ETHERNET VPN
Standardization and Status
Jorge Rabadan
jorge.rabadan@alcatel-lucent.com@jorabada
November 2015

COPYRIGHT © 2014 ALCATEL-LUCENT. ALL RIGHTS RESERVED.
ALCATEL-LUCENT — CONFIDENTIAL — SOLELY FOR AUTHORIZED PERSONS HAVING A NEED TO KNOW — PROPRIETARY — USE PURSUANT TO COMPANY INSTRUCTION

AGENDA

1. Introduction
2. Standardization and implementation status
3. Use-cases
4. Conclusions

2COPYRIGHT © 2014 ALCATEL-LUCENT. ALL RIGHTS RESERVED.
ALCATEL-LUCENT — CONFIDENTIAL — SOLELY FOR AUTHORIZED PERSONS HAVING A NEED TO KNOW — PROPRIETARY — USE PURSUANT TO COMPANY INSTRUCTION

EVPN AND THE OPPORTUNITY TO MAKE IT RIGHT• What we learned about VPNs
- IP-VPN (RFC4364) is successfully deployed without
interop issues, easy to provision, supports all-active MH
but only IP traffic- VPLS (RFC4761/4762/6074) has control plane interopissues, provisioning vs efficiency trade-offs, flood-andlearn is not optimum, but works for any Ethernet traffic• Why another VPN technology- Cloud and NFV are shifting the way networks mustbehave- EVPN is an Ethernet VPN technology (provides L2 andL3) that provides the required flexibility, it is futureproof and inherits over a decade of VPN experience• Where can we use EVPN
- Cloud and virtualization services- Integrated Layer-2 and Layer-3 VPN services- Overlay technologies that simplify topologies and protocols

3
COPYRIGHT © 2014 ALCATEL-LUCENT. ALL RIGHTS RESERVED.
ALCATEL-LUCENT — CONFIDENTIAL — SOLELY FOR AUTHORIZED PERSONS HAVING A NEED TO KNOW — PROPRIETARY — USE PURSUANT TO COMPANY INSTRUCTION

WHAT CAN EVPN DO FOR ME?
OPERATIONAL BENEFITS FOR SERVICE PROVIDERS

IntegratedServices• Delivering Layer 2 and Layer 3 with a unified control plane• L3VPN-like operation for scalability and control

NetworkEfficiency• Multi-homing with all-active forwarding and mass withdraw• BUM reduction/suppression

DesignFlexibility• MPLS or IP data plane encapsulation choices• VXLAN encapsulation enables EVPN over a simple IP network

GreaterControl• EVPN changes the paradigm: FDB signaled in control plane vs.
flood-and-learn FDB in data plane• Proxy-ARP/ND proxy allows PEs to respond to ARP/ND requests

4COPYRIGHT © 2014 ALCATEL-LUCENT. ALL RIGHTS RESERVED.
ALCATEL-LUCENT — CONFIDENTIAL — SOLELY FOR AUTHORIZED PERSONS HAVING A NEED TO KNOW — PROPRIETARY — USE PURSUANT TO COMPANY INSTRUCTION

EVPN main concepts in one shot
RFC7432
Single-Active Mode- Multi-homed, One Active PE

Control Plane Learning
PEs Advertise MAC Addresses and Next Hops
From Connected CEs Using MP-BGP
Data/Mgmt Plane Learning
Dynamic or Static (Provisioned)
MAC/IP

Customer Edge(CE)Host, VM, Routeror Switch

EVI 1EVI 1PE6PE5PE1All-Active Mode- Multi-homed, Two or More Active PEs- Only LAG at the CE
PE3

EVI 1CEEVI 1

EVI 1

PE2

EVI 1

MAC/IP
BGP update

PE4

Data Plane Encapsulation
RSVP-TE, LDP, BGP 3107
Segment Routing

LAG

Ethernet Segment and ESI- Collection of Link(s) that Connect the CEto PEs- ESIs are Unique Across the Network)

5
COPYRIGHT © 2014 ALCATEL-LUCENT. ALL RIGHTS RESERVED.
ALCATEL-LUCENT — CONFIDENTIAL — SOLELY FOR AUTHORIZED PERSONS HAVING A NEED TO KNOW — PROPRIETARY — USE PURSUANT TO COMPANY INSTRUCTION

EVPN ABSTRACTS THE CONTROL PLANE
TO SUPPORT CURRENT AND FUTURE DATA PLANE ENCAPSULATIONS
CE2PE2
EVI 1PE1
MAC/IP BGPupdate

EVI 1
CE1
MAC1/IP1RD	  =	  65000:1	  ESI	  =	  0	  Ethernet	  Tag	  ID	  (4B)	  Carries label(EVPN-MPLS) or
VNI (EVPN-VXLAN)

MAC1	  -­‐	  IP1/32	  MPLS	  label	  (3B)	  EncapsulaHon	  (8B)	  EVPN-MPLS• Based on RFC7432• Uses a 20-bit MPLS service label as MAC-VRF demultiplexer• Any MPLS Transport tunnel (RSVP/LDP/BGP/SR)• Takes advantage of all the underlying MPLScapabilities (FRR, TE, etc.)

EVPN-VXLAN• Based on draft-ietf-bess-evpn-overlay• Uses a 24-bit VNI as MAC-VRF de-multiplexer• The VNI is encapsulated as part of the VXLAN header• VXLAN is transported over UDP/IP• Takes full advantage of the VXLAN simplicity andtransparency

RFC5512 BGP Tunnel Encapsulation• VXLAN value = 8• MPLS value = 106
COPYRIGHT © 2014 ALCATEL-LUCENT. ALL RIGHTS RESERVED.
ALCATEL-LUCENT — CONFIDENTIAL — SOLELY FOR AUTHORIZED PERSONS HAVING A NEED TO KNOW — PROPRIETARY — USE PURSUANT TO COMPANY INSTRUCTION

EVPN and PBB for large L2 Service Provider networks
PBB-EVPN (RFC7623)
BMAC Control plane learning
System BMACs are advertised by MP-BGP (shared BMACs)
ES BMACs are advertised by MP-BGP (Dedicated BMACs)
CMAC Data plane learning
CMAC-local AC or CMAC to remote BMAC
mapping is learnt in the data planeAll-active multi-homing supported
FDB ISID-1
CMAC BMACAA
BMAC-34

FDB EVI-1
BMAC
Next-hop type
BMAC-34
PE3
Evpn
PE4
Evpn
BMAC-4PE4
Evpn

ISID-1

AAPE1
EVI-1

I-comp

PE5PE3BMACs
advertised
BGP update

All-active ESI-1
BMAC-34
CMAC AA

B-comp

MPLS/Segment-Routing
transport

PE4BMAC-4

PBB-EVPN combines 802.1ah and EVPN
- PEs have I-components mapped to Bcomponents (EVIs)- Reduces the number of MACs in EVPN byaggregating CMACs with BMACs

Used to scale very large layer-2 EVPN networks- All EVPN Multihoming functions are supported, including
single-active and all-active- Per-ISID flooding trees are supported- The B-component EVI uses PBB over MPLS data plane

7
COPYRIGHT © 2014 ALCATEL-LUCENT. ALL RIGHTS RESERVED.
ALCATEL-LUCENT — CONFIDENTIAL — SOLELY FOR AUTHORIZED PERSONS HAVING A NEED TO KNOW — PROPRIETARY — USE PURSUANT TO COMPANY INSTRUCTION

AGENDA

1. Introduction
2. Standardization and implementation status
3. Use-cases
4. Conclusions

8COPYRIGHT © 2014 ALCATEL-LUCENT. ALL RIGHTS RESERVED.
ALCATEL-LUCENT — CONFIDENTIAL — SOLELY FOR AUTHORIZED PERSONS HAVING A NEED TO KNOW — PROPRIETARY — USE PURSUANT TO COMPANY INSTRUCTION

WHERE IS EVPN DEFINED IN THE STANDARDS?
IETF BESS WORKING GROUP
draft-ietf-bess-dci-evpn-overlay(DCI for EVPN-overlay networks)
draft-ietf-bess-evpn-vpls-seamless-integ(Integration with VPLS and PBB-VPLS)

draft-ietf-bess-evpn-overlay(EVPN for overlay tunnels)
RFC7623(EVPN for PBB)

draft-ietf-bess-evpn-vpws(ELINE services)draft-ietf-bess-evpn-etree(ETREE services)draft-snr-bess-proxy-arp-nd(proxy-arp/nd for BU reduction)
draft-rabadan-bess-evpn-optimized-ir(Optimized Ingress Replication)
draft-sajassi-bess-evpn-virt-eth-seg(Virtual ES)

draft-ietf-bess-evpn-inter-subnet-forwarding(EVPN for inter-subnet between hosts)
draft-ietf-bess-evpn-prefix-advertisement(ipv4/v6 prefix advertisement in EVPN)

PE-CE serviceinterfaces

Unicast andBUM transport
over MPLStunnels

MP-BGP mainroutes(ELANservices)draft-ietf-bess-dci-evpn-overlay(DCI Gateway for EVPN-overlay networks)
draft-ietf-bess-evpn-overlay(DCI inter-as model B for overlay tunnels)

Multi-homing
Single and allactive

9
COPYRIGHT © 2014 ALCATEL-LUCENT. ALL RIGHTS RESERVED.
ALCATEL-LUCENT — CONFIDENTIAL — SOLELY FOR AUTHORIZED PERSONS HAVING A NEED TO KNOW — PROPRIETARY — USE PURSUANT TO COMPANY INSTRUCTION

Mobility
Duplication
Protection

2013

EVPN-VXLAN
implementation for DC

2014
EVPN-VXLAN integratedlayer-2/layer-3

2015
EVPN-MPLS and PBB-EVPN
Including single-active andall-active MH

2016

Feb’15 - First EVPN-VXLAN
interop demo at EANTC(Cisco/Juniper/ALU/Nuage)

EVPN-VPWS, EVPN mLDP, EVPN AR,
EVPN-ETREE, EVPN-MPLS/VXLAN
integration and much more!
10COPYRIGHT © 2014 ALCATEL-LUCENT. ALL RIGHTS RESERVED.
ALCATEL-LUCENT — CONFIDENTIAL — SOLELY FOR AUTHORIZED PERSONS HAVING A NEED TO KNOW — PROPRIETARY — USE PURSUANT TO COMPANY INSTRUCTION

AGENDA

1. Introduction
2. Standardization and implementation status
3. Use-cases
4. Conclusions

11COPYRIGHT © 2014 ALCATEL-LUCENT. ALL RIGHTS RESERVED.
ALCATEL-LUCENT — CONFIDENTIAL — SOLELY FOR AUTHORIZED PERSONS HAVING A NEED TO KNOW — PROPRIETARY — USE PURSUANT TO COMPANY INSTRUCTION

Data Center and DCI use-case
EVPN-MPLS

MAC1/IP1

UDPIPMACVXLAN

DC-GW4

EVI1EVI1

EVI1EVI1.	  

MAC1/IP1

MAC1/IP1

EVI1.	  

EVI1
EVI1

VPN ID+ HASHEVPN control plane

Tunnel between endpoints-VXLAN data plane-IP FabricVXLAN

DC-GW3

EVI1

IP
VLAN
MAC

DC-GW2

IP Fabric

Payload

EVPN-VXLAN

DC-GW1

Brings the MP-BGP virtualization and scalability to the DC
Provides L2/L3, VM mobility, proxy-ARP/ND, ARP/unknown
unicast suppression

Provides the required scalability, performance andsimplicity
De-facto standard with assisted hardware in servers
ECMP and fast resiliency
12COPYRIGHT © 2014 ALCATEL-LUCENT. ALL RIGHTS RESERVED.
ALCATEL-LUCENT — CONFIDENTIAL — SOLELY FOR AUTHORIZED PERSONS HAVING A NEED TO KNOW — PROPRIETARY — USE PURSUANT TO COMPANY INSTRUCTIONINTERNET EXCHANGE POINTS (IXP)PEERING FABRIC
Static MAC/IP provisioning of the routerinterfaces for maximum security-Suppresses unknown and ARP/ND flooding
Drops unknown source MACs

MACs/IPs

EVI
EVI

EVPN required features
MAC/IP

EVI

IP or IP/MPLS
Core Network

EVI

ProxyARP/ND
EVI

Who has IP1?

-L2 interconnection over a VXLAN or MPLS
peering fabric
Proxy-ARP/ND and unknown/ARP/ND
suppression
MAC duplication, MAC protection
Anti-spoofing operation

MAC1 has IP1ARP
SPOOFER

Dynamic ARP/ND learning of proxy-ARP/ND entries for easy provisioning, minimum
flooding and anti-spoofing monitoring-Dynamic learning of ARP/ND entries is possible
Anti-spoofing monitors hosts claiming the same IP- If a duplicate is detected, an alarm is triggered and MAC/IPs put in hold-down mode
- An option to inject an anti-spoof mac is possible too
13
COPYRIGHT © 2014 ALCATEL-LUCENT. ALL RIGHTS RESERVED.
ALCATEL-LUCENT — CONFIDENTIAL — SOLELY FOR AUTHORIZED PERSONS HAVING A NEED TO KNOW — PROPRIETARY — USE PURSUANT TO COMPANY INSTRUCTION

PROVIDER-PROVISIONED VPNSLAYER-2 AND LAYER-3 SERVICES
PE1ESI1

EVPN MAC/IPupdates

PE3

EVI 1
EVI 2
EVI 3

EVI 1
EVI 2
EVI 3

VRF

Required EVPN features-EVI 1
EVI 2
EVI 3PE2-IP-prefix advertisement and inter-subnet forwarding
Multi-homing:- All-active multihoming for link utilization- Single-active multihoming for better
determinism- Virtual ES for access Ethernet and MPLS
networks
PBB-EVPN for large layer-2 VPNsEVPN provides layer-2 and layer-3 services-Both services are provided through the same logical AC to the customer
Layer-2 services include: ELAN, ELINE (EVPN-VPWS) and ETREE (EVPN-ETREE)One VPN technology for all services, no need for multiple protocols

14
COPYRIGHT © 2014 ALCATEL-LUCENT. ALL RIGHTS RESERVED.
ALCATEL-LUCENT — CONFIDENTIAL — SOLELY FOR AUTHORIZED PERSONS HAVING A NEED TO KNOW — PROPRIETARY — USE PURSUANT TO COMPANY INSTRUCTION

ENTERPRISE-PROVISIONED OVERLAY VPNSBGP Control PlanePECEPE
EVI 1SP BServiceProviderASP CCE

EVI 1

PE
EVI 1

CE

VXLAN Data Plane
VPN routing between endpoints can becontrolled with BGP (ipv4) and routing policies
to service providers

EVPN-VXLAN works over any IP service toprovide a flexible Layer-2 and Layer-3 VPN-Just requires IP connectivity between the sites, noneed to run any MPLS or special configuration by theIP service provider
Service Provider is transparent to EVPNEVPN overlay is transparent to service providers

Routing and MAC/IP advertisements within EVPN
controlled via iBGP (evpn) between PEs

15
COPYRIGHT © 2014 ALCATEL-LUCENT. ALL RIGHTS RESERVED.
ALCATEL-LUCENT — CONFIDENTIAL — SOLELY FOR AUTHORIZED PERSONS HAVING A NEED TO KNOW — PROPRIETARY — USE PURSUANT TO COMPANY INSTRUCTION

EVPN is the next-generation VPN control
plane specified in RFC7432, RFC7623 andother I-Ds.
EVPN is data plane agnostic, L2/L3 capableand cloud-optimized, making it the best
technology for DCI

EVPN is already a reality in many Cloud andService Provider networks
16
COPYRIGHT © 2014 ALCATEL-LUCENT. ALL RIGHTS RESERVED.
ALCATEL-LUCENT — CONFIDENTIAL — SOLELY FOR AUTHORIZED PERSONS HAVING A NEED TO KNOW — PROPRIETARY — USE PURSUANT TO COMPANY INSTRUCTION