VPN Services: EVPN, Inter-AS VPN, CSC and mVPN

What it is

Provider VPN services let one network carry many separate customer networks across a shared MPLS or SR core.

This page describes four extensions of the basic VPN idea. EVPN uses BGP to run Layer 2 and Layer 3 services. Inter-AS VPN joins VPNs across two providers.

CSC lets one provider carry another provider. mVPN adds multicast.

How it works

Each extension changes who holds the customer routes and how labels are exchanged.

EVPN

EVPN carries customer MAC and IP routes in BGP, in the l2vpn evpn address family. MAC addresses are learned on the edge and advertised in the control plane, so the core does not flood to learn them.

An EVPN instance (EVI) is the service. An Ethernet segment identifier (ESI) names a multihomed link, and EVPN supports all active multihoming, so both PEs forward at once. The route types you must know are:

EVPN can give point to point services (EVPN VPWS), the multipoint LAN service, and Layer 3 services. The data plane can be MPLS or VXLAN.

RP/0/RP0/CPU0:PE1(config)# evpn
RP/0/RP0/CPU0:PE1(config-evpn)# evi 100
RP/0/RP0/CPU0:PE1(config-evpn-instance)# bgp
RP/0/RP0/CPU0:PE1(config-evpn-instance-bgp)# route-target import 65000:100
RP/0/RP0/CPU0:PE1(config-evpn-instance-bgp)# route-target export 65000:100
RP/0/RP0/CPU0:PE1(config)# router bgp 65000
RP/0/RP0/CPU0:PE1(config-bgp)# address-family l2vpn evpn

That is IOS XR, and the BGP neighbours must also activate the l2vpn evpn family.

Inter-AS VPN

When two providers must join one VPN, their ASBRs connect. Three methods are named by letter.

In option A, each ASBR acts like a PE and a CE for the other. In option B, the ASBR changes the next hop to itself and assigns a new label. In option C, the PE loopbacks are exchanged with labels, and a multihop session carries the VPN routes, so ASBRs hold no VPN routes.

ASBR1(config)# router bgp 65000
ASBR1(config-router)# no bgp default route-target filter
ASBR1(config-router)# neighbor 198.51.100.2 remote-as 65100
ASBR1(config-router)# address-family vpnv4
ASBR1(config-router-af)# neighbor 198.51.100.2 activate

That is IOS XE option B. The route target filter line is needed because the ASBR has no VRFs and would otherwise discard the routes. On IOS XR, retain route-target all plays the same role.

Carrier supporting carrier

In CSC, a backbone carrier sells VPN service to another carrier, the customer carrier. The customer carrier runs its own MPLS network and its own customers, and it sends traffic through the backbone.

The backbone does not learn the end customers' routes. It only carries the customer carrier's internal routes, such as loopbacks, and it exchanges labels with the customer carrier edge, through LDP or BGP labelled unicast. The packet then has more labels, because the end customer's labels are inside the backbone labels.

Multicast VPN

Multicast VPN (mVPN) carries customer multicast across the provider core. There are two families of design.

• Rosen design: all PEs of a VPN join one default multicast group in the core, called the default MDT, and traffic is carried in GRE. A data MDT can be created for busy sources, so only interested PEs get the traffic. The core runs PIM.
• Next generation mVPN: BGP signals the multicast routes in the ipv4 mvpn address family, and the core uses MPLS point to multipoint LSPs, such as those made by mLDP.

The next generation design needs no multicast routing in the core, and it uses MPLS label forwarding for replication.