EVPN-L3VPN over ISIS-SR and TI-LFA in OcNOS: IP Routing Across the SR Backbone

Part of IP Infusion's guide to セグメントルーティング.

EVPN L3VPN combines the BGP control plane of EVPN with the Layer 3 routing of traditional MPLS VPNs. Using EVPN route type 5 (IP Prefix Routes), PE routers advertise IP prefixes from customer VRFs across the SR-MPLS backbone. This delivers scalable, automated inter-site IP routing without running separate BGP-VPNv4 and LDP control planes.

EVPN Route Type 5: IP Prefix Routes

Route type 5 is the foundation of EVPN L3VPN. Each PE router:

1. Learns IP prefixes from CE devices (via static routes, BGP, OSPF, or connected routes in the VRF)
2. Advertises them as EVPN type-5 routes, each carrying a per-VRF VPN label allocated from the PE's local dynamic label pool (not from the SR node-SID or SRGB space)
3. Remote PEs import the type-5 routes into their local VRF routing tables using the matching route-target
4. Traffic is forwarded across the fabric on the SR node-SID transport label, with the per-VRF VPN label as the inner service label. No separate LDP or RSVP-TE is required.

EVPN-L3VPN Topology

EVPN-L3VPN Configuration on OcNOS

The underlay is a single-area IS-IS level-2 domain running segment routing over MPLS. Each node advertises a prefix-SID from its loopback, and TI-LFA installs a loop-free backup path for fast reroute.

! OcNOS -- PE1: ISIS-SR underlay with TI-LFA
!
! SR prefix-SID advertised from the loopback
interface loopback1
 ip address 10.10.100.1/32
 prefix-sid index 101
!
! Core-facing interface toward P2
interface ce0
 description To-P2-ce2
 load-interval 30
 ip address 10.66.12.1/24
 mtu 9216
 label-switching
 isis network point-to-point
 isis circuit-type level-2-only
 ip router isis OCNOS
 no isis hello padding
!
! IS-IS level-2 with segment-routing MPLS and TI-LFA
router isis OCNOS
 is-type level-2-only
 metric-style wide
 mpls traffic-eng router-id 10.10.100.1
 mpls traffic-eng level-2
 capability cspf
 dynamic-hostname
 fast-reroute ti-lfa level-2 proto ipv4
 net 49.0001.0000.0000.0001.00
 passive-interface loopback1
 segment-routing mpls
!
commit

BGP EVPN sessions are reflected by P2, which acts as the route reflector for the EVPN-RRC peer group. Every PE peers only with the reflector.

! OcNOS -- P2: BGP EVPN route reflector
!
router bgp 65000
 bgp router-id 10.10.100.2
 no bgp inbound-route-filter
 neighbor EVPN-RRC peer-group
 neighbor EVPN-RRC remote-as 65000
 neighbor EVPN-RRC update-source loopback1
 neighbor 10.10.100.3 peer-group EVPN-RRC
 neighbor 10.10.100.4 peer-group EVPN-RRC
 neighbor 10.10.100.5 peer-group EVPN-RRC
 neighbor 10.10.100.6 peer-group EVPN-RRC
 !
 address-family l2vpn evpn
  neighbor EVPN-RRC activate
  neighbor EVPN-RRC route-reflector-client
 exit-address-family
!
commit

PE4 attaches the customer site in VRF EVPN-L3VPN and advertises its subnets as EVPN type-5 routes. EVPN over MPLS is enabled with IRB, the VRF carries its RD, route-target, and L3VNI, and the per-VRF IPv4 address family peers with the CE.

! OcNOS -- PE4: EVPN L3VPN PE with VRF and type-5 advertisement
!
! Enable EVPN over MPLS with integrated routing and bridging
evpn mpls enable
!
evpn mpls irb
!
evpn mpls vtep-ip-global 10.10.100.4
!
! Tenant VRF: RD, route-target, and L3VNI
ip vrf EVPN-L3VPN
 rd 10.10.100.4:500
 route-target both 500:500
 l3vni 5000
!
! CE-facing sub-interface placed in the VRF
interface xe15
 mtu 9216
!
interface xe15.500
 encapsulation dot1q 500
 ip vrf forwarding EVPN-L3VPN
 ip address 52.52.52.1/24
 mtu 9216
!
! BGP: EVPN session to the route reflector, plus per-VRF IPv4
router bgp 65000
 bgp router-id 10.10.100.4
 neighbor 10.10.100.2 remote-as 65000
 neighbor 10.10.100.2 update-source loopback1
 !
 address-family l2vpn evpn
  neighbor 10.10.100.2 activate
 exit-address-family
 !
 address-family ipv4 vrf EVPN-L3VPN
  redistribute connected
  neighbor 52.52.52.2 remote-as 65002
  neighbor 52.52.52.2 activate
 exit-address-family
!
commit

DCI Use Case: EVPN L3VPN for Data Center Interconnect

The same type-5 mechanism carries subnets between sites, which is exactly what a data center interconnect needs. On PE4 the routes learned from the remote PE (RD 10.10.100.5:500) arrive with a per-VRF VPN label and are resolved over the SR-MPLS transport tunnel to the remote loopback.

! OcNOS -- PE4: EVPN type-5 routes learned from the remote site
!
show bgp l2vpn evpn summary
! Neighbor      V  AS     Up/Down    State/PfxRcd  PREFIX-ROUTE
! 10.10.100.2   4  65000  02:23:36   2             2
!
show bgp l2vpn evpn prefix-route
! RD[10.10.100.5:500]
!   Prefix-Length  IP-Address    L3VNID/LABEL  Nexthop      Peer         Encap
!   24             53.53.53.0    26240         10.10.100.5  10.10.100.2  MPLS
!   32             60.60.60.60   26240         10.10.100.5  10.10.100.2  MPLS
! Label 26240 is a per-VRF VPN label from the local dynamic pool,
! not an SR node-SID (loopback node SIDs here are 16101 to 16106).
!
show evpn mpls tunnel
! Source        Destination    Status      Up/Down    evpn-id
! 10.10.100.4   10.10.100.5    Installed   00:24:08   5000

Verification Commands

First confirm the SR underlay and TI-LFA on a core node such as PE1.

! OcNOS -- PE1: verify the ISIS-SR underlay and TI-LFA
!
! IS-IS level-2 topology and next-hops
show isis topology
!
! SR label bindings in the MPLS forwarding table (node SIDs)
show mpls forwarding-table
!
! Incoming label map, including the local node SID (16101)
show mpls ilm-table
!
! MPLS-aware ping to a remote loopback over SR
ping mpls isis-sr ipv4 10.10.100.6/32 detail
! Success Rate is 100.00 percent (5/5)

Then verify the VRF routing table and end-to-end reachability on the PE.

! OcNOS -- PE4: verify VRF routes and end-to-end reachability
!
show ip route vrf EVPN-L3VPN database
! C *> 52.52.52.0/24    is directly connected, xe15.500
! B *> 53.53.53.0/24    [200/0] via 10.10.100.5
! B *> 60.60.60.60/32   [20/0]  via 10.10.100.5
! B *> 70.70.70.70/32   [20/0]  via 52.52.52.2, xe15.500
!
show mpls vrf-forwarding-table
! B> 53.53.53.0/24    Out-Label 26240   Nexthop 10.10.100.5
! B> 60.60.60.60/32   Out-Label 26240   Nexthop 10.10.100.5
!
! End-to-end connectivity test inside the VRF
ping 60.60.60.60 vrf EVPN-L3VPN
! 5 packets transmitted, 5 received, 0% packet loss

• Multi-Domain ISIS-SR with BGP-LU and EVPN
• EVPN-ELINE: Point-to-Point L2 Service
• EVPN-ELAN: Multipoint L2 Service
• OcNOS-SP Product Page
• IP Infusion へお問い合わせ

IP Infusion Engineering Team