Description

The article explains the DHCP support in EVPN-VXLAN Fabric Architecture.
Before we move ahead with the DHCP part, let's understand how EVPN and DHCP play a role in the ARP population.

  • In stateful DHCP (Default config), for every DHCP binding; an access-internal route gets created which programs the ARP in Kernel.

  • In the EVPN case, every EVPN MAC-IP route by default creates ARP/Host route.

  • In case, stateful DHCP and EVPN both co-exist in the customer network, it creates a conflict as both services create a host route in the Kernel which populates the ARP.

  • If any one of these routes (JDHCPD or L2ALD) gets withdrawn, ARP/host route from Kernel might get deleted.

Symptoms

In EVPN, if stateful DHCP is used; it might cause inconsistency between ARP & MAC-IP seen which causes forwarding issues.

  • If the leaf loses the DHCP binding, it will withdraw the access-internal route & which would delete the ARP entry from the system.

  • Here EVPN/L2ALD can still have a MAC-IP route but there is no ARP so the system will go out of sync.

Solution

Workaround:

Either use stateless DHCP (forward-only) OR suppress the access-internal routes with state-full DHCP through route suppression.

1. The Stateless DHCP forward-only option is a lightweight DHCP and does not create any bindings. It can be configured with the below knob:
set routing-instances VRF_1 forwarding-options dhcp-relay forward-only

2. In the case of state-full DHCP, by suppressing the access-internal routes, the ARP deletion issue can be resolved:

set routing-instances VRF_1 forwarding-options dhcp-relay route-suppression access-internal


​​​​More details on suppressing DHCP routes: https://www.juniper.net/documentation/us/en/software/junos/dhcp/topics/topic-map/dhcp-access-supressing.htm


    A few additional use cases are covered on the below-mentioned link.

     

    Note: All the ARP for IPs which has binding in DHCP need to be re-learned after adding these configs.

    • clear dhcp relay binding all routing-instance VRF_1

    • clear ethernet-switching table <MAC>

    • show route protocol access-internal table VRF_1.inet.0

    • show arp vpn VRF_1

    Modification History

    2023-07-27: Workaround modified as per PR 1748273, removed FIX as it is misleading, there is no fix as it is expected behavior in case of vxlan/evpn environment configured with DHCP-relay. Added related PRs in internal comments.

    Related Information

    DHCP Relay Agent over EVPN-VXLAN
    https://www.juniper.net/documentation/us/en/software/junos/evpn-vxlan/topics/concept/evpn-vxlan-dhcp-relay.html

    DHCP Relay Design and Implementation - Data Center EVPN-VXLAN Fabric Architecture Guide.
    https://www.juniper.net/documentation/us/en/software/nce/sg-005-data-center-fabric/topics/task/endpoint-services-cloud-dc-configuring.html