End of Support

Resource Reservation Protocol for Traffic Engineering (RSVP-TE)

The Resource Reservation Protocol for Traffic Engineering (RSVP-TE) is utilized to distribute Multiprotocol Label Switching (MPLS) labels. This protocol enables steering traffic along defined paths while reserving the necessary bandwidth for them.

RSVP-TE is a signaling protocol for establishing Label Switched Paths (LSPs) with or without specific resource requirements, such as guaranteed bandwidth. RSVP-TE reserves resources along a predetermined path to ensure network performance for critical traffic. RSVP-TE is used for traffic engineering and fast reroute.

RSVP-TE consists of the following main messages:

Path: Sent by the headend router requesting the resources and is forwarded through the network from the headend towards the tailend router.
Resv: Sent by the tailend router in response to the Path message received, confirming the resource reservation and travels from the tailend towards the headend router.
Error Messages: PathErr (Path Error) and ResvErr (Resv Error). PathErrs flow from the error node towards the headend (in the opposite direction of Path messages), and ResvErrs flow from the error node towards the tailend (in the opposite direction of Resv messages).
Tear Messages: PathTear and ResvTear. These messages are used to clear the Path, or Resv states, from the network.

Each Resource Reservation Protocol message is composed of multiple objects that serve specific functions. For instance, a Path message contains objects such as SESSION and SENDER_TEMPLATE, and a Resv message includes objects such as SESSION and FILTER_SPEC.

RSVP-TE Path messages contain an explicit route object that specifies the IP addresses that the LSP must traverse to reach its destination.

All LSPs that have the same SESSION object are part of the same session. LSPs within the same session share resources, such as bandwidth (if using the Shared Explicit style, which is usually the case). Sessions generally correspond to a single tunnel created on the headend. Sessions are uniquely identified by the three values in the SESSION object, which include the destination IP address (or P2MP ID in the case of P2MP sessions), the tunnel-ID (which is just an allocated integer value), and the extended-tunnel-ID (which generally is set to the source IP address).

There are two objects required to uniquely identify an LSP within a session:

The SESSION object consists of the destination IP address, the tunnel ID, and the extended destination ID.
The LSP ID, which comes from the SENDER_TEMPLATE object for Path messages and the FILTER_SPEC object for Resv messages.

Sections in this chapter include:

LDP Pseudowire

LDP pseudowire provides support for emulating Ethernet connections over a Multiprotocol Label Switching (MPLS) network, and controlled using the extension of the MPLS Label Distribution Protocol (LDP).

The patch panel command allows patching a local interface connector to an LDP pseudowire connector, terminating on the local switch. Configure LDP pseudowire in the MPLS LDP Configuration Mode.

LDP pseudowire also supports locally patching traffic between two interfaces and configured under the patch panel command.

Configuring LDP Pseudowire

Local-Remote Patch Configuration

To configure an LDP pseudowire,complete the following task.

Enter the pseudowire configuration section under the mpls ldp configuration section, and specify an LDP pseudowire name using the pseudowire command. In this example, the selected LDP pseudowire name is ldppw.
```
switch(config)# mpls ldp
switch(config-mpls-ldp)# pseudowire
switch(config-mpls-ldp-pw)# pseudowire ldppw
```
Once an LDP pseudowire has been configured, configure the neighbor IP address, pseudowire ID, and pseudowire MTU using the neighbor, pseudowire-id, and mtu configuration commands.
```
switch(config-mpls-ldp-pw-ldppw)# neighbor 1.2.3.4
switch(config-mpls-ldp-pw-ldppw)# pseudowire-id 1
switch(config-mpls-ldp-pw-ldppw)# mtu 9000
```
To configure a cross-connection between two connectors, configure a pseudowire patch by specifying a patch name in the patch panel configuration section.
```
switch(config)# patch panel
switch(config-patch)# patch example
```
After entering a patch configuration mode, configure a type 4 LDP pseudowire by specifying a VLAN tagged interface connector and an LDP pseudowire connector using the connector command.
```
switch(config-patch-example)# connector interface ethernet1 dot1q vlan 100
switch(config-patch-example)# connector pseudowire ldp ldppw
```
After entering a patch configuration mode, configure a type 5 LDP pseudowire by specifying an interface connector and an LDP pseudowire connector using the connector command.
```
switch(config-patch-example)# connector interface ethernet1
switch(config-patch-example)# connector pseudowire ldp ldppw
```
Note: IP routing must be enabled and the interface used for the local connector must be routed.
```
switch(config)# ip routing
switch(config)# interface ethernet1
switch(config-if-Et1)# no switchport
```

Local-Local Patch Configuration

The patch can also consist of two interface connectors or two VLAN tagged interface connectors to configure local stitching.

switch(config-patch)# patch example
switch(config-patch-example)# connector conn1 ethernet1
switch(config-patch-example)# connector conn2 ethernet2
switch(config-patch)# patch example2
switch(config-patch-example2)# connector conn1 ethernet1 dot1q vlan 100
switch(config-patch-example2)# connector conn2 ethernet2 dot1q vlan 200

Note:IP routing must be enabled and both interfaces used for the local connectors must be routed.

switch(config)# ip routing
switch(config)# interface ethernet1
switch(config-if-Et1)# no switchport
switch(config)# interface ethernet2
switch(config-if-Et2)# no switchport

Additional Patch Configuration Commands

The shutdown configuration command can be used to disable a pseudowire patch.

Example

switch(config-patch-example)# shutdown

Forwarding Behavior For Layer 2 Control Packets

There are differences in forwarding behavior for reserved MACs between the Ethernet Tagged Mode and the Ethernet Raw Mode. Some Layer 2 control packets are terminated and consumed at the Provider Edge, while others are encapsulated and forwarded on the pseudowire. Below is a list of the common Layer 2 control packets, and a summary of their forwarding behavior.


	Ethernet Tagged Mode (type 4)	Ethernet Raw Mode (type 5)
STP	When STP is enabled, STP packets are terminated. Otherwise, they are forwarded.	Forwarded
LLDP	Terminated	Forwarded
LACP	Terminated	Terminated
MACsec	Not supported	Forwarded

In addition, custom Layer 2 Control Packet forwarding behavior for type 5 pseudowire can be configured using the Layer 2 Protocol Forwarding functionality.

Configuring LDP End-of-LIB

The LDP End-of-LIB (Label Information Base) provides a signaling enhancement defined in RFC 5919 that allows an LDP speaker to notify a neighbor after completing the advertisement of all labels in the LIB. EOS supports this feature for the following Pseudowire types:

Prefix FECs - Sends notification when labels for all local and remote IP prefixes have advertised.

Use the following commands to enable End-of-LIB for an LDP configuration:

switch(config)# mpls ldp
switch(config-mpls-ldp)# neighbor end-of-lib

Displaying LDP End-of-LIB Status

Use the show mpls ldp neighbor to display the LDP End-of-LIB status:

switch# show mpls ldp neighbor
Peer LDP ID: 10.2.2.2:0; Local LDP ID: 10.1.1.1:0
   TCP Connection: 10.2.2.2:43745 - 10.1.1.1:646
   State: oper; Msgs sent/rcvd: 50/51; downstream unsolicited
   Uptime: 0:07:30
   Keepalive tx interval: 10 sec; proposed local/peer: 10/10 sec
   Keepalive hold time: 30 sec; proposed local/peer: 30/30 sec; expires in: 24.97 sec
   End-of-LIB: 5 sent, 5 received
   Graceful restart: not supported
   Graceful restart rx time: reconnect: 0 sec; recovery: 0 sec
   LDP discovery sources:
      Ethernet1
   Addresses bound to peer:
      10.2.2.2       192.168.1.2       192.168.2.1

LDP Pseudowire Limitations

When a subinterface has been configured with the same VLAN tag as a pseudowire connector on the same parent interface, or vice versa, only the first configured feature will be active.

When a port-based connector is used for a pseudowire or local cross-connect patch, dot1q-tagged packets will have the outer tag incorrectly removed on ingress/encap if any one of several other features are configured on the switch (on any interface) including Layer 2 subinterfaces, Dot1q Tunnel, VLAN Mapping, and VXLAN. The only workaround is to unconfigure these other features.

When a VLAN-based connector (or subinterface with dot1q encapsulation) is used for a pseudowire or local cross-connect patch, tagged packets will have incorrect tags after forwarding if any one of several other features are configured on the switch (on any interface) including Layer 2 subinterfaces, Dot1q Tunnel, VLAN Mapping, and VXLAN. The only workaround is to unconfigure these other features.

LDP Pseudowire Show Commands

Use the show patch panel command to display the overall status of the configured pseudowire patches.

Example

switch# show patch panel 
Patch     Connector                            Status 	
--------- ------------------------------------ ----------
example   1: Ethernet3                         Up
          2: Port-Channel2
example2  1: Ethernet1 802.1Q VLAN 100         Up
          2: LDP neighbor 1.1.1.1 PW ID 1111
example3  1: LDP neighbor 4.4.4.4 PW ID 1040   Up
          2: Ethernet2

Use the show patch panel detail command to display the detailed status of the configured pseudowire patches.

Example

switch# show patch panel detail 
PW Fault Legend:
   ET-IN - Ethernet receive fault
   ET-OUT - Ethernet transmit fault
   TUN-IN - Tunnel receive fault
   TUN-OUT - Tunnel transmit fault
   NF - Pseudowire not forwarding (other reason)
Patch: example, Status: Up
   Connector 1: Ethernet3
      Status: Up
   Connector 2: Port-Channel2
      Status: Up
Patch: example2, Status: Up
   Connector 1: Ethernet1 802.1Q VLAN 100
      Status: Up
   Connector 2: LDP neighbor 1.1.1.1 PW ID 1111
      Status: Up
      Local MPLS label: 100032, Group ID: 0
         MTU: 9000, 802.1Q VLAN request sent: -
      Neighbor MPLS label: 900000, Group ID: 0x0
         MTU: 9000, 802.1Q VLAN request received: -
      PW type: 4 (tagged), Control word: N
      Tunnel type: LDP, Tunnel index: 198
Patch: example3, Status: Up
   Connector 1: LDP neighbor 4.4.4.4 PW ID 1040
      Status: Up
      Local MPLS label: 100002, Group ID: 0x0
         MTU: 1500, 802.1Q VLAN request sent: -
      Neighbor MPLS label: 400000, Group ID: 0x0
         MTU: 9213, 802.1Q VLAN request received: -
      PW type: 5 (raw), Control word: N
      Tunnel type: LDP, Tunnel index: 2
   Connector 2: Ethernet2
      Status: Up

Use the show patch panel forwarding command to display the forwarding information for configured pseudowire connectors.

Example

switch# show patch panel forwarding
Legend:
   Type - Pseudowire type: 4 (tagged)
                           5 (raw)
   CW - Control word used

In/Out                       Type CW VLAN Status Patch   	 
---------------------------- ---- -- ---- ------ ------------
Et1 802.1Q VLAN 100             4         Up     example2
   Label 900000, LDP Tun 198
Et2                             5         Up     example3
   Label 400000, LDP Tun 2 
Et3                                       Up     example
   Po2
Po2                                       Up     example
   Et3

PW Label Out                   Source Type CW Status Patch   	 
-------- --------------------- ------ ---- -- ------ ----------
100002   Et2                   LDP       5    Up     example3
100032   Et1 802.1Q VLAN 100   LDP       4    Up     example2

RSVP-TE Overview

The configuration for RSVP-TE is split into two parts:

RSVP-TE Configuration (previously LSR)
Configuring RSVP-TE Tunnels (previously LER)

Core Prerequisites and Global Configuration

For RSVP-TE to function correctly, several global and interface-level settings must be configured:

IP Routing: IP Routing must be enabled globally on the switch.
MPLS Enablement: MPLS must be enabled globally on the switch.
Traffic Engineering: Traffic-engineering must be enabled globally on the switch.
Router ID: A router ID must be configured in either the traffic-engineering configuration or the general routing configuration.
IGP Traffic Engineering: Traffic engineering must be active within the Interior Gateway Protocol (IGP), such as IS-IS or OSPF.
Interface Traffic Engineering: Traffic-engineering must be enabled on interfaces that use RSVP-TE.
Source Interface: A local interface, typically a Loopback interface, is required to derive the source IP address for tunnels.
Protocol Activation: RSVP is globally activated using the no shutdown command within the MPLS RSVP configuration submode.

Supported Scalability

Arista RSVP-TE supports various router roles, with performance capabilities validated through internal testing.

Table 1. Supported Scalability
Role	Description	Scale Highlights
RSVP-TE P2P LSPs	The maximum number of RSVP-TE P2P LSPs Arista supports in any role.	30k LSPs
RSVP-TE P2P Tunnels	The maximum number of RSVP-TE P2P Tunnels Arista supports on a headend.	2k (1k with hot-standby secondary)
RSVP-TE P2MP Sub-LSPs	The maximum number of RSVP-TE P2MP sub-LSPs Arista supports in any role.	10k sub-LSPs
RSVP-TE P2MP Tunnels	The maximum number of RSVP-TE P2MP tunnels Arista supports on a headend.	Up to 60 MVPN tunnels with up to 64 leaves each

RSVP-TE Limitations

Only IPv4 is supported.
Only the default VRF is supported.
Only strict EROs with host hops (/32) are supported.
TE links with secondary IP addresses are not supported.
Subinterface links are not supported.
Changing the RSVP FRR mode while a bypass tunnel is already in use could cause both the primary and bypass tunnels to go down, resulting in traffic loss.
Changing the RSVP SRLG mode while a bypass tunnel is already in use could cause both the primary and bypass tunnels to go down, resulting in traffic loss.
The maximum number of IS-IS/OSPFv2 routers supported by CSPF on a single broadcast network is 30.
The maximum number of IS-IS/OSPFv2 adjacencies supported by CSPF for a single router is 500.
The maximum number of hops supported for an RSVP LSP is 256.
CSPF considers a maximum of 16 SRLGs per TE link when excluding SRLGs during path computation.
Explicit-null label termination does not work on 7500R and 7280R/7280R2 platforms when additional labels (such as VPN labels) are present on the MPLS packet.

Related Topics:

Visibility and Monitoring Services

The Visability and Monitors Services chapter contains the following sections:

MPLS

These sections describe the Arista MPLS implementation:

Configuring MPLS

MPLS Overview

Multiprotocol Label Switching (MPLS) provides a networking process that replaces complete network addresses with short path labels for directing data packets to network nodes. The labels identify virtual links (paths) between distant nodes rather than endpoints. MPLS is scalable and protocol-independent. MPLS assigns labels to data packets and uses the labels to determine packet forwarding destinations without examining the packet.

Arista switches utilize MPLS to improve efficiency and control from servers through data centers and the WAN. The MPLS implementation supports manually configured static MPLS tunneling on each switch or established over a network by an SDN Controller. The configuration specifies a set of rules that filter packets based on matching criteria. Each rule applies MPLS-related actions to packets that match the rule criteria. Each rule includes a metric that the switch uses to select an action when multiple rules match a packet.

MPLS Implementation

MPLS static rule parameters contain the following information:

A 20-bit value compared to the top header label of each MPLS packet. Other rule parameters may be applied to packets with matching top-label values.
A next hop location that specifies the packet’s next destination, IPv4 or IPv6, and the interface through which the switch forwards the packet.
An MPLS label stack management action performed on filtered packets:
- pop-payload -Removes the top label from the stack and terminates an Label-Switched Path (LSP).
- swap-label -Replaces the top label with a specified new label and passes a packet along an LSP.
A rule metric to select a rule when multiple rules match an MPLS packet.

The switch drops packets that do not match any MPLS rules.

MPLSoGRE Filtered Mirroring

In MPLS over Generic Routing Encapsulation (MPLSoGRE) filtered mirroring, IPv4 over MPLS over GRE and IPv6 over MPLS over GRE packets that enter a GRE tunnel endpoint where MPLS performs a lookup, and selects packets for mirroring based on the destination IP address field in the inner IPv4 or IPv6 header.

Note: MPLS does not select packets for mirroring if forwarded based on either the L2 or outer L3 header destination address.

The header has the following format for the packets selected for mirroring:

When mirroring to a GRE tunnel, the payload of the outgoing GRE packet contains the payload of the incoming source packet starting from the MPLS header. EOS strips L2 and outer L3 headers from the mirror copy. When the MPLS lookup fails, the packet becomes eligible for mirroring based on the selection criteria defined in the ACL.

Mixed TTL/DSCP in MPLS Tunnel Termination

A Label Edge Router (LER) decapsulating an MPLS packet may choose to source the TTL and DSCP fields from either the MPLS header or the original inner IPv4 header. However, some applications need the TTL field value from the MPLS header, while retaining the DSCP from the original IPv4 header. Mixed TTL/DSCP in MPLS Tunnel Termination enables tunnel termination to select this specific mix of two modes.

This section contains the following topics:

Configuring Mixed TTL/DSCP in MPLS Tunnel Termination
Packet Support for IPv6

Configuring Mixed TTL/DSCP in MPLS Tunnel Termination

Configure mixed TTL/DSCP in MPLS tunnel termination with MPLS VRF decapsulation. Therefore, the switch requires a static VRF-to-MPLS-label map:

switch(config)# mpls ip
switch(config)# mpls static vrf-label mpls-label vrf vrf-name
switch(config)# ip routing vrf vrf-name

Use the TTL uniform and DSCP pipe options with the mpls tunnel termination command:

switch(config)# mpls tunnel termination model ttl uniform dscp pipe

Configure the TCAM profile:

switch(config)# hardware tcam
# May use any profile that provides “qos ip”
switch(config-tcam)# profile name copy default   
switch(config-tcam-profile-name)# feature qos ip
switch(config-tcam-profile-name-feature-qos-ip)# packet mpls ipv4 forwarding routed decap   
switch(config-tcam)# system profile name

Packet Support for IPv6

RFE 391109 brings mixed TTL/DSCP support for IPv6 over MPLS packets as well. The TCAM profile configuration is similar to the above IPv4 configuration:

switch(config)# hardware tcam
   # May use any profile that provides “qos ipv6”
switch(config-tcam)# profile name copy default
switch(config-tcam-profile-name)# feature qos ipv6
switch(config-tcam-profile-name-ipv4)# packet mpls ipv6 forwarding routed decap
switch(config-tcam)# system profile name

Support for MPLS Packets in IP ACLs

Ingress and egress IPv4 and IPv6 access-lists do not automatically match the inner IP header when processing IP over MPLS traffic.

EOS supports matching of the inner IP header in an access-list by adding the proper packet types to the corresponding TCAM features.

DSCP-to-TC Maps for MPLS Traffic to Layer 3 VRFs

MPLS-labeled traffic, both IPv4 and IPv6, can be decapsulated and routed using a specific VRF, either the default or a named VRF. The MPLS label can be statically assigned to a specific VRF, or dynamically through L3 EVPN MPLS. In this configuration, the switch adds a traffic class label based on a packet's ingress DSCP to the decapsulated MPLS packet if directed to a specific VRF. This provides an MPLS tunneling technique called Short Pipe Mode.

A QoS map steers the mapping of DSCP labels to a traffic class. Up to 10 custom maps can be applied. A map only uses hardware resources when attached to at least one VRF. When first creating a map, the DSCP-to-TC map copies the configuration from the global map, and subsequent changes to the global map do not have any effect on custom maps.

Configuring MPLS

Enable MPLS routing using the mpls ip command.

Use the following command to enable MPLS routing.

switch(config)# mpls ip
switch(config)# show running-config mpls ip
!

end
switch(config)#

The mpls static command creates MPLS rules. MPLS static rules identify a set of MPLS packets by a common top label and defines the method of handling these packets.

Use the following commands to create an MPLS rule that matches packets with a top label value of 3400 and causes the removal of the top label from the header stack. Configure the next hop destination of the IPv4 payload as the IPv4 address 10.14.4.4 using the interface ethernet 3/3/3. This rule has a metric value of 100.

switch(config)# mpls static top-label 3400 ethernet 3/3/3 10.14.4.4 pop payload-type ipv4
switch(config)# show running-config

!
mpls static top-label 3400 Ethernet3/3/3 10.14.4.4 pop payload-type ipv4
!

end
switch(config)#

These commands create a backup rule that forwards the packet through interface ethernet 4/3. This rule’s metric value of 150 assigns it backup status prior to the first rule.

switch(config)# mpls static top-label 3400 ethernet 4/3 10.14.4.4 pop payload-type ipv4 metric 150
switch(config)# show running-config

!
mpls static top-label 3400 Ethernet4/3 10.14.4.4 pop payload-type ipv4 metric 150
mpls static top-label 3400 Ethernet3/3/3 10.14.4.4 pop payload-type ipv4
!

end
switch(config)#

Create an MPLS rule that forwards the packet to the nexthop address through any interface:

switch(config)# mpls static top-label 4400 10.15.46.45 pop payload-type ipv4
switch(config)# show running-config

!
mpls static top-label 3400 Ethernet4/3 10.14.4.4 pop payload-type ipv4 metric 150
mpls static top-label 3400 Ethernet3/3/3 10.14.4.4 pop payload-type ipv4
mpls static top-label 4400 10.15.46.45 pop payload-type ipv4
!

end
switch(config)#

Configure a static tunnel for the tunnel endpoint 64.0.0.1 and add a label 11111 to it.

switch(config)# mpls static STATIC 64.0.0.1/32 54.0.0.1 Port-Channel7 label-stack 11111

The following example shows an MPLS swap route configuration. The following command swaps a packet with MPLS top label 3400 to 5600 for forwarding to 10.14.4.4.

switch(config)# mpls static top-label 3400 10.14.4.4 swap 5600
switch(config)#

The following example shows MPLS next-hop groups configuration for MPLS. The following commands configures the specification of a next hop group called TestGrp1 with two entries.

switch(config)# nexthop-group TestGrp1 type MPLS
switch(config-nexthop-group-TestGrp1)# size 2
switch(config-nexthop-group-TestGrp1)# entry 0 push label-stack 70 nexthop 10.20.30.5
switch(config-nexthop-group-TestGrp1)# entry 1 push label-stack 71 nexthop 10.20.30.6
switch(config-nexthop-group-TestGrp1)# exit
switch(config)#

The label-stack parameter accepts only one label. Tunnel-source and ttl commands do not apply to MPLS NexthopGroups. The nexthop entry resolves when the entry specifies a remote next hop. The show command indicates the resolved, directly-attached nexthop.

Display the switch’s MPLS static rule configuration for specified routes and rules using the show mpls route.

switch# show mpls config route
In-Label  Out-Label  Metric  Payload  NextHop
3400      pop        100     ipv4     10.14.4.4,Et3/3/3
3400      pop        150     ipv4     10.14.4.4,Et4/3
switch#

Display statistics about the configuration and implementation of MPLS rules using the show mpls route summary command.

switch# show mpls route summary
Number of Labels: 1 (1 unprogrammed)
Number of adjacencies in hardware: 0
Number of backup adjacencies: 2
switch#

The show mpls lfib route command displays the Label Forward Information Base of the switch.

switch(config)# show mpls lfib route
MPLS forwarding table (Label [metric] Vias) - 1 routes
MPLS next-hop resolution allow default route: False
Via Type Codes:
          M - MPLS via, P - Pseudowire via,
          I - IP lookup via, V - VLAN via,
          VA - EVPN VLAN aware via, ES - EVPN ethernet segment via,
          VF - EVPN VLAN flood via, AF - EVPN VLAN aware flood via,
          NG - Nexthop group via
Source Codes:
          G - gRIBI, S - Static MPLS route,
          B2 - BGP L2 EVPN, B3 - BGP L3 VPN,
          R - RSVP, LP - LDP pseudowire,
          L - LDP, M - MLDP,
          IP - IS-IS SR prefix segment, IA - IS-IS SR adjacency segment,
          IL - IS-IS SR segment to LDP, LI - LDP to IS-IS SR segment,
          BL - BGP LU, ST - SR TE policy,
          DE - Debug LFIB
 
 S   300      [100]
                via M, 192.0.2.2, swap 500
                 payload mpls, bypass egress-acl
                 interface Ethernet3/1
switch(config)#

The show ip route command displays all IP routes along with static MPLS push routes and Next hop Group routes.

switch(config)# show ip route
VRF name: default
 Codes: C - connected, S - static, K - kernel,
 O - OSPF, IA - OSPF inter area, E1 - OSPF external type 1,
 E2 - OSPF external type 2, N1 - OSPF NSSA external type 1,
 N2 - OSPF NSSA external type2, B I - iBGP, B E - eBGP,
 R - RIP, I L1 - ISIS level 1, I L2 - ISIS level 2,
 O3 - OSPFv3, A B - BGP Aggregate, A O - OSPF Summary,
 NG - Nexthop Group Static Route, V - VXLAN Control Service
 
Gateway of last resort is not set
C 192.0.2.0/24 is directly connected, Ethernet1/1
 S 3.3.3.0/24 [1/0] via 192.0.2.2, Ethernet1/1 label 200
 S 10.80.0.0/13 [1/0] via 172.24.0.1, Management1
 S 10.95.0.0/20 [1/0] via 172.24.0.1, Management1
 C 172.24.0.0/18 is directly connected, Management1
 S 172.16.0.0/12 [1/0] via 172.24.0.1, Management1
switch(config)#

The MPLS push routes are static routes so the show ip route static command also displays the output for an MPLS Nexthop Group assuming there is a route pointing to the NexthopGroup and the entries in the NexthopGroup are resolved. The output displays the information for show nexthop-group TestGrp1, the test group configured earlier.

switch(config)# show nexthop-group TestGrp1
TestGrp1
  Id 2
  Type MPLS
  Size 2
  Entries
   0 push label-stack 70 nexthop 10.20.30.5
   Tunnel destination directly connected, Ethernet2
   52:14:a3:a6:50:e8, Ethernet2
   1 push label-stack 71 nexthop 10.20.30.6
   Tunnel destination directly connected, Ethernet2
   52:14:a3:a6:50:e8, Ethernet2
switch(config)#

LSP Ping/Traceroute for MPLS Nexthop Group Tunnels

The ping/traceroute mpls tunnel nexthop-group command checks the liveness of Nexthop Group tunnel endpoint for an MPLS Nexthop Group.

The following displays the output for the ping command when specifying the endpoint.

switch(config)# rtrmpls1
switch(config-rtrmpls1)# ping mpls tunnel nexthop-group 100.0.116.1/32
LSP ping to nexthop-group tunnel 100.0.116.1/32
 
100.0.116.1/32: nexthop-group tunnel index 1 (nexthop-group name: nhg-100)
Entry 0
 Via 10.0.16.2
 Reply from 10.0.108.1: seq=1, time=507.546ms
Entry 1
 Via 10.0.16.8
 Reply from 10.0.113.1: seq=1, time=516.131ms
 
--- nexthop-group tunnel index 1, nexthop-group nhg-100: lspping statistics
        ---
Entry 0
 Via 10.0.16.2
 1 packets transmitted, 1 received, 0% packet loss, time 652ms
 1 received from 10.0.108.1, rtt min/max/avg 507.546/507.546/507.546 ms
 
Entry 1
 Via 10.0.16.8
 1 packets transmitted, 1 received, 0% packet loss, time 652ms
   1 received from 10.0.113.1, rtt min/max/avg 516.131/516.131/516.131ms

The following displays the output when specifying the endpoint in the traceroute command.

switch(config)# rtrmpls1
switch(config-rtrmpls1)# traceroute mpls tunnel nexthop-group 100.0.116.1/32
LSP traceroute to nexthop-group tunnel 100.0.116.1/32
Traceroute over nexthop-group tunnel index 1, nexthop-group nhg-100 Entry 1
Entry 1
  1  10.0.225.1        32.571ms
     label stack (top label first): 89
  2  10.0.227.1        42.866ms
     label stack (top label first): 109
  3  10.0.229.1        54.893ms
     label stack (top label first): 110
  4  10.0.231.1        15.946ms
     label stack (top label first): 111
  5  10.0.233.1        27.72ms
     label stack (top label first): 112
  6  10.0.113.1        36.383ms

The following displays the output for the ping command where the static route resolves over Nexthop Group tunnel(s).

switch(config-rtrmpls1)# ping mpls static ip 100.0.77.0/24
LSP ping to static MPLS push label route 100.0.77.0/24
 
100.0.77.0/24: nexthop-group tunnel index 1 (nexthop-group name: nhg-46)
Entry 0
   Via 10.0.25.5
   Reply from 10.0.51.1: seq=1, time=112.171ms
 
100.0.77.0/24: nexthop-group tunnel index 2 (nexthop-group name: nhg-64)
Entry 0
   Via 10.0.25.4
   Reply from 10.0.68.1: seq=1, time=121.809ms
Entry 1
   Via 10.0.25.9
   Reply from 10.0.76.1: seq=1, time=133.668ms
 
--- nexthop-group tunnel index 1, nexthop-group nhg-46: lspping statistics ---
Entry 0
   Via 10.0.25.5
   1 packets transmitted, 1 received, 0% packet loss, time 251ms
   1 received from 10.0.51.1, rtt min/max/avg 112.171/112.171/112.171 ms
 
 
--- nexthop-group tunnel index 2, nexthop-group nhg-64: lspping statistics ---
Entry 0
   Via 10.0.25.4
   1 packets transmitted, 1 received, 0% packet loss, time 251ms
   1 received from 10.0.68.1, rtt min/max/avg 121.809/121.809/121.809 ms
 
Entry 1
   Via 10.0.25.9
   1 packets transmitted, 1 received, 0% packet loss, time 251ms
   1 received from 10.0.76.1, rtt min/max/avg 133.668/133.668/133.668 ms

The following displays the output for the traceroute command where the static route resolves over Nexthop Group tunnel(s). The command randomly selects a tunnel.

switch(config-rtrmpls1)# traceroute mpls static ip 100.0.77.0/24LSP traceroute to 100.0.77.0/24
100.0.77.0/24: nexthop-group tunnel index 1 (nexthop-group name: nhg-46)
100.0.77.0/24: nexthop-group tunnel index 2 (nexthop-group name: nhg-64)
Traceroute over nexthop-group tunnel index 1, nexthop-group nhg-46 Entry 0
Entry 0
  1  10.0.83.1         382.798ms
     label stack (top label first): 35
  2  10.0.85.1         42.7ms
     label stack (top label first): 47
  3  10.0.87.1         55.815ms
     label stack (top label first): 48
  4  10.0.89.1         17.728ms
     label stack (top label first): 49
  5  10.0.91.1         29.452ms
     label stack (top label first): 50
  6  10.0.51.1         38.686ms

Configuring Egress IPv4 and IPv6 over MPLS ACLs

By default, IPv4 and IPv6 over MPLS packets use ACLs at the egress stage by default, applicable only to IPv4 and IPv6 over MPLS packets with a popped MPLS label. Override this behavior if required by disabling egress ACLs for certain MPLS labels. The switch does not require a special configuration to enable egress ACLs on IPv4 and IPv6 over MPLS packets.

Examples

This command disables egress ACLs for MPLS top-label 12000 on the egress interface 120.1.1.1 next hop address.
```
switch(config)# no mpls static top-label 12000 120.1.1.1 pop payload-type ipv6
switch(config)# 
```
This command enables egress ACLs for MPLS top-label 12000 on the egress interface 120.1.1.1 next hop address.
```
switch(config)# mpls static top-label 12000 120.1.1.1 pop payload-type ipv6 
switch(config)#
```

Configuring MPLSoGRE Filtered Mirroring

Configure the filtered mirroring of terminated MPLSoGRE packets by creating an IPv4 access list, and then attaching the IPv4 access list to a monitor session source with a tunnel decap group. This IPv4 access-list has rules that match to either inner IPv4 or IPv6 destination addresses.

Enabling the TC-Counters TCAM Profile

The following limitations apply to MPLSoGRE filtered mirroring in tc-counters TCAM profile:

EOS does not enforce security ACLs on IPv4oMPLSoGRE and IPv6oMPLSoGRE terminated packets.
Set the rules of a mirroring-ACL to match either inner IPv4 or inner IPv6 header fields, but not both.

The ACLs containing rules to match both inner IPv4 and inner IPv6 header fields do not apply to a single source interface in multiple mirroring sessions. In other words, all ACLs applied to a shared source interface must contain either inner IPv4 rules or inner IPv6 rules.

The following commands switch to the tc-counters TCAM profile in the running configuration.

switch(config)# hardware tcam
switch(config-hw-tcam)# system profile tc-counters
switch(config-hw-tcam)# exit

Defining Two IPv4 Access-Lists

The ip access-list command places the switch in ACL configuration mode, a group change mode that modifies an IPv4 access control list. The command specifies the name of the IPv4 ACL that subsequent commands modify and creates an ACL if it references a nonexistent list. All changes in a group change mode edit session are pending till the end of the session.

The permit (Role) command configures one access-list to match the inner IPv4 address, and the other access-list to match the inner IPv6 address.

switch(config)# ip access-list dIPv4
switch(config)# 10 permit ip any any inner ip any host 5.5.5.5
switch(config)# exit

switch(config)# ip access-list dIPv6
switch(config)# 10 permit ip any any inner ipv6 any host 55::55
switch(config)# exit

Attaching Access-Lists

The monitor session source and monitor session destination commands allow to attach two access lists to two different monitor session sources.

switch(config)# monitor session sess1 source et1 rx ip access-group dIPv4
switch(config)# monitor session sess1 destination tunnel mode gre source 1.1.1.1 destination 2.2.2.2
switch(config)# monitor session sess2 source et2 rx ip access-group dIPv6
switch(config)# monitor session sess2 destination tunnel mode gre source 3.3.3.3 destination 4.4.4.4
switch(config)# show monitor session

Session sess1
------------------------

Source Ports:

  Rx Only:     Et1(IP ACL: dIPv4)

Destination Ports:

        status    source    dest     TTL   DSCP  proto    VRF      fwd-drop
Gre1 :  active    1.1.1.1   2.2.2.2  128   0     0x88be   default  no


Session sess2
------------------------

Source Ports:

  Rx Only:     Et2(IP ACL: dIPv6), Et5(IP ACL: dIPv6)

Destination Ports:

        status   source    dest     TTL   DSCP  proto    VRF        fwd-drop
Gre2 :  active   3.3.3.3   4.4.4.4  128   0     0x88be   default    no

switch(config)#

Configuring Support IP ACLs for MPLS Packets

Configuring Ingress IP Access Control (ACL) List Support

To facilitate inner IP header matching, EOS supports two TCAM profile packet types:

packet mpls ipv4 forwarding bridged
packet mpls ipv4 forwarding mpls

The ingress inner IP header matching creates a user-defined profile with these new packet types. Although MAC access-lists do not match on the inner IP header, you must add this packet type in order to generate a lookup for MPLS packets if using MAC ACLs.

switch(config)# hardware tcam
switch(config-tcam)# profile MyMPLS copy default
switch(config-tcam-profile-MyMPLS)# feature acl port ip 
switch(config-tcam-feature-acl-port-ip)# packet mpls ipv4 forwarding bridged
switch(config-tcam-feature-acl-port-ip)# packet mpls ipv4 forwarding mpls
switch(config-tcam-feature-acl-port-ip)# exit
switch(config-tcam-profile-MyMPLS)# feature acl port ipv6
switch(config-tcam-feature-acl-port-ipv6)# packet mpls ipv6 forwarding bridged 
switch(config-tcam-feature-acl-port-ipv6)# packet mpls ipv6 forwarding mpls
switch(config-tcam-profile-MyMPLS)# feature acl port mac
switch(config-tcam-feature-acl-port-mac)# packet mpls ipv4 forwarding bridged
switch(config-tcam-feature-acl-port-mac)# packet mpls ipv4 forwarding mpls
switch(config-tcam-feature-acl-port-mac)# packet mpls ipv6 forwarding bridged
switch(config-tcam-feature-acl-port-mac)# packet mpls ipv6 forwarding mpls

EOS supports ingress on inner IP header matching in MPLS packets on PBR ACLs. To enable this, the following must be configured in a user-defined TCAM profile:

switch(config-tcam)profile pbr-acls copy default
switch(config-tcam-profile-pbr-acls)# feature pbr mpls
switch(config-tcam-feature-pbr-mpls)# packet ipv4 forwarding mpls
switch(config-tcam-feature-pbr-mpls)# exit
switch(config-tcam-profile-pbr-acls)# feature pbr mpls
switch(config-tcam-feature-pbr-mpls)# packet mpls ipv6 forwarding mpls

Configuring Egress IPv4 and IPv6 over MPLS ACLs

Examples

This command disables egress ACLs for MPLS top-label 12000 on the egress interface 120.1.1.1 next hop address.
```
switch(config)# no mpls static top-label 12000 120.1.1.1 pop payload-type ipv6
switch(config)# 
```
This command enables egress ACLs for MPLS top-label 12000 on the egress interface 120.1.1.1 next hop address.
```
switch(config)# mpls static top-label 12000 120.1.1.1 pop payload-type ipv6 
switch(config)#
```

Configuring MPLS Pop Terminated Packets

To enable the use of these qualifiers on MPLS-terminated packets by last label pop, this feature must be applied to the current TCAM profile, for example, MyMPLS:

switch(config)# hardware tcam
switch(config-tcam)# profile MyMPLS
switch(config-tcam-profile-MyMPLS)# feature acl port ip packet egress mpls-tunnelled-match
switch(config-tcam-feature-acl-port-ip-egress-mpls-tunnelled-match)#

By default, EOS does not enable this feature on all system profiles. Some TCAM profiles may also use the resources required by this feature. This requires verification to ensure the current user-defined TCAM profile supports this feature.

switch(config)# hardware tcam
switch(config-tcam)# profile egress-mpls copy MyMPLS

Configuring MPLS VRF-Decapsulated Packets

To enable the use of these new qualifiers on MPLS-terminated packets by last label VRF-label mapping, the packet type mpls ipv4 forwarding routed decap must be applied to at least one feature in the TCAM profile.

switch(config)# hardware tcam
switch(config-tcam)# profile VRF-Decap copy default
switch(config-tcam-profile-VRF-Decap)# feature qos ip packet mpls ipv4 forwarding routed decap

Supporting Traffic Policy on Interfaces

Access Control Lists (ACL) configures the action for packets traversing the packet processor pipeline based on different fields of packets. Usually, this requires the TCAM to match packets with multiple entries matching the list of IP addresses. The TCAM has limited resources, so traffic-policy performs transformation of the fields of the packet, and summarizes them in terms of the relevant rules this field matches by using command interface traffic-policy.

Custom TCAM Profile

The following commands enable a custom TCAM profile to support a traffic policy.

switch(config)# hardware tcam
switch(config-tcam)# profile traffic-policy
switch(config-tcam-profile-traffic-policy)# feature acl port mac
switch(config-tcam-feature-acl-port-mac)# sequence 55
switch(config-tcam-feature-acl-port-mac)# key size limit 160
switch(config-tcam-feature-acl-port-mac)# key field dst-mac ether-type src-mac
switch(config-tcam-feature-acl-port-mac)# action count drop
switch(config-tcam-feature-acl-port-mac)# packet ipv4 forwarding bridged
switch(config-tcam-feature-acl-port-mac)# packet ipv4 forwarding routed
switch(config-tcam-feature-acl-port-mac)# packet ipv4 forwarding routed multicast
switch(config-tcam-feature-acl-port-mac)# packet ipv4 mpls ipv4 forwarding mpls decap
switch(config-tcam-feature-acl-port-mac)# packet ipv4 mpls ipv6 forwarding mpls decap
switch(config-tcam-feature-acl-port-mac)# packet ipv4 non-VXLAN forwarding routed decap
switch(config-tcam-feature-acl-port-mac)# packet ipv4 VXLAN forwarding bridged decap
switch(config-tcam-feature-acl-port-mac)# packet ipv6 forwarding bridged
switch(config-tcam-feature-acl-port-mac)# packet ipv6 forwarding routed
switch(config-tcam-feature-acl-port-mac)# packet ipv6 forwarding routed decap
switch(config-tcam-feature-acl-port-mac)# packet ipv6 forwarding routed multicast
switch(config-tcam-feature-acl-port-mac)# packet ipv6 ipv6 forwarding routed decap
switch(config-tcam-feature-acl-port-mac)# packet mpls forwarding bridged decap
switch(config-tcam-feature-acl-port-mac)# packet mpls ipv4 forwarding mpls
switch(config-tcam-feature-acl-port-mac)# packet mpls ipv6 forwarding mpls
switch(config-tcam-feature-acl-port-mac)# packet mpls non-ip forwarding mpls
switch(config-tcam-feature-acl-port-mac)# packet non-ip forwarding bridged
switch(config-tcam-feature-acl-port-mac)# exit
switch(config-tcam-profile-traffic-policy)# feature forwarding-destination mpls
switch(config-tcam-feature-forwarding-destination-mpl)# sequence 100
switch(config-tcam-feature-forwarding-destination-mpl)# exit
switch(config-tcam-profile-traffic-policy)# feature mirror ip
switch(config-tcam-feature-mirror-ip)# sequence 80
switch(config-tcam-feature-mirror-ip)# key size limit 160
switch(config-tcam-feature-mirror-ip)# key field dscp dst-ip ip-frag ip-protocol l4-dst-port l4-ops l4-src-port src-ip tcp-control
switch(config-tcam-feature-mirror-ip)# action count mirror set-policer
switch(config-tcam-feature-mirror-ip)# packet ipv4 forwarding bridged
switch(config-tcam-feature-mirror-ip)# packet ipv4 forwarding routed
switch(config-tcam-feature-mirror-ip)# packet ipv4 forwarding routed multicast
switch(config-tcam-feature-mirror-ip)# packet ipv4 non-VXLAN forwarding routed decap
switch(config-tcam-feature-mirror-ip)# exit
switch(config-tcam-profile-traffic-policy)# feature mpls
switch(config-tcam-feature-mpls)# sequence 5
switch(config-tcam-feature-mpls)# key size limit 160
switch(config-tcam-feature-mpls)# action drop redirect set-ecn
switch(config-tcam-feature-mpls)#  packet ipv4 mpls ipv4 forwarding mpls decap
switch(config-tcam-feature-mpls)# packet ipv4 mpls ipv6 forwarding mpls decap
switch(config-tcam-feature-mpls)# packet mpls ipv4 forwarding mpls
switch(config-tcam-feature-mpls)# packet mpls ipv6 forwarding mpls
switch(config-tcam-feature-mpls)# packet mpls non-ip forwarding mpls
switch(config-tcam-feature-mpls)# exit
switch(config-tcam-profile-traffic-policy)# feature-pbr-ip
switch(config-tcam-feature-pbr-ip)#  sequence 60
switch(config-tcam-feature-pbr-ip)# key size limit 160
switch(config-tcam-feature-pbr-ip)# key field dscp dst-ip ip-frag ip-protocol l4-dst-port l4-ops-18b l4-src-port src-ip tcp-control
switch(config-tcam-feature-pbr-ip)# action count redirect
switch(config-tcam-feature-pbr-ip)# packet ipv4 forwarding routed
switch(config-tcam-feature-pbr-ip)# packet ipv4 mpls ipv4 forwarding mpls decap
switch(config-tcam-feature-pbr-ip)# packet ipv4 mpls ipv6 forwarding mpls decap
switch(config-tcam-feature-pbr-ip)# packet ipv4 non-VXLAN forwarding routed decap
switch(config-tcam-feature-pbr-ip)#  packet ipv4 VXLAN forwarding bridged decap
switch(config-tcam-feature-pbr-ip)# exit
switch(config-tcam-profile-traffic-policy)# feature-pbr-ipv6
switch(config-tcam-feature-pbr-ipv6)# sequence 30
switch(config-tcam-feature-pbr-ipv6)# key field dst-ipv6 ipv6-next-header l4-dst-port l4-src-port src-ipv6-high src-ipv6-low tcp-control
switch(config-tcam-feature-pbr-ipv6)# action count redirect
switch(config-tcam-feature-pbr-ipv6)# packet ipv6 forwarding routed
switch(config-tcam-feature-pbr-ipv6)# exit
switch(config-tcam-profile-traffic-policy)# feature pbr mpls
switch(config-tcam-feature-pbr-mpls)# sequence 65
switch(config-tcam-feature-pbr-mpls)# key size limit 160
switch(config-tcam-feature-pbr-mpls)# key field mpls-inner-ip-tos
switch(config-tcam-feature-pbr-mpls)# action count drop redirect
switch(config-tcam-feature-pbr-mpls)# packet mpls ipv4 forwarding mpls
switch(config-tcam-feature-pbr-mpls)# packet mpls ipv6 forwarding mpls
switch(config-tcam-feature-pbr-mpls)# packet mpls non-ip forwarding mpls
switch(config-tcam-feature-pbr-mpls)# exit
switch(config-tcam-profile-traffic-policy)# feature qos ip
switch(config-tcam-feature-qos-ip)# sequence 75
switch(config-tcam-feature-qos-ip)# key size limit 160
switch(config-tcam-feature-qos-ip)# key field dscp dst-ip ip-frag ip-protocol l4-dst-port l4-ops l4-src-port src-ip tckp-control
switch(config-tcam-feature-qos-ip)# action set-dscp set-policer set-tc
switch(config-tcam-feature-qos-ip)# packet ipv4 forwarding routed
switch(config-tcam-feature-qos-ip)# packet ipv4 forwarding routed multicast
switch(config-tcam-feature-qos-ip)# packet ipv4 mpls ipv4 forwarding mpls decap
switch(config-tcam-feature-qos-ip)# packet ipv4 mpls ipv6 forwarding mpls decap
switch(config-tcam-feature-qos-ip)# packet ipv4 non-VXLAN forwarding routed decap
switch(config-tcam-feature-qos-ip)# exit
switch(config-tcam-profile-traffic-policy)# feature qos ipv6
switch(config-tcam-feature-qos-ipv6)# sequence 70
switch(config-tcam-feature-qos-ipv6)# key field dst-ipv6 ipv6-next-header ipv6-traffic-class l4-dst-port l4-src-port src-ipv6-high src-ipv6-low
switch(config-tcam-feature-qos-ipv6)# action set-dscp set-policer set-tc
switch(config-tcam-feature-qos-ipv6)# packet ipv6 forwarding routed
switch(config-tcam-feature-qos-ipv6)# exit
switch(config-tcam-profile-traffic-policy)# feature traffic-policy port ipv4
switch(config-tcam-feature-traffic-policy-port-ipv4)# sequence 45
switch(config-tcam-feature-traffic-policy-port-ipv4)# key size limit 160
switch(config-tcam-feature-traffic-policy-port-ipv4)# key field dscp dst-ip-label icmp-type-code ip-frag ip-fragment-offset ip-length ip-protocol l4-dst-port
switch(config-tcam-feature-traffic-policy-port-ipv4)# l4-src-port src-ip-label tcp-control ttl
switch(config-tcam-feature-traffic-policy-port-ipv4)# action count drop log set-dscp set-tc
switch(config-tcam-feature-traffic-policy-port-ipv4)# packet ipv4 forwarding routed
switch(config-tcam-feature-traffic-policy-port-ipv4)# exit
switch(config-tcam-profile-traffic-policy)# feature traffic-policy port ipv6
switch(config-tcam-feature-traffic-policy-port-ipv6)# sequence 25
switch(config-tcam-feature-traffic-policy-port-ipv6)# key field dst-ipv6-label hop-limit icmp-type-code ipv6-length ipv6-next-header ipv6-traffic-class l4-dst-port
switch(config-tcam-feature-traffic-policy-port-ipv6)#  l4-src-port src-ipv6-label tcp-control
switch(config-tcam-feature-traffic-policy-port-ipv6)# action count drop log set-dscp set-tc
switch(config-tcam-feature-traffic-policy-port-ipv6)#  packet ipv6 forwarding routed
switch(config-tcam-feature-traffic-policy-port-ipv6)# exit
switch(config-tcam-profile-traffic-policy)# feature tunnel vxlan
switch(config-tcam-feature-vxlan-tunnel)# sequence 50
switch(config-tcam-feature-vxlan-tunnel)# key size limit 160
switch(config-tcam-feature-vxlan-tunnel)# packet ipv4 VXLAN eth ipv4 forwarding routed decap
switch(config-tcam-feature-vxlan-tunnel)# packet ipv4 VXLAN forwarding bridged decap
switch(config-tcam-feature-vxlan-tunnel)# exit
switch(config-tcam-profile-traffic-policy)#

Static Inter-VRF Route

The Static Inter-VRF Route feature adds support for static inter-VRF routes. This enables the configuration of routes to destinations in one ingress VRF with an ability to specify a next-hop in a different egress VRF through a static configuration.

You can configure static inter-VRF routes in default and non-default VRFs. A different egress VRF is achieved by “tagging” the next-hop or forwarding via with a reference to an egress VRF (different from the source VRF) in which that next-hop should be evaluated. Static inter-VRF routes with ECMP next-hop sets in the same egress VRF or heterogenous egress VRFs can be specified.

The Static Inter-VRF Route feature is independent and complementary to other mechanisms that can be used to setup local inter-VRF routes. The other supported mechanisms in EOS and the broader use-cases they support are documented here:

Configuration

The configuration to setup static-Inter VRF routes in an ingress (source) VRF to forward IP traffic to a different egress (target) VRF can be done in the following modes:

This command creates a static route in one ingress VRF that points to a next-hop in a different egress VRF.

switc(config)#ip | ipv6 route [vrf vrf-name destination-prefix [egress-vrf egress-next-hop-vrf-name]next-hop]

Show Commands

Use the show ip route vrf to display the egress VRF name if it differs from the source VRF.

Example

switch# show ip route vrf vrf1

VRF: vrf1
Codes: C - connected, S - static, K - kernel,
       O - OSPF, IA - OSPF inter area, E1 - OSPF external type 1,
       E2 - OSPF external type 2, N1 - OSPF NSSA external type 1,
       N2 - OSPF NSSA external type2, B - BGP, B I - iBGP, B E - eBGP,
       R - RIP, I L1 - IS-IS level 1, I L2 - IS-IS level 2,
       O3 - OSPFv3, A B - BGP Aggregate, A O - OSPF Summary,
       NG - Nexthop Group Static Route, V - VXLAN Control Service,
       DH - DHCP client installed default route, M - Martian,
       DP - Dynamic Policy Route, L - VRF Leaked

Gateway of last resort is not set

 S        1.0.1.0/24 [1/0] via 1.0.0.2, Vlan2180 (egress VRF default)
 S        1.0.7.0/24 [1/0] via 1.0.6.2, Vlan2507 (egress VRF vrf3)

Limitations

For bidirectional traffic to work correctly between a pair of VRFs, static inter-VRF routes in both VRFs must be configured.
Static Inter-VRF routing is supported only in multi-agent routing protocol mode.

Inter-VRF Local Route Leaking

Inter-VRF local route leaking allows the leaking of routes from one VRF (the source VRF) to another VRF (the destination VRF) on the same router. Inter-VRF routes can exist in any VRF (including the default VRF) on the system. Routes can be leaked using the following methods:

Inter-VRF Local Route Leaking using BGP VPN
Inter-VRF Local Route Leaking using VRF-leak Agent

Inter-VRF Local Route Leaking using BGP VPN

Inter-VRF Local Route Leaking allows the user to export and import routes from one VRF to another on the same device. This is implemented by exporting routes from a VRF to the local VPN table using the route target extended community list and importing the same route target extended community lists from the local VPN table into the target VRF. VRF route leaking is supported on VPN-IPv4, VPN-IPv6, and EVPN types.

Figure 1. Inter-VRF Local Route Leaking using Local VPN Table

Accessing Shared Resources Across VPNs

To access shared resources across VPNs, all the routes from the shared services VRF must be leaked into each of the VPN VRFs, and customer routes must be leaked into the shared services VRF for return traffic. Accessing shared resources allows the route target of the shared services VRF to be exported into all customer VRFs, and allows the shared services VRF to import route targets from customers A and B. The following figure shows how to provide customers, corresponding to multiple VPN domains, access to services like DHCP available in the shared VRF.

Route leaking across the VRFs is supported on VPN-IPv4, VPN-IPv6, and EVPN.

Figure 2. Accessing Shared Resources Across VPNs

Configuring Inter-VRF Local Route Leaking

Configure Inter-VRF Local Route Leaking using VPN-IPv4, VPN-IPv6, and EVPN. Prefixes can be exported and imported using any of the configured VPN types. Ensure that the same VPN type that is exported is used while importing.

Leaking unicast IPv4 or IPv6 prefixes is supported and achieved by exporting prefixes locally to the VPN table and importing locally from the VPN table into the target VRF on the same device as shown in the figure titled Inter-VRF Local Route Leaking using Local VPN Table using the route-target command.

Exporting or importing the routes to or from the EVPN table is accomplished with the following two methods:

Using VXLAN for encapsulation
Using MPLS for encapsulation

Using VXLAN for Encapsulation

To use VXLAN encapsulation type, make sure that VRF to VNI mapping is present and the interface status for the VXLAN interface is up. This is the default encapsulation type for EVPN.

Example

The configuration for VXLAN encapsulation type is as follows:

switch(config)# router bgp 65001
switch(config-router-bgp)# address-family evpn
switch(config-router-bgp-af)# neighbor default encapsulation VXLAN next-hop-self source-interface Loopback0
switch(config)# hardware tcam
switch(config-hw-tcam)# system profile VXLAN-routing
switch(config-hw-tcam)# interface VXLAN1
switch(config-hw-tcam-if-Vx1)# VXLAN source-interface Loopback0
switch(config-hw-tcam-if-Vx1)# VXLAN udp-port 4789
switch(config-hw-tcam-if-Vx1)# VXLAN vrf vrf-blue vni 20001
switch(config-hw-tcam-if-Vx1)# VXLAN vrf vrf-red vni 10001

Using MPLS for Encapsulation

To use MPLS encapsulation type to export to the EVPN table, MPLS needs to be enabled globally on the device and the encapsulation method needs to be changed from default type, that is VXLAN to MPLS under the EVPN address-family sub-mode.

Example

switch(config)# router bgp 65001
switch(config-router-bgp)# address-family evpn
switch(config-router-bgp-af)# neighbor default encapsulation mpls next-hop-self source-interface Loopback0

Route-Distinguisher

Route-Distinguisher (RD) uniquely identifies routes from a particular VRF. Route-Distinguisher is configured for every VRF from which routes are exported from or imported into.

Use the following commands to configure Route-Distinguisher for a VRF.

switch(config-router-bgp)# vrf vrf-services
switch(config-router-bgp-vrf-vrf-services)# rd 1.0.0.1:1

switch(config-router-bgp)# vrf vrf-blue 
switch(config-router-bgp-vrf-vrf-blue)# rd 2.0.0.1:2

Exporting Routes from a VRF

Use the route-target export command to export routes from a VRF to the local VPN or EVPN table using the route target extended community list.

Examples

These commands export routes from vrf-red to the local VPN table.

switch(config)# service routing protocols model multi-agent
switch(config)# mpls ip
switch(config)# router bgp 65001
switch(config-router-bgp)# vrf vrf-red
switch(config-router-bgp-vrf-vrf-red)# rd 1:1
switch(config-router-bgp-vrf-vrf-red)# route-target export vpn-ipv4 10:10
switch(config-router-bgp-vrf-vrf-red)# route-target export vpn-ipv6 10:20

These commands export routes from vrf-red to the EVPN table.

switch(config)# router bgp 65001
switch(config-router-bgp)# vrf vrf-red
switch(config-router-bgp-vrf-vrf-red)# rd 1:1
switch(config-router-bgp-vrf-vrf-red)# route-target export evpn 10:1

Importing Routes into a VRF

Use the route-target import command to import the exported routes from the local VPN or EVPN table to the target VRF using the route target extended community list.

Examples

These commands import routes from the VPN table to vrf-blue.

switch(config)# service routing protocols model multi-agent
switch(config)# mpls ip
switch(config)# router bgp 65001
switch(config-router-bgp)# vrf vrf-blue
switch(config-router-bgp-vrf-vrf-blue)# rd 2:2
switch(config-router-bgp-vrf-vrf-blue)# route-target import vpn-ipv4 10:10
switch(config-router-bgp-vrf-vrf-blue)# route-target import vpn-ipv6 10:20

These commands import routes from the EVPN table to vrf-blue.

switch(config)# router bgp 65001
switch(config-router-bgp)# vrf vrf-blue
switch(config-router-bgp-vrf-vrf-blue)# rd 2:2
switch(config-router-bgp-vrf-vrf-blue)# route-target import evpn 10:1

Importing BGP Route Target Ranges for VRFs

EOS supports BGP route target ranges specifically for route import and allows configuring a range of route targets for importing routes into VRFs.

Use the following syntax to configure importing route target ranges into a VRF, labtest, on BGP 65511, with a vpn-ipv4 range of 65501-65502:1-2:

switch(config)# router bpg 65511
switch(config-router-bgp)# vrf labtest
switch(config-router-bgp-vrf-labtest)# route-target import vpn-ipv4 range 65501-65502:1-2

For EVPN, configure route target ranges using a BGP configuration for a specific VRF or an address family within a VRF:

Specific VRF

switch(config)# router bpg 65511
switch(config-router-bgp)# vrf labtest
switch(config-router-bgp-vrf-labtest)# route-target import evpn range 65501-65502:1-2

Address Family

switch(config)# router bpg 65511
switch(config-router-bgp)# vrf labtest
switch(config-router-bgp-vrf-labtest)# address-family ipv4
switch(config-router-bgp-vrf-labtest-af)# route-target import evpn range 65501-65502:1-2

The configurations also apply to VPN IPv4 and VPN IPv6. For Flowspec IPv4 and IPv6, configure the ranges on a specific VRF. ASDOT notation can be used for AS route target ranges.

Exporting and Importing Routes using Route Map

To manage VRF route leaking, control the export and import prefixes with route-map export or import commands. The route map is effective only if the VRF or the VPN paths are already candidates for export or import. The route-target export or import commandmust be configured first. Setting BGP attributes using route maps is effective only on the export end.

Note: Prefixes that are leaked are not re-exported to the VPN table from the target VRF.

Examples

These commands export routes from vrf-red to the local VPN table.

switch(config)# service routing protocols model multi-agent
switch(config)# mpls ip
switch(config)# router bgp 65001
switch(config-router-bgp)# vrf vrf-red
switch(config-router-bgp-vrf-vrf-red)# rd 1:1
switch(config-router-bgp-vrf-vrf-red)# route-target export vpn-ipv4 10:10
switch(config-router-bgp-vrf-vrf-red)# route-target export vpn-ipv6 10:20
switch(config-router-bgp-vrf-vrf-red)# route-target export vpn-ipv4 route-map EXPORT_V4_ROUTES_T0_VPN_TABLE
switch(config-router-bgp-vrf-vrf-red)# route-target export vpn-ipv6 route-map EXPORT_V6_ROUTES_T0_VPN_TABLE

These commands export routes to from vrf-red to the EVPN table.

switch(config)# router bgp 65001
switch(config-router-bgp)# vrf vrf-red
switch(config-router-bgp-vrf-vrf-red)# rd 1:1
switch(config-router-bgp-vrf-vrf-red)# route-target export evpn 10:1
switch(config-router-bgp-vrf-vrf-red)# route-target export evpn route-map EXPORT_ROUTES_T0_EVPN_TABLE

These commands import routes from the VPN table to vrf-blue.

switch(config)# service routing protocols model multi-agent
switch(config)# mpls ip
switch(config)# router bgp 65001
switch(config-router-bgp)# vrf vrf-blue
switch(config-router-bgp-vrf-vrf-blue)# rd 1:1
switch(config-router-bgp-vrf-vrf-blue)# route-target import vpn-ipv4 10:10
switch(config-router-bgp-vrf-vrf-blue)# route-target import vpn-ipv6 10:20
switch(config-router-bgp-vrf-vrf-blue)# route-target import vpn-ipv4 route-map IMPORT_V4_ROUTES_VPN_TABLE
switch(config-router-bgp-vrf-vrf-blue)# route-target import vpn-ipv6 route-map IMPORT_V6_ROUTES_VPN_TABLE

These commands import routes from the EVPN table to vrf-blue.

switch(config)# router bgp 65001
switch(config-router-bgp)# vrf vrf-blue
switch(config-router-bgp-vrf-vrf-blue)# rd 2:2
switch(config-router-bgp-vrf-vrf-blue)# route-target import evpn 10:1
switch(config-router-bgp-vrf-vrf-blue)# route-target import evpn route-map IMPORT_ROUTES_FROM_EVPN_TABLE

Inter-VRF Local Route Leaking using VRF-leak Agent

Inter-VRF local route leaking allows routes to leak from one VRF to another using a route map as a VRF-leak agent. VRFs are leaked based on the preferences assigned to each VRF.

Configuring Route Maps

To leak routes from one VRF to another using a route map, use the router general command to enter Router-General Configuration Mode, then enter the VRF submode for the destination VRF, and use the leak routes command to specify the source VRF and the route map to be used. Routes in the source VRF that match the policy in the route map will then be considered for leaking into the configuration-mode VRF. If two or more policies specify leaking the same prefix to the same destination VRF, the route with a higher (post-set-clause) distance and preference is chosen.

Example

These commands configure a route map to leak routes from VRF1 to VRF2 using route map RM1.

switch(config)# router general
switch(config-router-general)# vrf VRF2
switch(config-router-general-vrf-VRF2)# leak routes source-vrf VRF1 subscribe-policy RM1
switch(config-router-general-vrf-VRF2)#

EVPN VXLAN Single-Gateway Centralized Routing

In a traditional EVPN VXLAN centralized anycast gateway deployment, multiple Layer 3 VXLAN Tunnel Endpoints (VTEPs) serve the role of the centralized anycast gateway. For the hosts to have a consistent ARP binding for any of the individual centralized gateway VTEPs, each VTEP operating as a centralized gateway has a configuration with a virtual router MAC (VARP MAC). All of the L3 VTEPs operating as centralized gateways share a virtual VTEP IP (VARP VTEP IP). Each centralized gateway VTEP also advertises an EVPN type-3 route for both of the primary VTEP IP and VARP VTEP IP, so the IPs end up in the overlay floodset.

The traditional configuration works fine, but in the specific case of a network with only a single L3 VTEP centralized gateway or single MLAG pair operating as the L3 VTEP centralized gateway, this leads to unnecessary BUM traffic. When both the physical VTEP IP and the VARP IP end up in the overlay floodset, BUM traffic duplicates to the centralized gateway, which can create overhead workloads with a lot of broadcast or multicast traffic. Because only a single centralized gateway exists, it is not necessary to have a VARP VTEP IP to provide a stable ARP binding for the gateway.

The EVPN VXLAN Single-Gateway Centralized Routing feature enables a single L3 VTEP or single MLAG pair operating as an anycast gateway and does not require a VARP VTEP IP. And eliminates the duplicate BUM traffic caused by the VARP VTEP IP in the overlay floodset. It accomplishes this with two changes:

A change to the default ARP behavior when a host sends ARPs for the MAC address associated with a virtual IP address (SVI IP).
Previously, sending ARPs for a virtual IP returned different MAC address bindings, depending on whether or not a VARP VTEP IP was configured. If a VARP VTEP IP was configured, the ARP request returned the configured VARP MAC. If one was not, the ARP request returns the switch router MAC. This feature changes the behavior to always respond with the configured VARP MAC to an ARP request for a virtual IP. This closes an exception to the rule that virtual IPs are always associated with the VARP MAC.
A new EVPN MAC VRF configuration command that generates an EVPN type-2 route for the VARP MAC with a nexthop of the physical VTEP IP.

In a traditional EVPN centralized anycast gateway development, the presence of a configured VARP VTEP IP advertises an EVPN type-2 route for the VARP MAC with a nexthop of the VARP VTEP IP. This allows TOR switches to learn the ARP binding of the centralized anycast gateway as the default gateway. With this feature, you do not have to configure a VARP VTEP IP and requires an alternative method to advertise the appropriate EVPN route. This feature adds a new EVPN MAC VRF configuration command, redistribute router-mac next-hop vtep primary, when configured on a MAC VRF, advertises an EVPN type-2 route for the VARP MAC with a nexthop of the primary VTEP IP. This allows TOR switches to learn the ARP binding of the centralized anycast gateway.

EVPN and VCS Commands

Global Configuration Mode

router general

Router BGP Configuration Mode

next-hop resolution disabled
redistribute service vxlan
route-target
route-target export
route-target import
route-target route-map
vlan (VLAN-AWARE-Bundle configuration mode)
vni-aware-bundle

Router BGP Address-Family Configuration Mode

encapsulation vxlan layer-3 set next-hop igp-cost

VCS Commands

redistribute bgp evpn vxlan

EVPN VXLAN Commands

bfd vtep evpn
redistribute router-mac next-hop vtep primary

E-Tree Commands

e-tree
remote leaf host drop
show e-tree vlan

Display Commands

show bgp evpn
show bgp evpn sanity
show e-tree vlan
show ip bgp vrf
show ip route vrf
show ipv6 bgp vrf
show ipv6 route vrf
show l2rib input all
show l2Rib input VXLAN-control-service
show l2rib output
show service vxlan address-table
show vrf leak flapping
show VXLAN control-plane

bfd vtep evpn

The bfd vtep evpn command to configure the BGP PIC Edge for EVPN VXLAN routes for remote VTEPs. This command is configured under the VXLAN Tunnel Interface (VTI).

The no bfd vtep evpn command removes bfd vtep evpn configuration from the running-config.

Command Mode

VXLAN Tunnel Interface (VTI) Mode

Command Syntax

bfd vtep evpn interval interval-milliseconds min-rx min-rx-milliseconds multiplier multiplier-range

no bfd vtep evpn interval interval-milliseconds min-rx min-rx-milliseconds multiplier multiplier-range

Parameters

interval Set transmit rate in milliseconds.
- interval-milliseconds Rate in milliseconds. Value ranges from 50 to 60000 milliseconds.
min-rx Set expected minimum incoming rate in milliseconds.
- min-rx-milliseconds Rate in milliseconds. Value ranges from 50 to 60000 milliseconds.
multiplier Sets the BFD multiplier.
- multiplier-range The value ranges from 3 to 50.

Example

In this example (assuming symmetric configuration on other PE devices) any BFD for VXLAN session initiated on the VTI would have a detect time of 300ms (interval of 100ms multiplied by 3).

switch(config-if-Vx1)# bfd vtep evpn interval 100 min-rx 100 multiplier 3

encapsulation VXLAN layer-3 set next-hop igp-cost

The encapsulation VXLAN layer-3 set next-hop igp-cost command configures the underlay IGP metric for the VTEP reachability to be considered for BGP best path selection in the IP VRF that is importing the EVPN route.

The no encapsulation VXLAN layer-3 set next-hop igp-cost or default encapsulation VXLAN layer-3 set next-hop igp-cost command removes all the IGP cost for VTEP running configurations on the switch.

Command Mode

BGP Address-Family Configuration

Command Syntax

encapsulation VXLAN layer-3 set next-hop igp-cost

no encapsulation VXLAN layer-3 set next-hop igp-cost

default encapsulation VXLAN layer-3 set next-hop igp-cost

Example

The following command configures the IGP cost for VTEP feature on the switch :

switch(config-router-bgp)# address-family evpn
switch(config-router-bgp-af)# [no | default] encapsulation VXLAN layer-3 set next-hop igp-cost

e-tree

The vlan e-tree places the switch in VLAN configuration mode and allows configuration of E-Tree. By default, all VLANs have the E-Tree root role.Use the no e-tree role leaf to set the VLAN to the default role, root.

Command Mode

VLAN Configuration Mode

Command Syntax

[vlan vlan_id] e-tree role leaf

Parameters

vlan vlan_id - Specify the VLAN to configure E-Tree.
role - Specify the role of the VLAN.
leaf - Specify the role as leaf.

Examples

Use the following command to set VLAN 100 as an E-Tree leaf role:

switch(config)# vlan 100
            switch(config-vlan-100)# e-tree role leaf

To return the VLAN to the E-tree role root, use the following command:

switch(config)# vlan 100
            switch(config-vlan-100)# no e-tree role leaf

ip hardware fib vxlan

leak routes

The leak routes command configures an inter-VRF route-leaking policy to allow routes to be leaked from one VRF to another using a route map.

The no leak routes and default leak routes commands remove the specified route-leaking policy from running-config.

Command Mode

Router General Configuration

Command Syntax

leak routes source-vrf source_name subscribe-policy route_map

no leak routes source-vrf source_name

default leak routes source-vrf source_name

Example

These commands configure routes to be leaked from VRF VRF1 to VRF VRF2 according to the policy described in route-map RM1.

switch(config)# router general
switch(config-router-general)# vrf VRF2
switch(config-router-general-vrf-VRF2)# leak routes source-vrf VRF1 subscribe-policy RM1
switch(config-router-general-vrf-VRF2)# exit
switch(config-router-general)# exit
switch(config)#

next-hop resolution disabled

The next-hop resolution disabled command disables the next-hop resolution in routes received from BGP-EVPN peers.

The no next-hop resolution disabled and the default next-hop resolution disabled commands enable the next-hop resolution in routes received from BGP-EVPN peers.

Command Mode

Router-BGP Address-Family Configuration

Command Syntax

next-hop resolution disabled

Example

This command disables the next-hop resolution in routes received from BGP-EVPN peers.

switch(config)# router bgp 65002
switch(config-router-bgp)# address-family evpn
switch(config-router-bgp-af)# next-hop resolution disabled
switch(config-router-bgp-af)#

redistribute bgp evpn VXLAN

The redistribute bgp evpn VXLAN command enables BGP-EVPN routes to be redistributed to VCS, which in turn advertises them to all VTEPs within the DC.

The no redistribute bgp evpn VXLAN and the default redistribute bgp evpn VXLAN commands disable the redistribution of BGP-EVPN routes to VCS.

Command Mode

CVX-VXLAN Configuration

Command Syntax

redistribute bgp evpn VXLAN

Example

This command enables redistribution of BGP-EVPN routes to VCS.

switch(config)# cvx
switch(config-cvx)# no shutdown
switch(config-cvx)# service VXLAN
switch(config-cvx-VXLAN)# no shutdown
switch(config-cvx-VXLAN)# redistribute bgp evpn VXLAN

redistribute router-mac next-hop vtep primary

Use the redistribute router-mac next-hop vtep primary command in the MAC VRF configuration mode to advertise an EVPN type-2 route for the VARP MAC with a nexthop of the primary VTEP IP.

Configuration Mode

MAC VRF

Command Syntax

redistribute router-mac next-hop vtep primary [router-mac | next-hop | vtep | primary]

Parameters

router-mac Router Ethernet address.
next-hop Cnfigure the advertised next-hop.
vtep Associate next-hop with a VTEP.
primary Use the primary VTEP IP.

Example

The following example uses the command redistribute router-mac next-hop vtep primary in the MAC VRF configuration.

switch(config)# router bgp 65003
switch(config-router-bgp-65003)# neighbor 223.255.255.1 remote-as 65001
switch(config-router-bgp-65003)# neighbor 223.255.255.2 remote-as 65002
switch(config-router-bgp-65003)# neighbor 223.255.255.4 remote-as 65003

switch(config)# vlan 100
switch(config-vlan-100)# rd 1:100
switch(config-vlan-100-rd-100)# route-target both 1:100
switch(config-vlan-100-rd-100)# redistribute learned
switch(config-vlan-100-rd-100)# redistribute router-mac next-hop vtep primary  
  
switch(config)# vlan 200
switch(config-vlan-200)# rd 1:200
switch(config-vlan-100-rd-200)# route-target both 1:200
switch(config-vlan-100-rd-200)# redistribute learned
switch(config-vlan-100-rd-200)# redistribute router-mac next-hop vtep primary

redistribute service VXLAN

The redistribute service VXLAN command enables BGP to redistribute the Layer 2 bridging information received from VCS.

The no redistribute service VXLAN and the default redistribute service VXLAN commands disable the redistribution of the bridging information received from VCS.

Command Mode

Router-BGP VNI Configuration

Command Syntax

redistribute service VXLAN

Example

This command enables redistribution of the Layer 2 bridging information received from VCS.

switch(config)# router bgp 100
switch(config-router-bgp)# vni-aware-bundle bundle1
switch(config-macvrf-bundle1)# redistribute service VXLAN

remote leaf host drop

The remote leaf host drop command allows the configuration of per-VLAN explicit drop routes for E-Tree.

Command Mode

VLAN E-Tree Configuration Mode

Command Syntax

remote leaf host drop

Example

Use the following commands to configure per-VLAN explicit drop routes for VLAN 100:

switch(config)#vlan 100
switch(config-vlan-100)#e-tree role leaf
            switch(config-vlan-etree-100)#remote leaf host drop

route-target

The route-target command configures a well-known extended community that is used by BGP-EVPN to export routes from or import routes into MAC-VRF.

The no route-target and default route-target commands delete the route-target configuration.

Command Mode

Router-BGP VNI Configuration

Syntax

route-target [export | import | both] rt

no route-target

default route-target

Parameters

export configures a well-known extended community that is attached to the routes exported by BGP-EVPN.
import configures a well-knownextended community that identifies the received routes that need to be imported into the MAC-VRF specified by the VNI bundle.
both configures the same extended community for import and export of routes.
rt route-target extended community.

Example

This command configures a well-known extended community for import and export of routes.

switch(config)# router bgp 100
switch(config-router-bgp)# vni-aware-bundle bundle1
switch(config-macvrf-bundle1)# route-target both 503:12
switch(config-macvrf-bundle1)#

route-target export

The route-target export command allows you to export routes from a VRF to the local VPN table using the route target extended community list.

The no route-target export and default route-target export commands remove the routes from the VPN table.

Command Mode

Router-BGP VNI Configuration

Syntax

route-target export [evpn | vpn-ipv4 | vpn-ipv6] RT

no route-target export

default route-target export

Parameters

evpn EVPN address family.
vpn-ipv4 MPLS L3 VPN IPv4 unicast address family.
vpn-ipv6 MPLS L3 VPN IPv6 unicast address family.
RT route-target extended community.

Examples

These commands export routes from vrf-red to the VPN table.

switch(config)# service routing protocols model multi-agent
switch(config)# mpls ip
switch(config)# router bgp 65001
switch(config-router-bgp)# vrf vrf-red
switch(config-router-bgp-vrf-vrf-red)# rd 1:1
switch(config-router-bgp-vrf-vrf-red)# route-target export vpn-ipv4 10:10
switch(config-router-bgp-vrf-vrf-red)# route-target export vpn-ipv6 10:20

These commands export routes from vrf-red to the EVPN table.

switch(config)# router bgp 65001
switch(config-router-bgp)# vrf vrf-red
switch(config-router-bgp-vrf-vrf-red)# rd 1:1
switch(config-router-bgp-vrf-vrf-red)# route-target export evpn 10:1

route-target import

The route-target import command allows you to import route-target extended community lists from the local VPN table to the target VRF.

The no route-target import and default route-target import commands remove the routes from the VPN table.

Command Mode

Router-BGP VNI Configuration

Command Syntax

route-target import [evpn | vpn-ipv4 | vpn-ipv6] range route_target any-as:value

no route-target import

default route-target import

Parameters

evpn - Specify EVPN address family.
vpn-ipv4 - Specify MPLS L3 VPN IPv4 unicast address family.
vpn-ipv6 - Specify MPLS L3 VPN IPv6 unicast address family.
range_target - Specify a route-target extended community or a range of targets.
any-as: value - Specify a Local Administrator (LA) value from 0 to 4294967295. Any two octet AS route target matching the LA value imports the route target.

Examples

These commands import routes from the VPN table to vrf-blue.

switch(config)# service routing protocols model multi-agent
switch(config)# mpls ip
switch(config)# router bgp 65001
switch(config-router-bgp)# vrf vrf-blue
switch(config-router-bgp-vrf-vrf-blue)# rd 2:2
switch(config-router-bgp-vrf-vrf-blue)# route-target import vpn-ipv4 10:10
switch(config-router-bgp-vrf-vrf-blue)# route-target import vpn-ipv6 10:20

These commands import routes from the EVPN table to vrf-blue.

switch(config)# router bgp 65001
switch(config-router-bgp)# vrf vrf-blue
switch(config-router-bgp-vrf-vrf-blue)# rd 2:2
switch(config-router-bgp-vrf-vrf-blue)# route-target import evpn 10:1

route-target route-map

The route-target route-map command allows you to export and import route target extended community lists from one VRF to another using route maps.

The no route-target route-map and default route-target route-map commands remove the routes from the VPN table.

Command Mode

Router-BGP VNI Configuration

Command Syntax

route-target [import | export][evpn | vpn-ipv4 | vpn-ipv6] route-map RM

no route-target route-map

default route-target route-map

Parameters

evpn EVPN address family.
vpn-ipv4 MPLS L3 VPN IPv4 unicast address family.
vpn-ipv6 MPLS L3 VPN IPv6 unicast address family.
RM route-map extended community.

Examples

These commands export routes from vrf-red to the VPN table.

switch(config)# service routing protocols model multi-agent
switch(config)# mpls ip
switch(config)# router bgp 65001
switch(config-router-bgp)# vrf vrf-red
switch(config-router-bgp-vrf-vrf-red)# rd 1:1
switch(config-router-bgp-vrf-vrf-red)# route-target export vpn-ipv4 10:10
switch(config-router-bgp-vrf-vrf-red)# route-target export vpn-ipv6 10:20
switch(config-router-bgp-vrf-vrf-red)# route-target export vpn-ipv4 route-map EXPORT_V4_ROUTES_T0_VPN_TABLE
switch(config-router-bgp-vrf-vrf-red)# route-target export vpn-ipv6 route-map EXPORT_V6_ROUTES_T0_VPN_TABLE

These commands export routes from vrf-red to the EVPN table.

switch(config)# router bgp 65001
switch(config-router-bgp)# vrf vrf-red
switch(config-router-bgp-vrf-vrf-red)# rd 1:1
switch(config-router-bgp-vrf-vrf-red)# route-target export evpn 10:1
switch(config-router-bgp-vrf-vrf-red)# route-target export evpn route-map EXPORT_ROUTES_T0_EVPN_TABLE

These commands import routes from the VPN table to vrf-blue.

switch(config)# service routing protocols model multi-agent
switch(config)# mpls ip
switch(config)# router bgp 65001
switch(config-router-bgp)# vrf vrf-blue
switch(config-router-bgp-vrf-vrf-blue)# rd 1:1
switch(config-router-bgp-vrf-vrf-blue)# route-target import vpn-ipv4 10:10
switch(config-router-bgp-vrf-vrf-blue)# route-target import vpn-ipv6 10:20
switch(config-router-bgp-vrf-vrf-blue)# route-target import vpn-ipv4 route-map IMPORT_V4_ROUTES_VPN_TABLE
switch(config-router-bgp-vrf-vrf-blue)# route-target import vpn-ipv6 route-map IMPORT_V6_ROUTES_VPN_TABLE

These commands import routes from the EVPN table to vrf-blue.

switch(config)# router bgp 65001
switch(config-router-bgp)# vrf vrf-blue
switch(config-router-bgp-vrf-vrf-blue)# rd 2:2
switch(config-router-bgp-vrf-vrf-blue)# route-target import evpn 10:1
switch(config-router-bgp-vrf-vrf-blue)# route-target import evpn route-map IMPORT_ROUTES_FROM_EVPN_TABLE

router general

The router general command places the switch in Router-General Configuration Mode for the configuration of protocol-independent routing.

The no router general and default router general commands remove all protocol-independent routing configuration from running-config.

Command Mode

Global Configuration

Command Syntax

router general

no router general

default router general

Example

These commands place the switch in Router-General Configuration Mode and display the commands available there.

switch(config)# router general
switch(config-router-general)# ?
  command            Configuration command
  control-functions  Routing control functions configuration
  hardware           Configure hardware-specific parameters
  next-hops          Next hop configuration
  rib                Routing table
  route              Route commands
  route-map          Route-map source configuration
  router-id          Configure a general router ID for all routing processes
  segment-routing    Segment Routing configuration
  software           Software configuration
  vrf                Enter VRF sub-mode

switch(config-router-general)#

router multicast vrf leak

The router multicast command places the switch in router multicast configuration mode to configure virtual routing and forwarding multicast traffic.

Command Mode

Global Configuration

Command Syntax

router multicast vrf vrf-receiver-epvn leak group [prefix-list prefix-list-name][vrf vrf-name]

Parameters

vrf-receiver-epvn - The name of the VRF receiver
group - Traffic groups to leak
prefix-list prefix-list-name- The name of the traffic group
vrf vrf-name - The source of the multicast traffic

Example

The following command places the switch in router multicast configuration mode.

switch(config)# router multicast
switch(config-router-multicast)# vrf vrf-receiver-evpn1 leak
switch(config-router-multicast-vrf-vrf-receiver-evpn1)#leak group prefix-list prefix-list-name1 vrf traffic-source-vrf-name1

show bgp evpn

The show bgp evpn command displays information about the BGP-EVPN routes of the switch.

Command Mode

Global Configuration

Command Syntax

Parameters

no parameters - Displays all routes of the switch.
community - Displays routes filtered by the specified community. Options include:
- GSHUT - Displays the well known GSHUT community.
- aa:nn - Displays the AS and network number, separated by a colon. The value ranges from 1 to 4294967295.
- internet - Advertises route to the Internet community.
- local-as - Advertises route only to local peers.
- no-advertise -Does not advertise the route to any peer.
- no-export - Advertises route only within the BGP-EVPN AS boundary.
- comm_num - Displays the community number. Values range from 1 to 4294967040.
detail - Displays detailed information of routes.
esi esid - Displays routes filtered by the specified Ethernet Segment Identifier (ESI).
extcommunity - Displays routes that match with BGP or VPN extended community list. Options include:
- esi-label esid - Displays routes filtered by the specified value of ESI label. The value ranges from 0 to 16777215.
- mac-mobility - Displays routes filtered by the specified MAC mobility.
- rt - Displays routes filtered by the specified route target.
- tunnel-encap VXLAN - Displays routes filtered by the VXLAN tunnel encapsulation.
- router-mac H.H.H - Displays routes filtered by the specified router MAC address.
host-flap - Displays routes that contains MAC addresses blacklisted due to duplication.
instance - Displays routes with EVPN instances.
large-community AS:nn:nn - Displays routes filtered by the specified large community.
next-hop - Displays routes filtered by next-hop IPv4 or IPv6 addresses of remote VTEP.
rd admin:local-assignment - Displays routes filtered by the specified Route Distinguisher (RD).
route-type - Displays routes filtered by NLRI route type.
summary - Displays a summary of routes.
vni vni_num - Displays routes filtered by the specified VXLAN Network Identifier (VNI). Value ranges from 1 to 4294967294.

Examples

This command displays BGP-EVPN routes filtered by the VNI 3011.

switch(config-router-bgp-af)# show bgp evpn vni 3011
BGP routing table information for VRF default
Router identifier 2.0.2.2, local AS number 65002
Route status codes: s - suppressed, * - valid, > - active, # - not installed, E - ECMP head, e - ECMP
                    S - Stale, c - Contributing to ECMP, b - backup
                    % - Pending BGP convergence
Origin codes: i - IGP, e - EGP, ? - incomplete
AS Path Attributes: Or-ID - Originator ID, C-LST - Cluster List, LL Nexthop - Link Local Nexthop

         Network                Next Hop            Metric  LocPref Weight  Path
 * >Ec   RD: 3.3.3.1:3011 auto-discovery 0 009a:f13b:53bb:8800:0000
                                1.1.1.1               -       100     0       65999 65001 i
 *  ec   RD: 3.3.3.1:3011 auto-discovery 0 009a:f13b:53bb:8800:0000
                                1.1.1.1               -       100     0       65999 65001 i
 * >     RD: 3.3.3.2:3011 auto-discovery 0 009a:f13b:53bb:8800:0000
                                -                     -       -       0        i
 * >Ec   RD: 3.3.3.1:3011 imet 1.1.1.1
                                1.1.1.1               -       100     0       65999 65001 i
 *  ec   RD: 3.3.3.1:3011 imet 1.1.1.1
                                1.1.1.1               -       100     0       65999 65001 i
 * >     RD: 3.3.3.2:3011 imet 1.1.1.2
                                -                     -       -       0        i
cvx(config-router-bgp-af)#

This command displays the prefixes exported to the respective VPN table, along with the route distinguisher.

switch(config)# show bgp evpn
BGP routing table information for VRF default
Router identifier 1.1.1.1, local AS number 65001
Route status codes: s - suppressed, * - valid, > - active, # - not installed, E - ECMP head, e - ECMP
                    S - Stale, c - Contributing to ECMP, b - backup
                    % - Pending BGP convergence
Origin codes: i - IGP, e - EGP, ? - incomplete
AS Path Attributes: Or-ID - Originator ID, C-LST - Cluster List, LL Nexthop - Link Local Nexthop
         Network                Next Hop            Metric  LocPref Weight  Path
 * >     RD: 400:1 ip-prefix 45.0.0.1/32
                                -                     -       -       0        i
 * >     RD: 400:1 ip-prefix 52.0.0.1/32
                                -                     -       -       0        i
 * >     RD: 400:1 ip-prefix 120.0.0.0/24
                                -                     -       -       0        i
 * >     RD: 400:1 ip-prefix 130.0.0.0/24
                                -                     -       -       0        i
 * >     RD: 400:1 ip-prefix 130.0.1.0/24

show bgp evpn sanity

The show bgp evpn command displays information about the BGP-EVPN configuration attributes such as any inconsistencies as well as potential errors in the EVPN operational state.

The command performs the following sanity checks for EVPN:

Domain encapsulation consistency
Default-gateway redistribution override detection
MAC-VRF route-distinguisher check to warn for duplicate local RDs
D-PATH domain ID verification
Domain ID uniqueness
Type 5 route configuration validation
Remote RD/RT checks
MAC-VRF neighbor verification
I-ES encapsulation consistency check for DCI environments

Command Mode

Global Configuration

Command Syntax

show bgp evpn sanity [brief | detail]

Parameters

The output displays the following categories when detecting inconsistencies or warnings:

General EVPN
Layer 2 EVPN
Layer 3 EVPN
EVPN VXLAN
EVPN MPLS
EVPN DCI

Examples

The command displays the following output when detecting an inconsistency in the General EVPN configuration and a warning for the Layer 2 EVPN configuration:

switch# show bgp evpn sanity
Category     Status
---------    -------
General      FAIL
L2           WARN

Thecommand displays the following output when detecting a missing configuration on the EVPN peer 10.0.0.2 and the MAC-VRF 100 does not import or export a route target. All other verifications pass the sanity checks.

switch# show bgp evpn sanity brief
Category Check                Status Detail
-------- -------------------- ------ -------------------------------------------------
General  Send community       FAIL   Extended community not sent to 10.0.0.2
L2       MAC-VRF route-target WARN   The MAC-VRF VLAN 100 does not import or export a route-target
         import and export

The show bgp evpn sanity detail command displays all individual verifications regardless of the status:

switch show bgp evpn sanity detail
General  Send community       FAIL   Extended community not sent to 10.0.0.2                                                     
General  Multi-agent mode     OK                                                         
General  Neighbor established OK   
General  Domain encapsulation OK
         consistency
L2       MAC-VRF route-target WARN   The MAC-VRF VLAN 100 does not import or export a                                                        
         import and export           route-target                                                             
L2       MAC-VRF              OK                                                         
         route-distinguisher                                                             
L2       MAC-VRF local        OK
         neighbor configured
L2       MAC-VRF redistribute OK                                                         
L2       MAC-VRF SVI IP       OK
         redistribution
         consistency
L2       MAC-VRF overlapping  OK                                                         
         VLAN                                                                            
L2       Suppressed MAC       OK                                                         
VXLAN    VLAN to VNI map for  OK                                                         
         MAC-VRF                                                                         
VXLAN    VRF to VNI map for   OK                                                         
         IP-VRF     
DCI      MAC-VRF remote route OK
         distinguisher
DCI      MAC-VRF remote route OK
         target import and
         export
DCI      MAC-VRF remote       OK
         neighbor configured
DCI      Domain-ID uniqueness OK
DCI      D-PATH EVPN          OK
         Domain-ID
DCI      Type 5 routes with   OK
         next-hop-self and
         path aggregation
DCI      Type 5 routes with   OK
         next-hop-self and
         multi-domain VRF
DCI      I-ES Encapsulation   OK
         Consistency

show e-tree vlan

The show e-tree vlan command displays configuration information about E-Tree on VLANs.

Command Mode

EXEC

Command Syntax

show e-tree vlan

Example

To display information about E-Tree on VLANs, use the following command:

switch# show e-tree vlan
VLAN       E-Tree Role    Remote Leaf Install Mode
---------- -------------- ------------------------
100        Leaf           Install drop route
200        Leaf           Do not install

show ip bgp vrf

The show ip bgp vrf command displays the type of VPN from the imported route. It indicates that the IPv4 route has been leaked and displays source VRF information.

Command Mode

Global Configuration

Command Syntax

show ip bgp vrf [vrf_name | all | default]

Parameters

vrf_name name of the VRF.
all displays summary of all VRFs.
default default virtual routing and forwarding instance.

Example

This command displays the leaked and source VRF information.

switch(config)# show ip bgp 13.0.0.0/24 vrf vrf-blue
BGP routing table information for VRF vrf-blue
Router identifier 5.0.0.2, local AS number 65001
BGP routing table entry for 130.110.61.0/24
   4.0.0.3 from 4.0.0.3 (52.0.0.1), imported EVPN route, RD 400:1
      Origin IGP, metric -, localpref 100, weight 0, valid, external,best
      Extended Community: Route-Target-AS:4000:1 TunnelEncap:tunnelTypeVXLAN 
EvpnRouterMac:74:83:ef:0b:70:f3
      Leaked from VRF vrf-red

show ip route vrf

The show ip route vrf command displays leaked prefixes with the labelL in the output that indicates that the IPv4 route has been leaked. It also displays information about the source VRF from which these prefixes have been leaked.

Command Mode

Global Configuration

Command Syntax

show ip route vrf [vrf_name | all]

Parameters

vrf_name name of the VRF.
all displays summary of all VRFs.

Example

These commands display the OSPF or OSPFV3 leaked routes as redistribute ospf and redistribute ospfv3 are configured on the source VRF vrf-red.

switch(config)# show ip route vrf vrf-blue
VRF: vrf-blue
Codes: C - connected, S - static, K - kernel,
       O - OSPF, IA - OSPF inter area, E1 - OSPF external type 1,
       E2 - OSPF external type 2, N1 - OSPF NSSA external type 1,
       N2 - OSPF NSSA external type2, B I - iBGP, B E - eBGP,
       R - RIP, I L1 - IS-IS level 1, I L2 - IS-IS level 2,
       O3 - OSPFv3, A B - BGP Aggregate, A O - OSPF Summary,
       NG - Nexthop Group Static Route, V - VXLAN Control Service,
       DH - DHCP client installed default route, M - Martian,
       DP - Dynamic Policy Route, L - VRF Leaked
Gateway of last resort is not set
C       5.0.0.2/31 is directly connected, Ethernet14
B L  57.0.0.3/32 [200/0] (source VRF vrf-red) via 4.0.0.3, Ethernet11
B L  45.0.0.1/32 [200/0] (source VRF vrf-red) via 4.0.0.3, Ethernet11
B L  52.0.0.1/32 [200/0] (source VRF vrf-red) via 4.0.0.3, Ethernet11
B L  120.0.0.0/24 [200/0] (source VRF vrf-red) via 4.0.0.3, Ethernet11
B L  130.0.0.0/24 [200/0] (source VRF vrf-red) via 4.0.0.3, Ethernet11
B L  130.0.1.0/24 [200/0] (source VRF vrf-red) via 4.0.0.3, Ethernet11
B L  130.0.2.0/24 [200/0] (source VRF vrf-red) via 4.0.0.3, Ethernet11
B L  130.0.3.0/24 [200/0] (source VRF vrf-red) via 4.0.0.3, Ethernet11

show ipv6 bgp vrf

The show ipv6 bgp vrf command displays the type of VPN from the imported route. It shows an indication that the IPv6 route has been leaked and source VRF information is displayed.

Command Mode

Global Configuration

Command Syntax

show ipv6 bgp vrf [vrf_name | all | default]

Parameters

vrf_name name of the VRF.
all displays a summary of all VRFs.
default default virtual routing and forwarding instance.

Example

This command displays the leaked and source VRF information.

switch(config)# show ipv6 bgp 2001:10:1:0::102/64 vrf default
BGP routing table information for VRF default
Router identifier 218.218.218.218, local AS number 34
Route status codes: s - suppressed, * - valid, > - active, # - not installed, E 
- ECMP head, e - ECMP
                    S - Stale, c - Contributing to ECMP, b - backup, L - 
labeled-unicast
                    % - Pending BGP convergence
Origin codes: i - IGP, e - EGP, ? - incomplete
AS Path Attributes: Or-ID - Originator ID, C-LST - Cluster List, LL Nexthop - 
Link Local Nexthop

         Network                Next Hop              Metric  LocPref Weight  Path
 * >     2000:0:14:120::/64     2001:db8:1111:9000::  -       100     109     i
 *       2000:0:14:120::/64     2001:db8:156:1010::2  -       100     0       i
 *       2000:0:14:120::/64     2001:db8:152:1010::2  -       100     0       i
 *       2000:0:14:120::/64     2001:db8:203:1010::2  -       100     0       i

show ipv6 route vrf

The show ipv6 route vrf command displays leaked prefixes with the labelL in the output that indicates that the IPv6 route has been leaked. It also displays information about the source VRF from which these prefixes have been leaked.

Command Mode

Global Configuration

Command Syntax

show ipv6 route vrf [vrf_name | all]

Parameters

vrf_name the name of the VRF.
all displays a summary of all VRFs.

Example

These commands display the OSPF or OSPFV3 leaked routes as redistribute ospf and redistribute ospfv3 are configured on the source VRF vrf-red.

switch(config)# show ipv6 route vrf vrf-blue
VRF: vrf-blue
Displaying 802 of 802 IPv6 routing table entries
Codes: C - connected, S - static, K - kernel, O3 - OSPFv3, B - BGP, R - RIP, A B - BGP Aggregate, 
I L1 - IS-IS level 1, I L2 - IS-IS level 2, DH - DHCP, NG - Nexthop Group Static Route, M - Martian, 
DP - Dynamic Policy Route, L - VRF Leaked
  B L   18::1/128 [200/0] (source VRF vrf-red)
       via 4::3, Ethernet11
  B  L  6::2/127 [200/0] (source VRF vrf-red)
       via fe80::7683:efff:fe0b:963d, Ethernet11
  B  L  45::1/128 [200/0] (source VRF vrf-red)
       via fe80::7683:efff:fe0b:963d, Ethernet11
  B  L  130::/64 [200/0] (source VRF vrf-red)
       via fe80::7683:efff:fe0b:963d, Ethernet11
  B  L  130:0:0:1::/64 [200/0] (source VRF vrf-red)
       via fe80::7683:efff:fe0b:963d, Ethernet11
  B  L  130:0:0:2::/64 [200/0] (source VRF vrf-red)
       via fe80::7683:efff:fe0b:963d, Ethernet11
  B  L  130:0:0:3::/64 [200/0] (source VRF vrf-red)

show l2rib input all

Use the show l2rib input all command to display the Layer 2 RIB input tables migration process.

Command Mode

EXEC

Command Syntax

Parameters

detail Displays a more comprehensive output.
floodset Displays L2Rib floodset from input source.
- vlan Filter by VLAN ID.
- vtep Filter by VTEP.
interface Filter by destination interface.
- Ethernet Ethernet interface.
- Port-Channel Link Aggregation Group (LAG).
mac H.H.H Filter by MAC address.
vlan vlan_id Filter by VLAN ID.
vtep Filter by VTEP.
- A.B.C.D IP address of VTEP.
- A:B:C:D:E:F:G:H IP address of VTEP.

show l2Rib input VXLAN-control-service

Use the show l2Rib input VXLAN-control-service to display the migration processes for the VXLAN control service.

Command Mode

EXEC

Command Syntax

Parameters

detail Displays a more comprehensive output.
floodset Displays L2Rib floodset from input source.
- vlan Filter by VLAN ID.
- vtep Filter by VTEP.
interface Filter by destination interface.
- Ethernet Ethernet interface.
- Port-Channel Link Aggregation Group (LAG).
mac Filter by MAC address.
- H.H.H Ethernet address.
vlan vlan_id Filter by VLAN ID.
vtep Filter by VTEP.
- A.B.C.D IP address of VTEP.
- A:B:C:D:E:F:G:H IP address of VTEP.

show l2rib output

Use the show l2rib output command to display the the Layer 2 RIB utput tables migration process.

Command Mode

EXEC

Command Syntax

Parameters

detail Displays a more comprehensive output.
floodset Displays L2Rib floodset from input source.
- vlan Filter by VLAN ID.
- vtep Filter by VTEP.
interface Filter by destination interface.
- Ethernet Ethernet interface.
- Port-Channel Link Aggregation Group (LAG).
mac H.H.H Filter by MAC address.
vlan vlan_id Filter by VLAN ID.
vtep Filter by VTEP.
- A.B.C.D IP address of VTEP.
- A:B:C:D:E:F:G:H IP address of VTEP.

show service VXLAN address-table

The show service VXLAN address-table command displays route entries in the MAC forwarding table that are added through the CVX.

Command Mode

CVX Global Configuration

Command Syntax

show service VXLAN address-table {advertised | received}[address H.H.H | evpn | hsc | mss | switch [Word | all] | vni vnid | vtep A.B.C.D]

Parameters

advertised displays the advertised route entries in the MAC forwarding table.
received displays the received route entries in the MAC forwarding table.
address H.H.H displays route entries that are filtered by the specified MAC addresses.
evpn displays route entries filtered by BGP-EVPN.
hsc displays route entries filtered by Hardware Switch Controller (HSC).
mss displays route entries filtered by Macro Segmentation Service (MSS).
switch displays route entries that are filtered by the specified switch or all switches. Options include:
- Word Hostname, IP address or ID of the switch.
- all all switches.
vni vnid displays route entries filtered by the specified VXLAN Network Identifier (VNI). Value ranges from 1 to 4294967294.
vtep A.B.C.D displays route entries filtered by the specified IP address of the remote Virtual Tunnel End Point (VTEP).

Examples

This command displays the route entries in MAC forwarding table advertised to BGP-EVPN peers.

cvx# show service VXLAN address-table advertised evpn

         Advertised Mac Address Table
----------------------------------------------------------
VNI          Mac Address    VTEP         Moves
----------- ----------------- --------------- -----
1000         02:01:62:01:00:00 10.0.0.1         1
Total Mac Addresses for this criterion: 1

         Advertised Flood Table
---------------------------------------------------
VNI         Mac Address       VTEP(s)
---------- ----------------- ------------------------------
1000        00:00:00:00:00:00  10.0.0.1     10.0.0.2
Total Mac Addresses for this criterion: 1
cvx#

This command displays the route entries in MAC forwarding table received from BGP-EVPN peers.

switch# show service VXLAN address-table received evpn

      Received Mac Address Table
-------------------------------------------------------------
Source      VNI      Mac Address        VTEP       Moves
----------- -------- ----------------- ----------- -----
EVPN        1000     02:01:62:02:00:00  10.0.0.3   1
Total Mac Addresses for this criterion: 1

      Received Flood Table
--------------------------------------------------------------
Source          VNI      Mac Address    VTEP
----------------- ----------- ----------------- --------------
EVPN            1000     00:00:00:00:00:00 10.0.0.3
EVPN            1000     00:00:00:00:00:00 10.0.0.4
Total Mac Addresses for this criterion: 2
switch#

show vrf leak flapping

The show vrf leak flapping command displays the flapping prefixes of the routes leaked from one VRF to another VRF. Routes that are detected as “flapping” are blocked considering the future leaking policy execution.

Command Mode

EXEC

Command Syntax

show vrf leak flapping

Parameters

destination displays flapping prefixes destined to a VRF.
prefix displays flapping routes for a prefix.
source displays flapping prefixes sourced from a VRF.
vrf displays flapping prefixes associated with a VRF.

Example

This command displays the flapping prefixes of the leaked routes.

switch# show vrf leak flapping

  Age       Source VRF       Destination VRF       Prefix            Created At 
-------- ---------------- --------------------- ----------------- ------------- 
  141       VRF1             VRF2                  10.0.2.0/24    3357281.40992

show VXLAN control-plane

To enable the user to quickly view which control planes and sources are importing reachability information into which VLANs, use the following show command:

Command Mode

EXEC

Command Syntax

show VXLAN control-plane [ export vlan [ $ | vlan_id]|import vlan [$ | vlan_id]][vlan [$ | vlan_id]

Parameters

export Restricts output to VLANs exporting to a control plane.
- vlan Specifies specific VLANs to display control plane information.
  - $ List end.
  - vlan_id VLAN ID. Range 1-4094.
import Restricts output to VLANs importing from a control plane.
- $ List end.
- vlan_id VLAN ID. Range 1-4094.
vlan Specifies specific VLANs to display control plane information.
- $ List end.
- vlan_id VLAN ID. Range 1-4094.

vlan (VLAN-AWARE-Bundle configuration mode)

The vlan add/ remove command configures the VLAN range string in a VLAN-AWARE-BUNDLE. When the add and remove options are not used, the currently configured range is replaced by the new one. The add and remove options update the currently configured range-aware bundles by adding or removing the provided VLAN range from the currently configured range respectively.

Command Mode

VLAN-AWARE-BUNDLE Configuration

Command Syntax

vlan [add | remove] range

Parameter

range is the range specified.

Example

These commands take an existing vlan-aware-bundle configuration, corporate_100, and modify it with the add and remove options.

(Existing configuration for corporate_100)
vlan-aware-bundle corporate_100
  rd 1.1.1.1:100
  route-target both 100:100
  vlan 1-10

switch(config-vlan-aware-bundle)#vlan add 1000

(Modified configuration for corporate_100)
vlan-aware-bundle corporate_100
  rd 1.1.1.1:100
  route-target both 100:100
  vlan 1-10, 1000
  
switch(config-vlan-aware-bundle)#vlan remove 5

(Updated configuration for corporate_100)
vlan-aware-bundle corporate_100
  rd 1.1.1.1:100
  route-target both 100:100
  vlan 1-4, 6-10, 1000

vni-aware-bundle

The vni-aware-bundle command configures a BGP MAC-VRF containing Layer 2 routes from a group of VXLAN Network Identifiers (VNI).

Command Mode

Router BGP Configuration

Command Syntax

vni-aware-bundle vni_bundle_name

Parameter

vni_bundle_name VNI bundle name.

Example

This command configures MAC-VRF BGP to support VNI bundle1.

cvx(config)# router bgp 100
cvx(config-router-bgp)# vni-aware-bundle bundle1
cvx(config-macvrf-bundle1)#

EVPN Multicast VRF Leaking

Overview

EVPN Multicast virtual routing and forwarding (VRF) Leaking forwards multicast traffic from a sender in a tenant or external domain (VRF) to a different domain (VRF) with connected receivers. The source VRF refers to the VRF of the multicast sender, and the receiver VRF refers to the VRF of the multicast receiver.

Typically, a multicast receiver sends IGMP messages to a multicast stream, and a last hop router converts the IGMP message to a Protocol Independent Multicast (PIM) message and propagates them upstream on the network. When a VRF receives an IGMP or PIM message, a corresponding VRF leak occurs where the IGMP or PIM messages leak to the source VRF, which the source VRF processes. The corresponding EVPN Selective Multicast Ethernet Tag (SMET) route originates with the Supplementary Broadcast Domain (SBD) route target of the VRF and the route distinguisher (RD) where the sources connect. The receiver VRF RT and RD do not originate SMET routes.

When configuring EVPN Multicast VRF Leaking, the source VRF contains the Multicase Outgoing Interface (OIF) list of multicast routes from the receiver VRF. When the source VRF forwards traffic, the VRF sends a copy of the OIF list across the VRF.

EVPN Multicast VRF Leaking supports a per multicast group configuration to leak multicast traffic.

Note: Configure EVPN Multicast VRF Leaking with caution. Any network design or configuration issues could potentially cause traffic to blackhole, send multiple copies of traffic to the same receiver, or create traffic looping, which may impact traffic on your network.

In the following EVPN topology, two VRF tenants, red and blue, have multicase receivers and senders. The receiver, Rb1, on the blue VRF looks for group G on VRF, red, which has the resources. To enable the feature, configure VRF Leaking for group G on the PE connected to the Rb1 with VRF red as the source VRF.

Figure 1. Figure 1 - EVPN Multicast Traffic Flow with VRF Leaking

In the example topology, the control flow works as follows:

Rb1 sends an IGMP join request for (*,G), and the host device is unaware of VRF Leaking.
VRF blue has the configuration for VRF Leaking for G, so the egress Provider Edge (PE) router sends a SMET to the red VRF, and does not send a SMET to the blue VRF or the VLAN100.
The ingress PE connected to the source on VRF red, sends VXLAN-encapsulated multicast packets with the VNI of the source VLAN across the EVPN core.
The egress PE receives the VXLAN packet, decapsulates it, and routes the data packet to VRF blue.

Note: EVPN multi-homed receivers support VRF Leaking, and the configuration should be identical on both designated-forwarder (DF) and non-DF VTEPs for the multi-homed Ethernet segment.

EVPN Multicast VRF Leaking with a PIM EVPN Gateway (PEG)

On an EVPN network with a PEG role, the PEG acts as the rendezvous point (RP) for the leaked groups. The PEG also functions as the Rendezvous Point (RP) of the source VRF, which follows the PIM network model, where the PEG acts as the RP of the source and receiver VRFs. The configuration requires synchronization using a protocol such as Multicast Source Discovery Protocol (MSDP), and the source synchronization may be necessary with the source and receiver VRFs.

If an RP exists in the external PIM domain, then Multicast VRF Leaking can be configured on that RP instead of the PEG, but this requires that both the source and receiver VRFs extend into the PIM domain that includes the RP.

In this case, the sources on the EVPN tenant VRFs exist in a different VRF from the RP, and the unicast route leaks to the source from the tenant VRF into the external domain VRF to build the multicast trees and perform Reverse Path Forwarding (RPF) validation.

Figure 2. Figure 2 - Multicast Traffic Flow with VRF Leaking on the PEG

Using MLAG as a PEG on an EVPN Network

When configuring VRF Leaking on MLAG devices used as PEGS, configure the MLAG devices as a PEG in both the receiver VRF and the source VRF. Typically, the external PIM domain connects to the receiver. To enable PEG functionality on the source VRF, configure a stub VLAN and a corresponding SVI on both MLAG peers. Enable PIM on the SVIs of both peers and attach them to the source VRF. This enables PEG functionality in the source VRF as well.

Page 3 of 17

End of Support

Resource Reservation Protocol for Traffic Engineering (RSVP-TE)

LDP Pseudowire

Configuring LDP Pseudowire

Local-Remote Patch Configuration

Local-Local Patch Configuration

Additional Patch Configuration Commands

Forwarding Behavior For Layer 2 Control Packets

Configuring LDP End-of-LIB

Displaying LDP End-of-LIB Status

LDP Pseudowire Limitations

LDP Pseudowire Show Commands

RSVP-TE Overview

Core Prerequisites and Global Configuration

Supported Scalability

RSVP-TE Limitations

Visibility and Monitoring Services

MPLS

MPLS Overview

MPLS Implementation

MPLSoGRE Filtered Mirroring

Mixed TTL/DSCP in MPLS Tunnel Termination

Configuring Mixed TTL/DSCP in MPLS Tunnel Termination

Packet Support for IPv6

Support for MPLS Packets in IP ACLs

DSCP-to-TC Maps for MPLS Traffic to Layer 3 VRFs

Configuring MPLS

LSP Ping/Traceroute for MPLS Nexthop Group Tunnels

Configuring Egress IPv4 and IPv6 over MPLS ACLs

Configuring MPLSoGRE Filtered Mirroring

Enabling the TC-Counters TCAM Profile

Defining Two IPv4 Access-Lists

Attaching Access-Lists

Configuring Support IP ACLs for MPLS Packets

Configuring Ingress IP Access Control (ACL) List Support

Configuring Egress IPv4 and IPv6 over MPLS ACLs

Configuring MPLS Pop Terminated Packets

Configuring MPLS VRF-Decapsulated Packets

Supporting Traffic Policy on Interfaces

Custom TCAM Profile

Static Inter-VRF Route

Configuration

Show Commands

Limitations

Inter-VRF Local Route Leaking

Inter-VRF Local Route Leaking using BGP VPN

Accessing Shared Resources Across VPNs

Configuring Inter-VRF Local Route Leaking

Using VXLAN for Encapsulation

Using MPLS for Encapsulation

Route-Distinguisher

Exporting Routes from a VRF

Importing Routes into a VRF

Importing BGP Route Target Ranges for VRFs

Exporting and Importing Routes using Route Map

Inter-VRF Local Route Leaking using VRF-leak Agent

Configuring Route Maps

EVPN VXLAN Single-Gateway Centralized Routing

EVPN and VCS Commands

Global Configuration Mode

Router BGP Configuration Mode

Router BGP Address-Family Configuration Mode

Router General Configuration Mode

VCS Commands

EVPN VXLAN Commands

E-Tree Commands

Display Commands

bfd vtep evpn

encapsulation VXLAN layer-3 set next-hop igp-cost

e-tree

ip hardware fib vxlan

leak routes

next-hop resolution disabled

redistribute bgp evpn VXLAN

redistribute router-mac next-hop vtep primary

redistribute service VXLAN

remote leaf host drop

route-target

route-target export

route-target import