EVPN & MPLS

EVPN-L3VPN over ISIS-SR and TI-LFA in OcNOS: IP Routing Across the SR Backbone

Suraj Kumar Singh · · 7 min read

Part of IP Infusion's guide to Segment Routing.

EVPN L3VPN combines the BGP control plane of EVPN with the Layer 3 routing of traditional MPLS VPNs. Using EVPN route type 5 (IP Prefix Routes), PE routers advertise IP prefixes from customer VRFs across the SR-MPLS backbone. This delivers scalable, automated inter-site IP routing without running separate BGP-VPNv4 and LDP control planes.

EVPN Route Type 5: IP Prefix Routes

Route type 5 is the foundation of EVPN L3VPN. Each PE router:

  1. Learns IP prefixes from CE devices (via static routes, BGP, OSPF, or connected routes in the VRF)
  2. Advertises them as EVPN type-5 routes, each carrying a per-VRF VPN label allocated from the PE's local dynamic label pool (not from the SR node-SID or SRGB space)
  3. Remote PEs import the type-5 routes into their local VRF routing tables using the matching route-target
  4. Traffic is forwarded across the fabric on the SR node-SID transport label, with the per-VRF VPN label as the inner service label. No separate LDP or RSVP-TE is required.

EVPN-L3VPN Topology

OcNOS EVPN L3VPN lab: six routers on an IS-IS Segment Routing core with TI-LFA. PE4 and PE5 carry VRF EVPN-L3VPN (route-target 500:500, L3VNI 5000); PE4 attaches a CE at 52.52.52.2 in AS 65002 on xe15.500.
The lab this configuration is taken from. PE4 holds VRF EVPN-L3VPN with RD 10.10.100.4:500, route-target 500:500 for both import and export, and L3VNI 5000, and peers with the CE (52.52.52.2, AS 65002) on xe15.500. It advertises 52.52.52.0/24 as an EVPN route type 5 through the route reflector P2 to the remote PE, PE5 (RD 10.10.100.5:500), over an IS-IS Segment Routing MPLS underlay with TI-LFA.

EVPN-L3VPN Configuration on OcNOS

The underlay is a single-area IS-IS level-2 domain running segment routing over MPLS. Each node advertises a prefix-SID from its loopback, and TI-LFA installs a loop-free backup path for fast reroute.

! OcNOS -- PE1: ISIS-SR underlay with TI-LFA
!
! SR prefix-SID advertised from the loopback
interface loopback1
 ip address 10.10.100.1/32
 prefix-sid index 101
!
! Core-facing interface toward P2
interface ce0
 description To-P2-ce2
 load-interval 30
 ip address 10.66.12.1/24
 mtu 9216
 label-switching
 isis network point-to-point
 isis circuit-type level-2-only
 ip router isis OCNOS
 no isis hello padding
!
! IS-IS level-2 with segment-routing MPLS and TI-LFA
router isis OCNOS
 is-type level-2-only
 metric-style wide
 mpls traffic-eng router-id 10.10.100.1
 mpls traffic-eng level-2
 capability cspf
 dynamic-hostname
 fast-reroute ti-lfa level-2 proto ipv4
 net 49.0001.0000.0000.0001.00
 passive-interface loopback1
 segment-routing mpls
!
commit

BGP EVPN sessions are reflected by P2, which acts as the route reflector for the EVPN-RRC peer group. Every PE peers only with the reflector.

! OcNOS -- P2: BGP EVPN route reflector
!
router bgp 65000
 bgp router-id 10.10.100.2
 no bgp inbound-route-filter
 neighbor EVPN-RRC peer-group
 neighbor EVPN-RRC remote-as 65000
 neighbor EVPN-RRC update-source loopback1
 neighbor 10.10.100.3 peer-group EVPN-RRC
 neighbor 10.10.100.4 peer-group EVPN-RRC
 neighbor 10.10.100.5 peer-group EVPN-RRC
 neighbor 10.10.100.6 peer-group EVPN-RRC
 !
 address-family l2vpn evpn
  neighbor EVPN-RRC activate
  neighbor EVPN-RRC route-reflector-client
 exit-address-family
!
commit

PE4 attaches the customer site in VRF EVPN-L3VPN and advertises its subnets as EVPN type-5 routes. EVPN over MPLS is enabled with IRB, the VRF carries its RD, route-target, and L3VNI, and the per-VRF IPv4 address family peers with the CE.

! OcNOS -- PE4: EVPN L3VPN PE with VRF and type-5 advertisement
!
! Enable EVPN over MPLS with integrated routing and bridging
evpn mpls enable
!
evpn mpls irb
!
evpn mpls vtep-ip-global 10.10.100.4
!
! Tenant VRF: RD, route-target, and L3VNI
ip vrf EVPN-L3VPN
 rd 10.10.100.4:500
 route-target both 500:500
 l3vni 5000
!
! CE-facing sub-interface placed in the VRF
interface xe15
 mtu 9216
!
interface xe15.500
 encapsulation dot1q 500
 ip vrf forwarding EVPN-L3VPN
 ip address 52.52.52.1/24
 mtu 9216
!
! BGP: EVPN session to the route reflector, plus per-VRF IPv4
router bgp 65000
 bgp router-id 10.10.100.4
 neighbor 10.10.100.2 remote-as 65000
 neighbor 10.10.100.2 update-source loopback1
 !
 address-family l2vpn evpn
  neighbor 10.10.100.2 activate
 exit-address-family
 !
 address-family ipv4 vrf EVPN-L3VPN
  redistribute connected
  neighbor 52.52.52.2 remote-as 65002
  neighbor 52.52.52.2 activate
 exit-address-family
!
commit

DCI Use Case: EVPN L3VPN for Data Center Interconnect

The same type-5 mechanism carries subnets between sites, which is exactly what a data center interconnect needs. On PE4 the routes learned from the remote PE (RD 10.10.100.5:500) arrive with a per-VRF VPN label and are resolved over the SR-MPLS transport tunnel to the remote loopback.

! OcNOS -- PE4: EVPN type-5 routes learned from the remote site
!
show bgp l2vpn evpn summary
show bgp l2vpn evpn prefix-route
show evpn mpls tunnel
!
! What each of these prints on a real router is shown in the capture below.

The output below was captured on 2 October 2026 on two OcNOS 7.0.1 routers in IP Infusion's lab, R5 (loopback 5.5.5.5) and R6 (6.6.6.6), configured as this section describes: evpn mpls enable, VRF EVPN-L3VPN with route-target 500:500 and L3VNI 5000, and an iBGP l2vpn evpn session between the two loopbacks over an IS-IS SR core. Each PE carries one prefix in the VRF on a loopback (52.52.52.52/32 on R5, 53.53.53.53/32 on R6) instead of a CE. This is R6 learning R5's prefix as a type-5 route. Label 26240 is the per-VRF VPN label, not an SR node SID.

R6-S9510-30XC#show bgp l2vpn evpn summary

BGP router identifier 6.6.6.6, local AS number 65000
BGP table version is 2
1 BGP AS-PATH entries
0 BGP community entries

Neighbor          V    AS     MsgRcv     MsgSen  TblVer    InQ   OutQ   Up/Down  State/PfxRcd     AD  MACIP  MCAST    ESI  PREFIX-ROUTE  Desc
5.5.5.5            4 65000          8          7       2      0      0  00:02:04             1      0      0      0      0      1

Total number of neighbors 1

Total number of Established sessions 1
R6-S9510-30XC#show bgp l2vpn evpn prefix-route

BGP table version is 2, local router ID is 6.6.6.6
Status codes: s suppressed, d damped, h history, a add-path, b back-up, * valid, > best, i - internal,
              l - labeled, S Stale
Origin codes: i - IGP, e - EGP, ? - incomplete
Description : Ext-Color - Extended community color


RD[5.5.5.5:500]
     ESI         Eth-Tag   Prefix-Length      IP-Address      GW-IPAddress    L3VNID/LABEL    Nexthop            Peer            Encap     Router-Mac
*>i  0               0       32               52.52.52.52     0.0.0.0         26240           5.5.5.5           5.5.5.5         MPLS      e8c5:7ad4:dd17
R6-S9510-30XC#show evpn mpls tunnel

EVPN-MPLS Network tunnel Entries
Source           Destination      Status        Up/Down       Update        evpn-id       Ext-Color  FAT
========================================================================================================
6.6.6.6          5.5.5.5          Installed     00:02:08      00:02:08      5000             ---     ---

Total number of entries are 1

Verification Commands

First confirm the SR underlay and TI-LFA on a core node such as PE1.

! OcNOS -- PE1: verify the ISIS-SR underlay and TI-LFA
!
! IS-IS level-2 topology and next-hops
show isis topology
!
! SR label bindings in the MPLS forwarding table (node SIDs)
show mpls forwarding-table
!
! Incoming label map, including the local node SID (16101)
show mpls ilm-table
!
! MPLS-aware ping to a remote loopback over SR
ping mpls isis-sr ipv4 10.10.100.6/32 detail
! Success Rate is 100.00 percent (5/5)

Then verify the VRF routing table and end-to-end reachability on the PE.

! OcNOS -- PE4: verify VRF routes and end-to-end reachability
!
show ip route vrf EVPN-L3VPN database
show mpls vrf-forwarding-table
!
! End-to-end connectivity test inside the VRF. Options such as count come
! before vrf; without a count the ping runs until Ctrl+C.
ping 60.60.60.60 count 5 vrf EVPN-L3VPN
!
! What each of these prints on a real router is shown in the capture below.

The same two routers, on R6. The remote prefix is marked > (selected) in the VRF table and is forwarded through the BGP EVPN entry in the MPLS VRF forwarding table, which pushes VPN label 26240 toward R5's loopback.

R6-S9510-30XC#show ip route vrf EVPN-L3VPN database

Codes: K - kernel, C - connected, S - static, R - RIP, B - BGP
       O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2,
       ia - IS-IS inter area, E - EVPN,
       v - vrf leaked
       > - selected route, * - FIB route, p - stale info

IP Route Table for VRF "EVPN-L3VPN"
B     >   52.52.52.52/32 [200/0] via 5.5.5.5, installed 00:02:11, last update 00:02:11 ago
C    *>   53.53.53.53/32 is directly connected, loopback500, installed 00:02:17, last update 00:02:17 ago
C    *>   127.0.0.0/8 is directly connected, lo.EVPN-L3VPN, installed 00:02:18, last update 00:02:18 ago

Total number of IPv4 routes 3

Gateway of last resort is not set
R6-S9510-30XC#show mpls vrf-forwarding-table

Codes: > - installed FTN, * - selected FTN, p - stale FTN, ! - using backup, B - BGP FTN
(m) - Service mapped over multipath transport
(e) - Service mapped over ECMP
(D) - Down
Ext-Color - Extended-community color advertised by BGP
B(x) - BGP EVPN MPLS Services

Code    FEC                                         FTN-ID VRF-ID    Nhlfe-ID    Pri   Out-Label    Out-Intf         Nexthop         UpTime    Ext-Color
B(x)>   52.52.52.52/32                              1         2      32014       -     -            -                -               00:02:16  -
                                                                     32010       Yes   26240        -                5.5.5.5         -         -
R6-S9510-30XC#ping 52.52.52.52 count 3 vrf EVPN-L3VPN
Press CTRL+C to exit
PING 52.52.52.52 (52.52.52.52) 100(128) bytes of data.
108 bytes from 52.52.52.52: icmp_seq=1 ttl=64 time=0.717 ms
108 bytes from 52.52.52.52: icmp_seq=2 ttl=64 time=0.609 ms
108 bytes from 52.52.52.52: icmp_seq=3 ttl=64 time=0.590 ms
--- 52.52.52.52 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2062ms
rtt min/avg/max/mdev = 0.590/0.638/0.717/0.055 ms

IP Infusion Engineering Team

Approfondissez. Emportez-le avec vous.

La fiche technique du produit et des téléchargements techniques et concis qui vont plus loin que cette page.

Fiche technique

Datasheet OcNOS-SP

Spécification complète OcNOS-SP : l'ensemble des fonctionnalités access, cell site et agrégation, les SKU logiciels, les plateformes matérielles prises en charge et le guide de commande de la solution.

Obtenir la fiche technique
Solution brief

Mise à niveau SR-MPLS avec OcNOS

Migrez SR-MPLS vers OcNOS sur du matériel ouvert : Flex-Algo, TI-LFA et une bascule nœud par nœud.

Obtenir le brief
Solution brief

Transport WAN Cloud & Opérateurs

Transport WAN pour le cloud et les service provider sur du matériel ouvert : SR-MPLS, EVPN et transfert testé à l'échelle.

Obtenir le brief
Partager
Étiquettes BGP EVPN ISIS-SR L3VPN OcNOS Route Type 5 TI-LFA VRF
Written by

Suraj Kumar Singh

Technical Manager at IP Infusion, focused on Segment Routing, EVPN, and Flex-Algo on OcNOS.

Connect on LinkedIn

More from IP Infusion

EVPN & MPLS

VXLAN-EVPN on OcNOS 7.0: Configure a VTEP and Trace MAC Learning

Sep 15, 2026 EVPN & MPLS

Juniper QFX EVPN-VXLAN Migration to OcNOS-DC: Platforms and Cutover

Sep 10, 2026 EVPN & MPLS

L3VPN Day-2 Operations: A Step-by-Step Runbook for Network Operators

Sep 7, 2026