In Nokia’s EVPN-MPLS and EVPN-VXLAN implementations, for efficient load balancing of unknown unicast and known unicast traffic, the system uses a hash of the ingress physical port and the source MAC address of the Ethernet frame to select a specific next-hop from among the multiple equal-cost paths. This method helps distribute traffic flows from different source hosts across available links while maintaining flow consistency.

In an MPLS-based EVPN deployment (including EVPN-VPWS), the BGP next-hop address carried in the EVPN route must be reachable via the MPLS transport layer (e.g., via an LDP or RSVP-TE LSP). If the BGP next-hop (typically the system IP of the remote PE) is not resolvable in the global routing table or no label-switched path exists to it, the service label will be installed but traffic cannot be forwarded. The other options are less likely: Ethernet Tag ID must match for EVPN-VPWS, but its absence would likely prevent route installation; MTU issues cause fragmentation, not complete failure; and RDs need not match—they are locally significant.

In EVPN with multi-homing, the Designated Forwarder (DF) election is the standard mechanism (per ESI, per Ethernet Tag) that determines which PE in a redundancy group is responsible for forwarding Broadcast, Unknown Unicast, and Multicast (BUM) traffic to the multi-homed site. In single-active mode, the non-DF PE(s) do not forward any traffic (unicast or BUM) to the CE for that service, preventing loops. The election is typically based on a modulo operation involving the PE’s IP address and the list of PEs in the ES.

The issue describes a flow-specific failure where one flow works and another does not, despite the same endpoints. This is a classic symptom of an asymmetric routing problem in the underlay IP network. The VXLAN tunnel uses the outer IP/UDP header for transport. ECMP in the underlay uses a hash (e.g., of the outer IP 5-tuple) to select a path. If the hash for the TCP flow selects a different path than the ICMP flow, and that path is broken (e.g., a missing route, ACL, or MTU issue), that specific flow will fail. The UDP source port in VXLAN is often entropy-based to improve ECMP load balancing, but the core issue is the underlay ECMP path consistency.

In an EVPN-IPVPN model (often for Data Center Interconnect or DCI), EVPN is used as the control plane *between PEs* over the core (advertising IP Prefix routes with labels). However, on the PE-CE access link, standard IP routing protocols are used. If BGP is used on the PE-CE link, it is standard BGP IPv4 Unicast (AFI/SAFI 1/1). The PE learns the CE’s IP prefixes via this session, then re-advertises them to remote PEs using the BGP EVPN address family (specifically, IP Prefix Advertisement routes).

The service label (also called the VPN label or VC label) in an EVPN-MPLS MAC/IP route is an MPLS label that is pushed by the ingress PE after the transport label(s). When the packet arrives at the egress PE, this innermost label is used to identify the specific EVPN Instance (EVI) and broadcast domain to which the packet belongs. This allows the egress PE to perform the correct service-specific processing, such as removing the MPLS headers, adding the appropriate service VLAN tag, and forwarding the frame out the correct attachment circuit.

For an EVPN-based Virtual Private Wire Service (EVPN-VPWS), the Ethernet Auto-Discovery (EAD) route (Type 1) is the primary route type used. It is advertised per Ethernet Segment (ES) and includes the ESI and an Ethernet Tag ID that identifies the attachment circuit. This route enables the automatic discovery of remote PEs participating in the same point-to-point service and carries the VPWS service label. It is more efficient for a strict point-to-point service than using MAC/IP routes, as it doesn’t require per-MAC advertisement for a service that only has two endpoints.

The packet described has the key signatures of a VXLAN-encapsulated data plane packet: an inner Ethernet frame, an outer IP header with VTEP addresses as source/destination, and the IANA-assigned UDP port 4789 for VXLAN. Because the destination MAC is a specific host (Host-B) and not a broadcast/multicast address, and it is sent to a specific remote VTEP (VTEP-2), this represents a known unicast frame. The ingress VTEP (VTEP-1) has learned that Host-B’s MAC is located behind VTEP-2 (via EVPN MAC/IP routes) and is therefore sending the traffic directly via a unicast VXLAN tunnel.

For EVPN with IRB (Layer 2/Layer 3 integration), the PE must advertise the subnet’s default gateway information to remote PEs. This is done by advertising the IP address of the local IRB interface as an EVPN IP Prefix route (EVPN route type 5). This allows remote PEs/hosts to learn how to reach subnets routed by this PE. The IRB interface itself is typically part of a VPRN (Layer 3 VPN) instance on the Nokia 7750 SR, which is interconnected with the EVPN instance (VPLS or B-VPLS) via a configured ‘vxlan-gateway’ or similar construct.

In Nokia’s EVPN-MPLS and EVPN-VXLAN implementations, for efficient load balancing of unknown unicast and known unicast traffic, the system uses a hash of the ingress physical port and the source MAC address of the Ethernet frame to select a specific next-hop from among the multiple equal-cost paths. This method helps distribute traffic flows from different source hosts across available links while maintaining flow consistency.0