EVPN-VXLAN: Asymmetric IRB vs Symmetric IRB

The key difference is where inter-subnet routing occurs and how VXLAN encapsulation is performed.

Asymmetric IRB performs inter-subnet routing only at the ingress VTEP and forwards traffic using the destination L2 VNI, requiring all VLANs to be present on every leaf.

Symmetric IRB uses a tenant L3 VNI and performs routing at both ingress and egress VTEPs, allowing each leaf to host only its local VLANs and making it the preferred design for scalable EVPN-VXLAN deployments.

Asymmetric IRB

VM3 ping VM5 and VM6

root@Docker:~# ip add | grep 10.10.
inet 10.10.103.101/24 brd 10.10.103.255 scope global eth1
root@Docker:~#
root@Docker:~# ping 10.10.103.201
PING 10.10.103.201 (10.10.103.201) 56(84) bytes of data.
64 bytes from 10.10.103.201: icmp_seq=1 ttl=64 time=15.1 ms
64 bytes from 10.10.103.201: icmp_seq=2 ttl=64 time=7.55 ms
^C
--- 10.10.103.201 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1000ms
rtt min/avg/max/mdev = 7.547/11.336/15.125/3.789 ms
root@Docker:~# ping 10.10.104.201
PING 10.10.104.201 (10.10.104.201) 56(84) bytes of data.
64 bytes from 10.10.104.201: icmp_seq=2 ttl=63 time=5.11 ms
64 bytes from 10.10.104.201: icmp_seq=3 ttl=63 time=14.5 ms
^C
--- 10.10.104.201 ping statistics ---
3 packets transmitted, 2 received, 33.3333% packet loss, time 2001ms
rtt min/avg/max/mdev = 5.106/9.789/14.473/4.683 ms

VM3 learns how to encapsulate the VNI to reach VM5/6 via the ARP table.

root@leaf-r3# run show arp interface irb.103
MAC Address       Address         Name                      Interface               Flags
2c:6b:f5:b0:0c:f0 10.10.103.100   10.10.103.100             irb.103 [ae0.0]         permanent remote
50:00:00:91:00:01 10.10.103.101   10.10.103.101             irb.103 [ae0.0]         permanent remote
50:00:00:a4:00:01 10.10.103.201   10.10.103.201             irb.103 [vtep.32772]    permanent remote
Total entries: 3

[edit]
root@leaf-r3# run show arp interface irb.104
MAC Address       Address         Name                      Interface               Flags
2c:6b:f5:b0:0c:f0 10.10.104.100   10.10.104.100             irb.104 [ae0.0]         permanent remote
50:00:00:93:00:01 10.10.104.101   10.10.104.101             irb.104 [ae0.0]         permanent remote
50:00:00:a5:00:01 10.10.104.201   10.10.104.201             irb.104 [vtep.32772]    permanent remote
Total entries: 3

root@leaf-r4# run show arp interface irb.103
MAC Address       Address         Name                      Interface               Flags
2c:6b:f5:b0:0c:f0 10.10.103.100   10.10.103.100             irb.103 [ae0.0]         permanent remote
50:00:00:91:00:01 10.10.103.101   10.10.103.101             irb.103 [ae0.0]         permanent remote
50:00:00:a4:00:01 10.10.103.201   10.10.103.201             irb.103 [vtep.32770]    permanent remote
Total entries: 3

[edit]
root@leaf-r4# run show arp interface irb.104
MAC Address       Address         Name                      Interface               Flags
2c:6b:f5:b0:0c:f0 10.10.104.100   10.10.104.100             irb.104 [ae0.0]         permanent remote
50:00:00:93:00:01 10.10.104.101   10.10.104.101             irb.104 [ae0.0]         permanent remote
00:05:86:71:7a:f0 10.10.104.200   10.10.104.200             irb.104 [vtep.32770]    permanent remote
50:00:00:a5:00:01 10.10.104.201   10.10.104.201             irb.104 [vtep.32770]    permanent remote
Total entries: 4

root@leaf-r3# run show evpn database instance macvrf66-vlan-aware
Instance: macvrf66-vlan-aware
VLAN  DomainId  MAC address        Active source                  Timestamp        IP address
     50103      00:00:5e:00:53:aa  irb.103                        Jun 10 17:12:12  10.10.103.1
     50103      00:05:86:71:7a:f0  10.1.1.6                       Jun 16 21:40:38  10.10.103.200
     50103      2c:6b:f5:b0:0c:f0  00:00:00:00:00:00:00:00:00:34  Jun 16 21:42:00  10.10.103.100
     50103      50:00:00:91:00:01  00:00:00:00:00:00:00:00:00:34  Jun 16 21:43:36  10.10.103.101
     50103      50:00:00:a4:00:01  10.1.1.6                       Jun 16 21:33:25  10.10.103.201
     50104      00:00:5e:00:53:bb  irb.104                        Jun 10 17:12:12  10.10.104.1
     50104      00:05:86:71:7a:f0  10.1.1.6                       Jun 16 21:34:29  10.10.104.200
     50104      2c:6b:f5:b0:0c:f0  00:00:00:00:00:00:00:00:00:34  Jun 16 21:41:22  10.10.104.100
     50104      50:00:00:93:00:01  00:00:00:00:00:00:00:00:00:34  Jun 16 01:46:15  10.10.104.101
     50104      50:00:00:a5:00:01  10.1.1.6                       Jun 16 21:33:32  10.10.104.201

root@leaf-r4# run show evpn database instance macvrf66-vlan-aware
Instance: macvrf66-vlan-aware
VLAN  DomainId  MAC address        Active source                  Timestamp        IP address
     50103      00:00:5e:00:53:aa  irb.103                        Jun 10 17:04:12  10.10.103.1
     50103      00:05:86:71:7a:f0  10.1.1.6                       Jun 16 21:31:31  10.10.103.200
     50103      2c:6b:f5:b0:0c:f0  00:00:00:00:00:00:00:00:00:34  Jun 16 01:36:58  10.10.103.100
     50103      50:00:00:91:00:01  00:00:00:00:00:00:00:00:00:34  Jun 16 21:29:30  10.10.103.101
     50103      50:00:00:a4:00:01  10.1.1.6                       Jun 16 21:24:19  10.10.103.201
     50104      00:00:5e:00:53:bb  irb.104                        Jun 10 17:04:12  10.10.104.1
     50104      00:05:86:71:7a:f0  10.1.1.6                       Jun 16 21:25:22  10.10.104.200
     50104      2c:6b:f5:b0:0c:f0  00:00:00:00:00:00:00:00:00:34  Jun 16 01:36:58  10.10.104.100
     50104      50:00:00:93:00:01  00:00:00:00:00:00:00:00:00:34  Jun 16 21:32:35  10.10.104.101
     50104      50:00:00:a5:00:01  10.1.1.6                       Jun 16 21:24:26  10.10.104.201

[edit]

How it Works

The ingress VTEP performs the routing decision.

After routing, the packet is encapsulated into the destination L2 VNI and sent across the VXLAN fabric.

The egress VTEP only performs Layer-2 forwarding.

Example Topology

VM3 (VLAN 103)
    |
 Leaf3/4 (VTEP)
    |
 VXLAN Fabric
    |
 Leaf6 (VTEP)
    |
VM6 (VLAN 104)

Traffic Flow

VM3
  |
  | VLAN103
  v
Leaf3/4
  Route VLAN103 -> VLAN104
  Encapsulate into VNI50104
  |
  v
VXLAN Fabric
  |
  v
Leaf6
  Decapsulate VNI50104
  Bridge to VM6

Only Leaf3/4 performs routing.

Advantages

Simpler Design

No L3 VNI (type-5 routes) required.

Only need:

VLAN
L2 VNI
SVI

Disadvantages

Poor Scalability

Every VTEP must have all VLANs and SVIs.

Example:

Tenant A
  VLAN101
  VLAN102
  VLAN103
  VLAN104

Even if Leaf3/4 only has hosts in VLAN103, it still needs knowledge of VLAN104 and VLAN105 to route traffic.

In large fabrics:

100 Leafs
100 VLANs

Every leaf may need all 100 VLANs.

This becomes operationally difficult.

Symmetric IRB

VM3 ping VM5 and VM6

root@Docker:~# ip add | grep 10.10.103.101
    inet 10.10.103.101/24 brd 10.10.103.255 scope global eth1
root@Docker:~# ping 10.10.103.201
PING 10.10.103.201 (10.10.103.201) 56(84) bytes of data.
64 bytes from 10.10.103.201: icmp_seq=1 ttl=64 time=10.3 ms
64 bytes from 10.10.103.201: icmp_seq=2 ttl=64 time=5.92 ms
^C
--- 10.10.103.201 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1001ms
rtt min/avg/max/mdev = 5.919/8.132/10.345/2.213 ms
root@Docker:~# ping 10.10.104.201
PING 10.10.104.201 (10.10.104.201) 56(84) bytes of data.
64 bytes from 10.10.104.201: icmp_seq=2 ttl=62 time=5.87 ms
64 bytes from 10.10.104.201: icmp_seq=3 ttl=62 time=48.1 ms
64 bytes from 10.10.104.201: icmp_seq=4 ttl=62 time=4.92 ms
^C
--- 10.10.104.201 ping statistics ---
4 packets transmitted, 3 received, 25% packet loss, time 3004ms
rtt min/avg/max/mdev = 4.918/19.629/48.103/20.137 ms
root@Docker:~# ping 8.8.8.8
PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.
64 bytes from 8.8.8.8: icmp_seq=1 ttl=62 time=7.85 ms
64 bytes from 8.8.8.8: icmp_seq=2 ttl=62 time=4.75 ms
64 bytes from 8.8.8.8: icmp_seq=3 ttl=62 time=5.19 ms
^C
--- 8.8.8.8 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2002ms
rtt min/avg/max/mdev = 4.754/5.931/7.847/1.366 ms

VM3 GW the ARP table - the vtep interfaces are gone.

root@leaf-r3# run show arp interface irb.103
MAC Address       Address         Name                      Interface               Flags
2c:6b:f5:b0:0c:f0 10.10.103.100   10.10.103.100             irb.103 [ae0.0]         permanent remote
50:00:00:91:00:01 10.10.103.101   10.10.103.101             irb.103 [ae0.0]         permanent remote
Total entries: 2

[edit]
root@leaf-r3# run show arp interface irb.104
MAC Address       Address         Name                      Interface               Flags
2c:6b:f5:b0:0c:f0 10.10.104.100   10.10.104.100             irb.104 [ae0.0]         permanent remote
50:00:00:93:00:01 10.10.104.101   10.10.104.101             irb.104 [ae0.0]         permanent remote
Total entries: 2

leaf3/4 routing table

root@leaf-r3# run show route table t5-vrf1. | match 10.10.104.201
10.10.104.201/32   *[EVPN/170] 00:02:43
5:10.10.1.6:88::0::10.10.104.201::32/248

[edit]
root@leaf-r3# run show route table t5-vrf1. | match 10.10.103.201
10.10.103.201/32   *[EVPN/170] 00:02:46
5:10.10.1.6:88::0::10.10.103.201::32/248

root@leaf-r4# run show route table t5-vrf1. | match 10.10.104.201
10.10.104.201/32   *[EVPN/170] 00:03:55
5:10.10.1.6:88::0::10.10.104.201::32/248

[edit]
root@leaf-r4# run show route table t5-vrf1. | match 10.10.103.201
10.10.103.201/32   *[EVPN/170] 00:04:01
5:10.10.1.6:88::0::10.10.103.201::32/248

How it Works

Both ingress and egress VTEPs participate in routing.

Introduces:

L2 VNI
L3 VNI (per tenant VRF)

Example

VM3
10.10.103.101
VLAN103
VNI50103

VM6
10.10.104.201
VLAN104
VNI50104

Tenant VRF (t5-vrf1)
L3 VNI 1100

At Leaf3/4

VM3
  |
  v
Leaf3/4

Route:
10.10.103.0/24
      ->
10.10.104.0/24

Encapsulate into L3 VNI 1100 (transit vrf :t5-vrf1)

Across the Fabric

VXLAN Header
VNI = 1100

At Leaf6

Receive L3 VNI 1100

Lookup VRF (transit vrf :t5-vrf1)

Route:
VRF t5-vrf1
      ->
VLAN104

Forward to VM6

Both Leaf3/4 and Leaf6 perform routing.

Packet Walk Comparison

Asymmetric IRB

VM3
  |
Leaf3/4
(Route)
  |
VNI50104
  |
Fabric
  |
Leaf2
(Bridge)
  |
VM6

Symmetric IRB

VM3
  |
Leaf3/4
(Route)
  |
L3 VNI 1100
  |
Fabric
  |
Leaf6
(Route)
  |
VLAN104
  |
VM6

EVPN Route Types

Asymmetric IRB

Primarily uses:

EVPN Route Type 2

MAC + IP Advertisement

Symmetric IRB

Typically uses:

EVPN Route Type 2 (MAC/IP)
EVPN Route Type 5 (IP Prefix)

IP Prefix Advertisement

Type 5 routes become especially useful for large-scale routing and tenant mobility.

Why Symmetric IRB Became the Industry Standard

Modern EVPN fabrics primarily deploy Symmetric IRB because of its scalability and operational simplicity.

Better Scalability

Only local VLANs need to exist on a leaf.

Example:

Leaf3:
 VLAN103

Leaf6:
 VLAN104

No need to stretch all VLANs everywhere.

Better Multi-Tenancy

Tenant-A
  VRF (L3)
   |
   +-- VLAN101
   +-- VLAN103
   +-- VLAN104

L3 VNI = 1100

The L3 VNI provides a common routing domain for the tenant.

Smaller Control Plane

Less:

VLAN state
SVI state
ARP entries
Flooding domains

Feature Comparison

Feature	Asymmetric IRB	Symmetric IRB
Routing Location	Ingress VTEP only	Ingress + Egress VTEP
L3 VNI Required	No	Yes
L2 VNI Required	Yes	Yes
Scalability	Limited	Excellent
All VLANs on Every Leaf	Yes	No
Multi-Tenant Support	Limited	Excellent
Preferred in Modern Fabrics	No	Yes

Design Summary

Asymmetric IRB performs inter-subnet routing only at the ingress VTEP and forwards traffic using the destination L2 VNI, requiring all VLANs to be present on every leaf.

Symmetric IRB uses a tenant L3 VNI and performs routing at both ingress and egress VTEPs, allowing each leaf to host only its local VLANs and making it the preferred design for scalable EVPN-VXLAN deployments.

Copyright Notice: This article is an original work. Copyright belongs to Will's Blog. Please contact the author for permission before reprinting.

Article URL: https://blog.1amwill.com/index.php/archives/27/

If you have any questions or concerns about this article, feel free to leave a comment. I will try my best to respond as soon as possible.

Juniper EVPN/VXLAN-Mac-VRF-3

EVPN-VXLAN: Asymmetric IRB vs Symmetric IRB

Asymmetric IRB

VM3 ping VM5 and VM6

How it Works

Example Topology

Traffic Flow

Advantages

Simpler Design

Disadvantages

Poor Scalability

Symmetric IRB

VM3 ping VM5 and VM6

VM3 GW the ARP table - the vtep interfaces are gone.

leaf3/4 routing table

How it Works

Example

At Leaf3/4

Across the Fabric

At Leaf6

Packet Walk Comparison

Asymmetric IRB

Symmetric IRB

EVPN Route Types

Asymmetric IRB

Symmetric IRB

Why Symmetric IRB Became the Industry Standard

Better Scalability

Better Multi-Tenancy

Smaller Control Plane

Feature Comparison

Design Summary

Leave a Comment

表情类型

Table of Contents