Service Provider L2VPN and L3VPN · RFC 7432 / 8214 / 8317

EVPN over MPLS and Segment Routing

EVPN over MPLS uses the BGP EVPN control plane to deliver E-Line, E-LAN, E-Tree, and Layer 3 VPN services on the MPLS or Segment Routing transport a service provider already runs. Endpoints are learned in BGP instead of by flooding, multi-homing is all-active, and protection comes from TI-LFA or RSVP-TE in the underlay. It is the service-provider counterpart of EVPN-VXLAN, with the same control plane and a label data plane.

EVPN services on an SR-MPLS transport

Three provider edge routers and a Segment Routing core. PE1 and PE2 share one Ethernet Segment for an all-active multi-homed customer site; PE3 serves a single-homed site. E-Line, E-LAN, and L3VPN services all ride the same label stack, protected hop by hop with TI-LFA.

EVPN services over a Segment Routing MPLS core Two provider edge routers on the left share one Ethernet Segment to a dual-attached customer site. They connect through two core routers running SR-MPLS to a third provider edge router on the right serving a single-homed site. EVPN E-Line, E-LAN, and L3VPN services are carried on the same label stack with TI-LFA protection. SR-MPLS label stack · TI-LFA protected PE1 ESI-1 · all-active PE2 ESI-1 · all-active P1 SR node SID P2 SR node SID PE3 single-homed CE-A CE-B BGP EVPN · SR-MPLS TRANSPORT · E-LINE / E-LAN / E-TREE / L3VPN

What EVPN over MPLS is

EVPN (RFC 7432) was designed for MPLS first. Its BGP control plane advertises MAC and IP reachability between provider edge routers, and the traffic itself is forwarded with a label stack: a transport label to reach the remote PE and a service label that identifies the EVPN instance. The transport can be anything the core already runs, LDP, RSVP-TE, or Segment Routing, so EVPN slots into an existing MPLS network without changing the underlay.

The result is one service model for everything a service provider sells over Ethernet. Point-to-point circuits, multipoint LANs, rooted-multipoint access trees, and routed VPNs are all EVPN instances with different route-target and forwarding policy, signalled by the same BGP session. This page covers what is specific to the MPLS and Segment Routing data plane. The route types themselves, Type-1 through Type-5, are the same in every data plane and are explained on the EVPN-VXLAN page.

EVPN-MPLS and EVPN-VXLAN, side by side

Same control plane, different wire. The table is what changes when the encapsulation does.

AspectEVPN over MPLS or SREVPN over VXLAN
Where it runsService provider core, metro, and aggregationData centre leaf-spine fabrics
Data planeMPLS label stack: transport label plus service labelUDP encapsulation with a 24-bit VNI over plain IP
TransportIGP with LDP, RSVP-TE, SR-MPLS, or SRv6Any IP underlay, usually eBGP unnumbered
Traffic engineeringNative: RSVP-TE tunnels or SR policies steer per serviceLimited to ECMP over the fabric
Fast protectionTI-LFA or RSVP Fast Reroute in the underlayUnderlay IGP or BGP reconvergence
Carrier Ethernet OAMCFM and Y.1731 performance monitoring per serviceService monitoring over VXLAN where supported
ServicesE-Line, E-LAN, E-Tree, L3VPN with IRB, Inter-ASL2 overlay, IRB, Type-5 routing, DCI
OcNOS packageOcNOS-SPOcNOS-DC and OcNOS-SP

The transport underneath

EVPN does not care how the label-switched path is built, which is why it migrates cleanly. OcNOS-SP carries EVPN services over every transport in the Feature Matrix:

  • LDP and RSVP-TE. The classic MPLS transports, with ECMP across parallel LSPs for both (RSVP ECMP since OcNOS 5.0, LDP ECMP since 6.1.0) and graceful restart with EVPN services attached.
  • SR-MPLS. EVPN over the IGP-computed Segment Routing LSP or over an SR policy (since 4.2), with TI-LFA local protection (since 5.1) and BGP-LU for inter-domain reach (since 5.1).
  • SRv6. Initial SRv6 support on selected routers in OcNOS-SP PLUS covers EVPN E-Line and E-LAN single-homed over an IPv6 segment list (RFC 9252), with more in development. How SRv6 works.

Service mapping picks the tunnel per EVPN instance through a local tunnel policy, so a premium E-Line can ride an SR policy with a latency objective while best-effort E-LAN follows the IGP path.

What OcNOS-SP delivers

The complete list, with platform and licence coverage, is in the Feature Matrix.

E-Line and E-LAN

EVPN VPWS point-to-point (RFC 8214) and multipoint E-LAN (RFC 7432), single and multi-homed attachment, MAC statistics per instance.

Since OcNOS 4.0

E-Tree

Rooted-multipoint per RFC 8317, single-homed from 4.1, multi-homed from 6.5.1, scenario 2 leaf handling from 7.0.0.

Since OcNOS 4.1

EVPN over Segment Routing

Services carried over the SR LSP or an SR policy, selected per instance by local tunnel policy. TI-LFA and BGP-LU from 5.1.

Since OcNOS 4.2

Transport protection

One-to-one and facility backup with RSVP-TE, TI-LFA with SR-MPLS, and RSVP or LDP graceful restart with EVPN services attached.

Since OcNOS 4.0

Multi-homing modes

All-active multi-homing from 4.0 and single-active (active-standby) from 6.4.1 for MPLS and SR. Mass withdrawal and aliasing across the segment.

Since OcNOS 4.0

IRB and L3VPN

Integrated Routing and Bridging (RFC 9135), EVPN L3VPN with or without IRB, host-route advertisement, anycast gateway with multiple IPs, ECMP for symmetric IRB from 7.0.0.

Since OcNOS 6.0.0

Inter-AS

Option A and Option C for EVPN services that cross an autonomous system boundary, with control word support from 6.0.1.

Since OcNOS 5.1

Carrier Ethernet OAM

CFM (IEEE 802.1ag) and Y.1731 delay and loss measurement over EVPN MPLS E-Line and E-LAN, single and multi-homed. TWAMP over EVPN L3VPN over SR-MPLS.

Since OcNOS 6.4.1

EVPN over SRv6

Initial SRv6 support on selected routers in OcNOS-SP PLUS: EVPN E-Line and E-LAN single-homed over SRv6 (RFC 9252), with more in development.

Selected routers

Policy and scale controls

EVPN address-family route-maps, per-instance MAC limits, MAC hold timer, link-loss forwarding, and L2CP handling on EVPN access.

Since OcNOS 7.0.0

Migrating from VPLS and VPWS

Most service providers arrive at EVPN from an LDP-signalled VPLS or VPWS estate. EVPN removes the two things that limited VPLS at scale: data-plane MAC learning, which floods until every PE has seen every address, and the full mesh of pseudowires, which grows with the square of the PE count. In EVPN the MAC table is a BGP table and the mesh is a set of BGP routes.

The migration does not need a flag day. OcNOS-SP runs LDP and BGP-signalled VPLS, hierarchical VPLS, and EVPN on the same router, so services move instance by instance. The multi-homing that VPLS could only offer as active-standby MLAG becomes all-active in EVPN, and the same BGP session that already carries L3VPN carries the new L2 services.

Where EVPN over MPLS fits

  • Metro Ethernet: E-Line and E-LAN business services with CFM and Y.1731 SLA measurement per circuit.
  • Core and aggregation: one BGP EVPN control plane across core, metro, and the data centre edge, with SR-MPLS transport and TI-LFA.
  • Wholesale and access aggregation: E-Tree keeps leaf sites isolated from each other while every leaf reaches the root.

Qualified hardware

Reference, not a specification. EVPN over MPLS is an OcNOS-SP capability and runs on the Broadcom Qumran and Jericho based routers qualified for the SP package. The current qualified list, with ASIC, port density, and release coverage per platform, is the OcNOS Hardware Compatibility List.

See qualified platforms → EVPN over MPLS in the Feature Matrix →

Related technologies and solutions

EVPN-VXLAN and route types → EVPN multi-homing (ESI-LAG) → SR-MPLS and TI-LFA → SRv6 → MPLS-TE and RSVP-TE → BGP → Metro Ethernet solution → IP Core solution → E-Line over IS-IS SR, worked example → E-Tree over IS-IS SR, worked example → EVPN L3VPN over IS-IS SR, worked example →

Planning an EVPN migration on your MPLS or Segment Routing core?

Contact us

Frequently asked questions

What is EVPN over MPLS?
EVPN over MPLS uses the BGP EVPN control plane (RFC 7432) to advertise MAC and IP reachability, and an MPLS label stack to forward the traffic between provider edge routers. It delivers point-to-point (E-Line), multipoint (E-LAN), rooted-multipoint (E-Tree), and Layer 3 VPN services on the same transport service providers already run for L3VPN.
What is the difference between EVPN-MPLS and EVPN-VXLAN?
The control plane is identical. The difference is the data plane. EVPN-MPLS forwards on MPLS labels over an IGP and LDP, RSVP-TE, or Segment Routing transport, which is what service provider core and metro networks run. EVPN-VXLAN forwards in UDP over a plain IP fabric, which is what data centre leaf-spine networks run. OcNOS-SP supports both, so one control plane can span the DC and the WAN.
Can EVPN run over Segment Routing?
Yes. OcNOS-SP carries EVPN services over SR-MPLS using either the IGP-computed SR LSP or an SR policy, protected by TI-LFA. OcNOS-SP PLUS adds initial SRv6 support on selected routers, including EVPN E-Line and E-LAN single-homed services over SRv6 (RFC 9252), with more in development.
What is EVPN E-Line, E-LAN, and E-Tree?
These are the MEF Carrier Ethernet service types. E-Line is point-to-point between two sites, delivered by EVPN VPWS (RFC 8214). E-LAN is any-to-any between many sites in one broadcast domain (RFC 7432). E-Tree is rooted-multipoint (RFC 8317): roots reach every site, leaves reach only roots, which suits access aggregation and wholesale. OcNOS-SP supports all three over MPLS with single and multi-homed attachment.
How does EVPN replace VPLS?
VPLS learns MAC addresses in the data plane by flooding and needs a full mesh of pseudowires. EVPN learns MAC addresses in BGP, so the network knows where every endpoint is without flooding, supports all-active multi-homing that VPLS cannot, and scales by adding BGP routes rather than pseudowires. Existing VPLS and EVPN can run side by side on OcNOS-SP during a migration.
What is EVPN multi-homing with an Ethernet Segment Identifier?
A customer device connects to two or more provider edge routers that share one Ethernet Segment Identifier (ESI). BGP EVPN elects a designated forwarder for broadcast traffic and lets every link carry unicast at once (all-active), or holds one in reserve (single-active). OcNOS-SP supports all-active multi-homing over MPLS and, since 6.4.1, single-active (active-standby).
How is EVPN over MPLS protected against link and node failure?
Transport protection comes from the underlay: TI-LFA on SR-MPLS gives local repair for any topology, and RSVP-TE offers one-to-one and facility backup. Service protection comes from EVPN itself: mass withdrawal on an Ethernet Segment failure, aliasing across multi-homed peers, and BGP-signalled failover with no data-plane learning to relearn.
Does EVPN over MPLS support Layer 3 services?
Yes. With Integrated Routing and Bridging (RFC 9135) a provider edge router both bridges within a subnet and routes between subnets, and Type-5 prefix routes (RFC 9136) carry IP prefixes between sites. OcNOS-SP supports EVPN L3VPN with and without IRB, distributed anycast gateways, and ECMP for symmetric IRB since 7.0.

Go deeper. Take it with you.

The product datasheet plus short, technical downloads that go further than this page.

Datasheet

OcNOS-SP Datasheet

Full OcNOS-SP specification: the access, cell site and aggregation feature set, software SKUs, supported hardware platforms, and the solution ordering guide.

Get the datasheet
Solution Brief

SR-MPLS Upgrade with OcNOS

Migrate SR-MPLS onto OcNOS on open hardware: Flex-Algo, TI-LFA, and a node-by-node cutover path.

Get the brief
Solution Brief

EVPN-VXLAN Data Center Fabric

Leaf-spine data center fabric on EVPN-VXLAN: a VRF and VNIs per tenant, EVPN multihoming, BGP unnumbered and route-target filtering.

Get the brief