Arista EOS/Networking Tips by Solomon Yang: StepByStep

Showing posts with label StepByStep. Show all posts

5/31/2020

Arista EVPN VXLAN Configuration Example (3c) - Single-homing, L3 EVPN, Symmetric IRB

One of the purposes of symmetric IRB is to address the scale issue of asymmetric IRB solution. And here is the list of differences compared with asymmetric IRB:

VTEPs only need to hold the VLANs and SVIs of directly connected subnets
An intermediate IP-VRF to carry the remote subnets

5/30/2020

Arista EVPN VXLAN Configuration Example (3b) - Single-homing, L3 EVPN, Asymmetric IRB

To solve the sub-optimal routing pattern in the solution of centralized routing, the IRB EVPN Draft proposes 2 solutions, asymmetric IRB and symmetric IRB. Because the local VTEP does both inter-VLAN routing and intra-VLAN switching, it is called IRB (Integrated Routing and Bridging).

The asymmetric IRB is illustrated as below

Explanations:

VTEP on has 1 directly connected VLAN:

VTEP1 - VLAN 641
VTEP2 - VLAN 642

But the VTEPs must have

2 x SVI interface, VLAN 641 and 642
2 x VLANs under MAC VRF
2 x VLAN/VNI bindings under Vxlan interfce

Routing is performed on the ingress VTEP, and egress VTEP only decapsulates the Vxlan header and switches into destination VLANs.
The returning traffic does the same, so routing is done on different VTEPs, hence the term Asymmetric IRB
Advantage:

Optimal traffic path and no traffic trombone

Disadvantage:

VTEPs must have all SVIs and VLANs configured, even not locally connected.
That means ALL VTEPs hold ALL MAC and ARP of hosts for source and destination VLANs.
So the scale is the biggest issue. To make things worse, TOR devices normally don't much high capacity.

From the below output, the VTEP1 has 6 ARP entries, 3 local VLANs and 3 remote VLANs

snp261-eVtep1.23:11:00#sh arp

Address Age (sec) Hardware Addr Interface

160.64.1.101 0:02:54 444c.a8a5.1140 Vlan641, Ethernet78

160.64.1.102 0:01:08 444c.a8a5.1140 Vlan641, Ethernet78

160.64.1.103 0:01:04 444c.a8a5.1140 Vlan641, Ethernet78

160.64.2.201 - 444c.a8a5.1141 Vlan642, Vxlan1

160.64.2.202 - 444c.a8a5.1141 Vlan642, Vxlan1

160.64.2.203 - 444c.a8a5.1141 Vlan642, Vxlan1

Arista EVPN VXLAN Configuration Example (3a) - Single-homing, L3 EVPN, Centralized Routing

In traditional DC design, the most common inter-VLAN routing is centralized routing, and illustrated as below,

Explanation:

A dedicated router - up506/cenRtr is used to route the traffic between vlans;
All gateway SVIs on the cenRtr
Advantages:

Low resource requirement on VTEPs, which only need to know how to reach gateway. So fewer MAC and no ARP
Easy managed.

Disadvantages:

Sub-optimal traffic flow.
Single point failure

Control Plane Check-up:

1. IMET:

On centralized router, under vlan 631, only 2 VTEPs - local and VTEP1

up506-CentRtr#show bgp evpn route-type imet vni 631
Network Next Hop Metric LocPref Weight Path
* > RD: 160.255.255.10:630 imet 631 160.255.255.10
160.255.255.10 - 100 0 i Or-ID: 160.255.255.10 C-LST: 180.255.255.1
* > RD: 160.255.255.20:630 imet 631 160.255.255.100
- - - 0 i

Similarly, under vlan 632, only 2 VTEPs - local and VTEP2

up506-CentRtr#show bgp evpn route-type imet vni 632
Network Next Hop Metric LocPref Weight Path
* > RD: 160.255.255.20:630 imet 632 160.255.255.20
160.255.255.20 - 100 0 i Or-ID: 160.255.255.20 C-LST: 180.255.255.1
* > RD: 160.255.255.20:630 imet 632 160.255.255.100
- - - 0 i

2. MAC-IP:

up506-CentRtr#show bgp evpn route-type mac-ip vni 631
Network Next Hop Metric LocPref Weight Path
* > RD: 160.255.255.10:630 mac-ip 631 444c.a8a5.1140
160.255.255.10 - 100 0 i Or-ID: 160.255.255.10 C-LST: 180.255.255.1

up506-CentRtr#show bgp evpn route-type mac-ip vni 632
Network Next Hop Metric LocPref Weight Path
* > RD: 160.255.255.20:630 mac-ip 632 444c.a8a5.1141
160.255.255.20 - 100 0 i Or-ID: 160.255.255.20 C-LST: 180.255.255.1

Ping check-up:

Host1#ping vrf EvpnHost1 160.63.2.202
PING 160.63.2.202 (160.63.2.202) 72(100) bytes of data.
80 bytes from 160.63.2.202: icmp_seq=1 ttl=63 time=0.157 ms
80 bytes from 160.63.2.202: icmp_seq=2 ttl=63 time=0.112 ms
80 bytes from 160.63.2.202: icmp_seq=3 ttl=63 time=0.144 ms
80 bytes from 160.63.2.202: icmp_seq=4 ttl=63 time=0.106 ms
80 bytes from 160.63.2.202: icmp_seq=5 ttl=63 time=0.133 ms

--- 160.63.2.202 ping statistics ---
5 packets transmitted, 5 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.106/0.130/0.157/0.021 ms, ipg/ewma 0.156/0.143 ms

5/21/2020

Arista EVPN VXLAN Configuration Example (2c) - Single-homing, L2 EVPN, Vlan-aware vs Vlan-based

According to draft-krattiger-evpn-modes-interop-0, the vlan-based should interop with vlan-aware bundled MAC VRF. But I did a quick test on 4.24.0F EOS, it doesn't work obviously

And the problem is that, flood set is not correct.

snp261#sh l2rib input bgp floodset
L2 RIB EVPN Input flood set:
Vlan Address Type Destination
---------- -------------------- ---------- -------------------
601 0000.0000.0000 All VTEP 160.255.255.20
602 0000.0000.0000 All VTEP 160.255.255.20
611 0000.0000.0000 All VTEP 160.255.255.20
612 0000.0000.0000 All VTEP 160.255.255.20
<<<< there is no VTEP flood set for VLAN 621 and 622

Even the "show bgp evpn route-type imet <prefix>" shows correct RT values, the but import doesn't work here.

wa464#sh bgp evpn route-type imet rd 160.255.255.10:621 detail

BGP routing table information for VRF default

Router identifier 160.255.255.20, local AS number 65162

BGP routing table entry for imet 160.255.255.10, Route Distinguisher: 160.255.255.10:621

Paths: 1 available

Local

160.255.255.10 from 160.255.255.1 (180.255.255.1)

Origin IGP, metric -, localpref 100, weight 0, valid, internal, best

Originator: 160.255.255.10, Cluster list: 180.255.255.1

Extended Community: Route-Target-AS:65100:620 TunnelEncap:tunnelTypeVxlan

VNI: 621

PMSI Tunnel: Ingress Replication, MPLS Label: 621, Leaf Information Required: false, Tunnel ID: 160.255.255.10

Arista EVPN VXLAN Configuration Example (2b) - Single-homing, L2 EVPN, Vlan-aware

The VLAN-based MAC VRF has RD/RT values per VLAN/VNI. But most of the time, one tenant customer uses multiple VLANs. In this case, we can use just 1 RD/RT to mark the EVPN routes, which is called VLAN-aware bundle MAC VRF, and is illustrated as below:

Explanations:

Configuration is much like the VLAN-based MAC VRF
Configure VLAN-aware MAC-VRF under router BGP with RD/RT and it can have multiple VLANs
"redistribute learned" is to advertised the learnt MAC under VLAN as type-2 routes to remote EVPN peers.
Under interface Vxlan 1, configure VNI values for above VLANs

Control Plane Check-up:

1. IMET, almost same as VLAN-based, but under 1 RD/RT with 2 VNIs/VTEP

snp261-eVtep1#sh bgp evpn route-type imet rd 160.255.255.20:610 detail
BGP routing table information for VRF default
Router identifier 160.255.255.10, local AS number 65161
BGP routing table entry for imet 611 160.255.255.20, Route Distinguisher: 160.255.255.20:610
Paths: 1 available
Local
160.255.255.20 from 160.255.255.1 (180.255.255.1)
Origin IGP, metric -, localpref 100, weight 0, valid, internal, best
Originator: 160.255.255.20, Cluster list: 180.255.255.1
Extended Community: Route-Target-AS:65100:610 TunnelEncap:tunnelTypeVxlan
VNI: 611
PMSI Tunnel: Ingress Replication, MPLS Label: 611, Leaf Information Required: false, Tunnel ID: 160.255.255.20
BGP routing table entry for imet 612 160.255.255.20, Route Distinguisher: 160.255.255.20:610
Paths: 1 available
Local
160.255.255.20 from 160.255.255.1 (180.255.255.1)
Origin IGP, metric -, localpref 100, weight 0, valid, internal, best
Originator: 160.255.255.20, Cluster list: 180.255.255.1
Extended Community: Route-Target-AS:65100:610 TunnelEncap:tunnelTypeVxlan
VNI: 612
PMSI Tunnel: Ingress Replication, MPLS Label: 612, Leaf Information Required: false, Tunnel ID: 160.255.255.20

2. MAC-IP, under 1 RD/RT, but 2 VNI for 2 VLANs

snp261-eVtep1#sh bgp evpn route-type mac-ip rd 160.255.255.20:610 detail
BGP routing table information for VRF default
Router identifier 160.255.255.10, local AS number 65161
BGP routing table entry for mac-ip 611 444c.a8a5.1141, Route Distinguisher: 160.255.255.20:610
Paths: 1 available
Local
160.255.255.20 from 160.255.255.1 (180.255.255.1)
Origin IGP, metric -, localpref 100, weight 0, valid, internal, best
Originator: 160.255.255.20, Cluster list: 180.255.255.1
Extended Community: Route-Target-AS:65100:610 TunnelEncap:tunnelTypeVxlan
VNI: 611 ESI: 0000:0000:0000:0000:0000
BGP routing table entry for mac-ip 612 444c.a8a5.1141, Route Distinguisher: 160.255.255.20:610
Paths: 1 available
Local
160.255.255.20 from 160.255.255.1 (180.255.255.1)
Origin IGP, metric -, localpref 100, weight 0, valid, internal, best
Originator: 160.255.255.20, Cluster list: 180.255.255.1
Extended Community: Route-Target-AS:65100:610 TunnelEncap:tunnelTypeVxlan
VNI: 612 ESI: 0000:0000:0000:0000:0000

Ping check-up:

Host1#ping vrf EvpnHost1 160.61.1.201
PING 160.61.1.201 (160.61.1.201) 72(100) bytes of data.
80 bytes from 160.61.1.201: icmp_seq=1 ttl=64 time=0.790 ms
80 bytes from 160.61.1.201: icmp_seq=2 ttl=64 time=0.134 ms
80 bytes from 160.61.1.201: icmp_seq=3 ttl=64 time=0.102 ms
80 bytes from 160.61.1.201: icmp_seq=4 ttl=64 time=0.107 ms
80 bytes from 160.61.1.201: icmp_seq=5 ttl=64 time=0.117 ms

--- 160.61.1.201 ping statistics ---
5 packets transmitted, 5 received, 0% packet loss, time 4ms
rtt min/avg/max/mdev = 0.102/0.250/0.790/0.270 ms, ipg/ewma 1.000/0.510 ms

Host2#ping vrf EvpnHost1 160.61.2.201
PING 160.61.2.201 (160.61.2.201) 72(100) bytes of data.
80 bytes from 160.61.2.201: icmp_seq=1 ttl=64 time=0.884 ms
80 bytes from 160.61.2.201: icmp_seq=2 ttl=64 time=0.105 ms
80 bytes from 160.61.2.201: icmp_seq=3 ttl=64 time=0.106 ms
80 bytes from 160.61.2.201: icmp_seq=4 ttl=64 time=0.097 ms
80 bytes from 160.61.2.201: icmp_seq=5 ttl=64 time=0.096 ms

--- 160.61.2.201 ping statistics ---
5 packets transmitted, 5 received, 0% packet loss, time 4ms
rtt min/avg/max/mdev = 0.096/0.257/0.884/0.313 ms, ipg/ewma 1.001/0.559 ms

Arista EVPN VXLAN Configuration Example (2a) - Single-homing, L2 EVPN, Vlan-based

As of May 2020, the latest EOS 4.24.0F supports 2 types of L2 EVPN MAC-VRF:

Vlan-based

1 VRF (1 RD): 1 VLAN
ESI = 0

Vlan-aware Bundled

1 VRF (1 RD): n VLANs
ESI = VNI

Here is the configuration of Vlan-Based L2 EVPN

Explanations:

Configure VLAN aka MAC-VRF under router BGP with RD/RT
"redistribute learned" is to advertised the learnt MAC under VLAN as type-2 routes to remote EVPN peers.
Under interface Vxlan 1, configure VNI values for above VLANs

Control Plane Checkup:

EVPN uses 2 types routes for L2EVPN, 1) type-3 IMET, 2) type-2 MAC-IP

1) IMET

snp261-eVtep1#show bgp evpn route-type imet vni 601 detail
BGP routing table information for VRF default
Router identifier 160.255.255.10, local AS number 65161
BGP routing table entry for imet 160.255.255.10, Route Distinguisher: 160.255.255.10:601
Paths: 1 available
Local
- from - (0.0.0.0)
Origin IGP, metric -, localpref -, weight 0, valid, local, best
Extended Community: Route-Target-AS:65100:601 TunnelEncap:tunnelTypeVxlan
VNI: 601
PMSI Tunnel: Ingress Replication, MPLS Label: 601, Leaf Information Required: false, Tunnel ID: 160.255.255.10
BGP routing table entry for imet 160.255.255.20, Route Distinguisher: 160.255.255.20:601
Paths: 1 available
Local
160.255.255.20 from 160.255.255.1 (180.255.255.1)
Origin IGP, metric -, localpref 100, weight 0, valid, internal, best
Originator: 160.255.255.20, Cluster list: 180.255.255.1
Extended Community: Route-Target-AS:65100:601 TunnelEncap:tunnelTypeVxlan << RT to control import
VNI: 601 << VNI for this VLAN
PMSI Tunnel: Ingress Replication, MPLS Label: 601, Leaf Information Required: false, Tunnel ID: 160.255.255.20 << VTEP ID

2) Flood-set, the above IMET prefix is used to form the flood-set

snp261-eV1.16:27:32#show vxlan flood vtep vlan 601
VXLAN Flood VTEP Table
--------------------------------------------------------------------------------
VLANS Ip Address
----------------------------- ------------------------------------------------
601 160.255.255.20

snp261-eV1.16:23:04#show l2rib output floodset vlan 601
L2 RIB Output flood set:
Source: Local Dynamic, Local Static, BGP, VXLAN Static, VXLAN Dynamic
Vlan Address Type Destination
---------- -------------------- ---------- -------------------
601 0000.0000.0000 All VTEP 160.255.255.20

snp261-eV1.16:27:02#show l2rib input bgp floodset vlan 601
L2 RIB EVPN Input flood set:
Vlan Address Type Destination
---------- -------------------- ---------- -------------------
601 0000.0000.0000 All VTEP 160.255.255.20

3) Type-2 MAC-IP EVPN Route

snp261-eVtep1#show bgp evpn route-type mac-ip vni 601 detail
BGP routing table information for VRF default
Router identifier 160.255.255.10, local AS number 65161
BGP routing table entry for mac-ip 444c.a8a5.1140, Route Distinguisher: 160.255.255.10:601
Paths: 1 available
Local
- from - (0.0.0.0)
Origin IGP, metric -, localpref -, weight 0, valid, local, best
Extended Community: Route-Target-AS:65100:601 TunnelEncap:tunnelTypeVxlan
VNI: 601 ESI: 0000:0000:0000:0000:0000
BGP routing table entry for mac-ip 444c.a8a5.1141, Route Distinguisher: 160.255.255.20:601 << mac address
Paths: 1 available
Local
160.255.255.20 from 160.255.255.1 (180.255.255.1)
Origin IGP, metric -, localpref 100, weight 0, valid, internal, best
Originator: 160.255.255.20, Cluster list: 180.255.255.1
Extended Community: Route-Target-AS:65100:601 TunnelEncap:tunnelTypeVxlan << RT to control import
VNI: 601 ESI: 0000:0000:0000:0000:0000 << VNI

4) MAC table vs EVPN prefixes

snp261-eV1.16:29:56#show mac address-table interface vxlan 1 vlan 601
Mac Address Table
------------------------------------------------------------------

Vlan Mac Address Type Ports Moves Last Move
---- ----------- ---- ----- ----- ---------
601 444c.a8a5.1141 DYNAMIC Vx1 1 4:53:10 ago

5) Clear MAC on remote VTEP to simulate MAC aging out

wa464-eVtep2#clear mac address-table dynamic vlan 601 << clear MAC

snp261-eVtep1#show bgp evpn route-type mac-ip vni 601 detail << NO evpn type-2 prefix
BGP routing table information for VRF default
Router identifier 160.255.255.10, local AS number 65161
BGP routing table entry for mac-ip 444c.a8a5.1140, Route Distinguisher: 160.255.255.10:601
Paths: 1 available
Local
- from - (0.0.0.0)
Origin IGP, metric -, localpref -, weight 0, valid, local, best
Extended Community: Route-Target-AS:65100:601 TunnelEncap:tunnelTypeVxlan
VNI: 601 ESI: 0000:0000:0000:0000:0000

snp261-eVtep1#show mac address-table interface vxlan 1 vlan 601 << no MAC entry
Mac Address Table
------------------------------------------------------------------

Vlan Mac Address Type Ports Moves Last Move
---- ----------- ---- ----- ----- ---------

Data Plane Checkup:

host1 under VTEP1 ping host2 behind VTEP2

Host1#ping vrf EvpnHost1 160.60.1.201
PING 160.60.1.201 (160.60.1.201) 72(100) bytes of data.
80 bytes from 160.60.1.201: icmp_seq=1 ttl=64 time=0.135 ms
80 bytes from 160.60.1.201: icmp_seq=2 ttl=64 time=0.100 ms
80 bytes from 160.60.1.201: icmp_seq=3 ttl=64 time=0.092 ms
80 bytes from 160.60.1.201: icmp_seq=4 ttl=64 time=0.088 ms
80 bytes from 160.60.1.201: icmp_seq=5 ttl=64 time=0.089 ms

--- 160.60.1.201 ping statistics ---
5 packets transmitted, 5 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.088/0.100/0.135/0.021 ms, ipg/ewma 0.128/0.117 ms

VLAN-based: RD/RT vs VNI = 1:1

From the below output, the different VLANs have different RD and RT values, so 1:1 relationship. (In our case, only one host simulates multiple hosts under different VLANs).

snp261-eV1.18:18:45#sh bgp evpn route-type mac-ip vni 601 detail
BGP routing table entry for mac-ip 444c.a8a5.1141, Route Distinguisher: 160.255.255.20:601
Paths: 1 available
Local
160.255.255.20 from 160.255.255.1 (180.255.255.1)
Origin IGP, metric -, localpref 100, weight 0, valid, internal, best
Originator: 160.255.255.20, Cluster list: 180.255.255.1
Extended Community: Route-Target-AS:65100:601 TunnelEncap:tunnelTypeVxlan
VNI: 601 ESI: 0000:0000:0000:0000:0000

snp261-eV1.18:18:49#sh bgp evpn route-type mac-ip vni 602 detail
BGP routing table entry for mac-ip 444c.a8a5.1141, Route Distinguisher: 160.255.255.20:602
Paths: 1 available
Local
160.255.255.20 from 160.255.255.1 (180.255.255.1)
Origin IGP, metric -, localpref 100, weight 0, valid, internal, best
Originator: 160.255.255.20, Cluster list: 180.255.255.1
Extended Community: Route-Target-AS:65100:602 TunnelEncap:tunnelTypeVxlan
VNI: 602 ESI: 0000:0000:0000:0000:0000

5/20/2020

Arista EVPN VXLAN Configuration Example (1c) - eBGP Overlay

After the eBGP Undelay is up, we can move on to the eBGP Overlay.

Topology and configuration:

Explanations:

The BGP AS# of spine and leaf routes are different, so need to use BGP local-as feature to form iBGP peering
The benefit of BGP RR is that, the NH of EVPN updates are unchanged
Also need to disable the RR under address family ipv4 unicast or configure "no bgp default ipv4-unicast" under router bgp, otherwise you will see the following failed neighbor

bn303-eSpine1#show ip bgp summary

BGP summary information for VRF default

Router identifier 180.255.255.1, local AS number 65100

Neighbor Status Codes: m - Under maintenance

Description Neighbor V AS MsgRcvd MsgSent InQ OutQ Up/Down State PfxRcd PfxAcc

....

eOverL-V1 160.255.255.10 4 65100 552 545 0 0 07:40:16 Estab(NotNegotiated)

eOverL-V2 160.255.255.20 4 65100 555 543 0 0 07:40:16 Estab(NotNegotiated)

And in the following blogs of various L2/L3 vxlan evpn setup, we don't need to touch spine routers anymore

From control plane point of view, spine1 only reflects BGP EVPN updates among leaf routers w/o VXLAN interface or VRF, which means it doesn't need to understand or import the content.
From data plane point of view, spine1 only forwards the IPv4/VXLAN packets by the source/destination address are leafs' loopback address.

Verifications:

1) BGP EVPN peering to VTEP1/2 are up

bn303-eSpine1#show bgp evpn summary
BGP summary information for VRF default
Router identifier 180.255.255.1, local AS number 65100
Neighbor Status Codes: m - Under maintenance
Description Neighbor V AS MsgRcvd MsgSent InQ OutQ Up/Down State PfxRcd PfxAcc
eOverL-V1 160.255.255.10 4 65100 581 573 0 0 00:20:21 Estab 2 2
eOverL-V2 160.255.255.20 4 65100 585 571 0 0 00:20:21 Estab 2 2

Arista EVPN VXLAN Configuration Example (1b) - eBGP Underlay

Before start, let's talk a bit regarding the underlay vs overlay. This topic is very well covered in the EVPN Deployment Guide. Here is my easy understanding:

The underlay is:

EBGP between Spine and Leafs over P2P links. Of course, IGP is an option.
To advertise the routing information of the VTEPs' and Spines' loopbacks for

EVPN peering sessions
The source/destination address Vxlan data traffic

You can use different loopback for EVPN and Vxlan

In EVPN Deployment Guide (page 20), lo0 for EVPN peering, lo1 for VxLAN
In this blog, I use the same loopback160 for both

Overlay control plane is BGP EVPN, to

Register the VTEP (type 3), it is like L2vpn autodiscovery.
Carry EVPN prefixes L2 and L3

Topology and Configuration:

Explanation:

EVPN is only supported in BGP multi-agent mode.
Simple EBGP peering over b2b ethernet interfaces
All routers advertise the loopback160 /32 address
Please note, the spine routers/RR have a route-map to control, so that only /32 loopback prefixes within 160.255.255.0/24 are advertised.

The b2b interface addresses are not needed in the data plane, so unnecessary for routing protocol.
And this eBGP setup implies that interface address can be duplicated in different POP/DC. A big plus for automation

Control Plane Verification:
1) show ip bgp sum on VTEP1, and please note only 2 bgp routes

snp261-eVtep1#sh ip bgp sum
BGP summary information for VRF default
Router identifier 160.255.255.10, local AS number 65161
Neighbor Status Codes: m - Under maintenance
Description Neighbor V AS MsgRcvd MsgSent InQ OutQ Up/Down State PfxRcd PfxAcc
eUnder-Sp1 160.1.10.1 4 65100 23840 23848 0 0 13d17h Estab 2 2

2) show ip bgp on VTEP1 to check the bgp prefixes, 1 for spine, 1 from VTEP2

snp261-eVtep1#show ip bgp
Network Next Hop Metric LocPref Weight Path
* > 160.255.255.1/32 160.1.10.1 0 100 0 65100 i
* > 160.255.255.10/32 - - - 0 i
* > 160.255.255.20/32 160.1.10.1 0 100 0 65100 65162 i

3) show bgp prefix of VTEP2's loopback on VTEP1

snp261-eVtep1#sh ip bgp 160.255.255.20
BGP routing table information for VRF default
Router identifier 160.255.255.10, local AS number 65161
BGP routing table entry for 160.255.255.20/32
Paths: 1 available
65100 65162
160.1.10.1 from 160.1.10.1 (180.255.255.1)
Origin IGP, metric 0, localpref 100, weight 0, received 23:22:11 ago, valid, external, best
Rx SAFI: Unicast

4) show ip route on VTEP1 to ensure bgp route in routing table

snp261-eVtep1#show ip route 160.255.255.20/32
B E 160.255.255.20/32 [200/0] via 160.1.10.1, Ethernet13

5) VTEP1 pings VTEP2's lo160 - 160.255.255.20

snp261-eVtep1#ping 160.255.255.20 source lo160
PING 160.255.255.20 (160.255.255.20) from 160.255.255.10 : 72(100) bytes of data.
80 bytes from 160.255.255.20: icmp_seq=1 ttl=63 time=0.248 ms
80 bytes from 160.255.255.20: icmp_seq=2 ttl=63 time=0.128 ms
80 bytes from 160.255.255.20: icmp_seq=3 ttl=63 time=0.087 ms
80 bytes from 160.255.255.20: icmp_seq=4 ttl=63 time=0.082 ms
80 bytes from 160.255.255.20: icmp_seq=5 ttl=63 time=0.091 ms

--- 160.255.255.20 ping statistics ---
5 packets transmitted, 5 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.082/0.127/0.248/0.062 ms, ipg/ewma 0.179/0.184 ms

At this step, we are pretty sure the underlay is ready because the overlay bgp evpn peering is based on VTEPs' loopback interfaces.

Arista EVPN VXLAN Configuration Example (1a) - Overview

I am starting a series of blogs on the Arista EVPN Vxlan configuration and will cover the following topics:

Underlay/Overlay BGP Configuration (No IGP involved)
L2 EVPN vs L3

L2 VLAN-based vs L2 VLAN-aware
Symmetric and asymmetric routing

Single-homing and multi-homing

Multi-homing: MLAG vs EVPN active/active

2 major Arista platforms: Jericho and Trident families
Router reflector and router server
Inter-VPN solution
EVPN inter VRF route leak
Some other advanced features

Dynamic BGP peering

Pre-requisites: 2 things need to be taken care of before EVPN configuration:

BGP multi-agent mode, EVPN is ONLY supported with this mode

service routing protocols model multi-agent
And need to reboot device to make this effective

Hardware setup:

For Trident 2 (7050*X), Tomahawk (7060*X) family devices like , recirculation must be enabled
For Arad (7280E, 7500E)/Jericho (7280R*, 7500R*) series device, select vxlan-routing TCAM profile

List of reference:

Arista BGP EVPN - Configuration Example @ Overlaid

What's the difference between this series of blog and the above official documents?

Configuration and trouble-shooting focused, no theory. The above links did a good job on the theory explanation, so I don't need to waste time and effort here.
Simplest topology and step by step configuration

Starting with 2 single-homing VTEPs + 1 Spine + RR
L2 EVPN (vlan-based, vlan-bundle-aware) and L3 EVPN
2 dual-homing VTEPs by MLAG or EVPN A/A
IPv4/v6 overlay
Adding 1 Spine for ECMP and RS
Only necessary and user-input configuration (no BGP max routes or link speed)

Hardware and scale information and consideration
Convergence/switchover time

2/05/2019

Arista MPLS VPN Step by Step (1e) MPLS L3VPN PE/CE ISIS

Now it is the PE/CE routing option - ISIS. Here is the simplified topology

PE1 Configuration:

router bgp 65001

vrf pe1-isis

rd 100:115

route-target import vpn-ipv4 100:115

route-target import vpn-ipv4 200:115 << import PE2's routes

route-target export vpn-ipv4 100:115 << pe1=100:115, pe2=200:115

maximum-paths 2 ecmp 2

redistribute connected

redistribute isis level-2

router isis isis-pe1 vrf pe1-isis

net 47.0001.0011.0011.0011.00

is-type level-2

redistribute bgp

address-family ipv4 unicast

CE Configuration:

router isis isis-ce1 vrf ce1-isis

   net 47.0001.0001.0001.0001.00

   is-type level-2

!

   address-family ipv4 unicast

Ping check:

CE1(vrf:ce1-isis)#sh ip route
.......
C 100.100.115.0/24 is directly connected, Vlan104
I L2 100.250.115.0/24 [115/20] via 100.100.115.11, Vlan104
C 100.255.115.0/24 is directly connected, Loopback104
I L2 200.200.115.0/24 [115/10] via 100.100.115.11, Vlan104
I L2 200.250.115.0/24 [115/10] via 100.100.115.11, Vlan104
I L2 200.255.115.0/24 [115/10] via 100.100.115.11, Vlan104

CE1(vrf:ce1-isis)#ping 200.250.115.22 << ping pe2's loopback
....
--- 200.250.115.22 ping statistics ---
5 packets transmitted, 5 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.117/0.181/0.335/0.083 ms, ipg/ewma 0.243/0.253 ms

CE1(vrf:ce1-isis)#ping 200.255.115.2 << ping ce2's loopback
.....
--- 200.255.115.2 ping statistics ---
5 packets transmitted, 5 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.120/0.156/0.291/0.069 ms, ipg/ewma 0.214/0.221 ms

CE1(vrf:ce1-isis)#ping 200.200.115.2 << ping pe2-ce2's ip @ ce2
....
--- 200.200.115.2 ping statistics ---
5 packets transmitted, 5 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.120/0.153/0.274/0.061 ms, ipg/ewma 0.210/0.211 ms

CE1(vrf:ce1-isis)#ping 200.200.115.22 << ping pe2-ce2's ip @ pe2
.....
--- 200.200.115.22 ping statistics ---
5 packets transmitted, 5 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.115/0.151/0.253/0.053 ms, ipg/ewma 0.208/0.199 ms

Arista MPLS VPN Step by Step (1d) MPLS L3VPN PE/CE OSPF

In this post I will discuss the PE/CE routing option - OSPF. Here is the simplified topology

PE Configuration:

router bgp 65001
....
vrf pe1-ospf
rd 100:110
route-target import vpn-ipv4 100:110
route-target import vpn-ipv4 200:110
route-target export vpn-ipv4 100:110
maximum-paths 2 ecmp 2
redistribute connected
redistribute ospf
!
router ospf 100 vrf pe1-ospf
router-id 88.255.11.11
passive-interface Loopback103
redistribute bgp
network 100.100.110.11/32 area 0.0.0.0
network 100.250.110.11/32 area 0.0.0.0
max-lsa 12000

CE Configuration:

router ospf 100 vrf ce1-ospf
router-id 100.250.100.100
passive-interface Loopback103
network 100.100.110.1/32 area 0.0.0.0
network 100.255.110.1/32 area 0.0.0.0
max-lsa 12000

Arista MPLS VPN Step by Step (1c) MPLS L3VPN PE/CE eBGP

Following the previous blog, in this post I will discuss the PE/CE routing option - eBGP. Here is the simplified topology

PE Configuration

router bgp 65001

router-id 88.255.22.22

neighbor vpnv4-rr peer-group

neighbor vpnv4-rr remote-as 65001

neighbor vpnv4-rr update-source Loopback88

neighbor vpnv4-rr send-community standard extended

neighbor vpnv4-rr maximum-routes 12000

neighbor 88.255.1.1 peer-group vpnv4-rr

neighbor 88.255.2.2 peer-group vpnv4-rr

address-family vpn-ipv4

neighbor vpnv4-rr activate

neighbor default encapsulation mpls next-hop-self source-interface Loopback88

vrf pe2-ebgp

rd 200:20

route-target import vpn-ipv4 100:20

route-target import vpn-ipv4 200:20

route-target export vpn-ipv4 200:20

maximum-paths 2 ecmp 2

neighbor 200.200.20.2 remote-as 65500

neighbor 200.200.20.2 maximum-routes 12000

redistribute connected

CE configuration is as below. In my lab, I use vrf on CE router to segregate and simulate different CEs.

router bgp 65500

router-id 100.255.100.100

vrf ce1-ebgp

rd 100:20

neighbor 100.100.20.11 remote-as 65001

! need alllowas-in to permit remote prefix with same AS#

neighbor 100.100.20.11 allowas-in 3

neighbor 100.100.20.11 maximum-routes 12000

redistribute connected

2/04/2019

Arista MPLS VPN Step by Step (1b) MPLS L3VPN PE/CE Static

In this blog, I will discuss the PE/CE routing option - static. Here is the simplified topology

The configuration is quite simple.

router bgp 65001
router-id 88.255.11.11
neighbor vpnv4-rr peer-group
neighbor vpnv4-rr remote-as 65001
neighbor vpnv4-rr update-source Loopback88
neighbor vpnv4-rr send-community standard extended
neighbor vpnv4-rr maximum-routes 12000
neighbor 88.255.1.1 peer-group vpnv4-rr
neighbor 88.255.2.2 peer-group vpnv4-rr
!
address-family vpn-ipv4
neighbor vpnv4-rr activate
neighbor default encapsulation mpls next-hop-self source-interface Loopback88
!
....
vrf pe1-static
!! pe/ce: static, intf:vlan101+lo101, addr:100.1.11.0/24+100.1.100.0/32
rd 100:1
!
! PE1 ex/import 100:1, and import PE2's 200:1
!
route-target import vpn-ipv4 100:1
route-target import vpn-ipv4 200:1
route-target export vpn-ipv4 100:1
maximum-paths 2 ecmp 2
redistribute connected
redistribute static

So on PE1, we can 6 vpn-ipv4 routes (doubled by 2 RRs)

PE1(config)#sh bgp vpn-ipv4 rd 200:1

BGP routing table information for VRF default

Router identifier 88.255.11.11, local AS number 65001

Route status codes: s - suppressed, * - valid, > - active, # - not installed, E - ECMP head, e - ECMP

S - Stale, c - Contributing to ECMP, b - backup

% - Pending BGP convergence

Origin codes: i - IGP, e - EGP, ? - incomplete

AS Path Attributes: Or-ID - Originator ID, C-LST - Cluster List, LL Nexthop - Link Local Nexthop

Network Next Hop Metric LocPref Weight Path

* > RD: 200:1 IPv4 prefix 200.200.1.0/24

88.255.22.22 - 100 0 i Or-ID: 88.255.22.22 C-LST: 88.255.1.1

* RD: 200:1 IPv4 prefix 200.200.1.0/24

88.255.22.22 - 100 0 i Or-ID: 88.255.22.22 C-LST: 88.255.2.2

* > RD: 200:1 IPv4 prefix 200.250.1.0/24

88.255.22.22 - 100 0 i Or-ID: 88.255.22.22 C-LST: 88.255.1.1

* RD: 200:1 IPv4 prefix 200.250.1.0/24

88.255.22.22 - 100 0 i Or-ID: 88.255.22.22 C-LST: 88.255.2.2

* > RD: 200:1 IPv4 prefix 200.255.1.0/24

88.255.22.22 - 100 0 ? Or-ID: 88.255.22.22 C-LST: 88.255.1.1

* RD: 200:1 IPv4 prefix 200.255.1.0/24

88.255.22.22 - 100 0 ? Or-ID: 88.255.22.22 C-LST: 88.255.2.2

Arista MPLS VPN Step by Step (1a) MPLS LDP L3VPN Configuration

Above is the topology, in which we have:

2 PE + 4 P routers, all full mesh connections (we will leverage this setup for later configurations)
IGP: OSPF process 71
iBGP: AS 65001, peering with loopback 71 (71.#.#.#/32, # is the router-id)
MPLS LDP is enabled on all interfaces

P router configuration:

mpls ip
!
mpls ldp
router-id 88.255.1.1
transport-address interface Loopback88
fec filter prefix-list fec-pfx-list
no shutdown
!
router bgp 65001
router-id 88.255.1.1
maximum-paths 4 ecmp 4
neighbor pe peer-group
neighbor pe remote-as 65001
neighbor pe update-source Loopback88
neighbor pe route-reflector-client
neighbor pe send-community standard extended
neighbor pe maximum-routes 12000
!
! RR configuration, peering to PE1/PE2
!
neighbor 88.255.11.11 peer-group pe
neighbor 88.255.22.22 peer-group pe
!
address-family vpn-ipv4
! active vpn-ipv4 AF
neighbor pe activate
!
router ospf 88
router-id 88.255.1.1
passive-interface Loopback88
network 88.0.0.0/8 area 0.0.0.0
max-lsa 12000

PE router configuration:

mpls ip
!
mpls ldp
router bgp 65001
router-id 88.255.11.11
neighbor vpnv4-rr peer-group
neighbor vpnv4-rr remote-as 65001
neighbor vpnv4-rr update-source Loopback88
neighbor vpnv4-rr send-community standard extended
neighbor vpnv4-rr maximum-routes 12000
neighbor 88.255.1.1 peer-group vpnv4-rr
neighbor 88.255.2.2 peer-group vpnv4-rr
!
address-family vpn-ipv4
neighbor vpnv4-rr activate
neighbor default encapsulation mpls next-hop-self source-interface Loopback88

For the full router configuration, please go to the directory.