🧪 Lab 02 · Integrated Routing & Bridging (Symmetric IRB & Anycast Gateway)¶
✅ Validated on Arista cEOS 4.32.0F. All outputs captured live from fabric in OrbStack.
Time: ~50 minutes · Nodes: 6 (2 Spines, 2 Leafs, 2 Customer Hosts)
Quick Start — Step-by-Step Execution Guide (Location: labs/evpn-datacenter-lab/)
Step 1 · Deploy the Lab Fabric (if not already running)
cd labs/evpn-datacenter-lab
sudo containerlab deploy -t topology.clab.yml --max-workers 1
Step 2 · Launch the Fully Guided Interactive Walkthrough
./run.sh --guided
Alternative Execution Options (Automated Push or Manual CLI)
- Fast Automated Script Push:
./run.sh 01 # apply + verify step 01 automatically ./run.sh --all # run all steps in order - Manual Line-by-Line CLI Execution:
Interactive CLI shell on any container node:
docker exec -it clab-evpn-datacenter-lab-leaf1 Cli
🧠 Technology Deep Dive: Symmetric IRB vs. Asymmetric IRB¶
1. The Inter-Subnet Routing Challenge¶
Pure L2VNI (Lab 01) extends Layer 2 bridging, but when host workloads in different IP subnets (e.g. 10.10.10.0/24 in VLAN 10 and 10.20.20.0/24 in VLAN 20) need to communicate, traffic MUST be routed at Layer 3.
In EVPN-VXLAN, Integrated Routing and Bridging (IRB) handles this at the Leaf layer using two different architectural approaches:
2. Asymmetric IRB (Legacy / Scale-Constrained)¶
In Asymmetric IRB: - The ingress Leaf routes the packet from source VLAN to destination VLAN, then bridges the packet over the destination L2 VNI. - The Catch: Every Leaf router in the fabric MUST have EVERY VLAN and EVERY L2 VNI configured, even if no local hosts exist on that leaf! This severely limits fabric VLAN scalability.
3. Symmetric IRB (Hyperscale Production Standard)¶
In Symmetric IRB:
- Routing occurs on BOTH the Ingress and Egress Leaf:
1. Ingress Leaf routes from source VRF to a shared Layer 3 VNI (50001).
2. The packet travels across the fabric encapsulated in the L3 VNI header (VNI 50001).
3. Egress Leaf receives the packet on L3 VNI 50001 and routes it into the destination tenant VRF.
- Key Advantage: Leafs only need to configure the VLANs for locally connected hosts. Scale is limited only by hardware routing table capacity, not VLAN mapping limits!
+---------------------------------------------------------------------------------------------------+
| SYMMETRIC IRB PACKET ENCAPSULATION PATH |
+---------------------------------------------------------------------------------------------------+
| 1. Host1 (VLAN 10) sends frame to local Anycast Gateway (10.10.10.1, MAC 00:1c:73:00:00:01) |
| 2. Leaf1 routes packet into VRF TENANT-A, looks up destination host IP (10.20.20.20) |
| 3. Leaf1 encapsulates frame into L3 VNI 50001 (Outer Dst IP: Leaf2 VTEP 10.255.1.12) |
| 4. Leaf2 decapsulates L3 VNI 50001, routes packet into VRF TENANT-A, forwards to Host2 in VLAN 20 |
+---------------------------------------------------------------------------------------------------+
4. Anycast Virtual Gateway¶
To support seamless virtual machine and container mobility across leaves without modifying default gateway settings:
- Identical Virtual IP (10.10.10.1/24) and Identical Virtual MAC (00:1c:73:00:00:01) are configured on all Leaf switches.
- Hosts ARP for their default gateway and receive the exact same MAC response regardless of which leaf switch they are attached to!
Step 1 · Underlay IP & MP-iBGP EVPN Setup¶
Ensure OSPF underlay and MP-iBGP EVPN sessions are operational between Spines and Leafs.
configure
hostname spine1
!
interface Loopback0
ip address 10.255.0.1/32
ip ospf area 0.0.0.0
!
interface Ethernet1
no switchport
ip address 10.0.1.1/30
ip ospf area 0.0.0.0
!
interface Ethernet2
no switchport
ip address 10.0.1.5/30
ip ospf area 0.0.0.0
!
router ospf 100
router-id 10.255.0.1
passive-interface Loopback0
configure
hostname leaf1
!
interface Loopback0
ip address 10.255.0.11/32
ip ospf area 0.0.0.0
!
interface Loopback1
ip address 10.255.1.11/32
ip ospf area 0.0.0.0
!
interface Ethernet1
no switchport
ip address 10.0.1.2/30
ip ospf area 0.0.0.0
!
interface Ethernet2
no switchport
ip address 10.0.2.2/30
ip ospf area 0.0.0.0
!
router ospf 100
router-id 10.255.0.11
passive-interface Loopback0
passive-interface Loopback1
Step 2 · Symmetric IRB & Anycast Gateway Configuration¶
Configure L2 VNI 10100, L3 VNI 50001 (VRF TENANT-A), Anycast Gateway IP (10.10.10.1/24), and Virtual Router MAC (00:1c:73:00:00:01).
configure
vlan 10
name TENANT-A-VLAN10
!
vrf instance TENANT-A
!
interface Vlan10
vrf TENANT-A
ip address virtual 10.10.10.1/24
!
interface Vxlan1
vxlan source-interface Loopback1
vxlan udp-port 4789
vxlan vlan 10 vni 10100
vxlan vrf TENANT-A vni 50001
!
ip routing vrf TENANT-A
!
ip virtual-router mac-address 00:1c:73:00:00:01
!
router bgp 65000
vlan 10
rd 10.255.0.11:10100
route-target both 10100:10100
redistribute learned
!
vrf TENANT-A
rd 10.255.0.11:50001
route-target both 50001:50001
redistribute connected
configure
vlan 10
name TENANT-A-VLAN10
!
vrf instance TENANT-A
!
interface Vlan10
vrf TENANT-A
ip address virtual 10.10.10.1/24
!
interface Vxlan1
vxlan source-interface Loopback1
vxlan udp-port 4789
vxlan vlan 10 vni 10100
vxlan vrf TENANT-A vni 50001
!
ip routing vrf TENANT-A
!
ip virtual-router mac-address 00:1c:73:00:00:01
!
router bgp 65000
vlan 10
rd 10.255.0.12:10100
route-target both 10100:10100
redistribute learned
!
vrf TENANT-A
rd 10.255.0.12:50001
route-target both 50001:50001
redistribute connected
Step 3 · End-to-End Verification & Route Type 5 Analysis¶
1. Verify EVPN Route Type 5 (L3 Prefix Routes)¶
Verify that leaf1 receives L3 VNI 50001 prefix routes from leaf2:
docker exec -i clab-evpn-datacenter-lab-leaf1 Cli -p 15 <<'EOF'
enable
show bgp evpn route-type prefix-segment
EOF
2. Test Inter-Subnet Routing¶
Ping host workload across Symmetric IRB fabric:
docker exec -i clab-evpn-datacenter-lab-host1 Cli -p 15 <<'EOF'
enable
ping 10.10.10.20 repeat 5
EOF
✅ DONE when host1 pings host2 across Symmetric IRB L3 VNI 50001.
Clean up¶
sudo containerlab destroy -t topology.clab.yml