EVPN-ELAN over ISIS-SR with TI-LFA: Multipoint L2 Service on OcNOS

EVPN E-LAN on OcNOS delivers any-to-any multipoint L2 connectivity over an IS-IS SR-MPLS core, using BGP MAC learning and native ESI multi-homing. It is the modern replacement for VPLS, removing the full mesh of pseudowires while TI-LFA adds sub-50ms protection. See EVPN on OcNOS.

EVPN E-LAN (Ethernet LAN) is the EVPN model for multipoint Layer 2 connectivity that lets multiple customer sites share a common Ethernet broadcast domain over an MPLS/SR backbone. It is the modern replacement for VPLS, delivering the same multipoint service with better scalability, faster convergence, and native multi-homing through the BGP control plane.

EVPN-ELAN vs. VPLS

EVPN-ELAN Topology

Step 1: ISIS-SR Underlay with TI-LFA

The transport is built with IS-IS level-2-only, segment routing over MPLS, and TI-LFA for sub-50ms IGP fast reroute. Each PE advertises a node SID via a prefix-sid index on its loopback. The following is taken from the running configuration of PE1 (loopback 10.10.100.1).

! OcNOS PE1 - loopback with SR node SID
interface loopback1
 ip address 10.10.100.1/32
 prefix-sid index 101
!
! CE-facing / core interface (MPLS + IS-IS enabled)
interface ce0
 description To-P2-ce2
 load-interval 30
 ip address 10.66.12.1/24
 mtu 9216
 label-switching
 isis network point-to-point
 isis circuit-type level-2-only
 ip router isis OCNOS
 no isis hello padding
!
! IS-IS with segment-routing MPLS and TI-LFA
router isis OCNOS
 is-type level-2-only
 metric-style wide
 mpls traffic-eng router-id 10.10.100.1
 mpls traffic-eng level-2
 capability cspf
 dynamic-hostname
 fast-reroute ti-lfa level-2 proto ipv4
 net 49.0001.0000.0000.0001.00
 passive-interface loopback1
 segment-routing mpls
!
commit

TI-LFA (fast-reroute ti-lfa level-2 proto ipv4) is an IGP segment-routing fast-reroute mechanism: it precomputes a loop-free backup path in the IS-IS SR data plane so traffic reroutes locally on link or node failure. This is distinct from EVPN mass withdrawal, which is a BGP-EVPN control-plane mechanism for fast MAC/ESI convergence. The two operate at different layers and should not be conflated.

Step 2: BGP EVPN Control Plane

The overlay uses iBGP in AS 65000 with the L2VPN EVPN address family. In this lab P2 and P3 act as EVPN route reflectors; the PEs peer to them as clients. Route-reflector configuration from P2 (10.10.100.2):

! OcNOS P2 - EVPN route reflector
router bgp 65000
 bgp router-id 10.10.100.2
 no bgp inbound-route-filter
 neighbor EVPN-RRC peer-group
 neighbor EVPN-RRC remote-as 65000
 neighbor EVPN-RRC update-source loopback1
 neighbor 10.10.100.3 peer-group EVPN-RRC
 neighbor 10.10.100.4 peer-group EVPN-RRC
 neighbor 10.10.100.5 peer-group EVPN-RRC
 neighbor 10.10.100.6 peer-group EVPN-RRC
 !
 address-family l2vpn evpn
 neighbor EVPN-RRC activate
 neighbor EVPN-RRC route-reflector-client
 exit-address-family
 !
 exit
!
commit

Route-reflector client configuration from a PE (PE4, 10.10.100.4):

! OcNOS PE4 - EVPN route-reflector client
router bgp 65000
 bgp router-id 10.10.100.4
 neighbor 10.10.100.2 remote-as 65000
 neighbor 10.10.100.2 update-source loopback1
 !
 address-family l2vpn evpn
 neighbor 10.10.100.2 activate
 exit-address-family
 !
 exit
!
commit

Step 3: Enable EVPN-MPLS

EVPN over MPLS is enabled globally, with IRB for integrated routing and bridging, and the local VTEP anchored on the loopback address. From PE4 (10.10.100.4):

! OcNOS PE4 - global EVPN-MPLS enablement
evpn mpls enable
!
evpn mpls irb
!
evpn mpls vtep-ip-global 10.10.100.4
!
commit

Step 4: Single-Homed EVPN-ELAN Service

An E-LAN broadcast domain on OcNOS is built with a mac vrf, an evpn mpls id for the EVI, and an access-if-evpn stanza that maps the CE-facing interface into the VPN with map vpn-id. The commands below use the correct OcNOS EVPN-MPLS L2 syntax.

! OcNOS - single-homed E-LAN service (EVI 200)
!
mac vrf ELAN200
 rd 10.10.100.4:200
 route-target both 65000:200
!
evpn mpls id 200
 host-reachability-protocol evpn-bgp ELAN200
!
! Attach the CE-facing interface to the E-LAN
interface xe15.200 switchport
 encapsulation dot1q 200
 access-if-evpn
  map vpn-id 200
 exit
!
commit

Step 5: Multi-Homed EVPN-ELAN Service (ESI)

For a multi-homed CE, OcNOS configures the Ethernet Segment Identifier at the interface level (on the LAG or access interface) with evpn multi-homed esi and a load-balancing mode (single-active or port-active). There is no separate evpn ethernet-segment node and no all-active keyword in this model; split-horizon and DF election follow from the shared ESI advertised in BGP-EVPN.

! OcNOS - multi-homed E-LAN service with ESI (EVI 200)
!
interface po1.200 switchport
 evpn multi-homed esi 0100.0000.0001.0000.0002 load-balancing port-active
 encapsulation dot1q 200
 access-if-evpn
  map vpn-id 200
 exit
!
commit

Verification

The following commands were run in the lab and confirm the SR underlay and the EVPN control plane. SR reachability and label imposition from PE1:

! OcNOS PE1 - SR underlay verification
show isis topology
show mpls forwarding-table
show mpls ilm-table
ping mpls isis-sr ipv4 10.10.100.6/32 detail
! Result: Success Rate is 100.00 percent (5/5),
! round-trip min/avg/max = 0.69/1.44/2.18 ms

EVPN session state on the route reflector (P2) and on a PE (PE4):

! OcNOS - BGP EVPN session verification
show bgp l2vpn evpn summary
! P2 (RR): 4 neighbors, 4 established sessions
!   10.10.100.3 / .4 / .5 / .6
! PE4:      1 neighbor  (10.10.100.2), 1 established session

• EVPN-ELINE: Point-to-Point L2 Service
• EVPN-ETREE: Rooted Multipoint
• EVPN-L3VPN over ISIS-SR
• OcNOS-SP Product Page
• Contact IP Infusion

IP Infusion Engineering Team