¶ Part 2: Create the tunnel; Check MAC Address-Table
• Part1: Underlay --> You Are Here --> Part3: MP-BGP
Good reads:
CiscoLive: Introduction to VXLAN The Future Path of Your Data Center
Cisco: Troubleshooting BGP EVPN VXLAN (Ch. from EVPN Catalyst config guide)
LATEST: https://lostintransit.se/2024/01/03/evpn-deepdive-route-types-2-and-3/
Beware & be aware: l2 means Layer 2 and 12 is the number twelve. 
¶ Create User-Access-Ports, Add Clients PCs
User-Access-Ports will generate traffic that will be transported in the overlay
On leaf 1 : also create Client ports in VLAN 10
no cdp run
interface range gi 1/0/10 - 20
switchport mode access
switchport access vlan 10
On leaf 2 : also create Client ports in VLAN 20
no cdp run
interface range gi 1/0/10 - 20
switchport mode access
switchport access vlan 20
Connect PCs
- Connect pc-A to port 11 of Leaf-1 and give pc-A the IP 10.1.30.11/24
- Connect pc-B to port 12 of Leaf-2 and give pc-B the IP 10.1.30.12/24
¶ CHEAT (temporarily) with a Cable
Temporarily cheat with a cable, instead of a VXLAN-tunnel.
Connect one cable between Leaf-1 port 20 and Leaf-2 port 20
Assuming pc-A has MAC address 48:21:0b:11:11:11 and pc-B has MAC-address 48:21:0b:22:22:22, the verify with the show mac address-table command
Leaf-1
show mac address-table dynamic
Mac Address Table
-------------------------------------------
Vlan Mac Address Type Ports
---- ----------- -------- -----
10 4821.0b11.1111 DYNAMIC Gi1/0/11 <---- pc-A
10 4821.0b22.2222 DYNAMIC Gi1/0/20 <---- Cable, pc-B
Total Mac Addresses for this criterion: 2
Leaf-2
show mac address-table dynamic
Mac Address Table
-------------------------------------------
Vlan Mac Address Type Ports
---- ----------- -------- -----
20 4821.0b11.1111 DYNAMIC Gi1/0/20 <---- Cable, pc-A
20 4821.0b22.2222 DYNAMIC Gi1/0/12 <---- pc-B
Total Mac Addresses for this criterion: 2
WE HAVE NOW CREATED A LAYER-2 "TUNNEL", BY USING A CABLE
Please, check for yourself and note that pc-A can ping pc-B
(Double-check that they are in the same IP-subnet 10.1.30.0/24)
¶ Remove CHEAT
Remove the cable between Leaf-1 and Leaf-2
¶ Back to business
This is what we have, leaf-1,VLAN-10 has no connection to leaf-2,VLAN-20
This is what we want, a L2 VXLAN tunnel between leaf1-vlan10 and leaf2-vlan20
Terminology
-
VXLAN (Virtual Extensible LAN) - The technology that provides the same Ethernet Layer 2 network services as VLAN does today, but with greater extensibility and flexibility.
-
VTEP (Virtual Tunnel Endpoint) - This is the device that does the encapsulation and de-encapsulation.
-
EVI (EVPN instance): A logical switch within the EVPN domain which spans and interconnects multiple VTEPs to provide tenant Layer 2 and Layer 3 connectivity.
-
VNI (Vxlan Network Identifier) - 24 bit segment ID that defines the broadcast domain. Interchangeable with "VXLAN Segment ID".
-
NVE (Network Virtual Interface) - Logical interface where the encapsulation and de-encapsulation occur.
Variations: The Three BUM Traffic Models
| Model | How BUM is handled | Requires multicast? | CLI |
|---|---|---|---|
| Ingress replication | Each VTEP sends individual unicast copies to all other VTEPs |
❌ No | l2vpn evpn replication-type ingress! (no ARP suppression) |
| Multicast underlay | PIM + multicast group per VNI | ✅ Yes | l2vpn evpn replication-type static |
| EVPN with ARP suppression | BGP pre-populates ARP cache, Most BUM traffic is ARP |
❌ No | l2vpn evpn replication-type ingress ! Added ARP suppression in profile |
We choose the last one: "EVPN with ARP suppression"
¶ Paste code into leafs
Paste code into leafs to create EVPN, EVI, VNI and map VLANs in the VTEPs
¶ Leaf-1
Leaf-1 (Base EVPN Config)
show run | sec l2vpn
l2vpn evpn
description Connects dataplane (VTEP) to loopback 1
replication-type ingress
router-id Loopback1
l2vpn evpn instance 30 vlan-based
encapsulation vxlan
replication-type ingress
! "arp suppression" already done
do show l2vpn evpn summary | incl ARP
! ^^^ BUM traffic will flood, But ARPs are suppressed
Leaf-1#
show run | sec vlan config
vlan configuration 10
member evpn-instance 30 vni 12300
! Local VLAN number mapped to global VNI number
Leaf-1#
show run int nve 1
interface nve1
description Connects Control Plane BGP to loopback 1
no ip address
source-interface Loopback1
host-reachability protocol bgp
member vni 12300 ingress-replication
ip bgp-community new-format
! ^^^ Required to see community in aa:nn format
¶ Leaf-2
Leaf-2 (Base EVPN Config)
show run | sec l2vpn
l2vpn evpn
replication-type ingress
router-id Loopback2
l2vpn evpn instance 30 vlan-based
encapsulation vxlan
replication-type ingress
! "arp suppression" already done
exit
Leaf-2
show run | sec vlan config
vlan configuration 20
member evpn-instance 30 vni 12300
! Local VLAN number mapped to global VNI number
exit
Leaf-2
show run int nve 1
interface nve1
no ip address
source-interface Loopback2
host-reachability protocol bgp
member vni 12300 ingress-replication
ip bgp-community new-format
! ^^^ Required to see community in aa:nn format
*Sep 23 09:06:00.592: %LINK-3-UPDOWN: Interface nve1, changed state to down
*Sep 23 09:06:00.649: %LINK-3-UPDOWN: Interface nve1, changed state to up
*Sep 23 09:06:01.578: %LINEPROTO-5-UPDOWN: Line protocol on Interface nve1, > changed state to up
*Sep 23 09:06:01.629: %LINEPROTO-5-UPDOWN: Line protocol on Interface Tunnel1, changed state to up
¶ 
Test PC connectivity and fail
We have a very nice VXLAN "tunnel", but it has no idea where MAC-addresses.
It's the same thing as a L2-switch with empty MAC-address table and no flooding of unknowns.
Result:
Leaf-2#show mac address-table dynamic
Mac Address Table ------------------------------------------- Vlan Mac Address Type Ports ---- ----------- -------- ----- 20 4821.0b22.2222 DYNAMIC Gi1/0/12 Total Mac Addresses for this criterion: 1
Leaf-2#show ip interf bri | incl up
Vlan1 unassigned YES unset up up GigabitEthernet1/0/3 10.0.3.2 YES manual up up GigabitEthernet1/0/4 10.0.4.2 YES manual up up GigabitEthernet1/0/12 unassigned YES unset up up Ap1/0/1 unassigned YES unset up up nve1 unassigned YES unset up up Loopback2 10.2.2.2 YES manual up up Tunnel0 10.2.2.2 YES unset up up Leaf-2#
C:\pc-B> ping 10.1.30.11
Pinging 10.1.30.11 with 32 bytes of data:
Request timed out.
Request timed out.
Obviously we have no connectivity since MPBGP EVPN is not running 
Please continue with next part
• Part1: Underlay --> You Are Here --> Part3: MP-BGP