In an EVPN-VXLAN bridged overlay where the Layer 3 gateway is an external device, such as a firewall or an SD-WAN router, the switch may learn the gateway IP address of one VLAN inside the MAC-IP table of a different VLAN. The switch then advertises this binding to the rest of the fabric in an EVPN Type 2 route.

• The MAC-IP table of one VLAN (VLAN A) shows two gateway IP addresses on the same gateway MAC address. One of them belongs to a different VLAN (VLAN B).
• Both entries are learned locally (DL flag) on the interface toward the external gateway.
• The remote leaf switches also see the wrong IP address, learned from the EVPN Type 2 route.
• Clearing the entry only works for a short time. The VLAN A gateway IP comes back right away, but the VLAN B gateway IP comes back later, at a regular interval.
• Traffic for hosts in VLAN A is not affected, because both IP addresses point to the same gateway MAC address.

Example from the switch connected to the external gateway:

user@switch> show ethernet-switching mac-ip-table vlan-name <vlan-a-name> | match <gateway-mac>

<vlan-b-gateway-ip> <gateway-mac> DL,K,AD <interface>

<vlan-a-gateway-ip> <gateway-mac> DL,K,AD <interface>

Example from a remote leaf switch:

user@leaf> show route table bgp.evpn.0 evpn-mac-address <gateway-mac>

2:<local-vtep-ip>:1::<vlan-a-vni>::<gateway-mac>::<vlan-b-gateway-ip>/304 MAC/IP

2:<local-vtep-ip>:1::<vlan-a-vni>::<gateway-mac>::<vlan-a-gateway-ip>/304 MAC/IP

The external gateway sends ARP packets on VLAN A using its VLAN B IP address as the sender IP. VLAN A has no IRB on the fabric, so the switch learns the MAC-IP binding from these ARP packets exactly as received and advertises it to the fabric.

• Capture the ARP packets using port mirroring to a PC running Wireshark, since monitor traffic interface may not show them:

set forwarding-options analyzer <analyzer-name> input ingress interface <interface>

set forwarding-options analyzer <analyzer-name> output interface <free-port>

Use the Wireshark display filter arp.src.proto_ipv4 == <vlan-b-gateway-ip>. The target IP in the ARP packet shows the device in VLAN A that triggers it.

• Fix the source:

++ If the device in VLAN A uses the VLAN B gateway IP for a service (DHCP, DNS, NTP), change it to the VLAN A gateway IP.

++ Otherwise, check with the gateway vendor why it uses its VLAN B IP as the ARP sender on VLAN A.

• Clear the entry and confirm it does not come back:

user@switch> clear ethernet-switching mac-ip-table vlan-name <vlan-a-name> <gateway-mac>