EVPN multihoming and VXLAN multi-tenant configuration realized with Enterprise SONiC
Introduction
In data center networks, configurations that simultaneously satisfy redundancy (Active-Active) and tenant isolation are no longer uncommon.
On the other hand, in order to avoid vendor lock-in and design and build systems based on the premise of actual operation, Open Networking and its implementation know-how are indispensable.
This article describes the actual configuration and verification of EVPN/VXLAN (EVPN multihoming) + VRF-based multi-tenancy using Broadcom SONiC (Enterprise SONiC by Broadcom), and outlines the following three points: I will explain these points, along with configuration information and verification results.
・What design parameters
Which functions to combine
What are the key design points?
Regarding Broadcom SONiC, Here This is explained in the article.
Overall configuration overview
The overall structure is as described above, but it can be broken down into the following four layers.
1. Underlay (L3 network)
Spine: 2 stand (Spine1 / Spine2)
・BorderLeaf: 2 stand
・Leaf: 4 stand
In the BGP configuration, Spine is deployed as a Route Reflector.
2. Overlay (EVPN Control Plane)
・BGP EVPN (address-family l2vpn evpn)
We use advertise-all-vni to aggregate VNI information, and each node's Loopback is placed as a VTEP.
3. VXLAN Data Plane
VLANs and VNIs are mapped one-to-one, and each VRF is assigned an L3VNI (VLAN1000 / 2000).
This enables smooth VXLAN tunnel formation between VTEPs.
4. Edge redundancy (EVPN Multi-homing)
・Between BorderLeaf and Router: LACP + EVPN Ethernet Segment
・Leaf–Server: LACP + EVPN Ethernet Segment
By adopting an Active-Active configuration, communication can continue without interruption even if one system fails.
Design Essentials ①: EVPN Multihoming (ESI-LACP)
BorderLeaf side
In BorderLeaf1/2, the following settings are applied to RouterA/B:
- Set system-mac to PortChannel
- Same IP address anycast-mac-address
・ESI definition by evpn ethernet-segment
This allows the Router to recognize it as a single logical LACP connection, and traffic will automatically switch over in the event of a BorderLeaf failure.
Leaf side
Leaf–Server Similarly,
Trunk PortChannel
VLAN 11–13 (Tenant A) VLAN 21–23 (Tenant B)
PortChannel units ESI Assignments are made, and also in the server accommodation section. Active-Active Redundancy is achieved.
Design points
system-mac/anycast-mac are standardized across all nodes, and ESI is designed on a per-connection basis (per PortChannel).
The basic design principles and concepts are the same for both the router and server sections.
Design Essentials ②: Multi-tenancy using VRF + L3VNI
This configuration assumes two tenants.
Tenant A: Vrf10010
Tenant B: Vrf10020
For each VRF,
L2VNI (e.g., VLAN11 → VNI10011)
・L3VNI (VLAN1000 → VNI11000)
We have assigned it and linked it on the VXLAN VTEP as follows:
example:
map vni 10011 vlan 11
map vni 11000 vlan 1000
map vni 10011 vrf Vrf10010
map vni 11000 vrf Vrf10010
Anycast Gateway (.254/24) each VLAN By setting it to, Leaf Default when moving between locations Golden Week That remains unchanged.
inspection result
Verification Result ①: Operation of Redundant Configuration Confirmed
We tested the following failure scenarios.
BorderLeaf single-layer down jacket
Leaf-type down
- Multiple nodes down simultaneously → restoration
The verification results confirmed that processing was performed without causing prolonged communication interruptions, and that the system automatically returned to EVPN multihoming operation after the failure was resolved.
Furthermore, we have been able to demonstrate on actual devices that traffic is properly distributed to BorderLeaf and Leaf.
Verification Result ②: Confirmation of Multi-Tenant Isolation
Communication between different VRFs
ServerA ↔ RouterB (Different VRFs / Communication impossible)
• Ping result: Destination Net Unreachable (as expected)
Communication within the same VRF
ServerA1 ↔ ServerA2 (communication possible)
ServerB1 ↔ ServerB2 (communication possible)
All communication was functioning normally, and we confirmed that communication was completely isolated at the VRF level.
Points to note when implementing with Broadcom SONiC
The following points stand out as important from this analysis:
• For EVPN multihoming, consistency between LACP, system-mac, ESI, and anycast-mac is paramount.
- When linking VRF and VNI, you need to be aware of both L2VNI and L3VNI.
Due to the large number of components, design management using parameter sheets is essential.
Summary
Through this verification, we confirmed that by using Broadcom SONiC, elements such as "EVPN/VXLAN," "EVPN multihoming (Active-Active redundancy)," and "multi-tenancy using VRF + L3VNI" can be implemented in a configuration that is fully capable of withstanding actual operation.
Furthermore, by breaking down the process to configuration diagrams, parameters, and configuration granularity, we believe that a significant achievement is that it can be organized not merely as verification, but as a reusable design template.
At Macnica, we provide support from proof-of-concept (PoC) to actual implementation, based on our expertise in designing, building, and verifying Open Networking/SONiC environments.
Related information
Click here for list of materials
In addition to introducing products handled by Macnica,
We publish materials related to open networking, such as BGP cross network automatic construction files and network operation test evaluation reports.
Click here for details
Product Page Top
Broadcom, Inc.
We are an industry leader in both semiconductor solutions and infrastructure software, and provide products in a wide range of areas including data centers, networks, broadband, wireless communications, storage, and security.
Edgecore Networks
We continue to be a pioneer in open networking by developing and selling products related to OpenNetworking/white Box switches.
IP Infusion
As a market leader among open networking providers, we provide reliable network solutions to over 600 customers, including carriers, service providers, and data centers.