EVPN-ETREE over ISIS-SR with TI-LFA: Rooted Multipoint L2 Service on OcNOS

EVPN E-Tree (Ethernet Tree) is a specialized multipoint Layer 2 service that enforces a root-and-leaf traffic hierarchy. While E-LAN allows any-to-any communication between all sites, E-Tree restricts leaf-to-leaf communication so that traffic can only flow between root and leaf sites, never directly between two leaf sites. This makes E-Tree ideal for wholesale broadband aggregation, mobile backhaul, and managed service deployments where customer isolation is required.

E-Tree Traffic Model

EVPN-ETREE Use Cases

• Wholesale broadband aggregation: an ISP connects subscriber sites (leaves) to a central gateway (root) while ensuring subscribers cannot communicate directly with each other
• Mobile backhaul: cell sites (leaves) connect to a central packet core (root) with strict isolation between base stations
• Managed enterprise services: branch offices (leaves) connect to headquarters (root) in a hub-and-spoke topology

EVPN-ETREE Configuration on OcNOS

The lab builds an ISIS-SR underlay with TI-LFA fast reroute, an MP-BGP L2VPN EVPN overlay reflected through a route reflector, and an EVPN-MPLS E-Tree service. In this topology P3 is the hub (root) that connects the root CE, and PE4 / PE5 are spokes (leaves). The hub uses a plain evpn mpls id instance while every spoke adds the etree-leaf keyword, which is what enforces the leaf isolation.

Step 1: ISIS-SR underlay with TI-LFA (PE1)

! OcNOS - ISIS-SR underlay with TI-LFA (sample from PE1)
!
interface loopback1
 ip address 10.10.100.1/32
 prefix-sid index 101
!
interface ce0
 description To-P2-ce2
 load-interval 30
 ip address 10.66.12.1/24
 mtu 9216
 label-switching
 isis network point-to-point
 isis circuit-type level-2-only
 ip router isis OCNOS
 no isis hello padding
!
router isis OCNOS
 is-type level-2-only
 metric-style wide
 mpls traffic-eng router-id 10.10.100.1
 mpls traffic-eng level-2
 capability cspf
 dynamic-hostname
 fast-reroute ti-lfa level-2 proto ipv4
 net 49.0001.0000.0000.0001.00
 passive-interface loopback1
 segment-routing mpls
!
commit

Step 2: MP-BGP L2VPN EVPN overlay

! OcNOS - MP-BGP EVPN, Route Reflector (P2)
!
router bgp 65000
 bgp router-id 10.10.100.2
 no bgp inbound-route-filter
 neighbor EVPN-RRC peer-group
 neighbor EVPN-RRC remote-as 65000
 neighbor EVPN-RRC update-source loopback1
 neighbor 10.10.100.3 peer-group EVPN-RRC
 neighbor 10.10.100.4 peer-group EVPN-RRC
 neighbor 10.10.100.5 peer-group EVPN-RRC
 neighbor 10.10.100.6 peer-group EVPN-RRC
 !
 address-family l2vpn evpn
  neighbor EVPN-RRC activate
  neighbor EVPN-RRC route-reflector-client
 exit-address-family
!
commit
!
! OcNOS - MP-BGP EVPN, non-RR PE peers to the RR (PE4)
!
router bgp 65000
 bgp router-id 10.10.100.4
 neighbor 10.10.100.2 remote-as 65000
 neighbor 10.10.100.2 update-source loopback1
 !
 address-family l2vpn evpn
  neighbor 10.10.100.2 activate
 exit-address-family
!
commit

Step 3: EVPN-MPLS E-Tree service, single-homed

! OcNOS - Hub / ROOT PE (P3): plain evpn mpls id, no etree-leaf keyword
!
evpn mpls enable
!
evpn etree enable
!
evpn mpls vtep-ip-global 10.10.100.3
!
evpn mpls id 701
 host-reachability-protocol evpn-bgp ETREE-SH
!
mac vrf ETREE-SH
 rd 10.10.100.3:700
 route-target both evpn-auto-rt
!
interface xe13.700 switchport
 encapsulation dot1q 700
 mtu 9216
 access-if-evpn
  map vpn-id 701
!
commit

! OcNOS - Spoke / LEAF PE (PE4): etree-leaf keyword enforces leaf isolation
!
evpn mpls enable
!
evpn etree enable
!
evpn mpls vtep-ip-global 10.10.100.4
!
evpn mpls id 701 etree-leaf
 host-reachability-protocol evpn-bgp ETREE-SH
!
mac vrf ETREE-SH
 rd 10.10.100.4:700
 route-target both evpn-auto-rt
!
interface xe15.700 switchport
 encapsulation dot1q 700
 mtu 9216
 access-if-evpn
  map vpn-id 701
!
commit

Multi-Homed Leaf Configuration

To dual-home a leaf CE, enable EVPN-MPLS multihoming and the supporting hardware profile on every PE attached to that CE, then place the shared Ethernet Segment on the port-channel with evpn multi-homed system-mac. The remaining E-Tree configuration is identical to the single-homed spoke. The hub (P3) does not need multihoming enabled.

! OcNOS - Multi-homed LEAF PE (PE5)
!
hardware-profile filter evpn-mpls-mh enable
!
evpn mpls enable
!
evpn mpls multihoming enable
!
evpn etree enable
!
evpn mpls vtep-ip-global 10.10.100.5
!
evpn mpls id 801 etree-leaf
 host-reachability-protocol evpn-bgp ETREE-MH
!
mac vrf ETREE-MH
 rd 10.10.100.5:800
 route-target both evpn-auto-rt
!
! Shared Ethernet Segment placed on the port-channel to the dual-homed CE
interface po111
 evpn multi-homed system-mac 0000.1111.aaaa
!
interface xe15.800 switchport
 encapsulation dot1q 800
 mtu 9216
 access-if-evpn
  map vpn-id 801
!
interface po111.800 switchport
 encapsulation dot1q 800
 mtu 9216
 access-if-evpn
  map vpn-id 801
!
commit

Verification

Validate the underlay first, then the EVPN overlay, then prove the E-Tree isolation with pings from the CE devices.

! OcNOS - Underlay verification (from PE1)
!
show isis topology
show mpls forwarding-table
show mpls ilm-table
ping mpls isis-sr ipv4 10.10.100.6/32 detail
!
! Confirm the L2VPN EVPN sessions are Established:
show bgp l2vpn evpn summary

! OcNOS - EVPN E-Tree overlay verification
!
! Service, tunnel, and label state:
show evpn mpls
show evpn mpls tunnel
show evpn mpls tunnel label
!
! EVPN routes exchanged with the remote PEs:
show bgp l2vpn evpn
show bgp l2vpn evpn mac-ip          ! type-2 MAC/IP routes
show bgp l2vpn evpn mcast           ! type-3 inclusive multicast routes
!
! On the leaf, the tunnel to the root has Remote-Leaf blank; to another leaf it is set:
!   Source        Destination   evpn-id   Local-Leaf   Remote-Leaf
!   10.10.100.4   10.10.100.3   701       set          ---     (peer 10.10.100.3 is root)
!   10.10.100.4   10.10.100.5   701       set          set     (peer 10.10.100.5 is leaf)
!
! Multi-homed leaf only: confirm the ESI and multihoming state
show evpn multihoming-status        ! "Multihoming is ACTIVE in Hardware" on the MH PE
show evpn multi-homing              ! shows ESI 00:00:00:11:11:aa:aa:00:00:00 on po111

! OcNOS - Proving E-Tree isolation from the CE devices (single-homed lab)
!   CE1 = leaf (71.71.71.1), CE2 = leaf (71.71.71.2), CE3 = root (71.71.71.3)
!
! Leaf-to-leaf is BLOCKED: CE1 -> CE2 fails
CE1# ping 71.71.71.2
! From 71.71.71.1 icmp_seq=1 Destination Host Unreachable
! 7 packets transmitted, 0 received, +6 errors, 100% packet loss
!
! Leaf-to-root is ALLOWED: CE1 -> CE3 succeeds
CE1# ping 71.71.71.3
! 5 packets transmitted, 5 received, 0% packet loss
!
! Root reaches every leaf: CE3 -> CE1 and CE3 -> CE2 both succeed
CE3# ping 71.71.71.1
CE3# ping 71.71.71.2
! 5 packets transmitted, 5 received, 0% packet loss

• EVPN-ELINE: Point-to-Point L2 Service
• EVPN-ELAN: Multipoint L2 Service
• EVPN-L3VPN over ISIS-SR
• OcNOS-SP Product Page
• IP Infusion kontaktieren

IP Infusion Engineering Team