IPVPN vs. EVPN-MPLS: Architectural Deep Dive and Configuration Guide for Juniper MX and Cisco ASR 9000
Multiprotocol Label Switching (MPLS) networks remain the primary foundation for enterprise WAN, data center interconnects (DCI), and service provider infrastructure. However, as workloads become increasingly mobile and enterprise requirements shift toward dual Layer 2 / Layer 3 agility, network architectures have evolved from classic IPVPN (IP Layer 3 VPN) to Ethernet VPN (EVPN-MPLS).
In this deep dive, we explore the architectural mechanics of both protocols, compare their control and data planes, examine network topologies with active-active multihoming, and walk through production configurations on Juniper MX Series (Junos OS) and Cisco ASR 9000 Series (IOS XR) platforms.
1. Architectural Overview & Comparison
IPVPN (BGP/MPLS L3VPN — RFC 4364)
IPVPN operates purely at Layer 3. The Provider Edge (PE) router acts as the routing hop and default gateway for the Customer Edge (CE) device, terminating L3 interfaces directly into dedicated Virtual Routing and Forwarding (VRF) instances.
+---------------+ eBGP / OSPF +-------------------+ +-------------------+ eBGP / OSPF +---------------+
| Customer Edge | <------------------> | Provider Edge 1 | <==== MPLS ====> | Provider Edge 2 | <------------------> | Customer Edge |
| (CE 1) | PE-CE Routing | (Juniper MX) | MP-BGP VPNv4 | (Cisco ASR 9000) | PE-CE Routing | (CE 2) |
+---------------+ +-------------------+ +-------------------+ +---------------+
[VRF: CUSTOMER_A] [VRF: CUSTOMER_A]
RD: 10.0.0.1:100 RD: 10.0.0.2:100
RT: 65000:100 RT: 65000:100- Control Plane: Uses Multi-Protocol BGP (MP-BGP) with the
vpnv4andvpnv6address families (AFI=1/2, SAFI=128). - Route Isolation: Uses Route Distinguishers (RD) to create unique 96-bit prefixes across overlapping customer spaces, and Route Targets (RT) attached as BGP Extended Communities to manage import/export VRF membership.
- Data Plane: Relies on a standard two-label MPLS stack:
- Outer (Transport) Label: Pushes traffic through the core using LDP, RSVP-TE, or Segment Routing (SR-MPLS).
- Inner (VPN) Label: Allocated by the egress PE to map incoming packets directly to the destination VRF or subinterface.
- CE-PE Routing: Requires an explicit routing protocol session (eBGP, OSPF, IS-IS, or Static) between the PE VRF and CE.
EVPN-MPLS (RFC 7432)
EVPN is a unified control-plane architecture designed for flexible Layer 2 (bridged) and Layer 3 (routed) services. Unlike legacy L2VPN technologies such as VPLS, EVPN completely eliminates the need for data-plane flood-and-learn MAC discovery, moving all MAC address advertisement into MP-BGP.
+---------------------------------+
| MP-BGP EVPN |
| AFI 25 / SAFI 70 (L2VPN) |
+---------------------------------+
/ \
/ \
RT 1: Auto-Discovery RT 2: MAC/IP Route
RT 3: Inclusive Multicast RT 4: Ethernet Segment
RT 5: IP Prefix Route
/ \
v v
+---------------+ Active-Active +-------------------+ MPLS Core TE +-------------------+ Active-Active +---------------+
| Customer Edge | <===================> | Provider Edge 3 | =============== | Provider Edge 4 | <===================> | Customer Edge |
| (CE 1 - L2/L3)| ESI: 00:01:00...100 | (Juniper MX) | SR-MPLS / LDP | (Cisco ASR 9000) | ESI: 00:01:00...200 | (CE 2 - L2/L3)|
+---------------+ LACP Trunk +-------------------+ +-------------------+ LACP Trunk +---------------+
[EVPN-EVI / IRB] [EVPN-EVI / IRB]
Anycast GW: 10.1.1.1 Anycast GW: 10.1.1.1- Control Plane: Operates over MP-BGP using the
l2vpn evpnaddress family (AFI=25, SAFI=70). It advertises MAC and IP reachability using five standard route types:- Type 1 (Ethernet Auto-Discovery Route): Used for Ethernet Segment discovery, aliasing, and fast-reroute (FRR) convergence upon link failure.
- Type 2 (MAC/IP Advertisement Route): Advertises host MAC addresses alongside optional IP bindings for Integrated Routing and Bridging (IRB).
- Type 3 (Inclusive Multicast Ethernet Tag Route): Builds replication trees for Broadcast, Unknown Unicast, and Multicast (BUM) traffic using Ingress Replication or P2MP LSPs.
- Type 4 (Ethernet Segment Route): Enables Designated Forwarder (DF) election across multihomed PE switches sharing the same Ethernet Segment Identifier (ESI).
- Type 5 (IP Prefix Route): Carries pure routed IP prefixes (
/24,/32, etc.), acting as a replacement or complementary channel for traditional L3VPN.
- Multihoming: Standardizes All-Active and Single-Active multihoming using non-proprietary Ethernet Segment Identifiers (ESI). CE devices see dual-homed PEs as a standard IEEE 802.1AX LACP trunk without requiring Spanning Tree Protocol (STP).
Comparison Matrix
| Feature | IPVPN (RFC 4364) | EVPN-MPLS (RFC 7432) |
|---|---|---|
| Service Layer | Layer 3 (Routed) | Layer 2 Bridged & Layer 3 Routed (Integrated) |
| MP-BGP Address Family | vpnv4 / vpnv6 (AFI 1/2, SAFI 128) | l2vpn evpn (AFI 25, SAFI 70) |
| MAC Discovery | N/A (IP routing only) | Control Plane BGP MP-REACH |
| Default Gateway | Local PE Interface per VRF | Distributed Anycast Gateway / IRB across PEs |
| Multihoming | L3 ECMP via BGP/OSPF Multipath | L2 & L3 All-Active ECMP via ESI Aliasing |
| BUM Handling | N/A | Ingress Replication or P2MP LSPs (Type 3) |
| Per-Flow Load Balancing | Dependent on IP header hashes | Per-flow load balancing over All-Active ESIs |
2. Network Topologies & Architectural Diagrams
IPVPN Logical Architecture
[Customer Site A]
CE 1 Router
| (192.168.100.2/30)
| eBGP AS 65100
v
+-----------------------+
| PE1: Juniper MX |
| VRF: CUSTOMER_A |
| RD: 10.0.0.1:100 |
+-----------------------+
|
MP-BGP VPNv4 Tunnel
Transport: LDP / SR
|
+-----------------------+
| PE2: Cisco ASR 9000 |
| VRF: CUSTOMER_A |
| RD: 10.0.0.2:100 |
+-----------------------+
^
| eBGP AS 65200
| (192.168.200.2/30)
[Customer Site B]
CE 2 RouterEVPN-MPLS Multihoming & IRB Architecture
+-------------------+
| Customer CE 1 |
| Dual-Homed |
+-------------------+
/ \
Port 1/ \ Port 2
(LACP) (LACP)
/ \
v v
+-------------------+ +-------------------+
| PE 3: Juniper MX | | PE 4: Cisco ASR9K |
| EVI: 200 | | EVI: 200 |
| IRB: 10.1.1.1/24 | | IRB: 10.1.1.1/24 |
+-------------------+ +-------------------+
\ /
\ /
MP-BGP L2VPN EVPN
(Route Types 1,2,3,4,5)
Segment Routing Core
|
v
+-----------------------+
| PE 5: Remote Site |
| EVI: 200 |
| IRB: 10.1.1.1/24 |
+-----------------------+
|
+--------------+
| Customer CE2 |
+--------------+3. IPVPN Configuration Examples
Below are production-grade configurations establishing an IPVPN L3VPN instance between a Juniper MX PE and a Cisco ASR 9000 PE across an existing MPLS core.
Juniper MX Series (Junos OS)
# 1. MP-BGP Signaling for VPNv4
set protocols bgp group IBGP-CORE type internal
set protocols bgp group IBGP-CORE local-address 10.0.0.1
set protocols bgp group IBGP-CORE family inet-vpn unicast
set protocols bgp group IBGP-CORE neighbor 10.0.0.2
# 2. Access Subinterface Attachment
set interfaces ge-0/0/1 unit 100 vlan-id 100
set interfaces ge-0/0/1 unit 100 family inet address 192.168.100.1/30
# 3. VRF Instance Configuration
set routing-instances CUSTOMER_A_L3VPN instance-type vrf
set routing-instances CUSTOMER_A_L3VPN interface ge-0/0/1.100
set routing-instances CUSTOMER_A_L3VPN route-distinguisher 10.0.0.1:100
set routing-instances CUSTOMER_A_L3VPN vrf-target target:65000:100
set routing-instances CUSTOMER_A_L3VPN vrf-table-label
# 4. PE-CE Routing Protocol (eBGP)
set routing-instances CUSTOMER_A_L3VPN protocols bgp group PE-CE type external
set routing-instances CUSTOMER_A_L3VPN protocols bgp group PE-CE peer-as 65100
set routing-instances CUSTOMER_A_L3VPN protocols bgp group PE-CE neighbor 192.168.100.2Cisco ASR 9000 Series (Cisco IOS XR)
! 1. VRF Definition
vrf CUSTOMER_A_L3VPN
address-family ipv4 unicast
import route-target 65000:100
export route-target 65000:100
!
!
! 2. Subinterface Attachment
interface GigabitEthernet0/0/0/1.100
vrf CUSTOMER_A_L3VPN
ipv4 address 192.168.100.1 255.255.255.252
encapsulation dot1q 100
!
! 3. MP-BGP Configuration
router bgp 65000
neighbor 10.0.0.2
remote-as 65000
update-source Loopback0
address-family vpnv4 unicast
!
!
vrf CUSTOMER_A_L3VPN
rd 10.0.0.2:100
address-family ipv4 unicast
!
neighbor 192.168.100.2
remote-as 65100
address-family ipv4 unicast
!
!
!
!4. EVPN-MPLS Configuration Examples
The following setups illustrate an EVPN Layer 2 Multipoint service featuring Integrated Routing and Bridging (IRB) with an Anycast Gateway.
Juniper MX Series (Junos OS)
# 1. MP-BGP Configuration for EVPN
set protocols bgp group IBGP-EVPN type internal
set protocols bgp group IBGP-EVPN local-address 10.0.0.1
set protocols bgp group IBGP-EVPN family evpn signaling
set protocols bgp group IBGP-EVPN neighbor 10.0.0.2
# 2. Customer-Facing Interface
set interfaces ge-0/0/2 flexible-vlan-tagging
set interfaces ge-0/0/2 encapsulation flexible-ethernet-services
set interfaces ge-0/0/2 unit 200 encapsulation vlan-bridge
set interfaces ge-0/0/2 unit 200 vlan-id 200
# 3. Integrated Routing and Bridging (IRB) Anycast Interface
set interfaces irb unit 200 family inet address 10.1.1.1/24 Virtual-gateway-address 10.1.1.1
set interfaces irb unit 200 mac 00:00:5e:00:01:01
# 4. EVPN Routing Instance
set routing-instances EVPN_L2_SVC instance-type virtual-switch
set routing-instances EVPN_L2_SVC interface ge-0/0/2.200
set routing-instances EVPN_L2_SVC interface irb.200
set routing-instances EVPN_L2_SVC route-distinguisher 10.0.0.1:200
set routing-instances EVPN_L2_SVC vrf-target target:65000:200
set routing-instances EVPN_L2_SVC protocols evpn encapsulation mpls
set routing-instances EVPN_L2_SVC protocols evpn extended-vlan-list 200
set routing-instances EVPN_L2_SVC bridge-domains BD_VLAN200 vlan-id 200
set routing-instances EVPN_L2_SVC bridge-domains BD_VLAN200 interface ge-0/0/2.200
set routing-instances EVPN_L2_SVC bridge-domains BD_VLAN200 routing-interface irb.200Cisco ASR 9000 Series (Cisco IOS XR)
! 1. MP-BGP Configuration for EVPN
router bgp 65000
address-family l2vpn evpn
!
neighbor 10.0.0.2
remote-as 65000
update-source Loopback0
address-family l2vpn evpn
!
!
!
! 2. EVPN Instance (EVI) Setup
evpn
evi 200
bgp
rd 10.0.0.2:200
route-target import 65000:200
route-target export 65000:200
!
advertise-mac
!
!
! 3. Anycast Gateway BVI Interface
interface BVI200
host-routing
vrfs CUSTOMER_A_EVPN
ipv4 address 10.1.1.1 255.255.255.0
mac-address 0000.5e00.0101
!
! 4. L2 Transport Subinterface
interface GigabitEthernet0/0/0/2.200 l2transport
encapsulation dot1q 200
!
! 5. L2VPN Bridge Domain Association
l2vpn
bridge group BG_EVPN
bridge-domain BD_VLAN200
evi 200
interface GigabitEthernet0/0/0/2.200
!
routed interface BVI200
!
!
!
!5. Verification Commands
Junos OS Verification
# IPVPN Verification
show route table CUSTOMER_A_L3VPN.inet.0
show bgp summary
show route receive-protocol bgp 10.0.0.2 table CUSTOMER_A_L3VPN.inet.0
# EVPN Verification
show evpn instance
show evpn mac-table
show route table bgp.evpn.0
show interfaces irb unit 200Cisco IOS XR Verification
# IPVPN Verification
show route vrf CUSTOMER_A_L3VPN
show bgp vpnv4 unicast vrf CUSTOMER_A_L3VPN
show cef vrf CUSTOMER_A_L3VPN
# EVPN Verification
show evpn evi detail
show evpn mac-address
show l2vpn bridge-domain detail
show adjacency bvi 200Summary: Choosing the Right Architecture
- Choose IPVPN when services are purely routed, customer boundaries are strictly at Layer 3, and legacy operation simplicity is required across simple hub-and-spoke WANs.
- Choose EVPN-MPLS when you require active-active multihoming, low latency Layer 2 extension across sites, host mobility, or integrated Layer 2/3 IRB gateways without Spanning Tree protocol limitations.