PacketLab
Protocol Library/Routing & Switching/VXLAN
VXLAN · EVPN overlays

MP-BGP EVPN Layer 2 VNI

Advertise a learned host MAC through BGP while VXLAN still transports the tenant frame.

Keep the same one-spine, two-leaf roles

Example platform: Nexus 9300/9000v · NX-OS 9.3(9) command model. Commands are platform-specific. Use a release and hardware/image with the stated VXLAN, multicast and routing features. All outputs and packet excerpts below are constructed teaching examples, not lab recordings.

SPINE1 is the iBGP EVPN route reflector and multicast RP. LEAF1/2 terminate VNI 10010, and hosts H1/H2 remain in 10.10.10.0/24 on VLAN 10. OSPF reaches the loopbacks; PIM delivers BUM to group 239.1.1.1. These are separate functions even though one spine performs several roles.

Independent lab · evpn-l2Illustrative topology
Physical topology of evpn-l2; addressing and roles appear in the following table.
Solid lines are physical connections; crossings are not junctions. The tenant service terminates on leaves, not on transit spines. Port addresses and host settings are listed below.
Physical linkAddress at first endpointAddress at second endpoint
SPINE1 Ethernet1/1 ↔ LEAF1 Ethernet1/1192.0.2.1/30192.0.2.2/30
SPINE1 Ethernet1/2 ↔ LEAF2 Ethernet1/1192.0.2.5/30192.0.2.6/30
DeviceLoopback0 / router ID
SPINE110.255.0.1/32
LEAF110.255.0.2/32
LEAF210.255.0.3/32

Establish the EVPN address family

SPINE1 · reflector

feature bgp
nv overlay evpn
router bgp 65000
  router-id 10.255.0.1
  address-family l2vpn evpn
  neighbor 10.255.0.2
    remote-as 65000
    update-source loopback0
    address-family l2vpn evpn
      send-community
      send-community extended
      route-reflector-client
  neighbor 10.255.0.3
    remote-as 65000
    update-source loopback0
    address-family l2vpn evpn
      send-community
      send-community extended
      route-reflector-client

LEAF1 · client

feature bgp
nv overlay evpn
router bgp 65000
  router-id 10.255.0.2
  address-family l2vpn evpn
  neighbor 10.255.0.1
    remote-as 65000
    update-source loopback0
    address-family l2vpn evpn
      send-community
      send-community extended

LEAF2 uses neighbor 10.255.0.1 with the same AS 65000, source Loopback0 and EVPN family. The reflector has both leaves as clients. Extended communities carry route-target policy. The TCP session reaching Established is a control-plane check, not proof that the NVE can forward.

Give the segment an import/export policy

Both leaves · L2 segment and control learning

evpn
  vni 10010 l2
    rd auto
    route-target import 65000:10010
    route-target export 65000:10010
interface nve1
  host-reachability protocol bgp
  member vni 10010
    mcast-group 239.1.1.1

The RD distinguishes routes from different originators; the RT selects which segment imports them. Matching RTs here are intentional. The host-facing access port, VLAN-to-VNI mapping and NVE source come from the full independent recipe. SPINE1 reflects reachability but does not terminate VNI 10010.

Let hosts create reachability information

ObservationWhere it belongs
H1 source MAC on its access portLEAF1 local MAC learning.
H1 MAC/IP information advertisedEVPN Route Type 2; an IP binding is included when available.
H1 remote location installedLEAF2 uses VTEP 10.255.0.2 as the transport destination.
BUM membershipAn inclusive multicast/replication design; multicast remains configured here.

BGP does not invent a host that has not been discovered. Generate a benign H1/H2 exchange, then inspect the local entry and its advertisement. A MAC-only Type 2 route is not equivalent to having an IP/MAC binding for ARP suppression.

Check route, next hop and data-plane installation

LEAF1 · illustrative output, selected fields
LEAF1# show bgp l2vpn evpn summary
Neighbor       AS     State/PfxRcd
10.255.0.1    65000  3
LEAF1 · illustrative output, selected fields
LEAF1# show bgp l2vpn evpn route-type 2
Route: MAC 0200.0000.0022, IP 10.10.10.22
  Next hop: 10.255.0.3
  Extended community: RT:65000:10010
  Encapsulation: VXLAN, VNI 10010
LEAF1 · illustrative output, selected fields
LEAF1# show nve peers
Interface Peer-IP       State LearnType
nve1      10.255.0.3   Up    CP

The remote VTEP remains LEAF2, not the reflector. Selected route fields are shown rather than a full platform route-key transcript. The exact prefix count depends on MAC-only, MAC/IP and membership routes. Finish with an endpoint ping and a packet/counter check.

The control route is not the user packet

Known H1 → H2 frame · reconstructed packet fields, not a recorded capture
Outer IP: 10.255.0.2 -> 10.255.0.3
UDP destination: 4789; VNI 10010
Inner Ethernet: H1 MAC -> H2 MAC
BGP does not appear inside this VXLAN payload

An EVPN update can be sent through SPINE1 as reflector while the user packet is routed through the same device as ordinary IP transit. If the remote route is present but not imported, check RTs; if imported but unusable, check the next-hop route, NVE state and local attachment. Restoring RT 65000:10010 on both leaves repairs the deliberate mismatched-import fault.

Complete independent lab configurations

Start with clean isolated lab devices. These are the complete scenario configurations, not changes to apply on top of a different lesson. Physical ports must match the address table. Virtual-image data-plane capabilities can differ from physical switches; these examples have not been executed on live devices.

Download configuration reference

SPINE1

hostname SPINE1
feature ospf
feature pim
ip pim rp-address 10.255.0.1 group-list 239.1.1.0/24
router ospf UNDERLAY
  router-id 10.255.0.1
interface loopback0
  ip address 10.255.0.1/32
  ip router ospf UNDERLAY area 0.0.0.0
  ip pim sparse-mode
interface Ethernet1/1
  no switchport
  mtu 9216
  ip address 192.0.2.1/30
  ip ospf network point-to-point
  ip ospf cost 40
  ip router ospf UNDERLAY area 0.0.0.0
  ip pim sparse-mode
  no shutdown
interface Ethernet1/2
  no switchport
  mtu 9216
  ip address 192.0.2.5/30
  ip ospf network point-to-point
  ip ospf cost 40
  ip router ospf UNDERLAY area 0.0.0.0
  ip pim sparse-mode
  no shutdown
feature bgp
nv overlay evpn
router bgp 65000
  router-id 10.255.0.1
  address-family l2vpn evpn
  neighbor 10.255.0.2
    remote-as 65000
    update-source loopback0
    address-family l2vpn evpn
      send-community
      send-community extended
      route-reflector-client
  neighbor 10.255.0.3
    remote-as 65000
    update-source loopback0
    address-family l2vpn evpn
      send-community
      send-community extended
      route-reflector-client

LEAF1

hostname LEAF1
feature ospf
feature pim
ip pim rp-address 10.255.0.1 group-list 239.1.1.0/24
router ospf UNDERLAY
  router-id 10.255.0.2
interface loopback0
  ip address 10.255.0.2/32
  ip router ospf UNDERLAY area 0.0.0.0
  ip pim sparse-mode
interface Ethernet1/1
  no switchport
  mtu 9216
  ip address 192.0.2.2/30
  ip ospf network point-to-point
  ip ospf cost 40
  ip router ospf UNDERLAY area 0.0.0.0
  ip pim sparse-mode
  no shutdown
feature nv overlay
feature vn-segment-vlan-based
vlan 10
  vn-segment 10010
interface Ethernet1/2
  switchport
  switchport mode access
  switchport access vlan 10
  spanning-tree port type edge
  no shutdown
interface nve1
  no shutdown
  source-interface loopback0
  host-reachability protocol bgp
  member vni 10010
    mcast-group 239.1.1.1
evpn
  vni 10010 l2
    rd auto
    route-target import 65000:10010
    route-target export 65000:10010
feature bgp
nv overlay evpn
router bgp 65000
  router-id 10.255.0.2
  address-family l2vpn evpn
  neighbor 10.255.0.1
    remote-as 65000
    update-source loopback0
    address-family l2vpn evpn
      send-community
      send-community extended

LEAF2

hostname LEAF2
feature ospf
feature pim
ip pim rp-address 10.255.0.1 group-list 239.1.1.0/24
router ospf UNDERLAY
  router-id 10.255.0.3
interface loopback0
  ip address 10.255.0.3/32
  ip router ospf UNDERLAY area 0.0.0.0
  ip pim sparse-mode
interface Ethernet1/1
  no switchport
  mtu 9216
  ip address 192.0.2.6/30
  ip ospf network point-to-point
  ip ospf cost 40
  ip router ospf UNDERLAY area 0.0.0.0
  ip pim sparse-mode
  no shutdown
feature nv overlay
feature vn-segment-vlan-based
vlan 10
  vn-segment 10010
interface Ethernet1/2
  switchport
  switchport mode access
  switchport access vlan 10
  spanning-tree port type edge
  no shutdown
interface nve1
  no shutdown
  source-interface loopback0
  host-reachability protocol bgp
  member vni 10010
    mcast-group 239.1.1.1
evpn
  vni 10010 l2
    rd auto
    route-target import 65000:10010
    route-target export 65000:10010
feature bgp
nv overlay evpn
router bgp 65000
  router-id 10.255.0.3
  address-family l2vpn evpn
  neighbor 10.255.0.1
    remote-as 65000
    update-source loopback0
    address-family l2vpn evpn
      send-community
      send-community extended
HostAddressGateway
H110.10.10.11/24none
H210.10.10.22/24none

Further reading

Key Takeaways

  • EVPN separates reachability advertisement from VXLAN packet forwarding.
  • Type 2 advertisements carry discovered MAC and optional IP information.
  • RD uniqueness and RT import/export have different purposes.
  • The reflector does not become the remote VTEP for reflected host reachability.
  • BUM handling remains necessary even with EVPN unicast learning.

MP-BGP EVPN Layer 2 VNI Quiz

Six questions · four options each · select one answer per question. Submit all answers to see your score and explanations.

1. Which EVPN route type advertises a MAC and optional IP binding?
2. What does the route target control here?
3. Must the reflector terminate each tenant VNI?
4. Which outer destination is used for H2?
5. Does EVPN remove the need for BUM delivery?
6. A BGP route exists but does not import into the local segment. What is a useful check?