{"id":2783,"date":"2023-03-06T13:46:36","date_gmt":"2023-03-06T12:46:36","guid":{"rendered":"https:\/\/www.safekom.pl\/blog\/?p=2783"},"modified":"2023-03-06T13:46:36","modified_gmt":"2023-03-06T12:46:36","slug":"nsx-t-evpn-inline-mode","status":"publish","type":"post","link":"https:\/\/www.safekom.pl\/blog\/en\/vmware-en\/nsx-en\/nsx-t-evpn-inline-mode\/","title":{"rendered":"NSX-T EVPN Inline Mode"},"content":{"rendered":"

From the NSX 3.0 version, we can configure the EVPN function between the T0 router and the physical router. This post will be devoted to how to configure EVPN step by step in inline mode.<\/p>\n

What is EVPN?<\/span><\/p>\n

\n
\n
\n
\n
<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n

EVPN (Ethernet VPN) is an IEEE standard that allows for the creation of virtual private networks (VPNs) at the Layer 2 (LAN) and Layer 3 (IP) levels for Ethernet devices. EVPN uses two planes: the control plane and the data plane. The control plane is based on the Multiprotocol Border Gateway Protocol (MP-BGP), which is responsible for distributing MAC and IP address information between devices in the network. The data plane uses Virtual Extensible LAN (VXLAN) technology, which allows Ethernet packets to be transmitted within a tunnel network.<\/p>\n

Inline Mode<\/h3>\n

In this mode, the tier-0 gateway establishes MP-BGP EVPN control plane sessions with external routers to exchange routing information. In the data plane, edge nodes forward all traffic exiting the local data center to the data center gateways and incoming traffic from the remote data center to the hypervisors in the local data center. As the edge nodes are in the data forwarding path, this model is called the Inline model.<\/p>\n

\n
\n
\n
\n
\n
\n

Test architecture NSX-T EVPN<\/h3>\n<\/div>\n<\/div>\n<\/div>\n
\n
<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n

In the solution architecture, two Virtual Routing and Forwarding (VRF) instances are defined on the external router (e.g., Juniper vMX), which are then passed to the T0 router through an MP-BGP session. On the T0 router, these VRF instances are extended to corresponding VRFs with the same names and Route Distinguisher (RD) identifiers. Then, the T1 routers are connected to these VRFs, which will have connected network segments. As a result, each network segment can function as an independent VRF, and devices in different segments can communicate with each other as if they were in a single physical LAN.<\/p>\n

\"\"<\/a><\/p>\n

 <\/p>\n

Limitations and Caveats<\/h3>\n

According to VMware documentation.\u00a0<\/a><\/p>\n\n\n\n\n
Limitations<\/td>\nCaveats<\/td>\n<\/tr>\n
\n
    \n
  • NSX supports L3 VPN by advertising and receiving IP prefixes as EVPN Route Type-5.<\/li>\n
  • NSX-T generates a unique route MAC for every NSX Edge VTEP in the EVPN domain. However, there may be other nodes in the network that are not managed by NSX-T, for example, physical routers. You must make sure that the router MACs are unique across all the VTEPs in the EVPN domain.<\/li>\n
  • The EVPN feature supports NSX Edge nodes to be either the ingress or the egress of the EVPN virtual tunnel endpoint. If an NSX Edge node receives EVPN Route Type-5 prefixes from its eBGP peer that needs to be redistributed to another eBGP peer, the routes are re-advertised without any change to the next hop.<\/li>\n
  • In multi-path network topologies, it is recommended that ECMP is enabled for the NSX BGP EVPN control plane, so that all the possible paths can be advertised by the tier-0 gateway. This will avoid any potential traffic blackhole due to asymmetric data path forwarding.<\/li>\n
  • A tier-0 gateway can span across multiple edge nodes. However, specifying a unique route distinguisher for each edge node or TEP (either via auto or manual configuration) is not supported. As a result, the use of ECMP on the peer router is not supported.<\/li>\n
  • Route maps are not supported for EVPN address family.<\/li>\n
  • Recursive route resolution for gateway IP via default static route is not supported.<\/li>\n<\/ul>\n<\/td>\n
\n