BGP EVPN Hands-On Configuration: Layer 2 and Layer 3 Overlay Implementation with Cisco IOS XE
Table of Contents
- Introduction to Hands-On BGP EVPN
- Lab Environment and Prerequisites
- Underlay Foundation Setup
- EVPN Ingress Replication Configuration
- Layer 2 Overlay Implementation
- BGP Route Type Analysis and Verification
- Layer 3 Overlay and Symmetric Routing
- Advanced Show Commands and Troubleshooting
- Complete Configuration Templates
- Course Completion and Next Steps
Introduction to Hands-On BGP EVPN
After comprehensive theoretical coverage of BGP EVPN concepts, design considerations, and routing architectures, it's time to implement these technologies in a practical lab environment. This hands-on configuration guide transforms theoretical knowledge into deployable configurations using real Cisco IOS XE examples from a functional leaf-spine fabric.
This practical implementation covers the complete BGP EVPN deployment lifecycle, from underlay preparation through Layer 2 overlay configuration and advanced Layer 3 symmetric routing implementation. Each configuration section includes detailed explanations, verification commands, and troubleshooting insights based on real-world deployment experience.
Theory-to-Practice Connection
This configuration guide serves as the culmination of our BGP EVPN journey, demonstrating how theoretical concepts like ingress replication, Route Types 2 and 3, VNI mappings, and symmetric routing translate into working network configurations.
Lab Environment and Prerequisites
The practical implementation utilizes a representative leaf-spine architecture running Cisco IOS XE 17.10, providing enterprise-grade BGP EVPN functionality suitable for data center and campus deployments.
Lab Topology Overview
Spine Switches (Route Reflectors):
- S1: 1.1.1.1/32 (Loopback0)
- S2: 1.1.1.2/32 (Loopback0)
Leaf Switches (VTEPs):
- L1: 1.1.1.3/32 (Loopback0)
- L2: 1.1.1.4/32 (Loopback0)
- L3: 1.1.1.5/32 (Loopback0)
BGP Design:
- AS 65001 (Single AS - IBGP)
- Spine Route Reflectors
- L2VPN EVPN Address Family
Software Requirements
- Cisco IOS XE 17.10+: Recommended for optimal EVPN feature support
- BGP EVPN Capability: L2VPN EVPN address family support
- VXLAN Support: Network Virtualization Edge (NVE) interface functionality
- VRF Capability: Required for Layer 3 overlay implementation
Underlay Foundation Setup
Before implementing EVPN overlays, the underlay foundation must provide reliable loopback-to-loopback connectivity for VXLAN tunnel establishment. This implementation uses IBGP with route reflectors for overlay connectivity and OSPF for underlay reachability.
Underlay IGP Configuration
! Loopback Interface (VTEP Source)
interface Loopback0
description VTEP Source Interface
ip address 1.1.1.3 255.255.255.255
ip ospf 1 area 0
! Physical Uplink Interfaces
interface GigabitEthernet0/0/1
description Uplink to Spine1
ip address 10.1.13.3 255.255.255.252
ip ospf network point-to-point
ip ospf 1 area 0
no shutdown
! OSPF Process
router ospf 1
router-id 1.1.1.3
area 0 stub no-summary
BGP EVPN Foundation
router bgp 65001
bgp router-id 1.1.1.3
bgp log-neighbor-changes
no bgp default ipv4-unicast
! Spine Route Reflector Neighbors
neighbor 1.1.1.1 remote-as 65001
neighbor 1.1.1.1 update-source Loopback0
neighbor 1.1.1.2 remote-as 65001
neighbor 1.1.1.2 update-source Loopback0
! L2VPN EVPN Address Family
address-family l2vpn evpn
neighbor 1.1.1.1 activate
neighbor 1.1.1.1 send-community extended
neighbor 1.1.1.2 activate
neighbor 1.1.1.2 send-community extended
Spine Route Reflector Configuration:
router bgp 65001
bgp router-id 1.1.1.1
bgp log-neighbor-changes
no bgp default ipv4-unicast
! Leaf Neighbors (Route Reflector Clients)
neighbor 1.1.1.3 remote-as 65001
neighbor 1.1.1.3 update-source Loopback0
address-family l2vpn evpn
neighbor 1.1.1.3 activate
neighbor 1.1.1.3 route-reflector-client
neighbor 1.1.1.3 send-community extended
EVPN Ingress Replication Configuration
Ingress replication provides BUM (Broadcast, Unknown unicast, Multicast) traffic handling without requiring multicast underlay infrastructure. This approach simplifies deployment while providing optimal performance for most use cases.
Ingress Replication Mechanics
When a VTEP (e.g., Leaf1) needs to send broadcast traffic, it must understand which remote VTEPs participate in the same EVPN instance. This knowledge comes from BGP Route Type 3 advertisements, which signal VTEP membership in specific VNIs.
BUM Traffic Replication Process
- Route Type 3 Advertisement: Each VTEP advertises its VNI membership
- Replication List Building: VTEPs maintain per-VNI remote VTEP lists
- Traffic Replication: Source VTEP creates copies for each remote VTEP
- Encapsulation: Each copy uses VXLAN encapsulation to remote VTEP
Layer 2 EVPN Instance Configuration
! L2VPN EVPN Instance Configuration
l2vpn evpn instance 101 vlan-based
encapsulation vxlan
replication-type ingress
! VLAN Configuration
vlan configuration 101
member evpn-instance 101 vni 10101
! Network Virtualization Edge Interface
interface nve1
no ip address
source-interface Loopbook0
host-reachability protocol bgp
member vni 10101 ingress-replication
Ingress Replication Verification
L1# show l2vpn evpn ethernet-segment 101 detail
Bridge Domain 101:
Identification: 101
State: Up
VXLAN Replication List:
1.1.1.4 (Leaf2)
1.1.1.5 (Leaf3)
BGP Route Type 3 Verification:
L1# show bgp l2vpn evpn route-type imet
Route Type: 3 (Inclusive Multicast Ethernet Tag)
[3]:[0]:[32]:[1.1.1.3]/80 from 0.0.0.0 (1.1.1.3)
Origin IGP, metric 0, localpref 100, weight 32768
Extended Community: RT:65001:101 ENCAP:8
Originator: 1.1.1.3
[3]:[0]:[32]:[1.1.1.4]/80 from 1.1.1.1 (1.1.1.4)
Origin IGP, metric 0, localpref 100, weight 0
Extended Community: RT:65001:101 ENCAP:8
Originator: 1.1.1.4
Layer 2 Overlay Implementation
Layer 2 overlay implementation creates stretched VLANs across the VXLAN fabric, enabling host mobility and broadcast domain extension. This section demonstrates EVI (EVPN Instance) configuration and automatic RD/RT derivation.
EVPN Instance Auto-Derivation
Modern platforms automatically derive Route Distinguisher (RD) and Route Target (RT) values from BGP AS number and EVI number, simplifying operational management:
Auto-Derivation Formula
- Route Distinguisher: BGP_AS:EVI_NUMBER (e.g., 65001:101)
- Route Target: BGP_AS:EVI_NUMBER (e.g., RT:65001:101)
- Manual Override: Can be configured manually if required
Complete Layer 2 Configuration
! VLAN Configuration
vlan 101
name Green_Tenant
! L2VPN EVPN Instance
l2vpn evpn instance 101 vlan-based
encapsulation vxlan
replication-type ingress
! VLAN to VNI Mapping
vlan configuration 101
member evpn-instance 101 vni 10101
! Access Interface Configuration
interface GigabitEthernet0/0/10
description Host_Connection
switchport mode access
switchport access vlan 101
no shutdown
! NVE Interface Configuration
interface nve1
no ip address
source-interface Loopback0
host-reachability protocol bgp
member vni 10101 ingress-replication
no shutdown
BGP Route Type Analysis and Verification
Understanding BGP EVPN route types through practical verification commands provides insight into control plane operation and troubleshooting capabilities.
Route Type 2 Analysis
Route Type 2 carries MAC address and optionally IP address information for host reachability. In Layer 2-only deployments, these routes contain MAC-only information:
L1# show bgp l2vpn evpn route-type mac-ip detail
BGP routing table entry for [2]:[0]:[48]:[aabb.cc01.0101]:[0]:[0.0.0.0]/216
Paths: (1 available, best #1)
Local
0.0.0.0 from 0.0.0.0 (1.1.1.3)
Origin IGP, metric 0, localpref 100, weight 32768, valid, sourced, local, best
Extended Community: RT:65001:101 ENCAP:8
ESI: 00000000000000000000
VNI Label: 10101
Local vxlan vtep: 1.1.1.3, vni: 10101
Key Route Type 2 Fields:
- Route Type: 2 (MAC/IP Advertisement)
- ESI: 00000000000000000000 (No multihoming)
- MAC Length: 48 bits
- MAC Address: aabb.cc01.0101
- IP Length: 0 (MAC-only route)
- VNI Label: 10101 (L2 VNI)
- Extended Community: RT:65001:101
MAC+IP Route Type 2
When ARP learning occurs, Route Type 2 advertisements include both MAC and IP information, enabling IP-to-MAC binding distribution:
[2]:[0]:[48]:[aabb.cc01.0101]:[32]:[10.1.101.10]/272
Extended Community: RT:65001:101 ENCAP:8
VNI Label: 10101
Router MAC: 5254.0001.0101
Key Differences:
- IP Length: 32 bits (Host route)
- IP Address: 10.1.101.10
- Router MAC: Present for L3 routing
- Same VNI Label: 10101 (L2 VNI)
Local vs. Remote Route Identification
BGP Route Attributes for Identification
- Local Routes: Weight 32768, "sourced, local, best"
- Remote Routes: Weight 0, received via route reflector
- Route Reflector: Originator ID indicates actual source VTEP
- Extended Communities: RT values indicate VPN membership
Layer 3 Overlay and Symmetric Routing
Layer 3 overlay implementation enables inter-VLAN routing within the VXLAN fabric using symmetric routing architecture. This approach requires L3 VNI configuration and distributed anycast gateway implementation.
Symmetric Routing Architecture
Symmetric routing performs routing at both ingress and egress VTEPs, requiring L3 VNI for inter-subnet communication and router MAC address advertisement for proper packet forwarding:
Symmetric Routing Requirements
- VRF Configuration: Tenant isolation and routing table separation
- L3 VNI: Inter-subnet routing identifier (distinct from L2 VNIs)
- Distributed Anycast Gateway: Consistent default gateway across VTEPs
- Router MAC Advertisement: Route Type 2 with router MAC for egress routing
VRF and L3 VNI Configuration
! VRF Definition
vrf definition Green
rd 65001:901
route-target export 65001:901
route-target import 65001:901
address-family ipv4
exit-address-family
! L3 VNI VLAN Configuration
vlan 901
name L3VNI_Green
vlan configuration 901
member vni 10901
! L3 VNI SVI Configuration
interface Vlan901
description L3VNI for Green VRF
vrf forwarding Green
ip unnumbered Loopback0
no autostate
no shutdown
Distributed Anycast Gateway Configuration
! L2 VLAN SVIs (Anycast Gateways)
interface Vlan101
description Green_Tenant_VLAN
vrf forwarding Green
ip address 10.1.101.1 255.255.255.0
fabric forwarding mode anycast-gateway
no shutdown
interface Vlan102
description Green_Tenant_VLAN_102
vrf forwarding Green
ip address 10.1.102.1 255.255.255.0
fabric forwarding mode anycast-gateway
no shutdown
! BGP VRF Configuration
router bgp 65001
address-family ipv4 vrf Green
advertise l2vpn evpn
redistribute connected
exit-address-family
NVE Interface L3 VNI Mapping
interface nve1
no ip address
source-interface Loopback0
host-reachability protocol bgp
member vni 10101 ingress-replication
member vni 10102 ingress-replication
member vni 10901 associate-vrf
no shutdown
Key Configuration Points:
- L2 VNIs: 10101, 10102 (ingress-replication)
- L3 VNI: 10901 (associate-vrf)
- No EVI for L3 VNI (VRF association only)
Advanced Show Commands and Troubleshooting
Comprehensive verification commands provide visibility into BGP EVPN operation, enabling effective troubleshooting and operational validation.
Layer 3 Route Type 2 with Dual Labels
With L3 VNI configured, Route Type 2 advertisements include both L2 VNI label and L3 VNI label, enabling symmetric routing operation:
[2]:[0]:[48]:[aabb.cc01.0101]:[32]:[10.1.101.10]/272
Paths: (1 available, best #1)
Local
0.0.0.0 from 0.0.0.0 (1.1.1.3)
Extended Community: RT:65001:101 RT:65001:901 ENCAP:8
ESI: 00000000000000000000
VNI Label 1: 10101 (L2 VNI)
VNI Label 2: 10901 (L3 VNI)
Router MAC: 5254.0001.0101
Key L3 Enhancements:
- Dual Extended Communities (L2 + L3 RT values)
- Two VNI Labels (L2 and L3)
- Router MAC Address (for symmetric routing)
- VRF association information
Comprehensive Verification Commands
! EVPN Instance Status
show l2vpn evpn instance detail
! BGP EVPN Route Table
show bgp l2vpn evpn all
! Route Type Specific Views
show bgp l2vpn evpn route-type imet
show bgp l2vpn evpn route-type mac-ip
! NVE Interface Status
show nve interface nve1
show nve peers
show nve vni
! VRF and L3 VNI Status
show ip route vrf Green
show bgp l2vpn evpn vni-id 10901
! Bridge Domain Information
show bridge-domain
show l2route evpn ethernet-tag topology
Troubleshooting Common Issues
| Issue | Symptom | Verification Command | Common Cause |
|---|---|---|---|
| No Route Type 3 | No BUM replication | show bgp l2vpn evpn route-type imet | EVI not configured |
| No MAC Learning | No Route Type 2 | show bgp l2vpn evpn route-type mac-ip | Host not active/ARP missing |
| Inter-VLAN Routing Fails | L2 works, L3 doesn't | show nve vni | L3 VNI not configured |
| Route Target Mismatch | Routes not imported | show bgp l2vpn evpn detail | RT configuration error |
Complete Configuration Templates
This section provides complete, deployable configuration templates for both Layer 2 and Layer 3 BGP EVPN implementations.
Complete Leaf Switch Configuration
hostname Leaf1
! VRF Definition
vrf definition Green
rd 65001:901
route-target export 65001:901
route-target import 65001:901
address-family ipv4
exit-address-family
! VLANs
vlan 101
name Green_Tenant_101
vlan 102
name Green_Tenant_102
vlan 901
name L3VNI_Green
! L2VPN EVPN Instances
l2vpn evpn instance 101 vlan-based
encapsulation vxlan
replication-type ingress
l2vpn evpn instance 102 vlan-based
encapsulation vxlan
replication-type ingress
! VLAN Configurations
vlan configuration 101
member evpn-instance 101 vni 10101
vlan configuration 102
member evpn-instance 102 vni 10102
vlan configuration 901
member vni 10901
! Loopback Interface
interface Loopback0
ip address 1.1.1.3 255.255.255.255
ip ospf 1 area 0
! Physical Interfaces
interface GigabitEthernet0/0/1
description Uplink to Spine1
ip address 10.1.13.3 255.255.255.252
ip ospf network point-to-point
ip ospf 1 area 0
no shutdown
interface GigabitEthernet0/0/2
description Uplink to Spine2
ip address 10.1.23.3 255.255.255.252
ip ospf network point-to-point
ip ospf 1 area 0
no shutdown
! Access Interfaces
interface GigabitEthernet0/0/10
description Host Connection
switchport mode access
switchport access vlan 101
no shutdown
! SVI Interfaces (Anycast Gateways)
interface Vlan101
vrf forwarding Green
ip address 10.1.101.1 255.255.255.0
fabric forwarding mode anycast-gateway
no shutdown
interface Vlan102
vrf forwarding Green
ip address 10.1.102.1 255.255.255.0
fabric forwarding mode anycast-gateway
no shutdown
! L3 VNI Interface
interface Vlan901
vrf forwarding Green
ip unnumbered Loopback0
no autostate
no shutdown
! NVE Interface
interface nve1
no ip address
source-interface Loopback0
host-reachability protocol bgp
member vni 10101 ingress-replication
member vni 10102 ingress-replication
member vni 10901 associate-vrf
no shutdown
! OSPF Configuration
router ospf 1
router-id 1.1.1.3
! BGP Configuration
router bgp 65001
bgp router-id 1.1.1.3
bgp log-neighbor-changes
no bgp default ipv4-unicast
neighbor 1.1.1.1 remote-as 65001
neighbor 1.1.1.1 update-source Loopback0
neighbor 1.1.1.2 remote-as 65001
neighbor 1.1.1.2 update-source Loopback0
address-family l2vpn evpn
neighbor 1.1.1.1 activate
neighbor 1.1.1.1 send-community extended
neighbor 1.1.1.2 activate
neighbor 1.1.1.2 send-community extended
address-family ipv4 vrf Green
advertise l2vpn evpn
redistribute connected
Course Completion and Next Steps
Congratulations on completing this comprehensive BGP EVPN Basic to Advanced journey! This hands-on configuration guide represents the culmination of theoretical knowledge transformed into practical, deployable network configurations.
Knowledge Foundation Achieved
- Theoretical Mastery: Deep understanding of BGP EVPN concepts and architectures
- Design Expertise: Ability to choose appropriate routing architectures and design options
- Implementation Skills: Hands-on configuration experience with real equipment
- Troubleshooting Capability: Verification commands and issue resolution techniques
Professional Journey Enhancement
This course provides a strong foundation for continued BGP EVPN mastery and professional development. The combination of theoretical depth and practical implementation prepares you for advanced topics and real-world deployment challenges.
Advanced Topics for Continued Learning
- Advanced Multihoming: Complex redundancy scenarios and load balancing optimization
- Inter-AS EVPN: Multi-domain and service provider implementations
- EVPN-VPWS: Point-to-point EVPN services
- Performance Optimization: Scale testing and convergence optimization
- Integration Technologies: EVPN with SD-WAN, MPLS, and cloud connectivity
Lab Practice Recommendations
Continue practicing with the provided configuration templates in your lab environment. Experiment with different scenarios, failure conditions, and vendor platforms to deepen your understanding and build troubleshooting expertise.
The configuration examples and verification techniques presented in this guide represent real-world deployment patterns used in production environments. By combining theoretical understanding with practical implementation experience, network engineers can confidently deploy BGP EVPN solutions that meet modern data center and enterprise networking requirements.
Implementation Success
With the hands-on configuration knowledge gained from this guide, you're now equipped to implement BGP EVPN solutions in production environments. The combination of underlay preparation, overlay configuration, and comprehensive verification provides a solid foundation for successful deployments.
This practical configuration guide completes our comprehensive BGP EVPN series, providing the hands-on implementation skills needed to transform theoretical knowledge into working network solutions.
No comments:
Post a Comment