EVPN-L3VPN over ISIS-SR and TI-LFA in OcNOS: IP Routing Across the SR Backbone

Part of IP Infusion's guide to Segment Routing.

EVPN L3VPN combines the BGP control plane of EVPN with the Layer 3 routing of traditional MPLS VPNs. Using EVPN route type 5 (IP Prefix Routes), PE routers advertise IP prefixes from customer VRFs across the SR-MPLS backbone. This delivers scalable, automated inter-site IP routing without running separate BGP-VPNv4 and LDP control planes.

EVPN Route Type 5: IP Prefix Routes

Route type 5 is the foundation of EVPN L3VPN. Each PE router:

1. Learns IP prefixes from CE devices (via static routes, BGP, OSPF, or connected routes in the VRF)
2. Advertises them as EVPN type-5 routes, each carrying a per-VRF VPN label allocated from the PE's local dynamic label pool (not from the SR node-SID or SRGB space)
3. Remote PEs import the type-5 routes into their local VRF routing tables using the matching route-target
4. Traffic is forwarded across the fabric on the SR node-SID transport label, with the per-VRF VPN label as the inner service label. No separate LDP or RSVP-TE is required.

EVPN-L3VPN Topology

EVPN-L3VPN Configuration on OcNOS

The underlay is a single-area IS-IS level-2 domain running segment routing over MPLS. Each node advertises a prefix-SID from its loopback, and TI-LFA installs a loop-free backup path for fast reroute.

! OcNOS -- PE1: ISIS-SR underlay with TI-LFA
!
! SR prefix-SID advertised from the loopback
interface loopback1
 ip address 10.10.100.1/32
 prefix-sid index 101
!
! Core-facing interface toward P2
interface ce0
 description To-P2-ce2
 load-interval 30
 ip address 10.66.12.1/24
 mtu 9216
 label-switching
 isis network point-to-point
 isis circuit-type level-2-only
 ip router isis OCNOS
 no isis hello padding
!
! IS-IS level-2 with segment-routing MPLS and TI-LFA
router isis OCNOS
 is-type level-2-only
 metric-style wide
 mpls traffic-eng router-id 10.10.100.1
 mpls traffic-eng level-2
 capability cspf
 dynamic-hostname
 fast-reroute ti-lfa level-2 proto ipv4
 net 49.0001.0000.0000.0001.00
 passive-interface loopback1
 segment-routing mpls
!
commit

BGP EVPN sessions are reflected by P2, which acts as the route reflector for the EVPN-RRC peer group. Every PE peers only with the reflector.

! OcNOS -- P2: BGP EVPN route reflector
!
router bgp 65000
 bgp router-id 10.10.100.2
 no bgp inbound-route-filter
 neighbor EVPN-RRC peer-group
 neighbor EVPN-RRC remote-as 65000
 neighbor EVPN-RRC update-source loopback1
 neighbor 10.10.100.3 peer-group EVPN-RRC
 neighbor 10.10.100.4 peer-group EVPN-RRC
 neighbor 10.10.100.5 peer-group EVPN-RRC
 neighbor 10.10.100.6 peer-group EVPN-RRC
 !
 address-family l2vpn evpn
  neighbor EVPN-RRC activate
  neighbor EVPN-RRC route-reflector-client
 exit-address-family
!
commit

PE4 attaches the customer site in VRF EVPN-L3VPN and advertises its subnets as EVPN type-5 routes. EVPN over MPLS is enabled with IRB, the VRF carries its RD, route-target, and L3VNI, and the per-VRF IPv4 address family peers with the CE.

! OcNOS -- PE4: EVPN L3VPN PE with VRF and type-5 advertisement
!
! Enable EVPN over MPLS with integrated routing and bridging
evpn mpls enable
!
evpn mpls irb
!
evpn mpls vtep-ip-global 10.10.100.4
!
! Tenant VRF: RD, route-target, and L3VNI
ip vrf EVPN-L3VPN
 rd 10.10.100.4:500
 route-target both 500:500
 l3vni 5000
!
! CE-facing sub-interface placed in the VRF
interface xe15
 mtu 9216
!
interface xe15.500
 encapsulation dot1q 500
 ip vrf forwarding EVPN-L3VPN
 ip address 52.52.52.1/24
 mtu 9216
!
! BGP: EVPN session to the route reflector, plus per-VRF IPv4
router bgp 65000
 bgp router-id 10.10.100.4
 neighbor 10.10.100.2 remote-as 65000
 neighbor 10.10.100.2 update-source loopback1
 !
 address-family l2vpn evpn
  neighbor 10.10.100.2 activate
 exit-address-family
 !
 address-family ipv4 vrf EVPN-L3VPN
  redistribute connected
  neighbor 52.52.52.2 remote-as 65002
  neighbor 52.52.52.2 activate
 exit-address-family
!
commit

DCI Use Case: EVPN L3VPN for Data Center Interconnect

The same type-5 mechanism carries subnets between sites, which is exactly what a data center interconnect needs. On PE4 the routes learned from the remote PE (RD 10.10.100.5:500) arrive with a per-VRF VPN label and are resolved over the SR-MPLS transport tunnel to the remote loopback.

! OcNOS -- PE4: EVPN type-5 routes learned from the remote site
!
show bgp l2vpn evpn summary
show bgp l2vpn evpn prefix-route
show evpn mpls tunnel
!
! What each of these prints on a real router is shown in the capture below.

The output below was captured on 2 October 2026 on two OcNOS 7.0.1 routers in IP Infusion's lab, R5 (loopback 5.5.5.5) and R6 (6.6.6.6), configured as this section describes: evpn mpls enable, VRF EVPN-L3VPN with route-target 500:500 and L3VNI 5000, and an iBGP l2vpn evpn session between the two loopbacks over an IS-IS SR core. Each PE carries one prefix in the VRF on a loopback (52.52.52.52/32 on R5, 53.53.53.53/32 on R6) instead of a CE. This is R6 learning R5's prefix as a type-5 route. Label 26240 is the per-VRF VPN label, not an SR node SID.

R6-S9510-30XC#show bgp l2vpn evpn summary

BGP router identifier 6.6.6.6, local AS number 65000
BGP table version is 2
1 BGP AS-PATH entries
0 BGP community entries

Neighbor          V    AS     MsgRcv     MsgSen  TblVer    InQ   OutQ   Up/Down  State/PfxRcd     AD  MACIP  MCAST    ESI  PREFIX-ROUTE  Desc
5.5.5.5            4 65000          8          7       2      0      0  00:02:04             1      0      0      0      0      1

Total number of neighbors 1

Total number of Established sessions 1
R6-S9510-30XC#show bgp l2vpn evpn prefix-route

BGP table version is 2, local router ID is 6.6.6.6
Status codes: s suppressed, d damped, h history, a add-path, b back-up, * valid, > best, i - internal,
              l - labeled, S Stale
Origin codes: i - IGP, e - EGP, ? - incomplete
Description : Ext-Color - Extended community color


RD[5.5.5.5:500]
     ESI         Eth-Tag   Prefix-Length      IP-Address      GW-IPAddress    L3VNID/LABEL    Nexthop            Peer            Encap     Router-Mac
*>i  0               0       32               52.52.52.52     0.0.0.0         26240           5.5.5.5           5.5.5.5         MPLS      e8c5:7ad4:dd17
R6-S9510-30XC#show evpn mpls tunnel

EVPN-MPLS Network tunnel Entries
Source           Destination      Status        Up/Down       Update        evpn-id       Ext-Color  FAT
========================================================================================================
6.6.6.6          5.5.5.5          Installed     00:02:08      00:02:08      5000             ---     ---

Total number of entries are 1

Verification Commands

First confirm the SR underlay and TI-LFA on a core node such as PE1.

! OcNOS -- PE1: verify the ISIS-SR underlay and TI-LFA
!
! IS-IS level-2 topology and next-hops
show isis topology
!
! SR label bindings in the MPLS forwarding table (node SIDs)
show mpls forwarding-table
!
! Incoming label map, including the local node SID (16101)
show mpls ilm-table
!
! MPLS-aware ping to a remote loopback over SR
ping mpls isis-sr ipv4 10.10.100.6/32 detail
! Success Rate is 100.00 percent (5/5)

Then verify the VRF routing table and end-to-end reachability on the PE.

! OcNOS -- PE4: verify VRF routes and end-to-end reachability
!
show ip route vrf EVPN-L3VPN database
show mpls vrf-forwarding-table
!
! End-to-end connectivity test inside the VRF. Options such as count come
! before vrf; without a count the ping runs until Ctrl+C.
ping 60.60.60.60 count 5 vrf EVPN-L3VPN
!
! What each of these prints on a real router is shown in the capture below.

The same two routers, on R6. The remote prefix is marked > (selected) in the VRF table and is forwarded through the BGP EVPN entry in the MPLS VRF forwarding table, which pushes VPN label 26240 toward R5's loopback.

R6-S9510-30XC#show ip route vrf EVPN-L3VPN database

Codes: K - kernel, C - connected, S - static, R - RIP, B - BGP
       O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2,
       ia - IS-IS inter area, E - EVPN,
       v - vrf leaked
       > - selected route, * - FIB route, p - stale info

IP Route Table for VRF "EVPN-L3VPN"
B     >   52.52.52.52/32 [200/0] via 5.5.5.5, installed 00:02:11, last update 00:02:11 ago
C    *>   53.53.53.53/32 is directly connected, loopback500, installed 00:02:17, last update 00:02:17 ago
C    *>   127.0.0.0/8 is directly connected, lo.EVPN-L3VPN, installed 00:02:18, last update 00:02:18 ago

Total number of IPv4 routes 3

Gateway of last resort is not set
R6-S9510-30XC#show mpls vrf-forwarding-table

Codes: > - installed FTN, * - selected FTN, p - stale FTN, ! - using backup, B - BGP FTN
(m) - Service mapped over multipath transport
(e) - Service mapped over ECMP
(D) - Down
Ext-Color - Extended-community color advertised by BGP
B(x) - BGP EVPN MPLS Services

Code    FEC                                         FTN-ID VRF-ID    Nhlfe-ID    Pri   Out-Label    Out-Intf         Nexthop         UpTime    Ext-Color
B(x)>   52.52.52.52/32                              1         2      32014       -     -            -                -               00:02:16  -
                                                                     32010       Yes   26240        -                5.5.5.5         -         -
R6-S9510-30XC#ping 52.52.52.52 count 3 vrf EVPN-L3VPN
Press CTRL+C to exit
PING 52.52.52.52 (52.52.52.52) 100(128) bytes of data.
108 bytes from 52.52.52.52: icmp_seq=1 ttl=64 time=0.717 ms
108 bytes from 52.52.52.52: icmp_seq=2 ttl=64 time=0.609 ms
108 bytes from 52.52.52.52: icmp_seq=3 ttl=64 time=0.590 ms
--- 52.52.52.52 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2062ms
rtt min/avg/max/mdev = 0.590/0.638/0.717/0.055 ms

• Multi-Domain ISIS-SR with BGP-LU and EVPN
• EVPN-ELINE: Point-to-Point L2 Service
• EVPN-ELAN: Multipoint L2 Service
• OcNOS-SP Product Page
• Contacter IP Infusion

IP Infusion Engineering Team