Layer-3 Accessible EVPN Services

defines three service interfaces for layer-2 accessible EVPN: VLAN-Based Service Interface, VLAN-Bundle Service Interface and VLAN-Aware Bundle Service Interface. These three types of service interfaces can realize the isolation of layer-2 traffic of customers in different ways, as shown in Figure 1.

For VLAN-based service interface, there is a one to one mapping between VID and EVI. Each EVI has a single broadcast domain so that traffic from different customers can be isolated. For VLAN-bundle service interface, there is a N to one mapping between VID and EVI. Each EVI has a single broadcast domain, but the MAC address MUST be unique that can be used for customer traffic isolation. For VLAN-aware bundle service interface, there is a N to one mapping between VID and EVI. Each EVI has multiple broadcast domains while the MAC address can overlap. One broadcast domain corresponds to one VID, which can be used to customer traffic isolation. In the scenarios corresponding to these service interfaces, CE-PE should be placed in the same Layer-2 network. In most of provider network, CE-PE need to cross a Layer-3 network, then the above service interfaces should be extended to adapt to the layer-3 network. In this draft, we describe three layer-3 accessible interfaces for EVPN, summarize the existing layer-3 accessible EVPN solutions, and propose a new solution which can simplify the depolyment of layer-3 accessible EVPN service.

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in .

The following terms are defined in this draft: CE: Client Edge PE: Provider Edge EVPN: BGP/MPLS Ethernet VPN, defined in VxLAN: Virtual eXtensible Local Area Network, defined in IPSec: Internet Protocol Security, defined in

In most of provider network, CE-PE need to cross a Layer-3 network. With this scenario, service interfaces defined in should be extended to adapt to the layer-3 network. To achieve the traffic isolation, tunnel encapsulation technologies can be used. We define Logical Session Identifier(LSI) to distinguish the packets from different tunnels, which is related to VNI/SPI. The length of LSI is 16 bits. The layer-3 accessible interfaces for EVPN are shown in Figure 2, refer to

For LSI-based service interface, there is a one to one mapping between LSI and IP-VRF. Each EVI has a single logical plane so that traffic from different customers can be isolated. For LSI-bundle service interface, there is a N to one mapping between LSI and IP-VRF. Each IP-VRF has a single logical plane, but the IP address MUST be unique that can be used for customer traffic isolation. For LSI-aware bundle service interface, there is a N to one mapping between LSI and IP-VRF. Each IP-VRF has multiple logical planes while the IP address can overlap. One logical plane corresponds to one LSI, which can be used to customer traffic isolation.

Let's assume a scenario as shown in Figure 3. PE1, PE2 and PE3 are EVPN peers, the customer data transmission between PEs relies on VxLAN. CE1, CE2 and CE3 are connected to the sites of customer for its department A and B.

If each VNI has its own IP-VRF, each PE and CE maintain an IP-VRF for each deployment. In this situation, customer traffic can be isolated by different VNIs, and there is no need for extending control plane/forwarding plane protocols. If VNIs share one IP-VRF, each CE still maintain an IP-VRF for each deployment, but each PE maintains only one VRF for all deployments. In this situation, customer traffic cannot be isolated by VNIs. We propose a solution for this scenario: Using LSI information to identify different customer routes/traffic. As described above, LSI can be generated by VNI/SPI, and there is a one to one mapping between LSI and VNI/SPI. PEs should maintain the mapping table of LSI and VNI/SPI, so that they can distinguish different customer routes/traffic. LSI information can be transmitted by reusing Ethernet Tag ID/ESI. The existing EVPN Route Type can carry Ethernet Tag ID/ESI, so there is no need for extending control plane protocols, while the forwarding plane protocol need to be extended to transmit the LSI information (Ethernet Tag ID/ESI). TBD (more solutions are welcome).

This solution only consider EVPN with VxLAN encapsulation. We extend the VxLAN GPE header to carry the LSI information, the extentions to the VxLAN GPE header is shown in Figure 4:

With VxLAN, we define a reserved bit as S bit. If S is set to 1, it means the field after O bit contains LSI information.

As described in Section 5, we reuse Ethernet Tag ID/ESI to transmit LSI information. Ethernet Tag ID/ESI can be carried by EVPN Route Type 2 () and 5 (). Since the length of LSI is 16 bits, while the length of Ethernet Tag ID and ESI are 80 bits and 32 bits, respectively. We can only use the lower 16 bits of Ethernet Tag ID / ESI field to carry LSI information, the other locations MUST set to 0.

TBD

This draft extends the VxLAN GPE header, S bit of Flag and LSI field are added: