[Nexus9Kv] VXLAN EVPNの外部接続方式(VRF-Lite, Route Leak, Downstream VNI)を確認

はじめに

VXLAN EVPNファブリックで外部接続を担うリーフスイッチをBorder Leafと呼びますが、「Border Leafでどう外部経路を受けて、どうテナントVRFへ配るか」で設計が大きく変わります。本記事では代表的な3方式（＋番外1方式）を整理し、Nexus9000vの実機で経路伝搬と疎通を確認しました。

以前の記事（[Nexus9K] VXLAN EVPN サービスチェイニング – GPO & ePBRを試してみた）と同じく、アンダーレイはIPv6 eBGP Unnumberedで組んだスパインリーフ構成です。今回はここにBorder Leaf（BLeaf）と外部ルータ（ExtRtr）を追加しています。

試験では外部ルータから 203.0.113.0/24 と 2001:203:0:113::/64 を広告し、BLeafで受信した経路をLeaf1（Customer-A）とLeaf2（Customer-B）へ配布して、配下のホストから外部へ到達できるかを確認しました。

方式概要
方式1Border LeafでのVRF Lite接続（テナントごとに外部接続）
方式2default VRF（アンダーレイ）で外部接続し、Border LeafでRoute Leak（Inband Management想定）
方式3Shared VRFで外部接続し、DSVNI（Downstream VNI）を使って各LeafでRoute Leak
番外Border LeafでのCentralized Route Leakingによるテナント間通信

Tips! DSVNI（Downstream VNI）とAsymmetric VNI

通常のSymmetric IRBでは、同じVRFについて全VTEPが同じL3VNIを使います。送信側も受信側も「VRF = このL3VNI」という前提で、異なるVRFの経路を使うにはそのVRF（とL3VNI）を自分にも作る必要があります。

DSVNIでは、送信側VTEPは宛先VTEPがEVPN経路に付けて広告したVNIでカプセル化します。たとえばLeaf1（Customer-A = L3VNI:50100）からBLeaf（Shared = L3VNI:50999）へは50999で、BLeafからLeaf1へは50100で送ります。往路と復路でVNIが異なるためAsymmetric VNIと呼ばれ、NX-OSではルーティングテーブルに (Asymmetric) と表示されます。

メリットは、VTEP間でVRFとL3VNIを揃えなくてよいことです。共有サービス用のVRFを各Leafに作らず、テナントVRFでRTをimportするだけで到達できます。逆にBorder LeafにもテナントVRFを作らずに済み、VLAN・VRF・L3VNIなどのリソースを節約できます。

検証構成

Spine 1台、Leaf 2台、Border Leaf 1台のファブリックに、テナント用ホスト2台と外部ルータ1台を接続しています。

全機器のコンフィグは、方式ごとに末尾のAppendixに掲載しています。本文では各方式のポイントとなる部分だけ抜粋しています。

  • ファブリック: Nexus9000v（C9300v）、NX-OS 10.6(3)
  • ホスト・外部ルータ: CSR1000v（IOS-XE 17.3.2）
  • アンダーレイ: IPv6 eBGP Unnumbered（リンクローカルのみ）、VTEPもIPv6（Loopback0）
  • オーバーレイ: BGP EVPN（Spineで retain route-target all ＋ next-hop unchanged）
  • RT: 65000:<VNI> のサービス統一フォーマット。eBGPベースのファブリックでは機器ごとにASが異なるため、route-target auto（ASN:VNI）では一致しません
  • RD: rd auto（Router-ID:VRF ID）

アンダーレイ（ファブリック）

機器役割ASRouter-IDLoopback0（VTEP）
SpineSpine65101101.101.101.1012001:db8:100::101/128
Leaf1Leaf（Customer-Aを収容）65102102.102.102.1022001:db8:100::102/128
Leaf2Leaf（Customer-Bを収容）65103103.103.103.1032001:db8:100::103/128
BLeafBorder Leaf65104104.104.104.1042001:db8:100::104/128

IPv6 UnnumberedではリンクローカルアドレスがBGPのネクストホップになるため、各Leaf（BLeafも含む）はEVPN経路の広告時にネクストホップを自身のVTEPアドレスに書き換えています。Spineは next-hop unchanged でそのまま中継します。以下は参考としてLeaf1の設定です（Leaf2・BLeafはアドレスだけ異なります）。

! Leaf1
route-map RM_EVPN_NH permit 10
  set ipv6 next-hop 2001:db8:100::102
!
router bgp 65102
  neighbor Ethernet1/1
    remote-as 65101
    address-family l2vpn evpn
      send-community
      send-community extended
      route-map RM_EVPN_NH out

オーバーレイ（テナント）

テナントはCustomer-AとCustomer-Bの2つのVRFです。CustomerA・CustomerBはそれぞれのVRFに属するホストで、アンダーレイのアドレスとは独立したオーバーレイ側のアドレスを持ちます。デフォルトゲートウェイは各LeafのAnycast Gateway（.1 / ::1）です。

VRFL2VNI（VLAN）L3VNI（VLAN）RTサブネット収容Leafホスト
Customer-A10010（VLAN10）50100（VLAN100）65000:5010010.10.10.0/24, 2001:10:10:10::/64Leaf1CustomerA: 10.10.10.100, 2001:10:10:10::100
Customer-B10020（VLAN20）50200（VLAN200）65000:5020010.20.20.0/24, 2001:10:20:20::/64Leaf2CustomerB: 10.20.20.100, 2001:10:20:20::100
Shared（方式3のみ）–50999（VLAN999）65000:50999外部接続用BLeaf–

外部接続

外部ルータ（ExtRtr、AS 65100）はLoopback0に 203.0.113.1/24 と 2001:203:0:113::1/64 を持ち、これを外部経路としてBLeafへ広告します。BLeafとExtRtrは2本の物理リンクでつながり、IPv4とIPv6それぞれのネイティブeBGPです。

リンクBLeaf側ExtRtr側使う方式
Eth1/5 – Gi1172.31.10.1/30, 2001:172:31:10::1/64172.31.10.2, 2001:172:31:10::2全方式（方式1ではCustomer-A用）
Eth1/6 – Gi2172.31.20.1/30, 2001:172:31:20::1/64172.31.20.2, 2001:172:31:20::2方式1のCustomer-B用のみ

方式1: Border Leaf上でのVRF Lite接続

テナントVRFをそのままBLeafまで延ばし、VRFごとに外部ルータとeBGPを張る、もっとも素直な方式です。外部経路はBLeafのVRFからEVPN Type-5として各L3VNIにそのまま広告されます。

メリットデメリット
構成がわかりやすく、特別な機能がいらないテナントごとにIF（またはサブIF）とeBGPセッションが必要で、テナント数に比例して接続コストと設定量が増える
テナントが物理・論理ともに分離され、障害やオペミスの影響がそのテナントに閉じる外部ルータ側もVRF（またはテナントごとの接続先）を用意する必要がある
外部側でもテナントごとにポリシーやQoS、帯域を分けやすいBLeafにも全テナントのVRF・L3VNIが必要で、テナント追加のたびにBLeafの設定も変える

コンフィグのポイント（BLeaf）

BLeafにもLeafと同じVRF・L3VNI・RTを定義し、外部向けIFをVRFに所属させてVRF配下でeBGPを張ります。Customer-Bも同様（Eth1/6、L3VNI 50200）です。

vrf context Customer-A
  vni 50100
  rd auto
  address-family ipv4 unicast
    route-target import 65000:50100
    route-target import 65000:50100 evpn
    route-target export 65000:50100
    route-target export 65000:50100 evpn
  address-family ipv6 unicast
    (ipv4と同様)
!
interface Vlan100
  no shutdown
  vrf member Customer-A
  ip forward
  ipv6 forward
!
interface nve1
  member vni 50100 associate-vrf
  member vni 50200 associate-vrf
!
interface Ethernet1/5
  no switchport
  vrf member Customer-A
  ip address 172.31.10.1/30
  ipv6 address 2001:172:31:10::1/64
!
router bgp 65104
  vrf Customer-A
    neighbor 2001:172:31:10::2
      remote-as 65100
      address-family ipv6 unicast
    neighbor 172.31.10.2
      remote-as 65100
      address-family ipv4 unicast

ログの確認ポイント

BLeaf: VRFごとに外部経路を受信。Customer-A・Customer-BそれぞれのeBGPセッションで203.0.113.0/24を受信しています。

BLeaf# show bgp ipv4 unicast vrf Customer-A
   Network            Next Hop            Metric     LocPrf     Weight Path
*>e10.10.10.0/24      2001:db8:100::102                              0 65101 65102 i
*>e10.10.10.100/32    2001:db8:100::102                              0 65101 65102 i
*>e203.0.113.0/24     172.31.10.2              0                     0 65100 i

BLeaf# show ipv6 route vrf Customer-B
2001:203:0:113::/64, ubest/mbest: 1/0
    *via 2001:172:31:20::2, [20/0], 00:09:07, bgp-65104, external, tag 65100

EVPNテーブルでは、受信した外部経路がVRFごとのRD（104.104.104.104:4 = L3VNI 50100、:5 = L3VNI 50200）でType-5として生成されています。

BLeaf# show bgp l2vpn evpn
Route Distinguisher: 104.104.104.104:4    (L3VNI 50100)
*>l[5]:[0]:[0]:[24]:[203.0.113.0]/224
                      2001:db8:100::104        0                     0 65100 i
*>l[5]:[0]:[0]:[64]:[2001:203:0:113::]/416
                      2001:db8:100::104        0                     0 65100 i
Route Distinguisher: 104.104.104.104:5    (L3VNI 50200)
*>l[5]:[0]:[0]:[24]:[203.0.113.0]/224
                      2001:db8:100::104        0                     0 65100 i
*>l[5]:[0]:[0]:[64]:[2001:203:0:113::]/416
                      2001:db8:100::104        0                     0 65100 i

Leaf1: Customer-AのVRFにインポート。外部経路がBLeafのVTEP（2001:db8:100::104）宛て、L3VNI 50100でフォワーディングテーブルまで入っています。Leaf2も同様に Customer-B（L3VNI 50200）に取り込まれています。

Leaf1# show ip route vrf Customer-A
203.0.113.0/24, ubest/mbest: 1/0
    *via 2001:db8:100::104%default, [20/0], 00:07:42, bgp-65102, external, tag 65101, segid: 50100 VTEP:(2001:db8:100::104, underlay_vrf: 1) encap: VXLAN

Leaf1# show forwarding ipv4 route vrf Customer-A
203.0.113.0/24       2001:db8:100::104  nve1        vni:   50100

疎通確認。CustomerA・CustomerBの両方から外部アドレスへIPv4/IPv6ともに到達できました（CustomerBのIPv6初回1パケットは近隣解決で落ちたものと思われます）。

CustomerA#ping 203.0.113.1
Success rate is 100 percent (5/5), round-trip min/avg/max = 5/6/7 ms
CustomerB#ping 2001:203:0:113::1
.!!!!
Success rate is 80 percent (4/5), round-trip min/avg/max = 5/6/10 ms

方式2: default VRFで外部接続しBorder LeafでRoute Leak

外部ルータとの接続をdefault VRF（アンダーレイ）側で1本だけ持ち、BLeaf上で各テナントVRFとdefault VRFの間で経路をリークする方式です。Inband Managementのように、アンダーレイ（グローバル）側にある外部ネットワークと各テナントを繋ぐ用途を想定しています。リークにはVRF配下の import vrf default / export vrf default を使います。

メリットデメリット
外部接続を1本に集約でき、テナントが増えても接続数もeBGPセッションも増えない外部経路とアンダーレイの経路が混ざる（後述）。外部とのeBGPにフィルタが必須
Leaf側の設定変更が不要で、リークの制御がBLeafに集約されるテナントを追加するたびに、BLeafでVRF・L3VNIに加えてprefix-list／route-mapを追加する必要がある
Inband Managementのように、アンダーレイ側にあるネットワークと各テナントを繋ぐ用途に向く全テナントの経路がdefault VRFに集まるため、テナント間でアドレスが重複していると使えない
共有部分の障害やオペミスが全テナントに影響する

コンフィグのポイント（BLeaf）

外部向けIF（Eth1/5）をdefault VRFに戻し、eBGPもdefault VRFで張ります（Eth1/6はshutdown）。各テナントVRFでは、取り込む外部経路と外へ出す自テナント経路をroute-mapで絞ってリークします。IPv6も rmapv6-global-* で同様に設定しています。

ip prefix-list plist-global-exportA seq 5 permit 10.10.10.0/24
ip prefix-list plist-global-exportB seq 5 permit 10.20.20.0/24
ip prefix-list plist-global-import  seq 5 permit 203.0.113.0/24
!
route-map rmap-global-exportA permit 10
  match ip address prefix-list plist-global-exportA
route-map rmap-global-import permit 10
  match ip address prefix-list plist-global-import
!
vrf context Customer-A
  vni 50100
  rd auto
  address-family ipv4 unicast
    route-target import 65000:50100
    route-target import 65000:50100 evpn
    route-target export 65000:50100
    route-target export 65000:50100 evpn
    import vrf default map rmap-global-import advertise-vpn
    export vrf default map rmap-global-exportA allow-vpn
!
router bgp 65104
  neighbor 2001:172:31:10::2
    remote-as 65100
    address-family ipv6 unicast
  neighbor 172.31.10.2
    remote-as 65100
    address-family ipv4 unicast

advertise-vpn はdefault VRFから取り込んだ経路をさらにEVPNへ広告するため、allow-vpn はEVPNで学習したテナント経路をdefault VRFへ出すために必要です。

ログの確認ポイント

BLeaf: default VRFの外部経路が各テナントVRFにリーク。ネクストホップが %default となっており、default VRFからのリークであることがわかります。

BLeaf# show ip route vrf Customer-A
203.0.113.0/24, ubest/mbest: 1/0
    *via 172.31.10.2%default, [20/0], 00:13:04, bgp-65104, external, tag 65100

BLeaf# show ip route vrf Customer-B
203.0.113.0/24, ubest/mbest: 1/0
    *via 172.31.10.2%default, [20/0], 00:09:53, bgp-65104, external, tag 65100

リークした経路は各VRFのRD（104.104.104.104:4 / :5）でType-5として再広告され、方式1と同じ形でLeafへ届きます。

Leaf1# show ip route vrf Customer-A
203.0.113.0/24, ubest/mbest: 1/0
    *via 2001:db8:100::104%default, [20/0], 00:10:50, bgp-65102, external, tag 65101, segid: 50100 VTEP:(2001:db8:100::104, underlay_vrf: 1) encap: VXLAN

逆方向も、ExtRtrは1本のセッションで両テナントの経路を受信しています。CustomerA・CustomerBからのpingはIPv4/IPv6とも100%成功しました。

ExtRtr#show bgp ipv4 unicast
 *>   10.10.10.0/24    172.31.10.1                            0 65104 65101 65102 i
 *>   10.20.20.0/24    172.31.10.1                            0 65104 65101 65103 i
 *>   203.0.113.0      0.0.0.0                  0         32768 i

注意: アンダーレイと外部の経路が混ざる

default VRFで外部接続しているため、外部経路はアンダーレイのIPv6ユニキャストにもそのまま流れ、SpineやLeafのdefault VRFにも 2001:203:0:113::/64 が入りました（Spineから外部へping6も通ります）。逆にExtRtrにはVTEPのLoopback（2001:db8:100::101〜104/128）が広告されています。

Spine# show ipv6 route
2001:203:0:113::/64, ubest/mbest: 1/0
    *via fe80::5209:ff:fe00:1b08, Eth1/3, [20/0], 00:38:16, bgp-65101, external, tag 65104

ExtRtr#show bgp ipv6 unicast
 *>   2001:DB8:100::101/128  2001:172:31:10::1   0 65104 65101 i
 *>   2001:DB8:100::104/128  2001:172:31:10::1   0 65104 i

Inband Managementのように、アンダーレイと外部が繋がること自体が目的なら想定どおりの動きです。ただし外部にファブリックのVTEPアドレスが見え、外部経路がアンダーレイに入るので、外部とのeBGPにはインバウンド／アウトバウンドのフィルタをセットで設計しておくのが安全です。ユーザ通信の外部接続であれば、アンダーレイと切り離せる方式1や方式3の方が向いています。

方式3: Shared VRF＋DSVNIで各LeafがRoute Leak

BLeafには外部接続用のShared VRF（L3VNI 50999）だけを置き、各LeafはテナントVRFでSharedのRTをimportするだけの方式です。異なるL3VNI間の通信は、DSVNI（Downstream VNI）により「宛先VTEPが広告したVNIでカプセル化する」ことで成立します。

方式3: Route Leak with Shared VRF & Downstream VNI
メリットデメリット・注意点
BLeafにテナントVRFが不要で、VRF・VLAN・L3VNIのリソースを節約できるShared VRFは方式2と同じく共通の障害点になる
各LeafはSharedのRTをimportするだけ。prefix-list等の管理も不要Shared VRFに全テナントの経路が集まるため、テナント間でアドレスが重複していると使えない
外部経路がアンダーレイに入らず、方式2のような経路の混在が起きないテナント追加時は、Leaf側に加えてBLeafのShared VRFにもそのテナントのRTのimportを追加する
テナント間の分離は保たれる（各LeafはSharedのRTしかimportしない）テナント間の分離がRT設計に依存する。Sharedにテナント経路が集まるので、外部へ出す経路のフィルタも検討が必要
全VTEPでDSVNIをサポートしている必要がある。送信と受信でVNIが異なるため、トラブルシュートで見るべき点が増える

コンフィグのポイント

BLeafのShared VRFでは、各テナントのRT（65000:50100 / 65000:50200）をimportします。Customer-A・Customer-BのVRF自体はBLeafに存在しません。

vlan 999
  vn-segment 50999
!
vrf context Shared
  vni 50999
  rd auto
  address-family ipv4 unicast
    route-target import 65000:50100
    route-target import 65000:50100 evpn
    route-target import 65000:50200
    route-target import 65000:50200 evpn
    route-target import 65000:50999
    route-target import 65000:50999 evpn
    route-target export 65000:50999
    route-target export 65000:50999 evpn
  address-family ipv6 unicast
    (ipv4と同様)
!
interface Ethernet1/5
  vrf member Shared
  ip address 172.31.10.1/30
  ipv6 address 2001:172:31:10::1/64
!
interface nve1
  member vni 50999 associate-vrf
!
router bgp 65104
  vrf Shared
    address-family ipv4 unicast
      advertise l2vpn evpn
    address-family ipv6 unicast
      advertise l2vpn evpn
    neighbor 172.31.10.2
      remote-as 65100
      address-family ipv4 unicast
    neighbor 2001:172:31:10::2
      remote-as 65100
      address-family ipv6 unicast

各Leafでは、テナントVRFにSharedのRTを追加するだけです（Leaf1の例。Leaf2のCustomer-Bも同様）。

vrf context Customer-A
  vni 50100
  rd auto
  address-family ipv4 unicast
    route-target import 65000:50100
    route-target import 65000:50100 evpn
    route-target import 65000:50999
    route-target import 65000:50999 evpn
    route-target export 65000:50100
    route-target export 65000:50100 evpn
  address-family ipv6 unicast
    (ipv4と同様)

ログの確認ポイント

Leaf1: 外部経路がVNI 50999（Asymmetric）で入る。Leaf1自身は50999を持っていませんが、BLeaf宛ては50999でカプセル化しています。

Leaf1# show ip route vrf Customer-A
203.0.113.0/24, ubest/mbest: 1/0
    *via 2001:db8:100::104%default, [20/0], 00:16:17, bgp-65102, external, tag 65101, segid: 50999 (Asymmetric) VTEP:(2001:db8:100::104, underlay_vrf: 1) encap: VXLAN

Leaf1# show forwarding ipv4 route vrf Customer-A
203.0.113.0/24       2001:db8:100::104  nve1        vni:   50999

BLeaf: 各LeafのL3VNIを制御プレーンで学習。Configured VNIs は50999だけですが、Learnt CP VNIs としてLeaf1から50100、Leaf2から50200を学習し、戻りトラフィックはそのVNIでカプセル化されます。

BLeaf# show nve peers detail
Peer-Ip: 2001:db8:100::102
    Configured VNIs     : 50999
    Learnt CP VNIs      : 50100
Peer-Ip: 2001:db8:100::103
    Configured VNIs     : 50999
    Learnt CP VNIs      : 50200

Shared VRF（RD 104.104.104.104:6 = L3VNI 50999）には両テナントの経路と外部経路が集まっています。一方でSpineやLeafのdefault VRFに外部経路は入っておらず、方式2で見られたアンダーレイへの混入はありません。

疎通確認。両テナントから外部へはIPv4/IPv6とも100%。一方、CustomerAとCustomerBの間は届きません。各LeafはSharedのRTしかimportしていないため、テナント間の分離は保たれています。

CustomerA#ping 203.0.113.1
Success rate is 100 percent (5/5), round-trip min/avg/max = 5/6/10 ms
CustomerA#ping 10.20.20.100
.....
Success rate is 0 percent (0/5)

番外: Border LeafでのCentralized Leakingによるテナント間通信

外部接続からは少し外れますが、テナント間のリークをBLeafだけで集中管理する方式も試しました。方式2の構成のまま、BLeaf上でCustomer-AとCustomer-BのRTを相互importし、集約経路として相手テナントへ再広告しています。

メリットデメリット
テナント間のリークをBLeafで集中コントロールできるテナント間トラフィックが必ずBLeafを経由する（ヘアピン）。BLeafの帯域と障害がボトルネックになりうる
各Leafの設定変更がないため、オペミスを減らせるBLeafの転送はホスト経路（/32・/128）に依存する
可否の変更と1箇所で完結し、稼働中のテナント間通信を管理しやすい相手テナントのサブネットごとに集約経路（aggregate-address）を設計・追加する必要がある

コンフィグのポイント（BLeaf）

RTをimportしただけでは、取り込んだ経路は別テナントのRTで再広告されません。そこで各VRFで相手テナントのサブネットを aggregate-address で再生成し、自テナントのRTで広告させています。

この集約経路が必要な点は、コンフィグレーションガイドのCentralized VRF Route-Leakingの項にも明記されています。

Configured less specific prefixes (aggregates) are advertised from the Routing-Block to the remaining VTEPs in the respective destination VRF.

BGP EVPN does not export prefixes that were previously imported to prevent the occurrence of routing loops.

— Cisco Nexus 9000 Series NX-OS VXLAN Configuration Guide, Release 10.2(x) – Configuring External VRF Connectivity and Route Leaking（Centralized VRF Route-Leaking Brief – Specific Prefixes Between Custom VRF）

つまり、BGP EVPNはループ防止のため「importした経路をそのまま別VRFへexportしない」ので、Routing-Block（今回はBLeaf）で集約経路を生成し、それを宛先VRFに広告する必要があります。同ガイドのGuidelinesでは、この方式にはVTEPでのハードウェアVXLANルーティングと再カプセル化（re-encapsulation）が必要ともされています。

vrf context Customer-A
  address-family ipv4 unicast
    route-target import 65000:50200
    route-target import 65000:50200 evpn
vrf context Customer-B
  address-family ipv4 unicast
    route-target import 65000:50100
    route-target import 65000:50100 evpn
!
router bgp 65104
  vrf Customer-A
    address-family ipv4 unicast
      advertise l2vpn evpn
      aggregate-address 10.20.20.0/24
    address-family ipv6 unicast
      advertise l2vpn evpn
      aggregate-address 2001:10:20:20::/64
  vrf Customer-B
    address-family ipv4 unicast
      advertise l2vpn evpn
      aggregate-address 10.10.10.0/24
    address-family ipv6 unicast
      advertise l2vpn evpn
      aggregate-address 2001:10:10:10::/64

ログの確認ポイント

Leaf1: 相手テナントの経路がBLeaf経由で入る。10.20.20.0/24のネクストホップはLeaf2ではなくBLeaf（2001:db8:100::104）で、AS_PATHもBLeaf発の集約経路（65101 65104 i）となっています。

Leaf1# show bgp l2vpn evpn
Route Distinguisher: 104.104.104.104:4
*>e[5]:[0]:[0]:[24]:[10.20.20.0]/224
                      2001:db8:100::104                              0 65101 65104 i

Leaf1# show ip route vrf Customer-A
10.20.20.0/24, ubest/mbest: 1/0
    *via 2001:db8:100::104%default, [20/0], 00:08:56, bgp-65102, external, tag 65101, segid: 50100 VTEP:(2001:db8:100::104, underlay_vrf: 1) encap: VXLAN

BLeaf: ホスト経路で相手Leafへ転送。集約経路自体はNull0なので、実際の転送はRT importで取り込んだType-2のホスト経路で行われます。相手テナントのホストは宛先側のVNI（50200）でカプセル化され、Asymmetricと表示されています。

BLeaf# show ip route vrf Customer-A
10.20.20.0/24, ubest/mbest: 1/0
    *via Null0, [220/0], 00:10:31, bgp-65104, discard, tag 65104
10.20.20.100/32, ubest/mbest: 1/0
    *via 2001:db8:100::103%default, [20/0], 00:19:05, bgp-65104, external, tag 65101, segid: 50200 (Asymmetric) VTEP:(2001:db8:100::103, underlay_vrf: 1) encap: VXLAN

疎通確認。CustomerAとCustomerBの間でIPv4/IPv6とも100%到達しました。RTTは7〜10 ms程度で、外部宛て（5〜6 ms）より大きく、BLeafを折り返している様子がうかがえます。

CustomerA#ping 10.20.20.100
Success rate is 100 percent (5/5), round-trip min/avg/max = 7/8/10 ms
CustomerB#ping 2001:10:10:10::100
Success rate is 100 percent (5/5), round-trip min/avg/max = 7/8/11 ms

なお、BLeafがホスト経路に依存するため、通信しない（ARP/NDが学習されていない）サイレントホストは集約経路のNull0で落ちる可能性があります。本番で使う場合はこの点の評価が必要です。

まとめ

3方式とも、外部経路（203.0.113.0/24、2001:203:0:113::/64）を各LeafのテナントVRFまで配布でき、IPv4/IPv6ともに配下ホストから疎通できました。違いは「リークをどこでやるか」と「何を共有するか」にあります。

方式外部接続数BLeafのテナントVRFリークする場所Leafの設定変更障害・オペミスの影響範囲向いているケース
1. VRF Liteテナント数分必要なし不要テナント単位テナント数が少ない、分離を最優先したい
2. default VRF＋BLeafでリーク（Inband Management）1必要BLeaf不要全テナント＋アンダーレイインバンド管理など、アンダーレイと繋ぐ前提の用途
3. Shared VRF＋DSVNI1不要各Leaf（RT importのみ）RTを1行追加全テナントテナントが多く、アドレス重複がない共通サービス接続
番外. Centralized Leaking–必要BLeaf（集約で再広告）不要リーク対象のテナントテナント間通信を集中管理したい（ヘアピン許容）
  • 分離とわかりやすさを重視するなら方式1。テナントが増えるたびにIFとeBGPが増える点だけが課題です。
  • 方式2はアンダーレイ側の外部（管理網など）と各テナントを繋ぐ方式で、外部経路とアンダーレイ経路が混ざる。今回のログでもVTEPアドレスが外部へ、外部経路がSpineへ漏れていました。フィルタ設計とセットで考える必要があります。
  • テナントが多い環境では方式3がもっともシンプル。BLeafはShared VRFだけ、LeafはRTをimportするだけで済み、アンダーレイも汚れません。ただしShared VRFに全テナントの経路が集まるので、アドレス重複がないこととDSVNIへの対応が前提です。
  • 番外のCentralized Leakingは、テナント間通信の可否をBLeaf 1台で管理できる反面、トラフィックがBLeafに集中し、ホスト経路への依存もあります。

RTを 65000:<VNI> のサービス統一フォーマットにしておいたことで、eBGPファブリックでも「どのRTをimportすればよいか」が一目で分かり、方式3や番外のようなRTベースのリークも素直に設定できました。

Appendix: コンフィグ全文

方式ごと・機器ごとの show running-config です。show runを取得していない機器は、前の方式の設定をそのまま使っています。Nexusは空のEthernetインタフェース、description、パスワードハッシュを省略しています。CSR（CustomerA・CustomerB・ExtRtr）はホスト名、IPv6ルーティング、使用しているインタフェース、スタティックルート、BGPのみ抜粋しています。

方式show runを取得した機器
方式1: VRF LiteSpine, Leaf1, Leaf2, BLeaf, CustomerA, CustomerB, ExtRtr
方式2: default VRF＋BLeafでリークBLeaf
方式3: Shared VRF＋DSVNILeaf1, Leaf2, BLeaf
番外: Centralized Route LeakBLeaf

方式1: VRF Lite

Spine 
!Command: show running-config
!No configuration change since last restart
!Time: Sun Sep 27 05:38:04 2026

version 10.6(3) Bios:version
hostname Spine
vdc Spine id 1
  limit-resource vlan minimum 16 maximum 4094
  limit-resource vrf minimum 2 maximum 4096
  limit-resource port-channel minimum 0 maximum 511
  limit-resource m4route-mem minimum 58 maximum 58
  limit-resource m6route-mem minimum 8 maximum 8

nv overlay evpn
feature bgp
feature nv overlay

no password strength-check
username admin password 5 <removed>  role network-admin
ip domain-lookup
copp profile strict
snmp-server user admin network-admin auth md5 <removed> priv aes-128 <removed> localizedV2key
rmon event 1 log trap public description FATAL(1) owner PMON@FATAL
rmon event 2 log trap public description CRITICAL(2) owner PMON@CRITICAL
rmon event 3 log trap public description ERROR(3) owner PMON@ERROR
rmon event 4 log trap public description WARNING(4) owner PMON@WARNING
rmon event 5 log trap public description INFORMATION(5) owner PMON@INFO

vlan 1

route-map NEXT-HOP-UNCH permit 10
  set ip next-hop unchanged
  set ipv6 next-hop unchanged
vrf context management

interface Ethernet1/1
  no switchport
  ipv6 address use-link-local-only
  ipv6 nd ra-interval 4 min 3
  ipv6 nd ra-lifetime 10
  no shutdown

interface Ethernet1/2
  no switchport
  ipv6 address use-link-local-only
  ipv6 nd ra-interval 4 min 3
  ipv6 nd ra-lifetime 10
  no shutdown

interface Ethernet1/3
  no switchport
  ipv6 address use-link-local-only
  ipv6 nd ra-interval 4 min 3
  ipv6 nd ra-lifetime 10
  no shutdown

interface mgmt0
  vrf member management

interface loopback0
  ipv6 address 2001:db8:100::101/128
icam monitor scale

line console
line vty
boot nxos bootflash:/nxos64-cs.10.6.3.F.bin
router bgp 65101
  router-id 101.101.101.101
  bestpath as-path multipath-relax
  address-family ipv6 unicast
    network 2001:db8:100::101/128
  address-family l2vpn evpn
    retain route-target all
  neighbor Ethernet1/1
    remote-as 65102
    address-family ipv6 unicast
    address-family l2vpn evpn
      send-community
      send-community extended
      route-map NEXT-HOP-UNCH out
  neighbor Ethernet1/2
    remote-as 65103
    address-family ipv6 unicast
    address-family l2vpn evpn
      send-community
      send-community extended
      route-map NEXT-HOP-UNCH out
  neighbor Ethernet1/3
    remote-as 65104
    address-family ipv6 unicast
    address-family l2vpn evpn
      send-community
      send-community extended
      route-map NEXT-HOP-UNCH out
Leaf1 
!Command: show running-config
!No configuration change since last restart
!Time: Sun Sep 27 05:34:17 2026

version 10.6(3) Bios:version
hostname Leaf1
vdc Leaf1 id 1
  limit-resource vlan minimum 16 maximum 4094
  limit-resource vrf minimum 2 maximum 4096
  limit-resource port-channel minimum 0 maximum 511
  limit-resource m4route-mem minimum 58 maximum 58
  limit-resource m6route-mem minimum 8 maximum 8

nv overlay evpn
feature bgp
feature interface-vlan
feature vn-segment-vlan-based
feature nv overlay

no password strength-check
username admin password 5 <removed>  role network-admin
ip domain-lookup
copp profile strict
snmp-server user admin network-admin auth md5 <removed> priv aes-128 <removed> localizedV2key
rmon event 1 log trap public description FATAL(1) owner PMON@FATAL
rmon event 2 log trap public description CRITICAL(2) owner PMON@CRITICAL
rmon event 3 log trap public description ERROR(3) owner PMON@ERROR
rmon event 4 log trap public description WARNING(4) owner PMON@WARNING
rmon event 5 log trap public description INFORMATION(5) owner PMON@INFO

fabric forwarding anycast-gateway-mac 0001.0001.0001
vlan 1,10,100
vlan 10
  name Customer-A
  vn-segment 10010
vlan 100
  name Customer-A-L3VNI
  vn-segment 50100

route-map RM_EVPN_NH permit 10
  set ipv6 next-hop 2001:db8:100::102
vrf context Customer-A
  vni 50100
  rd auto
  address-family ipv4 unicast
    route-target import 65000:50100
    route-target import 65000:50100 evpn
    route-target export 65000:50100
    route-target export 65000:50100 evpn
  address-family ipv6 unicast
    route-target import 65000:50100
    route-target import 65000:50100 evpn
    route-target export 65000:50100
    route-target export 65000:50100 evpn
vrf context management
system routing template-security-groups

interface Vlan1

interface Vlan10
  no shutdown
  vrf member Customer-A
  ip address 10.10.10.1/24
  ipv6 address 2001:10:10:10::1/64
  fabric forwarding mode anycast-gateway

interface Vlan100
  no shutdown
  vrf member Customer-A
  ip forward
  ipv6 forward

interface nve1
  no shutdown
  host-reachability protocol bgp
  source-interface loopback0
  member vni 10010
    ingress-replication protocol bgp
  member vni 50100 associate-vrf

interface Ethernet1/1
  no switchport
  ipv6 address use-link-local-only
  ipv6 nd ra-interval 4 min 3
  ipv6 nd ra-lifetime 10
  no shutdown

interface Ethernet1/5
  switchport access vlan 10
  spanning-tree port type edge

interface mgmt0
  vrf member management

interface loopback0
  ipv6 address 2001:db8:100::102/128
icam monitor scale

line console
line vty
boot nxos bootflash:/nxos64-cs.10.6.3.F.bin
router bgp 65102
  router-id 102.102.102.102
  bestpath as-path multipath-relax
  address-family ipv6 unicast
    network 2001:db8:100::102/128
  address-family l2vpn evpn
  neighbor Ethernet1/1
    remote-as 65101
    address-family ipv6 unicast
    address-family l2vpn evpn
      send-community
      send-community extended
      route-map RM_EVPN_NH out
  vrf Customer-A
    address-family ipv4 unicast
      network 10.10.10.0/24
      advertise l2vpn evpn
    address-family ipv6 unicast
      network 2001:10:10:10::/64
      advertise l2vpn evpn
evpn
  vni 10010 l2
    rd auto
    route-target import 65000:10010
    route-target export 65000:10010
Leaf2 
!Command: show running-config
!No configuration change since last restart
!Time: Sun Sep 27 05:34:20 2026

version 10.6(3) Bios:version
hostname Leaf2
vdc Leaf2 id 1
  limit-resource vlan minimum 16 maximum 4094
  limit-resource vrf minimum 2 maximum 4096
  limit-resource port-channel minimum 0 maximum 511
  limit-resource m4route-mem minimum 58 maximum 58
  limit-resource m6route-mem minimum 8 maximum 8

nv overlay evpn
feature bgp
feature interface-vlan
feature vn-segment-vlan-based
feature nv overlay

no password strength-check
username admin password 5 <removed>  role network-admin
ip domain-lookup
copp profile strict
snmp-server user admin network-admin auth md5 <removed> priv aes-128 <removed> localizedV2key
rmon event 1 log trap public description FATAL(1) owner PMON@FATAL
rmon event 2 log trap public description CRITICAL(2) owner PMON@CRITICAL
rmon event 3 log trap public description ERROR(3) owner PMON@ERROR
rmon event 4 log trap public description WARNING(4) owner PMON@WARNING
rmon event 5 log trap public description INFORMATION(5) owner PMON@INFO

fabric forwarding anycast-gateway-mac 0001.0001.0001
vlan 1,20,200
vlan 20
  name Customer-B
  vn-segment 10020
vlan 200
  name Customer-B-L3VNI
  vn-segment 50200

route-map RM_EVPN_NH permit 10
  set ipv6 next-hop 2001:db8:100::103
vrf context Customer-B
  vni 50200
  rd auto
  address-family ipv4 unicast
    route-target import 65000:50200
    route-target import 65000:50200 evpn
    route-target export 65000:50200
    route-target export 65000:50200 evpn
  address-family ipv6 unicast
    route-target import 65000:50200
    route-target import 65000:50200 evpn
    route-target export 65000:50200
    route-target export 65000:50200 evpn
vrf context management
system routing template-security-groups

interface Vlan1

interface Vlan20
  no shutdown
  vrf member Customer-B
  ip address 10.20.20.1/24
  ipv6 address 2001:10:20:20::1/64
  fabric forwarding mode anycast-gateway

interface Vlan200
  no shutdown
  vrf member Customer-B
  ip forward
  ipv6 forward

interface nve1
  no shutdown
  host-reachability protocol bgp
  source-interface loopback0
  member vni 10020
    ingress-replication protocol bgp
  member vni 50200 associate-vrf

interface Ethernet1/1
  no switchport
  ipv6 address use-link-local-only
  ipv6 nd ra-interval 4 min 3
  ipv6 nd ra-lifetime 10
  no shutdown

interface Ethernet1/5
  switchport access vlan 20
  spanning-tree port type edge

interface Ethernet1/7
  shutdown

interface mgmt0
  vrf member management

interface loopback0
  ipv6 address 2001:db8:100::103/128
icam monitor scale

line console
line vty
boot nxos bootflash:/nxos64-cs.10.6.3.F.bin
router bgp 65103
  router-id 103.103.103.103
  bestpath as-path multipath-relax
  address-family ipv6 unicast
    network 2001:db8:100::103/128
  address-family l2vpn evpn
  neighbor Ethernet1/1
    remote-as 65101
    address-family ipv6 unicast
    address-family l2vpn evpn
      send-community
      send-community extended
      route-map RM_EVPN_NH out
  vrf Customer-B
    address-family ipv4 unicast
      network 10.20.20.0/24
      advertise l2vpn evpn
    address-family ipv6 unicast
      network 2001:10:20:20::/64
      advertise l2vpn evpn
evpn
  vni 10020 l2
    rd auto
    route-target import 65000:10020
    route-target export 65000:10020
BLeaf 
!Command: show running-config
!No configuration change since last restart
!Time: Sun Sep 27 05:34:22 2026

version 10.6(3) Bios:version
hostname BLeaf
vdc BLeaf id 1
  limit-resource vlan minimum 16 maximum 4094
  limit-resource vrf minimum 2 maximum 4096
  limit-resource port-channel minimum 0 maximum 511
  limit-resource m4route-mem minimum 58 maximum 58
  limit-resource m6route-mem minimum 8 maximum 8

nv overlay evpn
feature bgp
feature interface-vlan
feature vn-segment-vlan-based
feature nv overlay

no password strength-check
username admin password 5 <removed>  role network-admin
ip domain-lookup
copp profile strict
snmp-server user admin network-admin auth md5 <removed> priv aes-128 <removed> localizedV2key
rmon event 1 log trap public description FATAL(1) owner PMON@FATAL
rmon event 2 log trap public description CRITICAL(2) owner PMON@CRITICAL
rmon event 3 log trap public description ERROR(3) owner PMON@ERROR
rmon event 4 log trap public description WARNING(4) owner PMON@WARNING
rmon event 5 log trap public description INFORMATION(5) owner PMON@INFO

vlan 1,100,200
vlan 100
  vn-segment 50100
vlan 200
  vn-segment 50200

route-map RM_EVPN_NH permit 10
  set ipv6 next-hop 2001:db8:100::104
vrf context Customer-A
  vni 50100
  rd auto
  address-family ipv4 unicast
    route-target import 65000:50100
    route-target import 65000:50100 evpn
    route-target export 65000:50100
    route-target export 65000:50100 evpn
  address-family ipv6 unicast
    route-target import 65000:50100
    route-target import 65000:50100 evpn
    route-target export 65000:50100
    route-target export 65000:50100 evpn
vrf context Customer-B
  vni 50200
  rd auto
  address-family ipv4 unicast
    route-target import 65000:50200
    route-target import 65000:50200 evpn
    route-target export 65000:50200
    route-target export 65000:50200 evpn
  address-family ipv6 unicast
    route-target import 65000:50200
    route-target import 65000:50200 evpn
    route-target export 65000:50200
    route-target export 65000:50200 evpn
vrf context management

interface Vlan1

interface Vlan100
  no shutdown
  vrf member Customer-A
  ip forward
  ipv6 forward

interface Vlan200
  no shutdown
  vrf member Customer-B
  ip forward
  ipv6 forward

interface nve1
  no shutdown
  host-reachability protocol bgp
  source-interface loopback0
  member vni 50100 associate-vrf
  member vni 50200 associate-vrf

interface Ethernet1/1
  no switchport
  ipv6 address use-link-local-only
  ipv6 nd ra-interval 4 min 3
  ipv6 nd ra-lifetime 10
  no shutdown

interface Ethernet1/5
  no switchport
  vrf member Customer-A
  ip address 172.31.10.1/30
  ipv6 address 2001:172:31:10::1/64
  no shutdown

interface Ethernet1/6
  no switchport
  vrf member Customer-B
  ip address 172.31.20.1/30
  ipv6 address 2001:172:31:20::1/64
  no shutdown

interface mgmt0
  vrf member management

interface loopback0
  ipv6 address 2001:db8:100::104/128
icam monitor scale

line console
line vty
boot nxos bootflash:/nxos64-cs.10.6.3.F.bin
router bgp 65104
  router-id 104.104.104.104
  bestpath as-path multipath-relax
  address-family ipv6 unicast
    network 2001:db8:100::104/128
  address-family l2vpn evpn
  neighbor Ethernet1/1
    remote-as 65101
    address-family ipv6 unicast
    address-family l2vpn evpn
      send-community
      send-community extended
      route-map RM_EVPN_NH out
  vrf Customer-A
    neighbor 2001:172:31:10::2
      remote-as 65100
      address-family ipv6 unicast
    neighbor 172.31.10.2
      remote-as 65100
      address-family ipv4 unicast
  vrf Customer-B
    neighbor 2001:172:31:20::2
      remote-as 65100
      address-family ipv6 unicast
    neighbor 172.31.20.2
      remote-as 65100
      address-family ipv4 unicast
CustomerA 
hostname CustomerA
!
ipv6 unicast-routing
!
interface GigabitEthernet1
 ip address 10.10.10.100 255.255.255.0
 negotiation auto
 ipv6 address 2001:10:10:10::100/64
 no mop enabled
 no mop sysid
!
ip route 0.0.0.0 0.0.0.0 10.10.10.1
!
ipv6 route ::/0 2001:10:10:10::1
!
end
CustomerB 
hostname CustomerB
!
ipv6 unicast-routing
!
interface GigabitEthernet1
 ip address 10.20.20.100 255.255.255.0
 negotiation auto
 ipv6 address 2001:10:20:20::100/64
 no mop enabled
 no mop sysid
!
ip route 0.0.0.0 0.0.0.0 10.20.20.1
!
ipv6 route ::/0 2001:10:20:20::1
!
end
ExtRtr 
hostname ExtRtr
!
ipv6 unicast-routing
!
interface Loopback0
 ip address 203.0.113.1 255.255.255.0
 ipv6 address 2001:203:0:113::1/64
!
interface GigabitEthernet1
 ip address 172.31.10.2 255.255.255.252
 negotiation auto
 ipv6 address 2001:172:31:10::2/64
 no mop enabled
 no mop sysid
!
interface GigabitEthernet2
 ip address 172.31.20.2 255.255.255.252
 negotiation auto
 ipv6 address 2001:172:31:20::2/64
 no mop enabled
 no mop sysid
!
router bgp 65100
 bgp log-neighbor-changes
 neighbor 2001:172:31:10::1 remote-as 65104
 neighbor 2001:172:31:20::1 remote-as 65104
 neighbor 172.31.10.1 remote-as 65104
 neighbor 172.31.20.1 remote-as 65104
 !
 address-family ipv4
  network 203.0.113.0
  no neighbor 2001:172:31:10::1 activate
  no neighbor 2001:172:31:20::1 activate
  neighbor 172.31.10.1 activate
  neighbor 172.31.20.1 activate
 exit-address-family
 !
 address-family ipv6
  network 2001:203:0:113::/64
  neighbor 2001:172:31:10::1 activate
  neighbor 2001:172:31:20::1 activate
 exit-address-family
!
end

方式2: default VRF＋BLeafでリーク

BLeaf 
!Command: show running-config
!Running configuration last done at: Sun Sep 27 06:18:04 2026
!Time: Sun Sep 27 06:27:52 2026

version 10.6(3) Bios:version
hostname BLeaf
vdc BLeaf id 1
  limit-resource vlan minimum 16 maximum 4094
  limit-resource vrf minimum 2 maximum 4096
  limit-resource port-channel minimum 0 maximum 511
  limit-resource m4route-mem minimum 58 maximum 58
  limit-resource m6route-mem minimum 8 maximum 8

nv overlay evpn
feature bgp
feature interface-vlan
feature vn-segment-vlan-based
feature nv overlay

no password strength-check
username admin password 5 <removed>  role network-admin
ip domain-lookup
copp profile strict
snmp-server user admin network-admin auth md5 <removed> priv aes-128 <removed> localizedV2key
rmon event 1 log trap public description FATAL(1) owner PMON@FATAL
rmon event 2 log trap public description CRITICAL(2) owner PMON@CRITICAL
rmon event 3 log trap public description ERROR(3) owner PMON@ERROR
rmon event 4 log trap public description WARNING(4) owner PMON@WARNING
rmon event 5 log trap public description INFORMATION(5) owner PMON@INFO

vlan 1,100,200
vlan 100
  vn-segment 50100
vlan 200
  vn-segment 50200

ip prefix-list plist-global-exportA seq 5 permit 10.10.10.0/24
ip prefix-list plist-global-exportB seq 5 permit 10.20.20.0/24
ip prefix-list plist-global-import seq 5 permit 203.0.113.0/24
ipv6 prefix-list plistv6-global-exportA seq 5 permit 2001:10:10:10::/64
ipv6 prefix-list plistv6-global-exportB seq 5 permit 2001:10:20:20::/64
ipv6 prefix-list plistv6-global-import seq 5 permit 2001:203:0:113::/64
route-map RM_EVPN_NH permit 10
  set ipv6 next-hop 2001:db8:100::104
route-map rmap-global-exportA permit 10
  match ip address prefix-list plist-global-exportA
route-map rmap-global-exportB permit 10
  match ip address prefix-list plist-global-exportB
route-map rmap-global-import permit 10
  match ip address prefix-list plist-global-import
route-map rmapv6-global-exportA permit 10
  match ipv6 address prefix-list plistv6-global-exportA
route-map rmapv6-global-exportB permit 10
  match ipv6 address prefix-list plistv6-global-exportB
route-map rmapv6-global-import permit 10
  match ipv6 address prefix-list plistv6-global-import
vrf context Customer-A
  vni 50100
  rd auto
  address-family ipv4 unicast
    route-target import 65000:50100
    route-target import 65000:50100 evpn
    route-target export 65000:50100
    route-target export 65000:50100 evpn
    import vrf default map rmap-global-import advertise-vpn
    export vrf default map rmap-global-exportA allow-vpn
  address-family ipv6 unicast
    route-target import 65000:50100
    route-target import 65000:50100 evpn
    route-target export 65000:50100
    route-target export 65000:50100 evpn
    import vrf default map rmapv6-global-import advertise-vpn
    export vrf default map rmapv6-global-exportA allow-vpn
vrf context Customer-B
  vni 50200
  rd auto
  address-family ipv4 unicast
    route-target import 65000:50200
    route-target import 65000:50200 evpn
    route-target export 65000:50200
    route-target export 65000:50200 evpn
    import vrf default map rmap-global-import advertise-vpn
    export vrf default map rmap-global-exportB allow-vpn
  address-family ipv6 unicast
    route-target import 65000:50200
    route-target import 65000:50200 evpn
    route-target export 65000:50200
    route-target export 65000:50200 evpn
    import vrf default map rmapv6-global-import advertise-vpn
    export vrf default map rmapv6-global-exportB allow-vpn
vrf context management

interface Vlan1

interface Vlan100
  no shutdown
  vrf member Customer-A
  ip forward
  ipv6 forward

interface Vlan200
  no shutdown
  vrf member Customer-B
  ip forward
  ipv6 forward

interface nve1
  no shutdown
  host-reachability protocol bgp
  source-interface loopback0
  member vni 50100 associate-vrf
  member vni 50200 associate-vrf

interface Ethernet1/1
  no switchport
  ipv6 address use-link-local-only
  ipv6 nd ra-interval 4 min 3
  ipv6 nd ra-lifetime 10
  no shutdown

interface Ethernet1/5
  no switchport
  ip address 172.31.10.1/30
  ipv6 address 2001:172:31:10::1/64
  no shutdown

interface Ethernet1/6
  shutdown

interface mgmt0
  vrf member management

interface loopback0
  ipv6 address 2001:db8:100::104/128
icam monitor scale

line console
line vty
boot nxos bootflash:/nxos64-cs.10.6.3.F.bin
router bgp 65104
  router-id 104.104.104.104
  bestpath as-path multipath-relax
  address-family ipv6 unicast
    network 2001:db8:100::104/128
  address-family l2vpn evpn
  neighbor 2001:172:31:10::2
    remote-as 65100
    address-family ipv6 unicast
  neighbor 172.31.10.2
    remote-as 65100
    address-family ipv4 unicast
  neighbor Ethernet1/1
    remote-as 65101
    address-family ipv6 unicast
    address-family l2vpn evpn
      send-community
      send-community extended
      route-map RM_EVPN_NH out

方式3: Shared VRF＋DSVNI

Leaf1 
!Command: show running-config
!Running configuration last done at: Sun Sep 27 07:50:23 2026
!Time: Sun Sep 27 08:06:32 2026

version 10.6(3) Bios:version
hostname Leaf1
vdc Leaf1 id 1
  limit-resource vlan minimum 16 maximum 4094
  limit-resource vrf minimum 2 maximum 4096
  limit-resource port-channel minimum 0 maximum 511
  limit-resource m4route-mem minimum 58 maximum 58
  limit-resource m6route-mem minimum 8 maximum 8

nv overlay evpn
feature bgp
feature interface-vlan
feature vn-segment-vlan-based
feature nv overlay

no password strength-check
username admin password 5 <removed>  role network-admin
ip domain-lookup
copp profile strict
snmp-server user admin network-admin auth md5 <removed> priv aes-128 <removed> localizedV2key
rmon event 1 log trap public description FATAL(1) owner PMON@FATAL
rmon event 2 log trap public description CRITICAL(2) owner PMON@CRITICAL
rmon event 3 log trap public description ERROR(3) owner PMON@ERROR
rmon event 4 log trap public description WARNING(4) owner PMON@WARNING
rmon event 5 log trap public description INFORMATION(5) owner PMON@INFO

fabric forwarding anycast-gateway-mac 0001.0001.0001
vlan 1,10,100
vlan 10
  name Customer-A
  vn-segment 10010
vlan 100
  name Customer-A-L3VNI
  vn-segment 50100

route-map RM_EVPN_NH permit 10
  set ipv6 next-hop 2001:db8:100::102
vrf context Customer-A
  vni 50100
  rd auto
  address-family ipv4 unicast
    route-target import 65000:50100
    route-target import 65000:50100 evpn
    route-target import 65000:50999
    route-target import 65000:50999 evpn
    route-target export 65000:50100
    route-target export 65000:50100 evpn
  address-family ipv6 unicast
    route-target import 65000:50100
    route-target import 65000:50100 evpn
    route-target import 65000:50999
    route-target import 65000:50999 evpn
    route-target export 65000:50100
    route-target export 65000:50100 evpn
vrf context management
system routing template-security-groups

interface Vlan1

interface Vlan10
  no shutdown
  vrf member Customer-A
  ip address 10.10.10.1/24
  ipv6 address 2001:10:10:10::1/64
  fabric forwarding mode anycast-gateway

interface Vlan100
  no shutdown
  vrf member Customer-A
  ip forward
  ipv6 forward

interface nve1
  no shutdown
  host-reachability protocol bgp
  source-interface loopback0
  member vni 10010
    ingress-replication protocol bgp
  member vni 50100 associate-vrf

interface Ethernet1/1
  no switchport
  ipv6 address use-link-local-only
  ipv6 nd ra-interval 4 min 3
  ipv6 nd ra-lifetime 10
  no shutdown

interface Ethernet1/5
  switchport access vlan 10
  spanning-tree port type edge

interface mgmt0
  vrf member management

interface loopback0
  ipv6 address 2001:db8:100::102/128
icam monitor scale

line console
line vty
boot nxos bootflash:/nxos64-cs.10.6.3.F.bin
router bgp 65102
  router-id 102.102.102.102
  bestpath as-path multipath-relax
  address-family ipv6 unicast
    network 2001:db8:100::102/128
  address-family l2vpn evpn
  neighbor Ethernet1/1
    remote-as 65101
    address-family ipv6 unicast
    address-family l2vpn evpn
      send-community
      send-community extended
      route-map RM_EVPN_NH out
  vrf Customer-A
    address-family ipv4 unicast
      network 10.10.10.0/24
      advertise l2vpn evpn
    address-family ipv6 unicast
      network 2001:10:10:10::/64
      advertise l2vpn evpn
evpn
  vni 10010 l2
    rd auto
    route-target import 65000:10010
    route-target export 65000:10010
Leaf2 
!Command: show running-config
!Running configuration last done at: Sun Sep 27 07:51:27 2026
!Time: Sun Sep 27 08:07:29 2026

version 10.6(3) Bios:version
hostname Leaf2
vdc Leaf2 id 1
  limit-resource vlan minimum 16 maximum 4094
  limit-resource vrf minimum 2 maximum 4096
  limit-resource port-channel minimum 0 maximum 511
  limit-resource m4route-mem minimum 58 maximum 58
  limit-resource m6route-mem minimum 8 maximum 8

nv overlay evpn
feature bgp
feature interface-vlan
feature vn-segment-vlan-based
feature nv overlay

no password strength-check
username admin password 5 <removed>  role network-admin
ip domain-lookup
copp profile strict
snmp-server user admin network-admin auth md5 <removed> priv aes-128 <removed> localizedV2key
rmon event 1 log trap public description FATAL(1) owner PMON@FATAL
rmon event 2 log trap public description CRITICAL(2) owner PMON@CRITICAL
rmon event 3 log trap public description ERROR(3) owner PMON@ERROR
rmon event 4 log trap public description WARNING(4) owner PMON@WARNING
rmon event 5 log trap public description INFORMATION(5) owner PMON@INFO

fabric forwarding anycast-gateway-mac 0001.0001.0001
vlan 1,20,200
vlan 20
  name Customer-B
  vn-segment 10020
vlan 200
  name Customer-B-L3VNI
  vn-segment 50200

route-map RM_EVPN_NH permit 10
  set ipv6 next-hop 2001:db8:100::103
vrf context Customer-B
  vni 50200
  rd auto
  address-family ipv4 unicast
    route-target import 65000:50200
    route-target import 65000:50200 evpn
    route-target import 65000:50999
    route-target import 65000:50999 evpn
    route-target export 65000:50200
    route-target export 65000:50200 evpn
  address-family ipv6 unicast
    route-target import 65000:50200
    route-target import 65000:50200 evpn
    route-target import 65000:50999
    route-target import 65000:50999 evpn
    route-target export 65000:50200
    route-target export 65000:50200 evpn
vrf context management
system routing template-security-groups

interface Vlan1

interface Vlan20

  no shutdown
  vrf member Customer-B
  ip address 10.20.20.1/24
  ipv6 address 2001:10:20:20::1/64
  fabric forwarding mode anycast-gateway

interface Vlan200
  no shutdown
  vrf member Customer-B
  ip forward
  ipv6 forward

interface nve1
  no shutdown
  host-reachability protocol bgp
  source-interface loopback0
  member vni 10020
    ingress-replication protocol bgp
  member vni 50200 associate-vrf

interface Ethernet1/1
  no switchport
  ipv6 address use-link-local-only
  ipv6 nd ra-interval 4 min 3
  ipv6 nd ra-lifetime 10
  no shutdown

interface Ethernet1/5
  switchport access vlan 20
  spanning-tree port type edge

interface Ethernet1/7
  shutdown

interface mgmt0
  vrf member management

interface loopback0
  ipv6 address 2001:db8:100::103/128
icam monitor scale

line console
line vty
boot nxos bootflash:/nxos64-cs.10.6.3.F.bin
router bgp 65103
  router-id 103.103.103.103
  bestpath as-path multipath-relax
  address-family ipv6 unicast
    network 2001:db8:100::103/128
  address-family l2vpn evpn
  neighbor Ethernet1/1
    remote-as 65101
    address-family ipv6 unicast
    address-family l2vpn evpn
      send-community
      send-community extended
      route-map RM_EVPN_NH out
  vrf Customer-B
    address-family ipv4 unicast
      network 10.20.20.0/24
      advertise l2vpn evpn
    address-family ipv6 unicast
      network 2001:10:20:20::/64
      advertise l2vpn evpn
evpn
  vni 10020 l2
    rd auto
    route-target import 65000:10020
    route-target export 65000:10020
BLeaf 
!Command: show running-config
!Running configuration last done at: Sun Sep 27 07:47:56 2026
!Time: Sun Sep 27 08:08:08 2026

version 10.6(3) Bios:version
hostname BLeaf
vdc BLeaf id 1
  limit-resource vlan minimum 16 maximum 4094
  limit-resource vrf minimum 2 maximum 4096
  limit-resource port-channel minimum 0 maximum 511
  limit-resource m4route-mem minimum 58 maximum 58
  limit-resource m6route-mem minimum 8 maximum 8

nv overlay evpn
feature bgp
feature interface-vlan
feature vn-segment-vlan-based
feature nv overlay

no password strength-check
username admin password 5 <removed>  role network-admin
ip domain-lookup
copp profile strict
snmp-server user admin network-admin auth md5 <removed> priv aes-128 <removed> localizedV2key
rmon event 1 log trap public description FATAL(1) owner PMON@FATAL
rmon event 2 log trap public description CRITICAL(2) owner PMON@CRITICAL
rmon event 3 log trap public description ERROR(3) owner PMON@ERROR
rmon event 4 log trap public description WARNING(4) owner PMON@WARNING
rmon event 5 log trap public description INFORMATION(5) owner PMON@INFO

vlan 1,999
vlan 999
  vn-segment 50999

route-map RM_EVPN_NH permit 10
  set ipv6 next-hop 2001:db8:100::104
vrf context Shared
  vni 50999
  rd auto
  address-family ipv4 unicast
    route-target import 65000:50100
    route-target import 65000:50100 evpn
    route-target import 65000:50200
    route-target import 65000:50200 evpn
    route-target import 65000:50999
    route-target import 65000:50999 evpn
    route-target export 65000:50999
    route-target export 65000:50999 evpn
  address-family ipv6 unicast
    route-target import 65000:50100
    route-target import 65000:50100 evpn
    route-target import 65000:50200
    route-target import 65000:50200 evpn
    route-target import 65000:50999
    route-target import 65000:50999 evpn
    route-target export 65000:50999
    route-target export 65000:50999 evpn
vrf context management

interface Vlan1

interface Vlan999
  no shutdown
  vrf member Shared
  ip forward
  ipv6 forward

interface nve1
  no shutdown
  host-reachability protocol bgp
  source-interface loopback0
  member vni 50999 associate-vrf

interface Ethernet1/1
  no switchport
  ipv6 address use-link-local-only
  ipv6 nd ra-interval 4 min 3
  ipv6 nd ra-lifetime 10
  no shutdown

interface Ethernet1/5
  no switchport
  vrf member Shared
  ip address 172.31.10.1/30
  ipv6 address 2001:172:31:10::1/64
  no shutdown

interface Ethernet1/6
  shutdown

interface mgmt0
  vrf member management

interface loopback0
  ipv6 address 2001:db8:100::104/128
icam monitor scale

line console
line vty
boot nxos bootflash:/nxos64-cs.10.6.3.F.bin
router bgp 65104
  router-id 104.104.104.104
  bestpath as-path multipath-relax
  address-family ipv6 unicast
    network 2001:db8:100::104/128
  address-family l2vpn evpn
  neighbor Ethernet1/1
    remote-as 65101
    address-family ipv6 unicast
    address-family l2vpn evpn
      send-community
      send-community extended
      route-map RM_EVPN_NH out
  vrf Shared
    address-family ipv4 unicast
      advertise l2vpn evpn
    address-family ipv6 unicast
      advertise l2vpn evpn
    neighbor 2001:172:31:10::2
      remote-as 65100
      address-family ipv6 unicast
    neighbor 172.31.10.2
      remote-as 65100
      address-family ipv4 unicast

番外: Centralized Route Leak

BLeaf 
!Command: show running-config
!Running configuration last done at: Sun Sep 27 06:45:53 2026
!Time: Sun Sep 27 06:53:31 2026

version 10.6(3) Bios:version
hostname BLeaf
vdc BLeaf id 1
  limit-resource vlan minimum 16 maximum 4094
  limit-resource vrf minimum 2 maximum 4096
  limit-resource port-channel minimum 0 maximum 511
  limit-resource m4route-mem minimum 58 maximum 58
  limit-resource m6route-mem minimum 8 maximum 8

nv overlay evpn
feature bgp
feature interface-vlan
feature vn-segment-vlan-based
feature nv overlay

no password strength-check
username admin password 5 <removed>  role network-admin
ip domain-lookup
copp profile strict
snmp-server user admin network-admin auth md5 <removed> priv aes-128 <removed> localizedV2key
rmon event 1 log trap public description FATAL(1) owner PMON@FATAL
rmon event 2 log trap public description CRITICAL(2) owner PMON@CRITICAL
rmon event 3 log trap public description ERROR(3) owner PMON@ERROR
rmon event 4 log trap public description WARNING(4) owner PMON@WARNING
rmon event 5 log trap public description INFORMATION(5) owner PMON@INFO

vlan 1,100,200
vlan 100
  vn-segment 50100
vlan 200
  vn-segment 50200

ip prefix-list plist-global-exportA seq 5 permit 10.10.10.0/24
ip prefix-list plist-global-exportB seq 5 permit 10.20.20.0/24
ip prefix-list plist-global-import seq 5 permit 203.0.113.0/24
ipv6 prefix-list plistv6-global-exportA seq 5 permit 2001:10:10:10::/64
ipv6 prefix-list plistv6-global-exportB seq 5 permit 2001:10:20:20::/64
ipv6 prefix-list plistv6-global-import seq 5 permit 2001:203:0:113::/64
route-map RM_EVPN_NH permit 10
  set ipv6 next-hop 2001:db8:100::104
route-map rmap-global-exportA permit 10
  match ip address prefix-list plist-global-exportA
route-map rmap-global-exportB permit 10
  match ip address prefix-list plist-global-exportB
route-map rmap-global-import permit 10
  match ip address prefix-list plist-global-import
route-map rmapv6-global-exportA permit 10
  match ipv6 address prefix-list plistv6-global-exportA
route-map rmapv6-global-exportB permit 10
  match ipv6 address prefix-list plistv6-global-exportB
route-map rmapv6-global-import permit 10
  match ipv6 address prefix-list plistv6-global-import
vrf context Customer-A
  vni 50100
  rd auto
  address-family ipv4 unicast
    route-target import 65000:50100
    route-target import 65000:50100 evpn
    route-target import 65000:50200
    route-target import 65000:50200 evpn
    route-target export 65000:50100
    route-target export 65000:50100 evpn
    import vrf default map rmap-global-import advertise-vpn
    export vrf default map rmap-global-exportA allow-vpn
  address-family ipv6 unicast
    route-target import 65000:50100
    route-target import 65000:50100 evpn
    route-target import 65000:50200
    route-target import 65000:50200 evpn
    route-target export 65000:50100
    route-target export 65000:50100 evpn
    import vrf default map rmapv6-global-import advertise-vpn
    export vrf default map rmapv6-global-exportA allow-vpn
vrf context Customer-B
  vni 50200
  rd auto
  address-family ipv4 unicast
    route-target import 65000:50100
    route-target import 65000:50100 evpn
    route-target import 65000:50200
    route-target import 65000:50200 evpn
    route-target export 65000:50200
    route-target export 65000:50200 evpn
    import vrf default map rmap-global-import advertise-vpn
    export vrf default map rmap-global-exportB allow-vpn
  address-family ipv6 unicast
    route-target import 65000:50100
    route-target import 65000:50100 evpn
    route-target import 65000:50200
    route-target import 65000:50200 evpn
    route-target export 65000:50200
    route-target export 65000:50200 evpn
    import vrf default map rmapv6-global-import advertise-vpn
    export vrf default map rmapv6-global-exportB allow-vpn
vrf context management

interface Vlan1

interface Vlan100
  no shutdown
  vrf member Customer-A
  ip forward
  ipv6 forward

interface Vlan200
  no shutdown
  vrf member Customer-B
  ip forward
  ipv6 forward

interface nve1
  no shutdown
  host-reachability protocol bgp
  source-interface loopback0
  member vni 50100 associate-vrf
  member vni 50200 associate-vrf

interface Ethernet1/1
  no switchport
  ipv6 address use-link-local-only
  ipv6 nd ra-interval 4 min 3
  ipv6 nd ra-lifetime 10
  no shutdown

interface Ethernet1/5
  no switchport
  ip address 172.31.10.1/30
  ipv6 address 2001:172:31:10::1/64
  no shutdown

interface Ethernet1/6
  shutdown

interface mgmt0
  vrf member management

interface loopback0
  ipv6 address 2001:db8:100::104/128
icam monitor scale

line console
line vty
boot nxos bootflash:/nxos64-cs.10.6.3.F.bin
router bgp 65104
  router-id 104.104.104.104
  bestpath as-path multipath-relax
  address-family ipv6 unicast
    network 2001:db8:100::104/128
  address-family l2vpn evpn
  neighbor 2001:172:31:10::2
    remote-as 65100
    address-family ipv6 unicast
  neighbor 172.31.10.2
    remote-as 65100
    address-family ipv4 unicast
  neighbor Ethernet1/1
    remote-as 65101
    address-family ipv6 unicast
    address-family l2vpn evpn
      send-community
      send-community extended
      route-map RM_EVPN_NH out
  vrf Customer-A
    address-family ipv4 unicast
      advertise l2vpn evpn
      aggregate-address 10.20.20.0/24
    address-family ipv6 unicast
      advertise l2vpn evpn
      aggregate-address 2001:10:20:20::/64
  vrf Customer-B
    address-family ipv4 unicast
      advertise l2vpn evpn
      aggregate-address 10.10.10.0/24
    address-family ipv6 unicast
      advertise l2vpn evpn
      aggregate-address 2001:10:10:10::/64

NEXUSBorder Leaf,Downstream VNI,DSVNI,IPv6 Unnumbered eBGP

Posted by admin