The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.
This chapter contains the following sections:
Configuring External VRF Connectivity
A VXLAN BGP EVPN fabric can be extended by using per-VRF IP routing to achieve external connectivity. The approach that is used for the Layer-3 extensions is commonly referred to as VRF Lite, while the functionality itself is more accurately defined as Inter-AS Option A or back-to-back VRF connectivity.
The following are the guidelines and limitations for External Layer-3 Connectivity for VXLAN BGP EVPN Fabrics:
A physical Layer-3 Interface (Parent-Interface) can be used for external Layer-3 connectivity (ie VRF default).
The Parent-Interface to multiple Sub-Interfaces can not be used for external Layer-3 connectivity (ie Ethernet1/1 for VRF default). A Sub-Interface can be used instead.
VTEPs do not support VXLAN encapsulated traffic over Parent-Interfaces if Sub-Interfaces are configured. This is regardless of VRF participation.
VTEPs do not support VXLAN encapsulated traffic over Sub-Interfaces. This is regardless of VRF participation or IEEE 802.1q encapsulation.
Mixing Sub-Interfaces for VXLAN and non-VXLAN enabled VLANs is not supported.
Configuring Route Leaking
VXLAN BGP EVPN uses MP-BGP and its route-policy concept to import and export prefixes. The ability of this very extensive route-policy model allows to leak routes from one VRF to another VRF and vice-versa; any combination of custom VRF or VRF default can be used. VRF route-leaking is a switch-local function at specific to a location in the network, the location where the cross-VRF route-target import/export configuration takes place (leaking point). The forwarding between the different VRFs follows the control-plane, the location of where the configuration for the route-leaking is performed - hence Centralized VRF route-leaking. With the addition of VXLAN BGP EVPN, the leaking point requires to advertise the cross-VRF imported/exported route and advertise them towards the remote VTEPs or External Routers.
The advantage of Centralized VRF route-leaking is that only the VTEP acting as leaking point requires the special capabilities needed, while all other VTEPs in the network are neutral to this function.
The following are the guidelines and limitations for External Layer-3 Connectivity for VXLAN BGP EVPN Fabrics:
A physical Layer-3 Interface (Parent-Interface) can be used for external Layer-3 connectivity (ie VRF default).
The Parent-Interface to multiple Sub-Interfaces can not be used for external Layer-3 connectivity (ie Ethernet1/1 for VRF default). A Sub-Interface can be used instead.
VTEPs do not support VXLAN encapsulated traffic over Parent-Interfaces if Sub-Interfaces are configured. This is regardless of VRF participation.
VTEPs do not support VXLAN encapsulated traffic over Sub-Interfaces. This is regardless of VRF participation or IEEE 802.1q encapsulation.
Mixing Sub-Interfaces for VXLAN and non-VXLAN enabled VLANs is not supported.
Some pointers follow:
The Shared Internet with VRF route-leaking for VXLAN BGP EVPN fabrics is depicted in the following figure.
The default-route is made exported from the Shared Internet VRF and re-advertisement within VRF Blue and VRF Red on the Border Node.
Ensure the default-route in VRF Blue and VRF Red is not leaked to the Shared Internet VRF.
The less specific prefixes for VRF Blue and VRF Red are exported for the Shared Internet VRF and re-advertised as necessary.
Configured less specific prefixes (aggregates) that are advertised from the Border Node to the remaining VTEPs to the destination VRF (Blue or Red).
BGP EVPN does not export prefixes that were previously imported to prevent the occurrence of routing loops.
Configuring Centralized VRF Route-leaking - Specific Prefixes between Custom VRF
This procedure applies equally to IPv6.
| Command or Action | Purpose | |
|---|---|---|
|
Step 1 |
configure terminal |
Enter global configuration mode. |
|
Step 2 |
vrf context vrf-name |
Configure the VRF. |
|
Step 3 |
vni number |
Specify the VNI. The VNI associated with the VRF is often referred to as Layer-3 VNI, L3VNI or L3VPN. The L3VNI is configured as common identifier across the participating VTEPs. |
|
Step 4 |
rd auto |
Specify the VRFs Route Distinguisher (RD). The RD uniquely identifies a VTEP within a L3VNI. |
|
Step 5 |
address-family ipv4 unicast |
Configure the IPv4 Unicast address-family. Required for IPv4 over VXLAN with IPv4 underlay. |
|
Step 6 |
route-target both {auto | as:vni} |
Configure the Route Target (RT) for import/export of IPv4 prefixes within the IPv4 unicast address-family The Route Target (RT) is used for a per-VRF prefix import/export policy. If as:vni is entered, the value is in the format of ASN:NN, ASN4:NN, or IPv4:NN. |
|
Step 7 |
route-target both {auto | as:vni }evpn |
Configure the Route Target (RT) for import/export of IPv4 prefixes within the IPv4 unicast address-family The Route Target (RT) is used for a per-VRF prefix import/export policy. If as:vni is entered, the value is in the format of ASN:NN, ASN4:NN, or IPv4:NN. |
|
Step 8 |
route-target import rt-from-different-vrf |
Configure the Route Target (RT) for importing IPv4 prefixes from the leaked-from VRF (ie AS:VNI). |
|
Step 9 |
route-target import rt-from-different-vrf evpn |
Configure the Route Target (RT) for importing IPv4 prefixes from the leaked-from VRF (ie AS:VNI). |
This procedure applies equally to IPv6.
| Command or Action | Purpose | |
|---|---|---|
|
Step 1 |
configure terminal |
Enters global configuration mode. |
|
Step 2 |
router bgp autonomous-system number |
Configure BGP. |
|
Step 3 |
vrf vrf-name |
Specify the VRF. |
|
Step 4 |
address-family ipv4 unicast |
Configure address family for IPv4 |
|
Step 5 |
advertise l2vpn evpn |
Enable the advertisement of EVPN routes within IPv4 address-family. |
|
Step 6 |
aggregate-address prefix/mask |
Create less specific prefix aggregate into the destination VRF. |
|
Step 7 |
maximum-paths ibgp number |
Enabling equal cost multipathing (ECMP) for iBGP prefixes. |
|
Step 8 |
maximum-paths number |
Enabling equal cost multipathing (ECMP) for eBGP prefixes |
The VXLAN BGP EVPN Routing-Block acts as centralized route-leaking point. The leaking configuration is localized such that control-plane leaking and data-path forwarding follow the same path. Most significantly is the VRF configuration of the Routing-Block and the advertisement of the less specific prefixes (aggregates) into the respective destination VRFs.
vrf context Blue
vni 51010
rd auto
address-family ipv4 unicast
route-target both auto
route-target both auto evpn
route-target import 65002:51020
route-target import 65002:51020 evpn
!
vlan 2110
vn-segment 51010
!
interface Vlan2110
no shutdown
mtu 9216
vrf member Blue
no ip redirects
ip forward
!
vrf context Red
vni 51020
rd auto
address-family ipv4 unicast
route-target both auto
route-target both auto evpn
route-target import 65002:51010
route-target import 65002:51010 evpn
!
vlan 2120
vn-segment 51020
!
interface Vlan2120
no shutdown
mtu 9216
vrf member Blue
no ip redirects
ip forward
!
interface nve1
no shutdown
host-reachability protocol bgp
source-interface loopback1
member vni 51010 associate-vrf
member vni 51020 associate-vrf
!
router bgp 65002
vrf Blue
address-family ipv4 unicast
advertise l2vpn evpn
aggregate-address 10.20.0.0/16
maximum-paths ibgp 2
Maximum-paths 2
vrf Red
address-family ipv4 unicast
advertise l2vpn evpn
aggregate-address 10.10.0.0/16
maximum-paths ibgp 2
Maximum-paths 2
Some pointers follow:
The Shared Internet with VRF route-leaking for VXLAN BGP EVPN fabrics is depicted in the following figure.
The default-route is made exported from the Shared Internet VRF and re-advertisement within VRF Blue and VRF Red on the Border Node.
Ensure the default-route in VRF Blue and VRF Red is not leaked to the Shared Internet VRF.
The less specific prefixes for VRF Blue and VRF Red are exported for the Shared Internet VRF and re-advertised as necessary.
Configured less specific prefixes (aggregates) that are advertised from the Border Node to the remaining VTEPs to the destination VRF (Blue or Red).
BGP EVPN does not export prefixes that were previously imported to prevent the occurrence of routing loops.
Configuring Centralized VRF Route-Leaking - Shared Internet with Custom VRF
This procedure applies equally to IPv6.
| Command or Action | Purpose | |
|---|---|---|
|
Step 1 |
configure terminal |
Enter global configuration mode. |
|
Step 2 |
vrf context vrf-name |
Configure the VRF. |
|
Step 3 |
vni number |
Specify the VNI. The VNI associated with the VRF is often referred to as Layer-3 VNI, L3VNI or L3VPN. The L3VNI is configured as common identifier across the participating VTEPs. |
|
Step 4 |
ip route 0.0.0.0/0 next-hop |
Configure default-route in shared internet VRF to external router (example). |
|
Step 5 |
rd auto |
Specify the VRFs Route Distinguisher (RD). The RD uniquely identifies a VTEP within a L3VNI. |
|
Step 6 |
address-family ipv4 unicast |
Configure the IPv4 Unicast address-family. Required for IPv4 over VXLAN with IPv4 underlay. |
|
Step 7 |
route-target both {auto | as:vni} |
Configure the Route Target (RT) for import/export of EVPN and IPv4 prefixes within the IPv4 unicast address-family. |
|
Step 8 |
route-target both shared-vrf-rt evpn |
Configure a special Route Target (RT) for the import/export of the shared IPv4 prefixes. Additional import/export map for further qualification is supported |
This procedure applies equally to IPv6.
| Command or Action | Purpose | |
|---|---|---|
|
Step 1 |
configure terminal |
Enters global configuration mode. |
|
Step 2 |
router bgp autonomous-system number |
Configure BGP. |
|
Step 3 |
vrf vrf-name |
Specify the VRF. |
|
Step 4 |
address-family ipv4 unicast |
Configure address family for IPv4 |
|
Step 5 |
advertise l2vpn evpn |
Enable the advertisement of EVPN routes within IPv4 address-family. |
|
Step 6 |
aggregate-address prefix/mask |
Create less specific prefix aggregate into the destination VRF. |
|
Step 7 |
maximum-paths ibgp number |
Enabling equal cost multipathing (ECMP) for iBGP prefixes. |
|
Step 8 |
maximum-paths number |
Enabling equal cost multipathing (ECMP) for eBGP prefixes. |
This procedure applies equally to IPv6.
| Command or Action | Purpose | |
|---|---|---|
|
Step 1 |
configure terminal |
Enters global configuration mode. |
|
Step 2 |
vrf context vrf-name |
Configure the VRF. |
|
Step 3 |
vni number |
Specify the VNI. The VNI associated with the VRF is often referred to as Layer-3 VNI, L3VNI or L3VPN. The L3VNI is configured as the common identifier across the participating VTEPs. |
|
Step 4 |
rd auto |
Specify the VRFs Route Distinguisher (RD). The Route Distinguisher (RD) uniquely identifies a VTEP within a L3VNI. |
|
Step 5 |
ip route 0.0.0.0/0 Null0 |
Configure default-route in common VRF to attract traffic towards Border Node with Shared Internet VRF. |
|
Step 6 |
address-family ipv4 unicast |
Configure the IPv4 Unicast address-family. Required for IPv4 over VXLAN with IPv4 underlay. |
|
Step 7 |
route-target both {auto | as:vni} |
Configure the Route Target (RT) for import/export of IPv4 prefixes within the IPv4 unicast address-family The Route Target (RT) is used for a per-VRF prefix import/export policy. If as:vni is entered, the value is in the format of ASN:NN, ASN4:NN, or IPv4:NN. |
|
Step 8 |
route-target both {auto | as:vni} evpn |
Configure the Route Target (RT) for import/export of IPv4 prefixes within the IPv4 unicast address-family The Route Target (RT) is used for a per-VRF prefix import/export policy. If as:vni is entered, the value is in the format of ASN:NN, ASN4:NN, or IPv4:NN. |
|
Step 9 |
import map name |
Apply a route-map on routes being imported into this routing table. |
This procedure applies equally to IPv6.
| Command or Action | Purpose | |
|---|---|---|
|
Step 1 |
configure terminal |
Enters global configuration mode. |
|
Step 2 |
router bgp autonomous-system-number |
Configure BGP. |
|
Step 3 |
vrf vrf-name |
Specify the VRF. |
|
Step 4 |
address-family ipv4 unicast |
Configure address family for IPv4. |
|
Step 5 |
advertise l2vpn evpn |
Enable the advertisement of EVPN routes within IPv4 address-family. |
|
Step 6 |
network 0.0.0.0/0 |
Creating IPv4 default-route network statement. |
|
Step 7 |
maximum-paths ibgp number |
Enabling equal cost multipathing (ECMP) for iBGP prefixes. |
|
Step 8 |
maximum-paths number |
Enabling equal cost multipathing (ECMP) for eBGP prefixes. |
An example of Centralized VRF route-leaking with Shared Internet VRF
The VXLAN BGP EVPN Border Node provides a centralized Shared Internet VRF. The leaking configuration is localized such that control-plane leaking and data-path forwarding following the same path. Most significantly is the VRF configuration of the Border Node and the advertisement of the default-route and less specific prefixes (aggregates) into the respective destination VRFs.
vrf context Shared
vni 51099
ip route 0.0.0.0/0 10.9.9.1
rd auto
address-family ipv4 unicast
route-target both auto
route-target both auto evpn
route-target both 99:99
route-target both 99:99 evpn
!
vlan 2199
vn-segment 51099
!
interface Vlan2199
no shutdown
mtu 9216
vrf member Shared
no ip redirects
ip forward
!
ip prefix-list PL_DENY_EXPORT seq 5 permit 0.0.0.0/0
!
route-map RM_DENY_IMPORT deny 10
match ip address prefix-list PL_DENY_EXPORT
route-map RM_DENY_IMPORT permit 20
!
vrf context Blue
vni 51010
ip route 0.0.0.0/0 Null0
rd auto
address-family ipv4 unicast
route-target both auto
route-target both auto evpn
route-target both 99:99
route-target both 99:99 evpn
import map RM_DENY_IMPORT
!
vlan 2110
vn-segment 51010
!
interface Vlan2110
no shutdown
mtu 9216
vrf member Blue
no ip redirects
ip forward
!
vrf context Red
vni 51020
ip route 0.0.0.0/0 Null0
rd auto
address-family ipv4 unicast
route-target both auto
route-target both auto evpn
route-target both 99:99
route-target both 99:99 evpn
import map RM_DENY_IMPORT
!
vlan 2120
vn-segment 51020
!
interface Vlan2120
no shutdown
mtu 9216
vrf member Blue
no ip redirects
ip forward
!
interface nve1
no shutdown
host-reachability protocol bgp
source-interface loopback1
member vni 51099 associate-vrf
member vni 51010 associate-vrf
member vni 51020 associate-vrf
!
router bgp 65002
vrf Shared
address-family ipv4 unicast
advertise l2vpn evpn
aggregate-address 10.10.0.0/16
aggregate-address 10.20.0.0/16
maximum-paths ibgp 2
maximum-paths 2
vrf Blue
address-family ipv4 unicast
advertise l2vpn evpn
network 0.0.0.0/0
maximum-paths ibgp 2
maximum-paths 2
vrf Red
address-family ipv4 unicast
advertise l2vpn evpn
network 0.0.0.0/0
maximum-paths ibgp 2
maximum-paths 2
Some pointers are given below:
The Shared Internet with VRF route-leaking for VXLAN BGP EVPN fabrics is depicted within Figure 4.
The default-route is made exported from VRF default and re-advertisement within VRF Blue and VRF Red on the Border Node.
Ensure the default-route in VRF Blue and VRF Red is not leaked to the Shared Internet VRF
The less specific prefixes for VRF Blue and VRF Red are exported to VRF default and re-advertised as necessary.
Configured less specific prefixes (aggregates) that are advertised from the Border Node to the remaining VTEPs to the destination VRF (Blue or Red).
BGP EVPN does not export prefixes that were previously imported to prevent the occurrence of routing loops.
Configuring Centralized VRF Route-Leaking - Shared Internet with VRF Default
This procedure applies equally to IPv6.
| Command or Action | Purpose | |
|---|---|---|
|
Step 1 |
configure terminal |
Enters global configuration mode. |
|
Step 2 |
ip route 0.0.0.0/0 next-hop |
Configure default-route in VRF default to external router (example) |
This procedure applies equally to IPv6.
| Command or Action | Purpose | |
|---|---|---|
|
Step 1 |
configure terminal |
Enters global configuration mode. |
|
Step 2 |
router bgp autonomous-system number |
Configure BGP. |
|
Step 3 |
address-family ipv4 unicast |
Configure address family for IPv4. |
|
Step 4 |
aggregate-address prefix/mask |
Create less specific prefix aggregate in VRF default. |
|
Step 5 |
maximum-paths number |
Enabling equal cost multipathing (ECMP) for eBGP prefixes. |
This procedure applies equally to IPv6
| Command or Action | Purpose | |
|---|---|---|
|
Step 1 |
configure terminal |
Enters global configuration mode. |
|
Step 2 |
ip prefix-list name seq 5 permit 0.0.0.0/0 |
Configure IPv4 prefix-list for default-route filtering. |
|
Step 3 |
route-map name deny 10 |
Create route-map with leading deny statement to prevent the default-route of being leaked. |
|
Step 4 |
match ip address prefix-list name |
Match against the IPv4 prefix-list that contains the default-route. |
|
Step 5 |
route-map name permit 20 |
Create route-map with trailing allow statement to advertise non-matching routes via route-leaking. |
This procedure applies equally to IPv6.
| Command or Action | Purpose | |
|---|---|---|
|
Step 1 |
configure terminal |
Enters global configuration mode. |
|
Step 2 |
route-map name permit 10 |
Create route-map with allow statement to advertise routes via route-leaking to the customer VRF and subsequently remote VTEPs. |
This procedure applies equally to IPv6.
| Command or Action | Purpose | |
|---|---|---|
|
Step 1 |
configure terminal |
Enters global configuration mode. |
|
Step 2 |
vrf context vrf-name |
Configure the VRF. |
|
Step 3 |
vni number |
Specify the VNI. The VNI associated with the VRF is often referred to as Layer-3 VNI, L3VNI or L3VPN. The L3VNI is configured as common identifier across the participating VTEPs. |
|
Step 4 |
rd auto |
Specify the VRFs Route Distinguisher (RD). The Route Distinguisher (RD) uniquely identifies a VTEP within a L3VNI. |
|
Step 5 |
ip route 0.0.0.0/0 Null0 |
Configure default-route in common VRF to attract traffic towards Border Node with Shared Internet VRF. |
|
Step 6 |
address-family ipv4 unicast |
Configure the IPv4 Unicast address-family. Required for IPv4 over VXLAN with IPv4 underlay. |
|
Step 7 |
route-target both auto | AS:VNI |
Configure the Route Target (RT) for import/export of EVPN and IPv4 prefixes within the IPv4 unicast address-family. |
|
Step 8 |
route-target both auto | AS:VNI evpn |
Configure the Route Target (RT) for import/export of EVPN and IPv4 prefixes within the IPv4 unicast address-family. |
|
Step 9 |
route-target both shared-vrf-rt |
Configure a special Route Target (RT) for the import/export of the Shared IPv4 prefixes. Additional import/export map for further qualification is supported |
|
Step 10 |
route-target both shared-vrf-rt evpn |
Configure a special Route Target (RT) for the import/export of the Shared IPv4 prefixes. Additional import/export map for further qualification is supported |
|
Step 11 |
import vrf default map name |
Permits all routes, from VRF default, from being imported into the custom VRF according to the specific route-map. |
This procedure applies equally to IPv6.
| Command or Action | Purpose | |
|---|---|---|
|
Step 1 |
configure terminal |
Enters global configuration mode. |
|
Step 2 |
router bgp autonomous-system-number |
Configure BGP. |
|
Step 3 |
vrf vrf-name |
Specify the VRF. |
|
Step 4 |
address-family ipv4 unicast |
Configure address family for IPv4. |
|
Step 5 |
advertise l2vpn evpn |
Enable the advertisement of EVPN routes within IPv4 address-family. |
|
Step 6 |
network 0.0.0.0/0 |
Creating IPv4 default-route network statement. |
|
Step 7 |
maximum-paths ibgp number |
Enabling equal cost multipathing (ECMP) for iBGP prefixes. |
|
Step 8 |
maximum-paths number |
Enabling equal cost multipathing (ECMP) for eBGP prefixes. |
An example of Centralized VRF route-leaking with VRF default
The VXLAN BGP EVPN Border Node provides centralized access to VRF default. The leaking configuration is localized such that control-plane leaking and data-path forwarding following the same path. Most significantly is the VRF configuration of the Border Node and the advertisement of the default-route and less specific prefixes (aggregates) into the respective destination VRFs.
ip route 0.0.0.0/0 10.9.9.1
!
ip prefix-list PL_DENY_EXPORT seq 5 permit 0.0.0.0/0
!
route-map permit 10
match ip address prefix-list PL_DENY_EXPORT
route-map RM_DENY_EXPORT permit 20
route-map RM_PERMIT_IMPORT permit 10
!
vrf context Blue
vni 51010
ip route 0.0.0.0/0 Null0
rd auto
address-family ipv4 unicast
route-target both auto
route-target both auto evpn
import vrf default map RM_PERMIT_IMPORT
export vrf default 100 map RM_DENY_EXPORT allow-vpn
!
vlan 2110
vn-segment 51010
!
interface Vlan2110
no shutdown
mtu 9216
vrf member Blue
no ip redirects
ip forward
!
vrf context Red
vni 51020
ip route 0.0.0.0/0 Null0
rd auto
address-family ipv4 unicast
route-target both auto
route-target both auto evpn
import vrf default map RM_PERMIT_IMPORT
export vrf default 100 map RM_DENY_EXPORT allow-vpn
!
vlan 2120
vn-segment 51020
!
interface Vlan2120
no shutdown
mtu 9216
vrf member Blue
no ip redirects
ip forward
!
interface nve1
no shutdown
host-reachability protocol bgp
source-interface loopback1
member vni 51010 associate-vrf
member vni 51020 associate-vrf
!
router bgp 65002
address-family ipv4 unicast
aggregate-address 10.10.0.0/16
aggregate-address 10.20.0.0/16
maximum-paths 2
maximum-paths ibgp 2
vrf Blue
address-family ipv4 unicast
advertise l2vpn evpn
network 0.0.0.0/0
maximum-paths ibgp 2
maximum-paths 2
vrf Red
address-family ipv4 unicast
advertise l2vpn evpn
network 0.0.0.0/0
maximum-paths ibgp 2
maximum-paths 2
Feedback