Explain symmetric and asymmetric IRB in VXLAN EVPN. Which would you choose, and why?
Show the answer
Say this first
Both route between subnets on the leaves. In asymmetric IRB the ingress leaf routes into the destination VLAN and bridges across the fabric in the destination's L2VNI, and the egress leaf only bridges. Replies come back in the source's L2VNI, hence asymmetric, and every leaf needs every VLAN, VNI and SVI of the tenant. In symmetric IRB the ingress leaf routes into a per-VRF L3VNI and the egress leaf routes again into the destination VLAN, so both directions use the L3VNI and leaves only need their local VLANs. I choose symmetric: it scales and supports type 5. NX-OS only implements symmetric for EVPN.
Go deeper
Example
SRV1 10.10.10.11 in VLAN 10 on LEAF1 talks to SRV3 10.10.20.22 in VLAN 20 on LEAF2. VRF TENANT-A, L2VNIs 10010 and 10020, L3VNI 50001.
Asymmetric
- LEAF1 routes from VLAN 10 to VLAN 20 using its own VLAN 20 SVI.
- LEAF1 bridges to SRV3's MAC in VNI 10020.
- LEAF2 decapsulates and bridges to SRV3. The reply is routed by LEAF2 and sent in VNI 10010.
Symmetric
- LEAF1 looks up 10.10.20.22/32 in VRF TENANT-A, learned from LEAF2's type 2 MAC+IP route.
- LEAF1 encapsulates in VNI 50001. Inner source MAC is LEAF1's router MAC, inner destination MAC is LEAF2's router MAC.
- LEAF2 maps VNI 50001 to the VRF, routes to VLAN 20 and delivers to SRV3. The reply uses VNI 50001 too.
| Asymmetric | Symmetric | |
|---|---|---|
| VLANs and SVIs per leaf | All of the tenant's | Only local ones, plus the L3VNI |
| MAC and ARP state | Every host on every leaf | Local hosts plus host routes |
| Extra VNI | None | One L3VNI per VRF |
| Type 5 prefixes | Not usable | Supported |
| Lookups | Route at ingress only | Route at ingress and egress |
They will ask next
Why does NX-OS need a VLAN for the L3VNI?
NX-OS binds the L3VNI to a VLAN and an SVI that has
ip forwardand no address, which gives the VRF its forwarding context in hardware. EOS does not need a VLAN;vxlan vrf TENANT-A vni 50001is enough.Can leaves in the same VRF use different models?
Avoid it. A routed packet would arrive in a VNI the egress leaf does not expect for that destination. Multi-vendor fabrics agree on symmetric IRB.
Traps
- Reading "asymmetric" as different physical paths. It describes which VNI each direction uses.