What is EVPN?

Ethernet VPN (EVPN) is a BGP-based control-plane technology, defined in RFC 7432, that extends Layer 2 Ethernet connectivity across a Layer 3 IP or MPLS network. It distributes MAC and IP reachability information between edge devices using multiprotocol BGP, and it natively supports multihoming so a site can connect to more than one edge device at once.

Key takeaways

• EVPN uses MP-BGP to distribute MAC and IP reachability between edge devices.
• Five standardized route types cover autodiscovery, MAC/IP, BUM, and multihoming.
• EVPN commonly pairs with VXLAN encapsulation to carry Ethernet over IP.
• Multihoming lets a site connect active-active to two or more edge devices.
• Versa VOS runs EVPN VXLAN across both its SD-WAN and ZT-LAN fabrics.

On this page: Why it matters · How it works · Types · EVPN & Versa · FAQ

Why is EVPN important?

Extending Layer 2 connectivity across a routed network used to mean flooding traffic and relying on data-plane MAC learning – a model that scales poorly and converges slowly when a link or device fails. EVPN replaces that with a BGP control plane: MAC and IP reachability propagate as BGP routes, the same way IP prefixes do, so an edge device learns a remote site’s addresses before traffic ever needs to reach it.

That control-plane model is what makes EVPN the standard for modern Layer 2 extension. It supports multihoming natively, so a host or a bridge domain can connect to two or more edge devices in active-active or single-active mode without loops or duplicate traffic – something older Layer 2 VPN technologies handled poorly, if at all. Because EVPN is an open, BGP-based standard (RFC 7432), it interoperates across vendors, which is why data-center interconnects, service-provider Layer 2 VPNs, and SD-WAN fabrics – including Versa’s – all converge on it as the way to carry Ethernet traffic over an IP or MPLS core.

What is EVPN?

EVPN separates the job of learning where a MAC or IP address lives from the job of forwarding traffic to it. In the control plane, multiprotocol BGP – using the Layer 2 VPN address family and the EVPN subsequent address family – carries reachability information between edge devices as standard BGP routes: which MAC addresses sit behind which device, and increasingly, which IP addresses too.

Five route types carry that information. Type 1 (Ethernet auto-discovery) and Type 4 (Ethernet segment) routes handle multihoming and designated-forwarder election. Type 2 (MAC/IP advertisement) routes carry the actual MAC and IP bindings. Type 3 (inclusive multicast Ethernet tag) routes set up ingress-replication paths for broadcast, unknown-unicast, and multicast (BUM) traffic. Type 5 (IP prefix) routes advertise IP reachability independently of any MAC binding.

In the data plane, an edge device imports the routes it needs into a MAC-VRF – a per-tenant forwarding table – using route distinguishers and route targets, then forwards Ethernet frames toward the correct remote device using whatever tunnel encapsulation the deployment uses, commonly VXLAN.

Types of EVPN

EVPN is defined by a handful of variants that combine independently. Service type determines how VLANs map to EVPN instances: a VLAN-based service maps one VLAN to one EVPN instance with its own MAC table, while a VLAN-aware bundle service maps multiple VLANs to a single instance, each keeping a separate bridge table under one route target and route distinguisher.

Encapsulation determines how frames actually cross the underlay. RFC 7432 originally defined EVPN over an MPLS core, using MPLS labels to identify the destination bridge table. EVPN VXLAN (RFC 8365) instead encapsulates Ethernet frames in VXLAN over UDP, which is the more common choice in IP-only and multitenant or cloud environments, including Versa’s implementation.

Multihoming mode determines how a site with links to more than one edge device behaves: single-active forwards traffic through one designated device at a time while the others stand by, and active-active forwards through all attached devices simultaneously, with EVPN’s Type 4 routes electing the designated forwarder for BUM traffic on each device.

EVPN & Versa

Versa Operating System (VOS) devices run EVPN VXLAN as the control plane for both the SD-WAN overlay between branches and hubs and the ZT-LAN fabric between leaf and spine switches on-site. In both cases, a virtual switch acts as the MAC-VRF: it carries a route distinguisher and route target, maps VLANs to VXLAN network identifiers (VNIs) through its bridge domains, and peers over MP-BGP with remote VXLAN tunnel endpoints (VTEPs) to exchange the standard EVPN route types.

Administrators choose between the VLAN and VLAN-aware bundle EVPN service types per virtual switch, and can enable ARP suppression so locally learned IP-to-MAC bindings are advertised to peers instead of flooded as ARP requests. Layer 2 forwarding on VOS ties EVPN into the rest of the bridging stack: IRB interfaces route between a bridge domain and the rest of the network, and VOS distributes IRB and VRRP MAC addresses through BGP, including a centralized-IRB mode where one device handles routing for the whole segment. BUM traffic uses ingress replication, with a limit of 64 EVPN neighbors per replication list.

Frequently asked questions

What is the difference between EVPN and VPLS?

VPLS floods and learns MAC addresses in the data plane like a traditional switch, while EVPN distributes MAC and IP reachability through BGP in the control plane. That makes EVPN converge faster after a failure and support active-active multihoming natively, without the flooding VPLS relies on to learn addresses.

What is the difference between EVPN and EVPN VXLAN?

EVPN is the BGP control plane defined in RFC 7432; it does not mandate an encapsulation. EVPN VXLAN (RFC 8365) pairs that control plane with VXLAN as the data-plane encapsulation, carrying Ethernet frames over UDP/IP instead of MPLS labels – the combination most cloud and SD-WAN deployments use today.

What is an EVPN route type?

EVPN uses five standardized BGP route types to carry different information: autodiscovery (Type 1), MAC/IP bindings (Type 2), multicast and BUM paths (Type 3), Ethernet segment routes for multihoming (Type 4), and IP prefixes (Type 5). Each edge device advertises and imports only the types it needs.

What is EVPN multihoming?

Multihoming lets a host or switch connect to two or more EVPN edge devices at once for redundancy. EVPN elects a designated forwarder among the attached devices using Type 4 Ethernet segment routes, and supports both single-active mode, where one device forwards at a time, and active-active mode, where all attached devices forward simultaneously.

How does EVPN handle broadcast and multicast traffic?

EVPN uses ingress replication for broadcast, unknown-unicast, and multicast (BUM) traffic: the ingress device copies a BUM frame and sends it directly to each remote edge device in the EVPN instance, instead of relying on multicast in the underlay. Type 3 routes advertise the replication list, which on VOS devices supports up to 64 neighbors.

More on EVPN

If you want to learn more, these are sources we trust.

Related terms

If you’re reading about EVPN, these are worth looking at next.