← Interview Prep

EVPN — Theory

EVPN as a BGP control plane for L2 and L3 VPNs: the route types (1 A-D, 2 MAC/IP, 3 IMET, 4 ES, 5 IP-prefix), EVI/ES/ESI/RD/RT, all-active multihoming (DF election, split-horizon, aliasing, mass withdrawal), MAC mobility & ARP suppression, symmetric vs asymmetric IRB & distributed anycast gateway, VXLAN/MPLS/SRv6 data planes, and EVPN vs VPLS.

EVPN is a BGP-based control plane for building Layer-2 and Layer-3 VPNs. It replaced VPLS's data-plane flood-and-learn with MAC learning in MP-BGP — the same way L3VPN learns IP routes — and became the one control plane behind modern DC fabrics (over VXLAN) and service-provider VPNs (over MPLS/SRv6). If you understand L3VPN's RD/RT machinery, EVPN is that idea extended to MACs, with multihoming and integrated routing bolted on.

One control plane, many data planes: EVPN routes ride the L2VPN/EVPN MP-BGP address family; the actual encapsulation is VXLAN (RFC 8365, data centers), MPLS (RFC 7432, SP), or SRv6. The route types are the whole subject.

Why EVPN (what it fixes over VPLS)

• Control-plane MAC learning — MACs are advertised in BGP, not learned by flooding. Far less BUM, plus ARP/ND suppression.
• All-active multihoming — a host/switch dual-homed to two PEs uses both links, loop-free, without STP. VPLS couldn't do this.
• MAC mobility — a VM moving between leaves is handled cleanly with sequence numbers.
• Integrated L2 + L3 — the same control plane does bridging and routing (IRB), with a distributed anycast gateway.
• Auto-discovery of PEs/VTEPs and fast convergence (aliasing, mass withdrawal).

See the progression from Pseudowire → VPLS → EVPN, and EVPN as the VXLAN control plane.

The route types

Everything EVPN does is a BGP EVPN NLRI route type. Know these cold:

Inside each route type

Every EVPN route is an NLRI of the form route-type + length + type-specific value, carried in MP-BGP (AFI 25 L2VPN, SAFI 70 EVPN). The value always begins with the RD; the real meaning is in the remaining fields plus a few extended communities. Here is what's actually inside each one.

Type 1 — Ethernet Auto-Discovery (A-D)

Two flavors: per-EVI A-D drives aliasing (remote PEs load-balance to the ES); per-ES A-D drives mass withdrawal (one route pulls all MACs on a failed link) and carries the ESI Label extended community for split-horizon + the single/all-active flag.

Type 2 — MAC/IP Advertisement

Rides with the MAC Mobility extended community (sequence number + sticky flag) for VM moves and duplicate-MAC detection, and the Router's MAC extended community (the next-hop MAC for symmetric IRB).

Type 3 — Inclusive Multicast Ethernet Tag (IMET)

The how of BUM lives in the attached PMSI Tunnel attribute: tunnel type (ingress replication / PIM / mLDP), tunnel ID, and the flood label/VNI. That's what builds the replication list.

Type 4 — Ethernet Segment

Tagged with the ES-Import RT (auto-derived from the ESI) so only PEs on the same segment import it — that's how they discover each other and run DF election.

Type 5 — IP Prefix

Carries the Router's MAC extended community as the inner-destination MAC for the L3VNI. This is how EVPN advertises summaries, external, and silent-host routes — EVPN as a full L3VPN (see MPLS L3VPN).

The extended communities that complete the picture

The NLRI carries identity; these BGP extended communities carry the semantics:

Core concepts

Multihoming

The headline EVPN feature. A CE dual-homed to two (or more) PEs forms one Ethernet Segment (ES), identified by a shared ESI on those links. Two modes: single-active (only one PE forwards for the ES; the other is standby) and all-active (both forward simultaneously) — the usual DC choice, and the one worth walking through carefully.

How all-active actually works

The trick is that known-unicast uses both PEs while BUM is gated to one, and split-horizon stops the loops. Step by step:

1. One bundle to the CE. The CE has a single LACP LAG whose members land on PE1 and PE2. The two PEs share the same ESI on those links and present a common LACP system-ID, so the CE sees one partner and hashes its flows across both links — both active, no STP.
2. The PEs discover each other & elect a DF. PE1 and PE2 find they're on the same ES via the Type 4 (Ethernet Segment) route (matched by the auto-derived ES-Import RT), then run Designated-Forwarder election per EVI/VLAN. Only the DF sends BUM down toward the CE for that VLAN — so a broadcast isn't delivered twice.
3. Known unicast forwards on both, both directions. CE→core: the CE's LACP hash lands a flow on PE1 or PE2; whichever receives it forwards into the fabric — both are live. core→CE: here's the key — a remote PE learns the host's MAC from a Type 2 (say PE1 advertised it) and learns from the Type 1 per-EVI Ethernet A-D that the whole ESI is reachable via both PE1 and PE2. That's aliasing: the remote PE installs an ECMP next-hop to the ESI and load-balances return traffic across PE1 and PE2 even though only PE1 advertised the MAC.
4. Split-horizon prevents the echo. A BUM frame the CE sends to PE1 floods the fabric and reaches PE2 (the other PE on the same ESI). PE2 must not forward it back down to the CE (it already arrived locally). This is enforced by the ESI Label (MPLS, carried in Type 1 per-ES) or local-bias (VXLAN): a frame from the peer VTEP on a shared ESI is blocked from egressing the local ESI link.
5. Failure is one message. If PE1's link to the CE dies, PE1 sends a single Type 1 per-ES withdrawal — mass withdrawal — and every remote PE instantly stops using PE1 for the entire ESI (all its MACs at once) and shifts to PE2, without re-learning each MAC. DF re-election restores BUM. Sub-second, regardless of how many hosts sat behind that link.

So: Type 4 = who's on the ES + DF; Type 1 per-EVI = aliasing (ECMP); Type 1 per-ES = split-horizon label + mass withdrawal; Type 2 = the MACs themselves.

Benefits — and how they're implemented

The features people list for EVPN aren't separate magic; each falls out of a specific route type or community:

MAC mobility & ARP suppression

• MAC mobility: when a host moves, the new PE advertises its MAC with a higher sequence number in the MAC Mobility extended community; PEs converge on the newest. Duplicate-MAC detection catches a flapping/looping MAC and dampens it.
• ARP/ND suppression: because Type 2 carries MAC and IP, each leaf can answer ARP locally from its EVPN table instead of flooding the request across the fabric.

Integrated Routing & Bridging (IRB)

EVPN bridges within a subnet (L2VNI) and routes between subnets (L3VNI) using an IRB interface on every leaf — a distributed anycast gateway (same gateway IP+MAC everywhere), so the first hop is always local.

Type 5 handles prefixes with no local MAC (summaries, external, silent hosts) and is how EVPN acts as a full L3VPN.

Data planes, services & underlay

• Encapsulation: VXLAN (RFC 8365, DC), MPLS (RFC 7432, SP), SRv6, MPLSoUDP/GRE.
• Service types: E-LAN (multipoint), E-Line (EVPN-VPWS, point-to-point), E-Tree (hub-and-spoke). Service models: VLAN-based, VLAN-bundle, VLAN-aware bundle (many VLANs in one EVI via the Ethernet Tag).
• Underlay: a routed IP fabric (leaf-spine Clos), commonly eBGP per switch; the EVPN overlay runs iBGP (with RRs on the spines) or eBGP, carrying the L2VPN/EVPN family.

EVPN vs VPLS