Theoretical foundations and architecture
Type 2 and Type 3 routes solve the L2 problem: they carry MAC addresses and BUM lists inside one EVI. Customers also need routing between subnets, which is L3. EVPN addresses it with IRB (Integrated Routing and Bridging, RFC 9135): the PE gets an L3 interface (BDI, Vbdif or irb) bound to a VRF, and this interface acts as the gateway for hosts. MAC-IP bindings learned from ARP/ND are carried in Type 2, while whole IP-VRF prefixes are carried in Type 5 routes (IP Prefix, RFC 9136). The lesson covers asymmetric and symmetric IRB, the anycast gateway with a shared IP and MAC on all PEs, the L3 label (L3 VNI in VXLAN), ARP/ND suppression, the behaviour of the MAC-IP binding during MAC mobility and the choice between Type 2 and Type 5. It assumes Type 2/3 and MAC mobility from the previous module and L3VPN basics (VRF, RD, RT).
From L2 to L3: why IRB
Type 2/3 turn an EVI into a virtual switch, but the subnets in an EVPN network still need routing between them. Earlier designs used an external router (router on a stick) or a centralised gateway on one PE: traffic between subnets at the same site went to a distant gateway and back (hairpin). IRB (RFC 9135) moves routing to the PE: a BDI, Vbdif or irb interface is attached both to a bridge domain (MAC-VRF) and to a VRF (IP-VRF). Hosts use the IP of this interface as their gateway, so routing happens on the nearest PE.
Asymmetric and symmetric IRB
In the asymmetric model the ingress PE does both routing and bridging: a packet from subnet A enters the IRB, is routed to subnet B, and the frame leaves into the EVI of subnet B with the destination host MAC already set. The egress PE only bridges. Therefore every PE must have the MAC-VRF and the IRB of all subnets its hosts may talk to, and must learn the MACs of remote hosts of those subnets. The model is simple but scales poorly in MAC and ARP entries.
In the symmetric model routing is done twice: at the ingress PE (from subnet A into the IP-VRF) and at the egress PE (from the IP-VRF into subnet B). Between PEs the packet travels as an IP packet inside a frame whose destination MAC is the Router's MAC of the egress PE, and the label (MPLS) or L3 VNI (VXLAN) points to the IP-VRF. Each PE needs only its local subnets and the IP-VRF, while remote subnets are known as Type 2 (hosts) or Type 5 (prefixes). The symmetric model is the one used in most real networks.
Type 2 with the MAC-IP binding
Route Type 2 contains an RD, ESI, Ethernet Tag, the MAC length and value, the IP length and value (0, 32 or 128 bits), Label1 and an optional Label2. Label1 identifies the MAC-VRF (bridging), Label2 the IP-VRF (symmetric routing). A route with an IP carries two RTs: the EVI RT and the IP-VRF RT; as a result the same advertisement lands in both the MAC-VRF and the IP-VRF. The PE obtains the MAC-IP binding from ARP or ND (RFC 7432 allows both a MAC-only advertisement and a MAC plus IP pair), and the IP from Type 2 is used for the /32 (/128) host route in the IP-VRF and for ARP/ND suppression.
Type 5 and RFC 9136
Route Type 5 (IP Prefix) contains an RD, ESI, Ethernet Tag, the prefix length and value, a Gateway IP field and a label (MPLS label or VNI). The Gateway IP and the ESI form the "overlay index" used for recursive next-hop resolution. The main model is the "interface-less" IP-VRF-to-IP-VRF: the route has no Gateway IP, and the destination address and MAC are taken from the next hop (the PE) and the Router's MAC extended community (RFC 9135/9136). Type 5 distributes any IP-VRF prefix: connected subnets, static routes, BGP/OSPF routes learned from a CE, summaries. It carries no host MAC and does not take part in MAC mobility, so it does not replace Type 2 where exact host routes and ARP suppression are needed.
Choosing between Type 2 and Type 5
Type 2 gives an exact route to the host and works with VM moves, but the number of routes grows with the number of hosts. Type 5 saves routes: it is enough to announce the subnet, but the path may be suboptimal if one subnet is stretched across several PEs (traffic goes to the PE that announced the prefix, not to the PE of the host). In practice, for stretched subnets both Type 2 (host routes) and Type 5 for the subnet are announced, for non-stretched subnets and external prefixes only Type 5. If a prefix is announced both as Type 5 and as a Type 2 /32, the more specific one is preferred.
Anycast gateway
The anycast gateway is one IP and one MAC on the IRB of all PEs of a subnet. When a host moves between PEs it needs no new ARP entry and does not lose its gateway. Implementations: Cisco configures identical ip address and mac-address on the BDI, Huawei uses a Vbdif with an identical mac-address, Junos uses virtual-gateway-address with virtual-gateway-v4-mac; the unique per-PE IP addresses are used only as the source for ICMP and ARP from the gateway. If the gateway MAC differs, host ARP caches go stale after moves and traffic is blackholed.
ARP/ND suppression
The PE stores MAC-IP bindings from Type 2 and answers ARP requests (and IPv6 NS) itself, as a proxy. The request is not sent into the core, which reduces BUM load; if there is no binding, the request is flooded as usual. RFC 9161 describes operational details: lifetimes, handling of gratuitous ARP, duplicate IP detection and moves. Suppression does not remove the need for Type 3: unknown unicast and ARP for unknown hosts still use the IM routes.
