5.5. Configuring an EVPN Service with CLI

This section provides information to configure VPLS using the command line interface.

5.5.1. EVPN-VXLAN Configuration Examples

5.5.1.1. Layer 2 PE Example

This section shows a configuration example for three PEs in a Data Center, given the following assumptions:

  1. PE-1 is a Data Center Network Virtualization Edge device (NVE) where service VPLS 2000 is configured.
  2. PE-2 and PE-3 are redundant Data Center Gateways providing Layer 2 connectivity to the WAN for service VPLS 2000

DC PE-1 configuration for service VPLS 2000

DC PE-2 and PE-3 configuration with SAPs at the WAN side (advertisement of all macs and unknown-mac-route):

 vpls 2000 name "2000" customer 1 create
                vxlan instance 1 vni 2000 create
                exit
                bgp
                    route-distinguisher 65001:2000
                    route-target export target:65000:2000 import target:65000:2000
                exit
                bgp-evpn
                    unknown-mac-route
                    vxlan bgp 1 vxlan-instance 1
                        no shutdown
                    exit
                exit
                site "site-1" create
                    site-id 1
                    sap 1/1/1:1           
                    no shutdown           
                exit                      
                sap 1/1/1:1 create        
                    no shutdown           
                exit                      
                no shutdown               
            exit 

DC PE-2 and PE-3 configuration with BGP-AD spoke-SDPs at the WAN side (mac-advertisement disable, only unknown-mac-route advertised):

service vpls 2000 name "vpls2000" customer 1 create
    vxlan instance 1 vni 2000 create
    bgp 
        pw-template-binding 1 split-horizon-group “to-WAN” import-
rt target:65000:2500
        vsi-export “export-policy-1” #policy exporting the WAN and DC RTs
        vsi-import “import-policy-1” #policy importing the WAN and DC RTs
        route-distinguisher 65001:2000
    bgp-ad
        no shutdown
        vpls-id 65000:2000
    bgp-evpn
        mac-advertisement disable 
        unknown-mac-route
        vxlan bgp 1 vxlan-instance 1
            no shutdown
    site site-1 create
        split-horizon-group “to-WAN”
        no shutdown
        site-id 1

5.5.1.2. EVPN for VXLAN in R-VPLS Services Example

This section shows a configuration example for three 7750 SR, 7450 ESS, or 7950 XRS PEs in a Data Center, based on the following assumptions:

  1. PE-1 is a Data Center Network Virtualization Edge device (NVE) where the following services are configured:
    1. R-VPLS 2001 and R-VPLS 2002 are subnets where Tenant Systems are connected
    2. VPRN 500 is a VPRN instance providing inter-subnet forwarding between the local subnets and from local subnets to the WAN subnets
    3. R-VPLS 501 is an IRB backhaul R-VPLS service that provides EVPN-VXLAN connectivity to the VPRNs in PE-2 and PE-3
*A:PE-1>config>service# info
        vprn 500 name "vprn500" customer 1 create
            ecmp 4
            route-distinguisher 65071:500
            vrf-target target:65000:500
            interface "evi-501" create
              address 10.30.30.1/24
                vpls "evpn-vxlan-501"
                exit
            exit
            interface "subnet-2001" create
                address 10.10.10.1/24
                vpls "r-vpls 2001"
                exit
            exit
            interface "subnet-2002" create
                address 10.20.20.1/24
                vpls "r-vpls 2002"
                exit
            exit
            no shutdown
        exit
        vpls 501 name “evpn-vxlan-501” customer 1 create
            allow-ip-int-bind
            vxlan instance 1 vni 501 create
            exit
            bgp
                route-distinguisher 65071:501
                route-target export target:65000:501 import target:65000:501
          exit 
            bgp-evpn
                ip-route-advertisement incl-host
                vxlan bgp 1 vxlan-instance 1
                    no shutdown
                exit
            exit
            stp
                shutdown
            exit
            no shutdown
        exit
        vpls 2001 name “r-vpls 2001” customer 1 create
            allow-ip-int-bind
            sap 1/1/1:21 create
            exit
            sap 1/1/1:501 create
            exit
            no shutdown
        exit                          
        vpls 2002 name “r-vpls 2002” customer 1 create
            allow-ip-int-bind
            sap 1/1/1:22 create
            exit
            sap 1/1/1:502 create
            exit
            no shutdown
        exit                          

PE-2 and PE-3 are redundant Data Center Gateways providing Layer 3 connectivity to the WAN for subnets “subnet-2001” and “subnet-2002”. The following configuration excerpt shows an example for PE-2. PE-3 would have an equivalent configuration.

*A:PE-2>config>service# info
        vprn 500  name "vprn500" customer 1 create
            ecmp 4
            route-distinguisher 65072:500
            auto-bind-tunnel
              resolution-filter
                gre
                ldp
                rsvp
              exit
              resolution filter
            exit
            vrf-target target:65000:500
            interface "evi-501" create
              address 10.30.30.2/24
                vpls "evpn-vxlan-501"
                exit
            exit
            no shutdown
        exit
        vpls 501 name “evpn-vxlan-501” customer 1 create
            allow-ip-int-bind
            vxlan instance 1 vni 501 create
            exit
            bgp
                route-distinguisher 65072:501
                route-target export target:65000:501 import target:65000:501
            exit                      
            bgp-evpn
                ip-route-advertisement incl-host
                vxlan bgp 1 vxlan-instance 1
                    no shutdown
                exit
            exit
            stp
                shutdown
            exit
            no shutdown
        exit

5.5.1.3. EVPN for VXLAN in EVPN Tunnel R-VPLS Services Example

The example in EVPN for VXLAN in R-VPLS Services Example can be optimized by using EVPN tunnel R-VPLS services instead of regular IRB backhaul R-VPLS services. If EVPN tunnels are used, the corresponding R-VPLS services cannot contain SAPs or SDP-bindings and the VPRN interfaces will not need IP addresses.

The following excerpt shows the configuration in PE-1 for the VPRN 500. The R-VPLS 501, 2001 and 2002 can keep the same configuration as shown in the previous section.

*A:PE-1>config>service# info
        vprn 500 name "vprn500" customer 1 create
            ecmp 4
            route-distinguisher 65071:500
            vrf-target target:65000:500
            interface "evi-501" create
                vpls "evpn-vxlan-501"
                    evpn-tunnel# no need to configure an IP address
                exit
            exit
            interface "subnet-2001" create
                address 10.10.10.1/24
                vpls "r-vpls 2001"
                exit
            exit
            interface "subnet-2002" create
                address 20.20.20.1/24
                vpls "r-vpls 2002"
                exit
            exit
            no shutdown
        exit

The VPRN 500 configuration in PE-2 and PE-3 would be changed in the same way by adding the evpn-tunnel and removing the IP address of the EVPN-tunnel R-VPLS interface. No other changes are required.

*A:PE-2>config>service# info
        vprn 500 name "vprn500" customer 1 create
            ecmp 4
            route-distinguisher 65072:500
            auto-bind-tunnel
              resolution-filter
                gre
                ldp
                rsvp
              exit
              resolution filter
            exit
            vrf-target target:65000:500
            interface "evi-501" create
                vpls "evpn-vxlan-501"
                    evpn-tunnel# no need to configure an IP address
                exit
            exit
            no shutdown
        exit

5.5.1.4. EVPN for VXLAN in R-VPLS Services with IPv6 interfaces and prefixes Example

In the following configuration example, PE1 is connected to CE1 in VPRN 30 through a dual-stack IP interface. VPRN 30 is connected to an EVPN-tunnel R-VPLS interface enabled for IPv6.

In the following excerpt configuration the PE1 will advertise, in BGP EVPN, the 172.16.0.0/24 and 2001:db8:1000::1 prefixes in two separate NLRIs. The NLRI for the IPv4 prefix will use GW IP = 0 and a non-zero GW MAC, whereas the NLRI for the IPv6 prefix will be sent with GW IP = Link-Local Address for interface “int-evi-301” and no GW MAC.

*A:PE1>config>service# info 
        vprn 30 name "vprn30" customer 1 create
            route-distinguisher 192.0.2.1:30
            vrf-target target:64500:30
            interface "int-PE-1-CE-1" create
                enable-ingress-stats
                address 172.16.0.254/24
                ipv6
                    address 2001:db8:1000::1/64 
                exit
                sap 1/1/1:30 create
                exit
            exit
            interface "int-evi-301" create
                ipv6
                exit
                vpls "evi-301"
                    evpn-tunnel
                exit
            exit
            no shutdown
----------------------------------------------

5.5.2. EVPN-MPLS Configuration Examples

5.5.2.1. EVPN All-active Multi-homing Example

This section shows a configuration example for three 7750 SR, 7450 ESS, or 7950 XRS PEs, given the following assumptions:

  1. PE-1 and PE-2 are multi-homed to CE-12 that uses a LAG to get connected to the network. CE-12 is connected to LAG SAPs configured in an all-active multi-homing ethernet-segment.
  2. PE-3 is a remote PE that performs aliasing for traffic destined for the CE-12

The following configuration excerpt applies to a VPLS-1 on PE-1 and PE-2, as well as the corresponding ethernet-segment and LAG commands.

A:PE1# configure lag 1 
A:PE1>config>lag# info 
----------------------------------------------
        mode access
        encap-type dot1q
        port 1/1/2 
        lacp active administrative-key 1 system-id 00:00:00:00:69:72 
        no shutdown
----------------------------------------------
A:PE1>config>lag# /configure service system bgp-evpn 
A:PE1>config>service>system>bgp-evpn# info 
----------------------------------------------
                route-distinguisher 192.0.2.69:0
                ethernet-segment "ESI-71" create
                    esi 0x01000000007100000001
                    es-activation-timer 10
                    service-carving
                        mode auto
                    exit
                    multi-homing all-active
                    lag 1
                    no shutdown
                exit
----------------------------------------------
A:PE1>config>service>system>bgp-evpn# /configure service vpls 1 
A:PE1>config>service>vpls# info 
----------------------------------------------
            bgp
            exit
            bgp-evpn
                cfm-mac-advertisement
                evi 1
                vxlan
                    shutdown
                exit
                mpls bgp 1
                    ingress-replication-bum-label
                    auto-bind-tunnel
                        resolution any
                    exit
                    no shutdown
                exit
            exit
            stp
                shutdown
            exit
            sap lag-1:1 create
              
            exit
            no shutdown
----------------------------------------------
 
A:PE2# configure lag 1 
A:PE2>config>lag# info 
----------------------------------------------
        mode access
        encap-type dot1q
        port 1/1/3 
        lacp active administrative-key 1 system-id 00:00:00:00:69:72 
        no shutdown
----------------------------------------------
A:PE2>config>lag# /configure service system bgp-evpn 
A:PE2>config>service>system>bgp-evpn# info 
----------------------------------------------
                route-distinguisher 192.0.2.72:0
                ethernet-segment "ESI-71" create
                    esi 0x01000000007100000001
                    es-activation-timer 10
                    service-carving
                        mode auto
                    exit
                    multi-homing all-active
                    lag 1
                    no shutdown
                exit
----------------------------------------------
A:PE2>config>service>system>bgp-evpn# /configure service vpls 1 
A:PE2>config>service>vpls# info 
----------------------------------------------
            bgp
            exit
            bgp-evpn
                cfm-mac-advertisement
                evi 1
                vxlan
                    shutdown
                exit
                mpls bgp 1
                    ingress-replication-bum-label
                    auto-bind-tunnel
                        resolution any
                    exit
                    no shutdown
                exit
            exit
            stp
                shutdown
            exit
            sap lag-1:1 create
            exit
            no shutdown
----------------------------------------------

The configuration on the remote PE (PE-3), which supports aliasing to PE-1 and PE-2 is shown below. PE-3 does not have any ethernet-segment configured. It only requires the VPLS-1 configuration and ecmp>1 in order to perform aliasing.

*A:PE3>config>service>vpls# info 
----------------------------------------------
            bgp
            exit
            bgp-evpn
                cfm-mac-advertisement
                evi 1
                mpls bgp 1
                    ingress-replication-bum-label
                    ecmp 4
                    auto-bind-tunnel
                        resolution any
                    exit
                    no shutdown
                exit
            exit
            stp
                shutdown
            exit
            sap 1/1/1:1 create
            exit
            spoke-sdp 4:13 create
                no shutdown
            exit
            no shutdown
----------------------------------------------

5.5.2.2. EVPN Single-active Multi-homing Example

If we wanted to use single-active multi-homing on PE-1 and PE-2 instead of all-active multi-homing, we would only need to modify the following:

  1. change the LAG configuration to single-active
    The CE-12 will be now configured with two different LAGs, hence the key/system-id/system-priority must be different on PE-1 and PE-2
  2. change the ethernet-segment configuration to single-active

No changes are needed at service level on any of the three PEs.

The differences between single-active versus all-active multi-homing are highlighted in bold in the following example excerpts:

A:PE1# configure lag 1 
A:PE1>config>lag# info 
----------------------------------------------
        mode access
        encap-type dot1q
        port 1/1/2 
        lacp active administrative-key 1 system-id 00:00:00:00:69:69 
        no shutdown
----------------------------------------------
A:PE1>config>lag# /configure service system bgp-evpn 
A:PE1>config>service>system>bgp-evpn# info 
----------------------------------------------
                route-distinguisher 192.0.2.69:0
                ethernet-segment "ESI-71" create
                    esi 0x01000000007100000001
                    es-activation-timer 10
                    service-carving
                        mode auto
                    exit
                    multi-homing single-active
                    lag 1
                    no shutdown
                exit
----------------------------------------------
 
A:PE2# configure lag 1 
A:PE2>config>lag# info 
----------------------------------------------
        mode access
        encap-type dot1q
        port 1/1/3 
        lacp active administrative-key 1 system-id 00:00:00:00:72:72 
        no shutdown
----------------------------------------------
A:PE2>config>lag# /configure service system bgp-evpn 
A:PE2>config>service>system>bgp-evpn# info 
----------------------------------------------
                route-distinguisher 192.0.2.72:0
                ethernet-segment "ESI-71" create
                    esi 0x01000000007100000001
                    es-activation-timer 10
                    service-carving
                        mode auto
                    exit
                    multi-homing single-active
                    lag 1
                    no shutdown
                exit
----------------------------------------------

5.5.3. PBB-EVPN Configuration Examples

5.5.3.1. PBB-EVPN All-active Multi-homing Example

As in the EVPN All-active Multi-homing Example, this section also shows a configuration example for three 7750 SR, 7450 ESS, or 7950 XRS PEs, however, PBB-EVPN is used in this excerpt, as follows:

  1. PE-1 and PE-2 are multi-homed to CE-12 that uses a LAG to get connected to I-VPLS 20001. CE-12 is connected to LAG SAPs configured in an all-active multi-homing ethernet-segment.
  2. PE-3 is a remote PE that performs aliasing for traffic destined for the CE-12.
  3. The three PEs are connected through B-VPLS 20000, a Backbone VPLS where EVPN is enabled.

The following excerpt shows the example configuration for I-VPLS 20001 and B-VPLS 20000 on PE-1 and PE-2, as well as the corresponding ethernet-segment and LAG commands:

*A:PE1# configure lag 1 
*A:PE1>config>lag# info 
----------------------------------------------
        mode access
        encap-type dot1q
        port 1/1/2 
        lacp active administrative-key 1 system-id 00:00:00:00:69:72 
        no shutdown
----------------------------------------------
*A:PE1>config>lag# /configure service system bgp-evpn 
*A:PE1>config>service>system>bgp-evpn# info 
----------------------------------------------
                route-distinguisher 192.0.2.69:0
                ethernet-segment "ESI-71" create
                    esi 01:00:00:00:00:71:00:00:00:01
                    source-bmac-lsb 71-71 es-bmac-table-size 8
                    es-activation-timer 5
                    service-carving
                        mode auto
                    exit
                    multi-homing all-active
                    lag 1
                    no shutdown
                exit
----------------------------------------------
*A:PE1>config>service>system>bgp-evpn# /configure service vpls 20001
*A:PE1>config>service>vpls# info 
----------------------------------------------
            pbb
                backbone-vpls 20000
                exit
            exit
            stp
                shutdown
            exit
            sap lag-1:71 create
            exit
            no shutdown
----------------------------------------------
*A:PE1>config>service>vpls# /configure service vpls 20000 
*A:PE1>config>service>vpls# info 
----------------------------------------------
            service-mtu 2000
            pbb
                source-bmac 00:00:00:00:00:69
                use-es-bmac
            exit
            bgp-evpn
                evi 20000
                mpls bgp 1
                    auto-bind-tunnel
                        resolution any
                    exit
                    no shutdown
                exit
            exit
            stp
                shutdown
            exit
            no shutdown
----------------------------------------------
 
*A:PE2# configure lag 1 
*A:PE2>config>lag# info 
----------------------------------------------
        mode access
        encap-type dot1q
        port 1/1/3 
        lacp active administrative-key 1 system-id 00:00:00:00:69:72 
        no shutdown
----------------------------------------------
*A:PE2>config>lag# /configure service system bgp-evpn 
*A:PE2>config>service>system>bgp-evpn# info 
----------------------------------------------
                route-distinguisher 192.0.2.72:0
                ethernet-segment "ESI-71" create
                    esi 01:00:00:00:00:71:00:00:00:01
                    source-bmac-lsb 71-71 es-bmac-table-size 8
                    es-activation-timer 5
                    service-carving
                        mode auto
                    exit
                    multi-homing all-active
                    lag 1
                    no shutdown
                exit
----------------------------------------------
*A:PE2>config>service>system>bgp-evpn# /configure service vpls 20001 
*A:PE2>config>service>vpls# info 
----------------------------------------------
            pbb
                backbone-vpls 20000
                exit
            exit
            stp
                shutdown
            exit
            sap lag-1:71 create
            exit
            no shutdown
----------------------------------------------
*A:PE2>config>service>vpls# /configure service vpls 20000 
*A:PE2>config>service>vpls# info 
----------------------------------------------
            service-mtu 2000
            pbb
                source-bmac 00:00:00:00:00:72
                use-es-bmac
            exit
            bgp-evpn
                evi 20000
                mpls bgp 1
                    auto-bind-tunnel
                        resolution any
                    exit
                    no shutdown
                exit
            exit
            stp
                shutdown
            exit
            no shutdown
----------------------------------------------
*A:PE2>config>service>vpls#

The combination of the pbb source-bmac and the ethernet-segment source-bmac-lsb create the same BMAC for all the packets sourced from both PE-1 and PE-2 for ethernet-segment “ESI-71”.

5.5.3.2. PBB-EVPN Single-Active Multi-Homing Example

In the following configuration example, PE-70 and PE-73 are part of the same single-active multi-homing, ethernet-segment ESI-7413. In this case, the CE is connected to PE-70 and PE-73 through spoke-SDPs 4:74 and 34:74, respectively.

In this example PE-70 and PE-73 use a different source-bmac for packets coming from ESI-7413 and it is not an es-bmac as shown in the PBB-EVPN All-active Multi-homing Example.

*A:PE70# configure service system bgp-evpn 
*A:PE70>config>service>system>bgp-evpn# info 
----------------------------------------------
                route-distinguisher 192.0.2.70:0
                ethernet-segment "ESI-7413" create
                    esi 01:74:13:00:74:13:00:00:74:13
                    es-activation-timer 0
                    service-carving
                        mode auto
                    exit
                    multi-homing single-active
                    sdp 4
                    no shutdown
                exit
----------------------------------------------
*A:PE70>config>service>system>bgp-evpn# /configure service vpls 20001 
*A:PE70>config>service>vpls# info 
----------------------------------------------
            pbb
                backbone-vpls 20000
                exit
            exit
            stp
                shutdown
            exit
            spoke-sdp 4:74 create
                no shutdown
            exit
            no shutdown
----------------------------------------------
*A:PE70>config>service>vpls# /configure service vpls 20000 
*A:PE70>config>service>vpls# info 
----------------------------------------------
            service-mtu 2000
            pbb
                source-bmac 00:00:00:00:00:70
            exit
            bgp-evpn
                evi 20000
                mpls bgp 1
                    ecmp 2
                    auto-bind-tunnel
                        resolution any
                    exit
                    no shutdown
                exit
            exit
            stp
                shutdown
            exit
            no shutdown
----------------------------------------------
*A:PE70>config>service>vpls#
 
 
A:PE73>config>service>system>bgp-evpn# info 
----------------------------------------------
                route-distinguisher 192.0.2.73:0
                ethernet-segment "ESI-7413" create
                    esi 01:74:13:00:74:13:00:00:74:13
                    es-activation-timer 0
                    service-carving
                        mode auto
                    exit
                    multi-homing single-active
                    sdp 34
                    no shutdown
                exit
----------------------------------------------
A:PE73>config>service>system>bgp-evpn# /configure service vpls 20001 
A:PE73>config>service>vpls# info 
----------------------------------------------
            pbb
                backbone-vpls 20000
                exit
            exit
            stp
                shutdown
            exit
            spoke-sdp 34:74 create
                no shutdown
            exit
            no shutdown
----------------------------------------------
A:PE73>config>service>vpls# /configure service vpls 20000 
A:PE73>config>service>vpls# info 
----------------------------------------------
            service-mtu 2000
            pbb
                source-bmac 00:00:00:00:00:73
            exit
            bgp-evpn
                evi 20000
                mpls bgp 1
                    auto-bind-tunnel
                        resolution any
                    exit
                    no shutdown
                exit
            exit
            stp
                shutdown
            exit
            no shutdown
----------------------------------------------
A:PE73>config>service>vpls#