EVPN with Transparent Firewall Insertion

Overview of EVPN with Transparent Firewall Insertion

In certain scenarios there is a requirement to send all routing traffic through a Layer 2 transparent firewall. However, by default, VXLAN EVPN requires a distributed anycast gateway on all LEAFs.

To address the Layer 2 transparent firewall requirement with VXLAN EVPN, a special topology can be used.



The topology contains the following types of VLANs:

  • Internal VLAN (A regular VXLAN on TOR Leafs with anycast gateway)

  • Firewall Untrusted VLAN X

  • Firewall Trusted VLAN Y

In this topology, the traffic that goes from VLAN X to other VLANS must go through a transparent Layer 2 firewall that is attached to the service leafs.

This topology utilizes an approach of an untrusted VLAN X and a trusted VLAN Y.

All TOR leafs have a Layer 2 VNI VLAN X. There is no SVI for VLAN X.

The service leafs that are connected to the firewall have Layer 2 VNI VLAN X, non-VXLAN VLAN Y, and SVI Y with a HSRP gateway.


Note

VXLAN flood and learn only supports a centralized gateway. This means that only one VPC pair VTEP can have an SVI per VXLAN. No other VTEP can have an SVI on a VXLAN VLAN.

VXLAN only supports an anycast gateway, not a centralized gateway.

EVPN with Transparent Firewall Insertion Example




Note

  • Host in VLAN X: 10.0.94.101

  • TOR Leaf: N9372-1

  • Service Leaf in vPC: N9332-1 and N9332-2

  • Border Leaf: N9332-5

  • TOR leaf configuration 

    
vlan 94
vn-segment 100094
interface nve1
 member vni 100094
  mcastgroup 239.1.1.1

router bgp 64500
 routerid 1.1.2.1
 neighbor 1.1.1.1 remote-as 64500
  address-family l2vpn evpn
   send-community extended
 neighbor 1.1.1.2 remote-as 64500
  address-family l2vpn evpn
   send-community extended
 vrf Ten1
  address-family ipv4 unicast
  advertise l2vpn evpn
 evpn
  vni 100094 l2
   rd auto
   route-target import auto
   route-target export auto

  • Service leaf 1 configuration 

    
vlan 94
 description untrusted_vlan
 vn-segment 100094

vlan 95
 description trusted_vlan

vpc domain 10
peer-switch
peer-keepalive destination 10.1.59.160
peer-gateway
auto-recovery
ip arp synchronize

interface Vlan2
 description vpc_backup_svi_for_overlay
no shutdown
no ip redirects
ip address 10.10.60.17/30
no ipv6 redirects
ip router ospf 100 area 0.0.0.0
ip ospf bfd
ip pim sparsemode

interface Vlan95
 descrition SVI_for_trusted_vlan
 no shutdown
 mtu 9216
 vrf member Ten-1
 no ip redirects
 ip address 10.0.94.2/24
 hsrp 0
  preempt
  priority 255
  ip 10.0.94.1

interface nve1
 member vni 100094
  mcast-group 239.1.1.1

router bgp 64500
 routerid 1.1.2.1
 neighbor 1.1.1.1 remote-as 64500
 address-family l2vpn evpn
  send-community extended
 neighbor 1.1.1.2 remote-as 64500
  address-family l2vpn evpn
   send-community extended
 vrf Ten-1
  address-family ipv4 unicast
   network 10.0.94.0/24 /*advertise /24 for SVI 95 subnet; it is not VXLAN anymore*/
   advertise l2vpn evpn

 evpn
  vni 100094 l2
  rd auto
  route-target import auto
  route-target export auto

  • Service leaf 2 configuration 

    
vlan 94
 description untrusted_vlan
 vnsegment 100094

vlan 95
 description trusted_vlan

vpc domain 10
peer-switch
peer-keepalive destination 10.1.59.159
peer-gateway
auto-recovery
ip arp synchronize

interface Vlan2
 description vpc_backup_svi_for_overlay
 no shutdown
 no ip redirects
 ip address 10.10.60.18/30
 no ipv6 redirects
 ip router ospf 100 area 0.0.0.0
 ip pim sparsemode

interface Vlan95
 description SVI_for_trusted_vla
 no shutdown
 mtu 9216
 vrf member Ten-1
 no ip redirects
 ip address 10.0.94.3/24
 hsrp 0
  preempt
  priority 255
  ip 10.0.94.1

interface nve1
 member vni 100094
  mcastgroup 239.1.1.1

router bgp 64500
 router-id 1.1.2.1
 neighbor 1.1.1.1 remote-as 64500
  address-family l2vpn evpn
   send-community extended
 neighbor 1.1.1.2 remote-as 64500
  address-family l2vpn evpn
   send-community extended
vrf Ten-1
 address-family ipv4 unicast
  network 10.0.94.0/24 /*advertise /24 for SVI 95 subnet; it is not VXLAN anymore*/
  advertise l2vpn evpn
  
evpn
 vni 100094 l2
  rd auto
  route-target import auto
  route-target export auto

Show Command Examples

  • Display information about ingress LEAF learned local MAC from host: 

    
N93721# sh mac add vl 94 | i 5b|MAC
* primary entry, G - Gateway MAC, (R) Routed - MAC, O - Overlay MAC
VLAN MAC Address Type age Secure NTFY Ports
* 94 d8b1.9071.5beb dynamic 0 F F Eth1/1

  • Display information about service leaf found MAC of host:


    Note

    In VLAN 94, the service leaf learned the host MAC from the remote peer by BGP. 

    
N93321# sh mac add vl 94 | i VLAN|eb
VLAN MAC Address Type age Secure NTFY Ports
* 94 d8b1.9071.5beb dynamic 0 F F nve1(1.1.2.1)

N93322# sh mac add vl 94 | i VLAN|eb
VLAN MAC Address Type age Secure NTFY Ports
* 94 d8b1.9071.5beb dynamic 0 F F nve1(1.1.2.1)

N93321# sh mac add vl 95 | i VLAN|eb
VLAN MAC Address Type age Secure NTFY Ports
+ 95 d8b1.9071.5beb dynamic 0 F F Po300

N93322# sh mac add vl 95 | i VLAN|eb
VLAN MAC Address Type age Secure NTFY Ports
+ 95 d8b1.9071.5beb dynamic 0 F F Po300

  • Display information about service leaf learned ARP for host on VLAN 95: 

    
N93322# sh ip arp vrf ten-1
Address     Age      MAC Address    Interface
10.0.94.101 00:00:26 d8b1.9071.5beb Vlan95

Service Leaf learns 9.9.9.9 from EVPN.

N93322# sh ip route vrf ten-1 9.9.9.9

IP Route Table for VRF "Ten-1"
'*' denotes best ucast nexthop
'**' denotes best mcast nexthop
'[x/y]' denotes [preference/metric]
'%<string>' in via output denotes VRF <string>
9.9.9.9/32, ubest/mbest: 1/0
*via 1.1.2.7%default, [200/0], 02:57:27, bgp64500,internal, tag 65000 (evpn) segid: 10011
tunnelid: 0x1
010207 encap: VXLA

  • Display information about border leaf learned host routes by BGP: 

    
N93965# sh ip route 10.0.94.101

IP Route Table for VRF "default"
'*' denotes best ucast nexthop
'**' denotes best mcast nexthop
'[x/y]' denotes [preference/metric]
'%<string>' in via output denotes VRF <string>
10.0.94.0/24, ubest/mbest: 1/0
*via 10.100.5.0, [20/0], 03:14:27, bgp65000,external, tag 6450