EVPN VPLS with MPLS to SRv6 or VXLAN to SRv6 Stitching
This chapter provides information about the EVPN VPLS with MPLS to SRv6 or VXLAN to SRv6 stitching.
Topics in this chapter include:
Applicability
The information and configuration in this chapter are based on SR OS Release 23.10.R2. MPLS to SRv6 stitching within an EVPN VPLS is supported in SR OS Release 22.10.R1 and later; VXLAN to SRv6 stitching within an EVPN VPLS is supported in SR OS Release 22.10.R3 and later.
Overview
SRv6 to MPLS stitching or SRv6 to VXLAN stitching is required in hybrid networks where MPLS PEs and SRv6 PEs are both attached to the same EVPN VPLS service. This concept follows the RFC 9014 standard and it is implemented in SR OS by using two EVPN instances in the same EVPN VPLS service. Also, a migration from MPLS tunnels to SRv6 tunnels in EVPN VPLS services requires the support of an SRv6 instance and an MPLS instance in the same EVPN VPLS service. EVPN destinations of different transport types (MPLS, VXLAN, or SRv6) can be placed in the same Split Horizon Groups (SHGs) to avoid loops.
The need for MPLS to SRv6 stitching in an EVPN VPLS shows an EVPN VPLS service configured in all PEs where the gateways (GWs) PE-4 and PE-5 have two service instances in the EVPN VPLS: BGP instance 1 uses MPLS transport and BGP instance 2 uses SRv6. For GW redundancy on PE-4 and PE-5, the anycast multihoming concept is applied.
- SHGs are supported:
- EVPN VXLAN cannot be configured with an explicit SHG
- SHG associated to the EVPN MPLS instance can be the same as or
different from the SHG associated to the EVPN SRv6 instance:
- when the same SHG is configured across two instances, no routes are redistributed between the instances
- when different SHGs are configured across two instances, routes are redistributed between the instances
- when one of the instances is SRv6, SAPs can be configured only if the two instances are configured with the same explicit SHG
- no SDP bindings are supported on multi-instance VPLS services:
- the configuration of spoke SDPs or mesh SDPs is blocked
- BGP VPLS and BGP AD can be configured, but the spoke SDPs are not auto-created
- the mh-mode access | network command is supported to
configure multihoming:
- access or network mode can be configured in an SRv6 instance, with network being the default mode
- the following combinations are supported:
- SRv6 mh-mode network with MPLS instance mh-mode access
- SRv6 mh-mode access with MPLS instance mh-mode network (Note: If provider-tunnel is needed on the multi-instance service, the MPLS instance must be configured as mh-mode network)
- two mh-mode access instances in the same EVPN VPLS are allowed for the combinations VXLAN/MPLS, VXLAN/SRv6, and MPLS/SRv6 (but not for the combination MPLS/MPLS)
- Anycast multihoming can be applied:
- two or more PEs can be configured with the same service parameters
as part of the same redundancy group:
- same Route Distinguisher (RD) for the same BGP instance
- same Route Target (RT) for the same BGP instance
- same inclusive multicast originator IP address
- remote PEs set up EVPN destinations to only one PE in the anycast group for a service
- no EVPN BUM destinations are established among the PEs in the anycast group because the received anycast peer inclusive multicast Ethernet tag (IMET) routes have the same inclusive multicast originator IP address
- policies are applied on the GW PEs to avoid loops:
- export policies add route target and site-of-origin (SOO) extended communities to the redistributed MAC/IP routes and the peer GW PEs drop the routes received with the group SOO
- default route tags per service instance differentiate the allowed non-redistributed MAC/IP routes from the rest, so that these MAC/IP routes are not advertised between access and network peers, as shown in Default route tags per service instance avoid loops.
- two or more PEs can be configured with the same service parameters
as part of the same redundancy group:
The figure shows that an incoming MAC/IP route with RT 64500:11 is accepted in VPLS-1 on GW PE-4 by service instance 1 and passed on to service instance 2 where it gets RT 64500:12 and default route tag 20. Routes with route tag 20 are accepted for routes sent to peer 2001:db8::2:6 in the network, but not for routes sent back to access peer 192.0.2.2. Likewise (but not shown in the figure), routes coming from peer 2001:db8::2:6 with RT 64500:12 are accepted by service instance 2 and passed on to service instance 1 where default route tag 10 is added. Routes with route tag 10 are forwarded to peer 192.0.2.2, but are not sent back to the network peer 2001:db8::2:6.
Configuration
EVPN VPLS with MPLS to SRv6 stitching
- cards, MDAs, ports, LAG
- router interfaces
- IS-IS as IGP
- LDP between PE-2, PE-3, PE-4, PE-5
SRv6 configuration
The SRv6 configuration on PE-4 is as follows:
# on PE-4:
configure {
card 1 {
mda 1 {
xconnect {
mac 1 {
loopback 1 {
}
loopback 2 {
}
}
}
}
}
fwd-path-ext {
fpe 1 {
path {
pxc 1
}
application {
srv6 {
type origination
}
}
}
fpe 2 {
path {
pxc 2
}
application {
srv6 {
type termination
}
}
}
}
port pxc-1.a {
admin-state enable
}
port pxc-1.b {
admin-state enable
}
port pxc-2.a {
admin-state enable
}
port pxc-2.b {
admin-state enable
}
port 1/1/m1/1 {
admin-state enable
}
port 1/1/m1/2 {
admin-state enable
}
port-xc {
pxc 1 {
admin-state enable
port-id 1/1/m1/1
}
pxc 2 {
admin-state enable
port-id 1/1/m1/2
}
}
router "Base" {
isis 0 {
admin-state enable
advertise-passive-only true
advertise-router-capability as
ipv6-routing native
traffic-engineering true
area-address [49.0001]
traffic-engineering-options {
ipv6 true
application-link-attributes {
}
}
segment-routing-v6 {
admin-state enable
locator "PE4-loc" {
level-capability 2
}
}
---snip---
interface "system" {
passive true
}
level 2 {
wide-metrics-only true
}
---snip---
segment-routing {
segment-routing-v6 {
origination-fpe [1]
source-address 2001:db8::2:4
locator "PE4-loc" {
admin-state enable
block-length 48
termination-fpe [2]
prefix {
ip-prefix 2001:db8:aaaa:104::/64
}
}
base-routing-instance {
locator "PE4-loc" {
function {
end 1 {
srh-mode usp
}
end-x-auto-allocate psp protection unprotected { }
}
}
}
}
}
---snip---
The SRv6 configuration on PE-5 and PE-6 is similar.
BGP configuration
In the MPLS access network, PE-2 acts as the route reflector (RR) with clients PE-3, PE-4, and PE-5. The BGP configuration is as follows:
# on RR PE-2:
configure {
router "Base" {
autonomous-system 64500
bgp {
vpn-apply-export true
vpn-apply-import true
rapid-withdrawal true
peer-ip-tracking true
split-horizon true
rapid-update {
evpn true
}
group "access-mpls" {
peer-as 64500
family {
evpn true
}
cluster {
cluster-id 192.0.2.2
}
}
neighbor "192.0.2.3" {
group "access-mpls"
}
neighbor "192.0.2.4" {
group "access-mpls"
}
neighbor "192.0.2.5" {
group "access-mpls"
}
The BGP configuration on PE-3 is as follows:
# on PE-3:
configure {
router "Base" {
autonomous-system 64500
bgp {
vpn-apply-export true
vpn-apply-import true
rapid-withdrawal true
peer-ip-tracking true
split-horizon true
rapid-update {
evpn true
}
group "access-mpls" {
peer-as 64500
family {
evpn true
}
}
neighbor "192.0.2.2" {
group "access-mpls"
}
In the SRv6 network, PE-6 acts as the RR. The BGP configuration on the GWs PE-4 and PE-5 is as follows. The export policy "drop-tag-10" is used to avoid loops within the core SRv6 network and the export policy "drop-tag-20" is used to avoid loops within the access MPLS network, as shown in Default route tags per service instance avoid loops.
# on GWs PE-4 and PE-5:
configure {
policy-options {
policy-statement "drop-tag-10" {
description "route tag in VPLSs to avoid loops"
entry 10 {
from {
tag 10
}
action {
action-type reject
}
}
}
policy-statement "drop-tag-20" {
description "route tag in VPLSs to avoid loops"
entry 10 {
from {
tag 20
}
action {
action-type reject
}
}
}
}
router "Base" {
autonomous-system 64500
bgp {
vpn-apply-export true
vpn-apply-import true
rapid-withdrawal true
peer-ip-tracking true
split-horizon true
rapid-update {
evpn true
}
group "access-mpls" {
peer-as 64500
family {
evpn true
}
export {
policy ["drop-tag-20"]
}
}
group "core-srv6" {
peer-as 64500
family {
evpn true
}
export {
policy ["drop-tag-10"]
}
}
neighbor "192.0.2.2" {
group "access-mpls"
}
neighbor "2001:db8::2:6" {
group "core-srv6"
}
}
}
The BGP configuration on RR PE-6 is as follows:
# on RR PE-6:
configure {
router "Base" {
autonomous-system 64500
bgp {
group "core-srv6" {
peer-as 64500
family {
evpn true
}
cluster {
cluster-id 192.0.2.6
}
}
neighbor "2001:db8::2:4" {
group "core-srv6"
}
neighbor "2001:db8::2:5" {
group "core-srv6"
}
Service configuration
VPLS-1 is configured on all nodes. On PE-2, PE-3, PE-4, and PE-5, service instance 1 of VPLS-1 uses MPLS tunnels. The service configuration on PE-2 and PE-3 is identical, except for the preference value in the all-active Ethernet segment (ES). Route target 64500:11 is accepted in service instance 1 of VPLS-1 on the GW PEs PE-4 and PE-5. The service configuration on PE-2 is as follows:
# on PE-2:
configure {
service {
system {
bgp {
evpn {
ethernet-segment "AA-vES-23-1" {
admin-state enable
type virtual
esi 0x01000000002300000101
multi-homing-mode all-active
df-election {
es-activation-timer 3
service-carving-mode manual
manual {
preference {
mode non-revertive
value 100 \# on PE-3: preference 150
}
}
}
association {
lag "lag-1" {
virtual-ranges {
dot1q {
q-tag 1 {
end 1
}
}
}
}
}
}
}
}
}
vpls "VPLS-1" {
admin-state enable
service-id 1
customer "1"
bgp 1 {
route-target {
export "target:64500:11"
import "target:64500:11"
}
}
bgp-evpn {
evi 1
mpls 1 {
admin-state enable
ingress-replication-bum-label true
ecmp 2
auto-bind-tunnel {
resolution any
}
}
}
sap lag-1:1 {
}
}
On PE-6, VPLS-1 uses SRv6 transport and route target 64500:12 is accepted in service instance 2 of VPLS-1 on the GW PEs PE-4 and PE-5. SAP 1/1/c10/1:1 is connected to CE-61. The configuration on PE-6 is as follows.
# on PE-6:
configure {
service {
vpls "VPLS-1" {
admin-state enable
service-id 1
customer "1"
segment-routing-v6 1 {
locator "PE6-loc" {
function {
end-dt2u {
}
end-dt2m {
}
}
}
}
bgp 1 {
route-target {
export "target:64500:12"
import "target:64500:12"
}
}
bgp-evpn {
evi 1
segment-routing-v6 1 {
admin-state enable
srv6 {
instance 1
default-locator "PE6-loc"
}
route-next-hop {
system-ipv6
}
}
}
sap 1/1/c10/1:1 {
}
}
The following configuration on the anycast GW PE-4 shows that the EVPN VPLS is configured with two instances: service instance 1 uses MPLS transport and service instance 2 uses SRv6. The configuration on GW PE-5 is identical with only a different SRv6 locator name. The VSI policies are used to accept EVPN routes with the matching route target and to avoid loops between GWs PE-4 and PE-5 based on the SOO.
# on PE-4:
configure {
policy-options {
community "RT64500:11" {
member "target:64500:11" { }
}
community "RT64500:12" {
member "target:64500:12" { }
}
community "SOO-45" {
member "origin:45:45" { }
}
policy-statement "vsi-11-export" {
entry 10 {
action {
action-type accept
community {
add ["RT64500:11" "SOO-45"]
}
}
}
}
policy-statement "vsi-11-import" {
entry 10 {
from {
family [evpn]
community {
name "SOO-45"
}
}
action {
action-type reject
}
}
entry 20 {
from {
family [evpn]
community {
name "RT64500:11"
}
}
action {
action-type accept
}
}
}
policy-statement "vsi-12-export" {
entry 10 {
action {
action-type accept
community {
add ["RT64500:12" "SOO-45"]
}
}
}
}
policy-statement "vsi-12-import" {
entry 10 {
from {
family [evpn]
community {
name "SOO-45"
}
}
action {
action-type reject
}
}
entry 20 {
from {
family [evpn]
community {
name "RT64500:12"
}
}
action {
action-type accept
}
}
}
}
service {
vpls "VPLS-1" {
admin-state enable
service-id 1
customer "1"
segment-routing-v6 1 {
locator "PE4-loc" {
function {
end-dt2u {
}
end-dt2m {
}
}
}
}
bgp 1 {
route-distinguisher "192.0.2.45:1"
vsi-import ["vsi-11-import"]
vsi-export ["vsi-11-export"]
}
bgp 2 {
route-distinguisher "192.0.2.54:1"
vsi-import ["vsi-12-import"]
vsi-export ["vsi-12-export"]
}
bgp-evpn {
evi 1
incl-mcast-orig-ip 145.145.145.145
segment-routing-v6 2 {
admin-state enable
default-route-tag 0x14 # default route tag 20
split-horizon-group "SHG-2"
srv6 {
instance 1
default-locator "PE4-loc"
}
route-next-hop {
system-ipv6
}
}
mpls 1 {
admin-state enable
split-horizon-group "SHG-1"
ecmp 2
default-route-tag 0xa # default route tag 10
mh-mode access
auto-bind-tunnel {
resolution any
}
}
}
split-horizon-group "SHG-1" {
}
split-horizon-group "SHG-2" {
}
}
The configuration of SHGs is optional. In this example, different SHGs are applied to the two service instances, so the routes can be redistributed between the instances.
- originator IP address: 145.145.145.145
- for instance 1: RD 192.0.2.45:1, RT 64500:11
- for instance 2: RD 192.0.2.54:1, RT 64500:12
Service instance 1 has default route tag 10 and service instance 2 has default route tag 20. These route tags allow to differentiate routes and avoid loops as shown in Default route tags per service instance avoid loops.
The MPLS multihoming mode is access in this example; the SRv6 multihoming mode is network (default).
Show commands
After VPLS-1 is configured on all nodes, traffic is sent between CE-11 and CE-61. The FDB for VPLS-1 on PE-2 is as follows:
[/]
A:admin@PE-2# show service id "VPLS-1" fdb detail
===============================================================================
Forwarding Database, Service 1
===============================================================================
ServId MAC Source-Identifier Type Last Change
Transport:Tnl-Id Age
-------------------------------------------------------------------------------
1 00:00:5e:00:53:11 sap:lag-1:1 L/0 01/10/24 08:49:10
1 00:00:5e:00:53:61 mpls-1: Evpn 01/10/24 08:45:13
192.0.2.4:524279
ldp:65538
-------------------------------------------------------------------------------
No. of MAC Entries: 2
-------------------------------------------------------------------------------
Legend:L=Learned O=Oam P=Protected-MAC C=Conditional S=Static Lf=Leaf T=Trusted
===============================================================================
PE-2 learns the remote MAC addresses via GW PE-4 (active) and GW PE-5 (backup). The following shows the received EVPN MAC routes for MAC address 00:00:5e:00:53:61 of CE-61. The anycast RD 192.0.2.45:1 is used.
[/]
A:admin@PE-2# show router bgp routes evpn mac mac-address 00:00:5e:00:53:61
===============================================================================
BGP Router ID:192.0.2.2 AS:64500 Local AS:64500
===============================================================================
Legend -
Status codes : u - used, s - suppressed, h - history, d - decayed, * - valid
l - leaked, x - stale, > - best, b - backup, p - purge
Origin codes : i - IGP, e - EGP, ? - incomplete
===============================================================================
BGP EVPN MAC Routes
===============================================================================
Flag Route Dist. MacAddr ESI
Tag Mac Mobility Label1
Ip Address
NextHop
-------------------------------------------------------------------------------
u*>i 192.0.2.45:1 00:00:5e:00:53:61 ESI-0
0 Seq:0 LABEL 524279
n/a
192.0.2.4
*>i 192.0.2.45:1 00:00:5e:00:53:61 ESI-0
0 Seq:0 LABEL 524279
n/a
192.0.2.5
-------------------------------------------------------------------------------
Routes : 2
===============================================================================
The detailed output for the first of these EVPN MAC routes shows the communities for RT, SOO, and the tunnel encapsulation MPLS.
[/]
A:admin@PE-2# show router bgp routes evpn mac mac-address 00:00:5e:00:53:61 detail
===============================================================================
BGP Router ID:192.0.2.2 AS:64500 Local AS:64500
===============================================================================
Legend -
Status codes : u - used, s - suppressed, h - history, d - decayed, * - valid
l - leaked, x - stale, > - best, b - backup, p - purge
Origin codes : i - IGP, e - EGP, ? - incomplete
===============================================================================
BGP EVPN MAC Routes
===============================================================================
Original Attributes
Network : n/a
Nexthop : 192.0.2.4
Path Id : None
From : 192.0.2.4
Res. Nexthop : 192.168.24.2
Local Pref. : 100 Interface Name : int-PE-2-PE-4
Aggregator AS : None Aggregator : None
Atomic Aggr. : Not Atomic MED : None
AIGP Metric : None IGP Cost : 10
Connector : None
Community : target:64500:11 origin:45:45 bgp-tunnel-encap:MPLS
Cluster : No Cluster Members
Originator Id : None Peer Router Id : 192.0.2.4
Origin : IGP
Flags : Used Valid Best
Route Source : Internal
AS-Path : No As-Path
EVPN type : MAC
ESI : ESI-0
Tag : 0
IP Address : n/a
Route Dist. : 192.0.2.45:1
Mac Address : 00:00:5e:00:53:61
MPLS Label1 : LABEL 524279 MPLS Label2 : n/a
Route Tag : 0
Neighbor-AS : n/a
DB Orig Val : N/A Final Orig Val : N/A
Source Class : 0 Dest Class : 0
Add Paths Send : Default
Last Modified : 00h04m30s
---snip---
The GWs PE-4 and PE-5 redistribute EVPN MAC routes between MPLS and SRv6 domains. The FDB on PE-4 shows that MAC address 00:00:5e:00:53:11 of CE-11 can be reached via the all-active ES with ESI 01:00:00:00:00:23:00:00:01:01, which is in the MPLS domain. MAC address 00:00:5e:00:53:61 of CE-61 can be reached using an SRv6 tunnel to PE-6. The FDB table on PE-5 is similar.
[/]
A:admin@PE-4# show service id "VPLS-1" fdb detail
===============================================================================
Forwarding Database, Service 1
===============================================================================
ServId MAC Source-Identifier Type Last Change
Transport:Tnl-Id Age
-------------------------------------------------------------------------------
1 00:00:5e:00:53:11 eES: Evpn 01/10/24 08:49:10
01:00:00:00:00:23:00:00:01:01
1 00:00:5e:00:53:61 srv6-1: Evpn 01/10/24 08:45:13
2001:db8::2:6
2001:db8:aaaa:106:8000::
-------------------------------------------------------------------------------
No. of MAC Entries: 2
-------------------------------------------------------------------------------
Legend:L=Learned O=Oam P=Protected-MAC C=Conditional S=Static Lf=Leaf T=Trusted
===============================================================================
The remote PEs, such as PE-2, set up EVPN destinations to only one GW PE in the anycast group for an EVPN VPLS service. The following command on PE-2 shows that two IMET routes with originator IP address 145.145.145.145 are valid, but only the IMET route from PE-4 is used:
[/]
A:admin@PE-2# show router bgp routes evpn incl-mcast originator-ip 145.145.145.145
===============================================================================
BGP Router ID:192.0.2.2 AS:64500 Local AS:64500
===============================================================================
Legend -
Status codes : u - used, s - suppressed, h - history, d - decayed, * - valid
l - leaked, x - stale, > - best, b - backup, p - purge
Origin codes : i - IGP, e - EGP, ? - incomplete
===============================================================================
BGP EVPN Inclusive-Mcast Routes
===============================================================================
Flag Route Dist. OrigAddr
Tag NextHop
-------------------------------------------------------------------------------
u*>i 192.0.2.45:1 145.145.145.145
0 192.0.2.4
*>i 192.0.2.45:1 145.145.145.145
0 192.0.2.5
-------------------------------------------------------------------------------
Routes : 2
===============================================================================
The details of the used IMET route from PE-4 are the following:
[/]
A:admin@PE-2# show router bgp routes evpn incl-mcast originator-ip 145.145.145.145 detail
===============================================================================
BGP Router ID:192.0.2.2 AS:64500 Local AS:64500
===============================================================================
Legend -
Status codes : u - used, s - suppressed, h - history, d - decayed, * - valid
l - leaked, x - stale, > - best, b - backup, p - purge
Origin codes : i - IGP, e - EGP, ? - incomplete
===============================================================================
BGP EVPN Inclusive-Mcast Routes
===============================================================================
Original Attributes
Network : n/a
Nexthop : 192.0.2.4
Path Id : None
From : 192.0.2.4
Res. Nexthop : 192.168.24.2
Local Pref. : 100 Interface Name : int-PE-2-PE-4
Aggregator AS : None Aggregator : None
Atomic Aggr. : Not Atomic MED : None
AIGP Metric : None IGP Cost : 10
Connector : None
Community : target:64500:11 origin:45:45 bgp-tunnel-encap:MPLS
Cluster : No Cluster Members
Originator Id : None Peer Router Id : 192.0.2.4
Origin : IGP
Flags : Used Valid Best
Route Source : Internal
AS-Path : No As-Path
EVPN type : INCL-MCAST
Tag : 0
Originator IP : 145.145.145.145
Route Dist. : 192.0.2.45:1
Route Tag : 0
Neighbor-AS : n/a
DB Orig Val : N/A Final Orig Val : N/A
Source Class : 0 Dest Class : 0
Add Paths Send : Default
Last Modified : 00h07m22s
-------------------------------------------------------------------------------
PMSI Tunnel Attributes :
Tunnel-type : Ingress Replication
Flags : Type: RNVE(0) BM: 0 U: 0 Leaf: not required
MPLS Label : LABEL 524279
Tunnel-Endpoint: 192.0.2.4
-------------------------------------------------------------------------------
---snip---
In the MPLS domain, PE-2 sets up EVPN destinations to PE-3 and to GW PE-4, but not to GW PE-5:
[/]
A:admin@PE-2# show service id "VPLS-1" evpn-mpls
===============================================================================
BGP EVPN-MPLS Dest (Instance 1)
===============================================================================
TEP Address Transport:Tnl Egr Label Oper Mcast Num
State MACs
-------------------------------------------------------------------------------
192.0.2.3 ldp:65537 524280 Up bum 0
192.0.2.4 ldp:65538 524279 Up bum 1
-------------------------------------------------------------------------------
Number of entries: 2
-------------------------------------------------------------------------------
===============================================================================
---snip---
In the MPLS domain, PE-4 sets up EVPN destinations to PE-2, PE-3, and the all-active ES with ESI 01:00:00:00:00:23:00:00:01:01, but not to GW PE-5:
[/]
A:admin@PE-4# show service id "VPLS-1" evpn-mpls
===============================================================================
BGP EVPN-MPLS Dest (Instance 1)
===============================================================================
TEP Address Transport:Tnl Egr Label Oper Mcast Num
State MACs
-------------------------------------------------------------------------------
192.0.2.2 ldp:65537 524280 Up bum 0
192.0.2.3 ldp:65538 524280 Up bum 0
-------------------------------------------------------------------------------
Number of entries: 2
-------------------------------------------------------------------------------
===============================================================================
===============================================================================
BGP EVPN-MPLS Dest (Instance 2)
===============================================================================
TEP Address Transport:Tnl Egr Label Oper Mcast Num
State MACs
-------------------------------------------------------------------------------
No Matching Entries
===============================================================================
===============================================================================
BGP EVPN-MPLS Ethernet Segment Dest (Instance 1)
===============================================================================
Eth SegId Num. Macs Last Update
-------------------------------------------------------------------------------
01:00:00:00:00:23:00:00:01:01 1 01/10/2024 08:49:10
-------------------------------------------------------------------------------
Number of entries: 1
-------------------------------------------------------------------------------
===============================================================================
---snip---
In the SRv6 domain, PE-6 receives two IMET routes with originator IP address 145.145.145.145, but only the IMET route from PE-4 is used:
[/]
A:admin@PE-6# show router bgp routes evpn incl-mcast originator-ip 145.145.145.145
===============================================================================
BGP Router ID:192.0.2.6 AS:64500 Local AS:64500
===============================================================================
Legend -
Status codes : u - used, s - suppressed, h - history, d - decayed, * - valid
l - leaked, x - stale, > - best, b - backup, p - purge
Origin codes : i - IGP, e - EGP, ? - incomplete
===============================================================================
BGP EVPN Inclusive-Mcast Routes
===============================================================================
Flag Route Dist. OrigAddr
Tag NextHop
-------------------------------------------------------------------------------
u*>i 192.0.2.54:1 145.145.145.145
0 2001:db8::2:4
*>i 192.0.2.54:1 145.145.145.145
0 2001:db8::2:5
-------------------------------------------------------------------------------
Routes : 2
===============================================================================
[/]
A:admin@PE-6# show router bgp routes evpn incl-mcast originator-ip 145.145.145.145 detail
===============================================================================
BGP Router ID:192.0.2.6 AS:64500 Local AS:64500
===============================================================================
Legend -
Status codes : u - used, s - suppressed, h - history, d - decayed, * - valid
l - leaked, x - stale, > - best, b - backup, p - purge
Origin codes : i - IGP, e - EGP, ? - incomplete
===============================================================================
BGP EVPN Inclusive-Mcast Routes
===============================================================================
Original Attributes
Network : n/a
Nexthop : 2001:db8::2:4
Path Id : None
From : 2001:db8::2:4
Res. Nexthop : fe80::1a:1ff:fe01:1
Local Pref. : 100 Interface Name : int-PE-6-PE-4
Aggregator AS : None Aggregator : None
Atomic Aggr. : Not Atomic MED : None
AIGP Metric : None IGP Cost : 10
Connector : None
Community : target:64500:12 origin:45:45
Cluster : No Cluster Members
Originator Id : None Peer Router Id : 192.0.2.4
Origin : IGP
Flags : Used Valid Best
Route Source : Internal
AS-Path : No As-Path
EVPN type : INCL-MCAST
Tag : 0
Originator IP : 145.145.145.145
Route Dist. : 192.0.2.54:1
Route Tag : 0
Neighbor-AS : n/a
DB Orig Val : N/A Final Orig Val : N/A
Source Class : 0 Dest Class : 0
Add Paths Send : Default
Last Modified : 00h09m17s
SRv6 TLV Type : SRv6 L2 Service TLV (6)
SRv6 SubTLV : SRv6 SID Information (1)
Sid : 2001:db8:aaaa:104::
Full Sid : 2001:db8:aaaa:104:7fff:9000::
Behavior : End.DT2M (24)
SRv6 SubSubTLV : SRv6 SID Structure (1)
Loc-Block-Len : 48 Loc-Node-Len : 16
Func-Len : 20 Arg-Len : 0
Tpose-Len : 20 Tpose-offset : 64
-------------------------------------------------------------------------------
PMSI Tunnel Attributes :
Tunnel-type : Ingress Replication
Flags : Type: RNVE(0) BM: 0 U: 0 Leaf: not required
MPLS Label : 8388496
Tunnel-Endpoint: 2001:db8::2:4
-------------------------------------------------------------------------------
---snip---
In the SRv6 domain, PE-6 sets up SRv6 destinations to PE-4, but not to PE-5:
[/]
A:admin@PE-6# show service id "VPLS-1" segment-routing-v6 destinations
===============================================================================
TEP, SID (Instance 1)
===============================================================================
TEP Address Segment Id Oper Mcast Num
State MACs
-------------------------------------------------------------------------------
2001:db8::2:4 2001:db8:aaaa:104:7fff:9000:: Up BUM 0
2001:db8::2:4 2001:db8:aaaa:104:7fff:a000:: Up - 1
-------------------------------------------------------------------------------
Number of TEP, SID: 2
-------------------------------------------------------------------------------
===============================================================================
===============================================================================
Segment Routing v6 Ethernet Segment Dest (Instance 1)
===============================================================================
Eth SegId Num. Macs Last Update
-------------------------------------------------------------------------------
No Matching Entries
===============================================================================
On PE-6, the following information for the SRv6 instance 1 in VPLS-1 shows the End.DT2U and End.DT2M types with the corresponding SIDs, and status:
[/]
A:admin@PE-6# show service id "VPLS-1" segment-routing-v6 detail
===============================================================================
Segment Routing v6 Instance 1 Service 1
===============================================================================
Locator
Type Function SID Status
-------------------------------------------------------------------------------
PE6-loc
End.DT2U *524288 2001:db8:aaaa:106:8000:: ok
End.DT2M *524287 2001:db8:aaaa:106:7fff:f000:: ok
===============================================================================
Legend: * - System allocated
EVPN VPLS with VXLAN to SRv6 stitching
Initial configuration
The initial configuration is similar to the one for EVPN VPLS with MPLS to SRv6 stitching, but LDP is not required between PE-2, PE-3, PE-4, and PE-5. The BGP configuration remains the same with the export policies using route tags to avoid loops.
Service configuration
In the VXLAN domain, all-active multihoming is used between PE-2 and PE-3. The service configuration on PE-2 and PE-3 is identical. Route tag 64500:21 accepted in instance 1 of VPLS-2 on GWs PE-4 and PE-5:
# on PE-2, PE-3:
configure {
service {
system {
bgp {
evpn {
ethernet-segment "AA-vES-23-2" {
admin-state enable
type virtual
esi 01:00:00:00:00:23:02:00:01:01
multi-homing-mode all-active
association {
lag "lag-1" {
virtual-ranges {
dot1q {
q-tag 2 {
end 2
}
}
}
}
}
}
}
}
}
vpls "VPLS-2" {
admin-state enable
service-id 2
customer "1"
vxlan {
instance 1 {
vni 2
}
}
bgp 1 {
route-target {
export "target:64500:21"
import "target:64500:21"
}
}
bgp-evpn {
evi 2
vxlan 1 {
admin-state enable
vxlan-instance 1
ecmp 2
mh-mode network # required for VXLAN MH
routes {
auto-disc {
advertise true # required for VXLAN MH
}
}
}
}
sap lag-1:2 {
}
}
In the SRv6 domain, no multihoming is used. The configuration of VPLS-2 on PE-6 is as follows:
# on PE-6:
configure {
service {
vpls "VPLS-2" {
admin-state enable
service-id 2
customer "1"
segment-routing-v6 1 {
locator "PE6-loc" {
function {
end-dt2u {
}
end-dt2m {
}
}
}
}
bgp 1 {
route-target {
export "target:64500:22"
import "target:64500:22"
}
}
bgp-evpn {
evi 2
segment-routing-v6 1 {
admin-state enable
srv6 {
instance 1
default-locator "PE6-loc"
}
route-next-hop {
system-ipv6
}
}
}
sap 1/1/c10/1:2 {
}
}
On the GW PEs, service instance 1 uses VXLAN and service instance 2 uses SRv6 transport. VSI policies are used to accept routes with the matching RT and to avoid loops based on the SOO. In the VXLAN service instance, the multihoming mode is access (multihoming mode network is not supported on VXLAN) and no explicit SHG can be configured. For anycast, the same RD and RT values are used on both GW PEs and the originator IP address is 45.45.45.45. The configuration on PE-4 is as follows:
# on PE-4:
configure {
policy-options {
community "RT64500:21" {
member "target:64500:21" { }
}
community "RT64500:22" {
member "target:64500:22" { }
}
community "SOO-45" {
member "origin:45:45" { }
}
policy-statement "drop-tag-10" {
description "default-route-tag in VPLSs to avoid loops"
entry 10 {
from {
tag 10
}
action {
action-type reject
}
}
}
policy-statement "drop-tag-20" {
description "default-route-tag in VPLSs to avoid loops"
entry 10 {
from {
tag 20
}
action {
action-type reject
}
}
}
policy-statement "vsi-21-export" {
entry 10 {
action {
action-type accept
community {
add ["RT64500:21" "SOO-45"]
}
}
}
}
policy-statement "vsi-21-import" {
entry 10 {
from {
family [evpn]
community {
name "SOO-45"
}
}
action {
action-type reject
}
}
entry 20 {
from {
family [evpn]
community {
name "RT64500:21"
}
}
action {
action-type accept
}
}
}
policy-statement "vsi-22-export" {
entry 10 {
action {
action-type accept
community {
add ["RT64500:22" "SOO-45"]
}
}
}
}
policy-statement "vsi-22-import" {
entry 10 {
from {
family [evpn]
community {
name "SOO-45"
}
}
action {
action-type reject
}
}
entry 20 {
from {
family [evpn]
community {
name "RT64500:22"
}
}
action {
action-type accept
}
}
}
}
service {
vpls "VPLS-2" {
admin-state enable
service-id 2
customer "1"
vxlan {
instance 1 {
vni 2
}
}
segment-routing-v6 1 {
locator "PE4-loc" {
function {
end-dt2u {
}
end-dt2m {
}
}
}
}
bgp 1 {
route-distinguisher "192.0.2.45:2"
vsi-import ["vsi-21-import"]
vsi-export ["vsi-21-export"]
}
bgp 2 {
route-distinguisher "192.0.2.54:2"
vsi-import ["vsi-22-import"]
vsi-export ["vsi-22-export"]
}
bgp-evpn {
evi 2
incl-mcast-orig-ip 45.45.45.45
segment-routing-v6 2 {
admin-state enable
default-route-tag 0x14 # route tag 20 to avoid loops
srv6 {
instance 1
default-locator "PE4-loc"
}
route-next-hop {
system-ipv6
}
}
vxlan 1 {
admin-state enable
vxlan-instance 1
default-route-tag 0xa # route tag 10 to avoid loops
ecmp 2
}
}
The configuration on GW PE-5 is identical, but the locator name is different.
Show commands
When traffic is sent between CE-12 and CE-62, the FDB on PE-2 is as follows:
[/]
A:admin@PE-2# show service id "VPLS-2" fdb detail
===============================================================================
Forwarding Database, Service 2
===============================================================================
ServId MAC Source-Identifier Type Last Change
Transport:Tnl-Id Age
-------------------------------------------------------------------------------
2 00:00:5e:00:53:12 sap:lag-1:2 L/0 01/10/24 08:57:53
2 00:00:5e:00:53:62 vxlan-1: Evpn 01/10/24 08:55:49
192.0.2.4:2
-------------------------------------------------------------------------------
No. of MAC Entries: 2
-------------------------------------------------------------------------------
Legend:L=Learned O=Oam P=Protected-MAC C=Conditional S=Static Lf=Leaf T=Trusted
===============================================================================
PE-2 receives two EVPN MAC routes for MAC address 00:00:5e:00:53:62 from CE-62, but only the route from GW PE-4 is used while the route from GW PE-5 is not.
[/]
A:admin@PE-2# show router bgp routes evpn mac mac-address 00:00:5e:00:53:62
===============================================================================
BGP Router ID:192.0.2.2 AS:64500 Local AS:64500
===============================================================================
Legend -
Status codes : u - used, s - suppressed, h - history, d - decayed, * - valid
l - leaked, x - stale, > - best, b - backup, p - purge
Origin codes : i - IGP, e - EGP, ? - incomplete
===============================================================================
BGP EVPN MAC Routes
===============================================================================
Flag Route Dist. MacAddr ESI
Tag Mac Mobility Label1
Ip Address
NextHop
-------------------------------------------------------------------------------
u*>i 192.0.2.45:2 00:00:5e:00:53:62 ESI-0
0 Seq:0 VNI 2
n/a
192.0.2.4
*>i 192.0.2.45:2 00:00:5e:00:53:62 ESI-0
0 Seq:0 VNI 2
n/a
192.0.2.5
-------------------------------------------------------------------------------
Routes : 2
===============================================================================
The GWs redistribute the EVPN MAC routes between the VXLAN domain and the SRv6 domain. On PE-4, the FDB contains entries in the VXLAN domain and in the SRv6 domain. The FDB on PE-5 is similar.
[/]
A:admin@PE-4# show service id "VPLS-2" fdb detail
===============================================================================
Forwarding Database, Service 2
===============================================================================
ServId MAC Source-Identifier Type Last Change
Transport:Tnl-Id Age
-------------------------------------------------------------------------------
2 00:00:5e:00:53:12 eES: Evpn 01/10/24 08:57:53
01:00:00:00:00:23:02:00:01:01
2 00:00:5e:00:53:62 srv6-1: Evpn 01/10/24 08:55:49
2001:db8::2:6
2001:db8:aaaa:106:7fff:e000::
-------------------------------------------------------------------------------
No. of MAC Entries: 2
-------------------------------------------------------------------------------
Legend:L=Learned O=Oam P=Protected-MAC C=Conditional S=Static Lf=Leaf T=Trusted
===============================================================================
On PE-4, the VXLAN destinations are the following:
[/]
A:admin@PE-4# show service id "VPLS-2" vxlan destinations
===============================================================================
Egress VTEP, VNI (Instance 1)
===============================================================================
VTEP Address Egress VNI Oper Mcast Num
State MACs
-------------------------------------------------------------------------------
192.0.2.2 2 Up BUM 0
192.0.2.3 2 Up BUM 0
-------------------------------------------------------------------------------
Number of Egress VTEP, VNI : 2
-------------------------------------------------------------------------------
===============================================================================
===============================================================================
Egress VTEP, VNI (Instance 2)
===============================================================================
VTEP Address Egress VNI Oper Mcast Num
State MACs
-------------------------------------------------------------------------------
No Matching Entries
===============================================================================
===============================================================================
BGP EVPN-VXLAN Ethernet Segment Dest (Instance 1)
===============================================================================
Eth SegId Num. Macs Last Update
-------------------------------------------------------------------------------
01:00:00:00:00:23:02:00:01:01 1 01/10/2024 08:57:53
-------------------------------------------------------------------------------
Number of entries: 1
-------------------------------------------------------------------------------
===============================================================================
===============================================================================
BGP EVPN-VXLAN Ethernet Segment Dest (Instance 2)
===============================================================================
Eth SegId Num. Macs Last Update
-------------------------------------------------------------------------------
No Matching Entries
===============================================================================
PE-5 is not included in the list of VTEP addresses. Also, remote PEs such as PE-2 set up EVPN destinations to only one PE in the anycast group for VPLS-2:
[/]
A:admin@PE-2# show service id "VPLS-2" vxlan destinations
===============================================================================
Egress VTEP, VNI (Instance 1)
===============================================================================
VTEP Address Egress VNI Oper Mcast Num
State MACs
-------------------------------------------------------------------------------
192.0.2.3 2 Up BUM 0
192.0.2.4 2 Up BUM 1
-------------------------------------------------------------------------------
Number of Egress VTEP, VNI : 2
-------------------------------------------------------------------------------
===============================================================================
===============================================================================
Egress VTEP, VNI (Instance 2)
===============================================================================
VTEP Address Egress VNI Oper Mcast Num
State MACs
-------------------------------------------------------------------------------
No Matching Entries
===============================================================================
===============================================================================
BGP EVPN-VXLAN Ethernet Segment Dest (Instance 1)
===============================================================================
Eth SegId Num. Macs Last Update
-------------------------------------------------------------------------------
No Matching Entries
===============================================================================
===============================================================================
BGP EVPN-VXLAN Ethernet Segment Dest (Instance 2)
===============================================================================
Eth SegId Num. Macs Last Update
-------------------------------------------------------------------------------
No Matching Entries
===============================================================================
PE-2 receives two IMET routes with originator IP address 45.45.45.45, but only the route with next hop PE-4 is used while the route with next hop PE-5 is not.
[/]
A:admin@PE-2# show router bgp routes evpn incl-mcast originator-ip 45.45.45.45
===============================================================================
BGP Router ID:192.0.2.2 AS:64500 Local AS:64500
===============================================================================
Legend -
Status codes : u - used, s - suppressed, h - history, d - decayed, * - valid
l - leaked, x - stale, > - best, b - backup, p - purge
Origin codes : i - IGP, e - EGP, ? - incomplete
===============================================================================
BGP EVPN Inclusive-Mcast Routes
===============================================================================
Flag Route Dist. OrigAddr
Tag NextHop
-------------------------------------------------------------------------------
u*>i 192.0.2.45:2 45.45.45.45
0 192.0.2.4
*>i 192.0.2.45:2 45.45.45.45
0 192.0.2.5
-------------------------------------------------------------------------------
Routes : 2
===============================================================================
The detailed information for the active IMET route is as follows:
[/]
A:admin@PE-2# show router bgp routes evpn incl-mcast originator-ip 45.45.45.45 detail
===============================================================================
BGP Router ID:192.0.2.2 AS:64500 Local AS:64500
===============================================================================
Legend -
Status codes : u - used, s - suppressed, h - history, d - decayed, * - valid
l - leaked, x - stale, > - best, b - backup, p - purge
Origin codes : i - IGP, e - EGP, ? - incomplete
===============================================================================
BGP EVPN Inclusive-Mcast Routes
===============================================================================
Original Attributes
Network : n/a
Nexthop : 192.0.2.4
Path Id : None
From : 192.0.2.4
Res. Nexthop : 192.168.24.2
Local Pref. : 100 Interface Name : int-PE-2-PE-4
Aggregator AS : None Aggregator : None
Atomic Aggr. : Not Atomic MED : None
AIGP Metric : None IGP Cost : 10
Connector : None
Community : target:64500:21 origin:45:45 bgp-tunnel-encap:VXLAN
Cluster : No Cluster Members
Originator Id : None Peer Router Id : 192.0.2.4
Origin : IGP
Flags : Used Valid Best
Route Source : Internal
AS-Path : No As-Path
EVPN type : INCL-MCAST
Tag : 0
Originator IP : 45.45.45.45
Route Dist. : 192.0.2.45:2
Route Tag : 0
Neighbor-AS : n/a
DB Orig Val : N/A Final Orig Val : N/A
Source Class : 0 Dest Class : 0
Add Paths Send : Default
Last Modified : 00h05m03s
-------------------------------------------------------------------------------
PMSI Tunnel Attributes :
Tunnel-type : Ingress Replication
Flags : Type: RNVE(0) BM: 0 U: 0 Leaf: not required
MPLS Label : VNI 2
Tunnel-Endpoint: 192.0.2.4
-------------------------------------------------------------------------------
---snip---
In the SRv6 domain, PE-6 receives IMET routes with originator IP address 45.45.45.45 from both GW PEs, but only the IMET route from PE-4 is used:
[/]
A:admin@PE-6# show router bgp routes evpn incl-mcast originator-ip 45.45.45.45
===============================================================================
BGP Router ID:192.0.2.6 AS:64500 Local AS:64500
===============================================================================
Legend -
Status codes : u - used, s - suppressed, h - history, d - decayed, * - valid
l - leaked, x - stale, > - best, b - backup, p - purge
Origin codes : i - IGP, e - EGP, ? - incomplete
===============================================================================
BGP EVPN Inclusive-Mcast Routes
===============================================================================
Flag Route Dist. OrigAddr
Tag NextHop
-------------------------------------------------------------------------------
u*>i 192.0.2.54:2 45.45.45.45
0 2001:db8::2:4
*>i 192.0.2.54:2 45.45.45.45
0 2001:db8::2:5
-------------------------------------------------------------------------------
Routes : 2
===============================================================================
The detailed output for the used IMET route from PE-4 is the following:
[/]
A:admin@PE-6# show router bgp routes evpn incl-mcast originator-ip 45.45.45.45 detail
===============================================================================
BGP Router ID:192.0.2.6 AS:64500 Local AS:64500
===============================================================================
Legend -
Status codes : u - used, s - suppressed, h - history, d - decayed, * - valid
l - leaked, x - stale, > - best, b - backup, p - purge
Origin codes : i - IGP, e - EGP, ? - incomplete
===============================================================================
BGP EVPN Inclusive-Mcast Routes
===============================================================================
Original Attributes
Network : n/a
Nexthop : 2001:db8::2:4
Path Id : None
From : 2001:db8::2:4
Res. Nexthop : fe80::1a:1ff:fe01:1
Local Pref. : 100 Interface Name : int-PE-6-PE-4
Aggregator AS : None Aggregator : None
Atomic Aggr. : Not Atomic MED : None
AIGP Metric : None IGP Cost : 10
Connector : None
Community : target:64500:22 origin:45:45
Cluster : No Cluster Members
Originator Id : None Peer Router Id : 192.0.2.4
Origin : IGP
Flags : Used Valid Best
Route Source : Internal
AS-Path : No As-Path
EVPN type : INCL-MCAST
Tag : 0
Originator IP : 45.45.45.45
Route Dist. : 192.0.2.54:2
Route Tag : 0
Neighbor-AS : n/a
DB Orig Val : N/A Final Orig Val : N/A
Source Class : 0 Dest Class : 0
Add Paths Send : Default
Last Modified : 00h09m02s
SRv6 TLV Type : SRv6 L2 Service TLV (6)
SRv6 SubTLV : SRv6 SID Information (1)
Sid : 2001:db8:aaaa:104::
Full Sid : 2001:db8:aaaa:104:7fff:6000::
Behavior : End.DT2M (24)
SRv6 SubSubTLV : SRv6 SID Structure (1)
Loc-Block-Len : 48 Loc-Node-Len : 16
Func-Len : 20 Arg-Len : 0
Tpose-Len : 20 Tpose-offset : 64
-------------------------------------------------------------------------------
PMSI Tunnel Attributes :
Tunnel-type : Ingress Replication
Flags : Type: RNVE(0) BM: 0 U: 0 Leaf: not required
MPLS Label : 8388448
Tunnel-Endpoint: 2001:db8::2:4
-------------------------------------------------------------------------------
---snip---
PE-6 sets up SRv6 destinations to PE-4, but not to PE-5:
[/]
A:admin@PE-6# show service id "VPLS-2" segment-routing-v6 destinations
===============================================================================
TEP, SID (Instance 1)
===============================================================================
TEP Address Segment Id Oper Mcast Num
State MACs
-------------------------------------------------------------------------------
2001:db8::2:4 2001:db8:aaaa:104:7fff:6000:: Up BUM 0
2001:db8::2:4 2001:db8:aaaa:104:7fff:7000:: Up - 1
-------------------------------------------------------------------------------
Number of TEP, SID: 2
-------------------------------------------------------------------------------
===============================================================================
===============================================================================
Segment Routing v6 Ethernet Segment Dest (Instance 1)
===============================================================================
Eth SegId Num. Macs Last Update
-------------------------------------------------------------------------------
No Matching Entries
===============================================================================
Conclusion
SRv6 to MPLS stitching and SRv6 to VXLAN stitching are required to interwork with non-SRv6 networks.