

VTEP Peers 200 200 200 200 200

MAC ( Local + Remote) 32000 64000 64000 80000 80000

VRF 255 255 255 1000 1000

BGP-65001 IGP BGP-65002

Routing + Private VLAN Bridging ( Community VLAN)

Community VLAN 201 Community VLAN 202

 Layer 2 Multipath in Standalone Mode is not supported.

 Layer 3 Network Segmentation to per-hop Multi-VRF with 802.1Q based segmentation.

VPLS 802.1Q MPLS VRF-Lite

 Layer 3 Network Segmentation to per-hop Multi-VRF with 802.1Q based segmentation.

Tenant Routed Multicast

• Transparent Wireless network integration into BGP EVPN fabric network

Leaf Intermediate Spine Border

Per-Hop Underlay QoS

• Trust-Boundary and policy enforcement at network edge.

EVPN EVPN EVPN

L2 Flood L2 Flood Storm-Control

Host vtep1 VXLAN tunnel

Flow record fields Packet data

• Supports v4 and v6 protocols TCP Flags 0x1A

tv VLAN VxLAN VLAN

L2 Access Bldg-VTEP-GW VTEP WLC

BUM on VLAN : BUM on EVPN : BUM on VLAN :

• Flood-n-Learn • Flood-n-Learn with IR or • Flood-n-Learn

• Bonjour gateway • MR : 1 mDNS frame = 1 • Bonjour gateway

• Extended mDNS flood-domain across network infrastructure

tv VLAN VxLAN VLAN

L2 Access Bldg-VTEP-GW VTEP WLC

Peer Agent Agent Peer

• Eliminate mDNS with end-to-end service-routing architecture

You might also like