A VM moves from LEAF1 to LEAF3. How does EVPN handle it, and how does it detect a MAC that keeps moving?
Show the answer
Say this first
LEAF3 learns the MAC locally (the hypervisor sends a RARP or gratuitous ARP after the move), sees it already has a remote route for that MAC from LEAF1, and advertises its own type 2 with the MAC mobility extended community and a higher sequence number. Every VTEP prefers the higher sequence, and LEAF1 withdraws its route. If a MAC moves too often, 5 moves in 180 seconds by default on NX-OS and as suggested by RFC 7432, it is flagged duplicate and no longer advertised, so a loop or a cloned MAC cannot churn the whole fabric.
Go deeper
Sequence numbers
- The first advertisement of a MAC carries no mobility community, which counts as sequence 0.
- Each move adds one. The highest sequence wins, before normal BGP best path comparison matters.
- If two leaves claim the same sequence number, RFC 7432 picks the route from the lower originator IP.
- A MAC advertised as static (sticky) cannot move. Gateway MACs use this.
With an anycast gateway
The VM keeps its cached gateway ARP entry because every leaf owns the same gateway MAC. Its /32 host route moves with the MAC+IP type 2 route, so routed traffic follows it.
Duplicate detection
- Real causes: a layer 2 loop at the access layer, cloned VMs with the same MAC, a broken multihoming setup that learns the same MAC on both sides.
- NX-OS marks the entry with a
Dupflag inshow l2route evpn mac alland stops advertising it. After repeated detections it can freeze the MAC until you clear it. - Duplicate IP detection works the same way for MAC+IP routes.
They will ask next
Why does the hypervisor send a RARP or GARP after the move?
So the new leaf learns the MAC immediately and the old location is corrected without waiting for the VM to send traffic on its own.
Traps
- Saying BGP picks the new location by shortest AS path. The mobility sequence number decides.