EVPN-IOS-XR

3 min read 11 Sep 2026 WAN & SD-WAN Network Services

Node names in this article have been generalized from the original system (Node A / Node B / Node C / Node D) to keep internal naming out of the write-up — each label refers consistently to one device role throughout. The AS number and network name have likewise been swapped for generic placeholders; only the EVPN/SR-MPLS architecture and NSO service templates are unchanged.

VPN Concept

Route Types

EVPN defines several BGP route types, each carrying a different piece of reachability information:

Type	Route Type	Usage
1	Ethernet Auto-Discovery Route	MAC mass-withdrawal, split-horizon, aliasing (load balancing)
2	MAC Advertisement Route	Advertise MAC address; provide MAC/IP bindings for ARP broadcast suppression
3	Inclusive Multicast Ethernet Tag Route	Used for BUM (broadcast/unknown-unicast/multicast) handling — see Data Plane below
4	Ethernet Segment Route	Auto-discovery of multi-homed Ethernet Segments; Designated Forwarder (DF) election
5	IP Prefix Advertisement Route	Advertisement of an IP prefix for inter-subnet forwarding

Control Plane

EVPN uses BGP as the control plane to distribute MAC/IP reachability information (Type-2 routes) and Inclusive Multicast Ethernet Tag routes (Type-3) for BUM handling. All PEs participate in the same EVI (EVPN Instance), meaning:

MAC addresses learned on any Bundle-Ether interface are advertised via BGP EVPN to all other PEs.
Remote MACs are installed in the bridge domain's MAC table as EVPN-learned entries.
ARP suppression can be enabled on the EVI to reduce flooding.

Data Plane

SR-MPLS is used as the data-plane transport. Frames entering any Bundle-Ether subinterface are:

Classified by dot1q VLAN ID encapsulation.
Associated with the bridge-domain's vl-id.
Forwarded locally if the destination MAC is known and local.
Encapsulated in MPLS and forwarded to the remote PE if the destination is a remote EVPN MAC.
Replicated to all EVPN peers (ingress replication) if the traffic is BUM.

EVPN NSO Service

This network fabric uses two EVPN redundancy flavors. Each node (Node A, Node B, Node C, Node D) consumes one of these flavors — the service definition is the same; only the redundancy mode and the Attachment Circuit type differ.

Flavor A — EVPN Multi-Homed All-Active

Tested. Used by: Node B (server bundles), Node C — any node that supports LACP across two PEs.

Parameter	Value
IP address	Anycast — identical on PE1 and PE2
host-routing	Anycast — NSO generated, identical on SR1 and SR2
IRB function	BVI bridges BD (L2) into VRF (L3)
ARP	Server ARPs to the anycast IP/MAC — transparent failover
Attachment Circuit	`Bundle-EtherX.<vlan> l2transport`

BGP multipath is required for aliasing to work:

router bgp 65000
 vrf <vrf-name>
  address-family ipv4 unicast
   additional-paths receive
   maximum-paths ibgp 10

The templates below use <AC-INTERFACE> as a placeholder. Substitute with either TenGigE0/0/0/X.<vlan> or Bundle-EtherN.<vlan> depending on flavor.

Attachment Circuit:

$vrf
$vlan
$intf
$bundle-id
$description
$ip_address
$ip_mask
$vlan
$bg
$evi

interface Bundle-Ether$bundle-id
 description $description
 mtu 9216
 no shutdown
 load-interval 30
 lacp system mac #NSO LOGIC#
exit

interface Bundle-Ether$bundle-id.$vlan l2transport
 description "$description"
 encapsulation dot1q $vlan
 no shutdown
 rewrite ingress tag pop 1 symmetric
exit

interface $intf
 description $description
 bundle id $bundle-id mode active
exit

interface BVI$evi
 description $description
 host-routing
 vrf $vrf
 ipv4 address $ip_address $ip_mask
 no shutdown
 mac-address #NSO LOGIC#
exit

evpn
 evi $evi
  interface Bundle-Ether$bundle-id
   ethernet-segment
    identifier type 0 70.0d.00.00.00.01.00.00.00
   exit
  exit
 exit

l2vpn
 bridge group $bg
  bridge-domain bd-$evi
   interface Bundle-Ether$bundle-id.$vlan  ! (list multiple servers)
    storm-control broadcast pps 1000
    storm-control multicast pps 1000
   exit
   routed interface BVI$evi
   !
   evi $evi

Flavor B — EVPN Multi-Homed Single-Active

Tested. Used by: Node A and ESXi hosts, and any node that cannot form a LAG across two PEs or where active/standby behavior is required.

Parameter	Value
IP address	Anycast — identical on PE1 and PE2
host-routing	Anycast — NSO generated, identical on SR1 and SR2
IRB function	BVI bridges BD (L2) into VRF (L3)
EVI MAC advertise	Enable MAC learning
Attachment Circuit	`TenGigE0/0/0/X.<vlan> l2transport`
Multi-homing	Non-LACP
Load balancing	Single-flow-active
Convergence	Requires MAC mobility

$vrf
$vlan
$intf
$description
$ip_address
$ip_mask
$vlan
$bg
$evi

interface $intf
 description $description
!

interface $intf.$vlan l2transport
 encapsulation dot1q $vlan
 rewrite ingress tag pop 1 symmetric
!

interface BVI$evi
 description "$evi"
 host-routing
 vrf $vrf
 ipv4 address $ip_address $ip_mask
!

evpn
 evi $evi
  advertise-mac
 !
 interface $intf
  ethernet-segment
   identifier type 0 70.0d.00.00.00.01.00.00.00
   load-balancing-mode single-flow-active
   convergence
    mac-mobility
   !
  !
 !

l2vpn
 bridge group $bg
  bridge-domain bd-$evi
   interface $intf.$vlan  ! (list multiple servers)
    storm-control multicast pps 25000
    storm-control broadcast pps 25000
   !
   routed interface BVI$evi
   !
   evi $evi
   !
  !

Segment Routing (SR-MPLS) Fundamentals — background on the SID/label mechanics this article's Data Plane section assumes are already up and forwarding.