What is a distributed anycast gateway, and why use it instead of HSRP or VRRP?
Show the answer
Say this first
Every leaf that has a VLAN uses the same gateway IP and the same gateway MAC on that SVI. Hosts always ARP for that one MAC, the local leaf answers and routes, so first-hop routing happens on every leaf at once. There are no FHRP hellos, no active and standby, no hairpin to a central gateway, and a VM that moves to another rack keeps working with its cached ARP entry.
Go deeper
Configuration
feature fabric forwarding
fabric forwarding anycast-gateway-mac 2020.0000.00aa
!
interface Vlan10
vrf member TENANT-A
ip address 10.10.10.1/24
fabric forwarding mode anycast-gatewayip virtual-router mac-address 00:1c:73:00:00:99
!
interface Vlan10
vrf TENANT-A
ip address virtual 10.10.10.1/24The gateway MAC is one value for the whole fabric, configured identically on every leaf.
Compared with HSRP or VRRP
- HSRP has one active router per group. In a fabric, every rack's traffic would cross to that router.
- FHRPs exchange hellos and fail over in seconds. An anycast gateway has nothing to fail over.
- A moved VM keeps the same gateway MAC and IP, so it does not need to re-ARP.
Operational points
- The gateway IP is shared, so you cannot use it to reach one specific leaf. Give each leaf a unique loopback in the tenant VRF for monitoring.
- DHCP relay must use a unique source per leaf (that loopback) so the server's reply returns to the right leaf, with option 82 link selection telling the server which scope to use.
They will ask next
Do you still need an FHRP anywhere?
Yes, outside the EVPN fabric: classic vPC or MLAG aggregation without EVPN, or edge devices such as firewalls and routers that offer a gateway to a segment.
Traps
- Using different anycast gateway MACs on different leaves. Moved hosts then talk to a MAC that no longer exists locally.
How did you do?