Theoretical foundations and architecture
EVPN (Ethernet VPN, RFC 7432) is a modern L2 and L3 VPN technology that addresses the weak points of VPLS. In VPLS MAC addresses are learned by flood-and-learn in the data plane, which causes excess BUM traffic and slow convergence when a host moves. In EVPN, MAC addresses learned locally on a PE port are advertised over MP-BGP in a Route Type 2 route (MAC/IP Advertisement), and remote PEs install them from the control plane. The key feature is MAC Mobility: when a virtual machine moves (for example with vMotion) to another PE, the new PE learns the MAC locally and advertises a Route Type 2 with the MAC Mobility extended community and an incremented sequence number. All other PEs, including the previous one, prefer the route with the higher number, and the previous PE withdraws its own. The switchover time depends on detection speed and BGP processing; brief loss during the move is possible.
Why EVPN if VPLS exists
In VPLS, MAC addresses are learned in the data plane (flood-and-learn): unknown unicast and BUM are flooded into all PWs, and the MAC tables on the PEs are not exchanged with each other. EVPN (RFC 7432, EVPN-MPLS) moves MAC learning into the control plane: a PE that sees a MAC on its AC advertises it via BGP (address family AFI 25, SAFI 70, l2vpn evpn), and the other PEs install the route and send unicast exactly to its destination without flooding. In addition, EVPN provides active-active multihoming, fast convergence on failure (mass withdraw), ARP suppression, BUM limiting and a single mechanism for L2 and L3 (RFC 9136 IP Prefix).
Model elements
EVI (EVPN Instance) is a service instance on the PE, the analog of a VFI, containing one or more MAC-VRFs (bridge domains). For each EVI an RD (Route Distinguisher, makes routes unique) and an RT (Route Target, defines which PEs import the routes) are configured. A typical scheme: the RD is unique per PE and EVI (for example 10.255.0.1:100 on PE1 and 10.255.0.2:100 on PE2), the RT is one per EVI (65000:100) - this way all PEs of one EVI import the common routes. If the same RD is configured on different PEs, routes for the same MAC from different PEs will be discarded as duplicates. The Ethernet Tag ID identifies a VLAN inside the EVI (it equals 0 for a VLAN-based service). The ESI (Ethernet Segment Identifier, 10 bytes) identifies the segment that connects a CE to one or more PEs; ESI = 0 means single-homed.
Service interface: VLAN-based (one EVI per VLAN, Ethernet Tag 0), VLAN-bundle (several VLANs in one MAC-VRF) and VLAN-aware bundle (several bridge domains in one EVI with an Ethernet Tag ID).
Route types
Type 1, Ethernet Auto-Discovery (A-D): per-ES (ESI + Ethernet Tag 0xFFFFFFFF) is used for mass withdraw: when the link to the CE fails, the PE withdraws a single route, and all remote PEs flush all MACs of this segment at once, without waiting for the withdrawal of each Type 2. Per-EVI A-D (with a label) is needed for aliasing: a remote PE load-balances traffic to a MAC across all PEs attached to the segment, even if the MAC was advertised by only one.
Type 2, MAC/IP Advertisement: RD, ESI, Ethernet Tag ID, MAC length (48), MAC, IP length (0, 32 or 128) and IP, Label1 (the MPLS label for L2, this particular label is needed at the bottom of the stack), optionally Label2. It contains the MAC Mobility extended community when moves occur.
Type 3, Inclusive Multicast Ethernet Tag: each PE advertises its own address and the PMSI Tunnel attribute for the EVI (tunnel type 6 - ingress replication, plus the label by which the receiver accepts BUM). From these routes the PE builds the flooding list: ingress replication - sending a copy of BUM to each remote PE using its label (P2MP LSPs are also possible).
Type 4, Ethernet Segment: advertises the PE's participation in the ES; it is needed for Designated Forwarder (DF) election. By default the DF is determined by the modulo algorithm: the PEs are sorted by IP, and the DF for a VLAN is the PE with index (Ethernet Tag mod N). The DF sends BUM into the segment, and the other PEs (non-DF) block BUM toward the CE. The timer for waiting for advertisements is 3 seconds (RFC 7432). The Route Target for Type 4 is the ES-Import RT (6 bytes from the ESI), so only PEs of the same segment import such routes.
Type 5 (RFC 9136) carries IP prefixes between EVIs and is used in L2/L3 integration and in routing via IRB.
MAC mobility
When a host (for example a virtual machine) moves from PE1 to PE2, PE2 sees the MAC on its AC (GARP/RARP) and advertises a Type 2 with the MAC Mobility extended community, whose sequence number equals the previous value plus one (the first appearance goes without the community, that is, sequence 0). All PEs select the route with the highest sequence number; on a tie, the lower PE IP address wins. PE1, having received a newer route for a MAC that it considered local, withdraws its advertisement and clears the local entry. Result: traffic to the MAC switches in one BGP iteration without waiting for aging. Sticky/static MACs are marked with a flag in the community and do not move (the sequence does not grow).
Protection from loops and "flapping" MACs: RFC 7432 recommends duplicate MAC detection: after M moves within N seconds (default M=5, N=180) the MAC is declared a duplicate, the PE stops advertising it and signals this to the operator, and return to normal is automatically possible after several minutes. Without this, a loop on the CE would lead to endless growth of the sequence number.
