Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

header-navigation

Solutions

Featured solutions AI Campus and branch Data center WAN Security Service provider Cloud operator Industries
Campus and Branch

Welcome to the NOW Way to Wi-Fi

Take your networking performance to new heights with a modern, cloud-native, AI-Native architecture. Only Juniper can help you unleash the full potential of Wi-Fi 7 with our AI-Native platform for innovation.
Prepare for liftoff
Business intelligence analyst dashboard on virtual screen. Big data Graphs Charts.

AI Data Center Networking

Juniper’s AI data center solution is a quick way to deploy high performing AI training and inference networks that are the most flexible to design and easiest to manage with limited IT resources.
Find out more
Enterprise AI-Native Networking

Enterprise AI‑Native Routing

Juniper's Ai-Native routing solution delivers robust 400GbE and 800GbE capabilities for unmatched performance, reliability, and sustainability at scale.
Explore enterprise routing
Zero trust security

Ops4AI Lab

Visit our lab in Sunnyvale, CA and see our AI data center solution for yourself. You can try out your own model’s functionality and performance, too.
Visit the lab
Enterprise AI-Native Networking

Enterprise AI‑Native Routing

Juniper's Ai-Native routing solution delivers robust 400GbE and 800GbE capabilities for unmatched performance, reliability, and sustainability at scale.
Explore enterprise routing
Higher Education

Shaping Student Experiences: The NOW Way to Build Higher Education Networks

Juniper Networks CIO Sharon Mandell and a virtual summit of C-level IT leaders from prestigious institutions discuss ongoing efforts to support digital transformation on campus.
Watch now
Hand on tablet with healthcare overlay of graphics

Security in healthcare

In this IDC Spotlight report, discover how AI networking can automate and strengthen a healthcare ecosystem to defeat criminals and prevent loss. 
Gain insights into ecosystem security
Retail

The Future of In-Store Technologies

Retail experts Kevin McCartan, Senior IT Service Delivery Engineer at Musgrave; Jack Stratten of Insider Trends; and Christian Gilby, Senior Director of Product Marketing at Juniper Networks, discuss customer experiences.
See the future

Products

Wireless access Wired access SD-WAN / SASE Routing and switching Security Mist AI™ Management software Network operating system Blueprint for AI-Native Acceleration Optics
  • Operations
ACX7020 router

Juniper ACX7020 Cloud Metro Access Router

Legacy networks simply cannot meet the demands of today’s rapidly evolving metro landscape. Unlock a new generation of highly scalable architectures and automated operations with the Juniper ACX7020. 
Learn more
EX4000 Ethernet Switch

Next-gen AI-Native EX4000 line of switches

Lack of AI innovation from your current networking vendor slowing you down? Embrace Juniper’s cloud-native, AI-Native access switches that support every level and layer, across nearly every deployment.
Discover how
The Q and AI text with an image of Bob Friday and Kedar Dhuru.

The Q&AI Podcast

Delivering practical solutions and enriching discussions, this podcast series is a vital resource for those seeking an in-depth exploration of AI's transformative potential.
Catch the latest episode

Services

Services
Services AI Care

Juniper AI Care Services Revolutionize Your Service Experience

Our industry-first AI-Native services couple AIOps with our deep expertise across the full network life cycle. You can move from reactive response to proactive insight and action.
Explore AI Care Services
Services AI Data Center

Juniper AI Data Center Deployment Services Optimize Your AI Model Runs

We use our expertise and validated designs to help design, deploy, validate and tune networks, including GPUs and storage, to get the most from your AI infrastructure operation.
Learn about AI Data Center Deployment Services

Partners

Partners

Support and Documentation

Support and Documentation

Learn

About Juniper Training Events The Feed Resources Technology learning topics Thought leadership and insights
Audience raising hands up while businessman is speaking in training at the office.

Juniper certification and training news

See the latest
Ringing of the bell

All global events

See the latest
AI-native-now

AI-Native NOW event series

Register now
Juniper's Christina Hendrix at the head of a conference table. With the text "The NOW Way to Network" overlayed, with "NOW" emphasizing the "O" in green color.

The NOW Way to Network

Watch the video series
AI Native Now

Executive insights

Dive deep with leading experts and thought leaders on all the topics that matter most to your business, from AI to network security to driving rapid, relevant transformation for your business.
Learn more
A keynote speaker giving a presentation at a conference. There are dozens of people sitting around them. The presentation is displayed via projector on all the walls in the room.

Leadership voices

Juniper Networks’ leaders operate on the front lines of creating the network of the future. Take a look around to see what’s on their minds.
Watch now
Bob Friday and Jessica Garrison speaking

Bob Friday Talks

Join Bob as he ventures into all the knowns -- and -- unknowns -- of AI.
Catch the latest episode
Documentation
Menu
License Guide
Quick Starts
Validated Designs
Home Documentation Juniper Apstra Juniper Apstra 4.2.2 / 4.2.1 / 4.2.0 User Guide References

Juniper Apstra 4.2.2 / 4.2.1 / 4.2.0 User Guide

keyboard_arrow_up
close
keyboard_arrow_left
Juniper Apstra 4.2.2 / 4.2.1 / 4.2.0 User Guide
Table of Contents Expand all
list Table of Contents
file_download PDF
{ "lLangCode": "en", "lName": "English", "lCountryCode": "us", "transcode": "en_US" }
English
ON THIS PAGE
keyboard_arrow_right

Apstra EVPN Support Addendum

Release: Juniper Apstra 4.2
{}
Change Release
date_range 07-Feb-24
arrow_backward
arrow_forward

When deploying EVPN on Apstra-supported devices and NOSs, be aware of several caveats and limitations. Even though EVPN is a standard, vendors implement protocols in very different manners. Also, different ASICs support varying feature sets that impact EVPN BGP VXLAN implementations (Routing In and Out of Tunnels (RIOT) for example). The following sections describe supported EVPN deployment implementations.

Qualified Vendor and NOS

Apstra software supports EVPN on the following hardware. For recommended NOS versions, see Qualified Device and NOS.

Hardware ASIC Support

Apstra supports EVPN on the following hardware ASICs:

  • Arista DCS 7280SE with Arad chipset

  • Cisco Cloudscale

  • Mellanox Spectrum A1

  • Trident Trident2 (see below)

  • Trident Trident2+ (see below)

  • Trident Trident3 (see below)

  • Trident Tomahawk (see below)

  • Juniper Q5

Table 1: Apstra EVPN ASIC Support
ASIC Example Switches Notes
Arista Trident2 Arista DCS-7050 Can use as Spine, Leaf, or Border Leaf. Must set up EOS Recirculation interface(s) to use as a Layer3 Leaf (see Arista VXLAN documentation for more information).
Arista Trident3 DCS-7050CX3 Can use as Spine, Leaf, or Border Leaf.
Arista XP80 Arista DCS-7160 Ca use as Spine, Leaf, or Border Leaf.
Arista Jericho DCS-7280R Can use as Spine, Leaf, or Border Leaf.
Cisco Cloudscale Cisco 93180YC-EX Can use as Spine, Leaf, or Border Leaf
Cisco Trident2 with ALE Cisco 9396PX, 9372PX, 9332PQ, 9504 Can use as Spine, Leaf, or Border Leaf (see TCAM Carving in NXOS section).
Cisco Trident2+ Cisco 3132Q-V Can't use as Border Leaf
Juniper Q5 Juniper QFX10002 Can use as Spine, Leaf, or Border Leaf
Juniper Trident2 Juniper QFX5100 Can use as Spine or Layer2 Leaf
Juniper Trident2+ Juniper QFX5110 Can use as Spine, Leaf, or Border Leaf
Juniper Trident3 Juniper QFX5120 Can use as Spine, Leaf, or Border Leaf

For recommended NOS versions, refer to Qualified Devices and NOS <device_support>.

Limitations

EVPN Layer2 Limitations

  • VLAN (Rack-local) Virtual networks must be in the default routing zone.
  • VxLAN (Inter-rack) Virtual networks can't be part of the default routing zone.

EVPN Layer3 Limitations

  • Generic systems with BGP peering to non-default routing zones must connect to leaf devices.
  • Generic systems with BGP peering only to the default routing zone can connect to leaf devices, spine devices or superspine devices.
  • Multi-zone security segmentations only support up to 16 routing zones (VRFs) on Arista (HW Limitation)
  • Inter routing zone (VRF) routing must be handled on a generic system (EVPN type 5 route leaking)
  • All BGP sessions and loopback addresses are part of the default routing zone.

TCAM Carving in NX-OS

To successfully deploy EVPN on Cisco Nexus devices other then Cisco Cloudscale, you must first configure Cisco NXOS TCAM carving. These other devices may include Cisco NXOSv, or Cisco Nexus "Trident2" devices such as 9396PX, 9372PX, 9332PQ, or 9504. On Cisco NXOS the ARP Suppression feature is used in order to minimize ARP flooding.

For details, see Juniper Support Knowledge Base article KB36733

Before installing the device agent, we recommend that you apply TCAM Carving during device management setup or during Cisco Power-on Auto Provisioning (POAP). TCAM Carving requires a device reboot.

Alternatively, you can apply TCAM Carving with configlets when you deploy the blueprint. You must manually reboot devices.

Use show hardware access-list tcam region to show and verify TCAM allocation on Cisco NX-OS.

Cisco NXOSv TCAM Carving

content_copy zoom_out_map
hardware access-list tcam region vacl 0
hardware access-list tcam region racl 0
hardware access-list tcam region arp-ether 256
content_copy zoom_out_map
no hardware access-list tcam region arp-ether 256
no hardware access-list tcam region racl 0
no hardware access-list tcam region vacl 0

Cisco Trident2 TCAM Carving

content_copy zoom_out_map
hardware access-list tcam region l3qos 0
hardware access-list tcam region arp-ether 256 double-wide
content_copy zoom_out_map
no hardware access-list tcam region l3qos 0
no hardware access-list tcam region arp-ether 256 double-wide

Arista EOS VxLAN Routing

Recirculation Interface for Arista Trident2 Devices

VxLAN Routing for Trident2 devices (for example, 7050QX-32) is supported but requires assigning EOS recirculation interfaces to unused physical interfaces on the device. You can use configlets to deploy this to all devices that require this configuration.

content_copy zoom_out_map
interface Recirc-Channel501
 switchport recirculation features vxlan
interface Ethernet35
 traffic-loopback source system device mac
 channel-group recirculation 501
interface Ethernet36
 traffic-loopback source system device mac
 channel-group recirculation 501
content_copy zoom_out_map
interface Ethernet35
 no traffic-loopback source system device mac
 no channel-group recirculation 501
interface Ethernet36
 no traffic-loopback source system device mac
 no channel-group recirculation 501
no interface Recirc-Channel501

VxLAN Routing System Profile for Arista Jericho Devices

We recommend when using VxLAN Routing for Jericho devices (for example, 7280SR-48C6) that you assign EOS VxLAN Routing System Profile on the device.

Before installing the device agent, we recommend that you apply the Arista TCAM system profile during the device management setup or during Arista Zero-Touch Provisioning (ZTP). TCAM system profile requires a device reboot.

Alternatively, you can use configlets to deploy this to all devices requiring this configuration and manually reboot the devices.

content_copy zoom_out_map
hardware tcam
   system profile vxlan-routing
content_copy zoom_out_map
hardware tcam
   no system profile vxlan-routing

VxLAN Routing Profile for Arista Arad Devices

We recommend when using VxLAN Routing for Arista Arad devices (for example, on 7280SE platform) that you assign EOS VxLAN Routing Profile on the device.

Before installing the device agent, we recommend that you apply the Arista TCAM system profile during the device management setup or during Arista Zero-Touch Provisioning (ZTP). TCAM system profile requires a device reboot.

Alternatively, you can use configlets to deploy this to all devices requiring this configuration and manually reboot the devices.

content_copy zoom_out_map
hardware tcam
   profile vxlan-routing

Graph Node VTEP Types

Unicast VTEPs

Unicast VTEPs do not apply to Arista.

Cisco Unicast VTEPs - Vendor Definition: Anycast VTEP

Apstra IP Allocation

Unique per leaf in MLAG pair

Not allocated to singleton switches

MLAG Configuration

content_copy zoom_out_map
interface loopback1
   IP address 10.0.0.1/32
   IP address 10.0.0.3/32 secondary
interface nve1
   source-interface loopback1
content_copy zoom_out_map
interface loopback1
   IP address 10.0.0.2/32
   IP address 10.0.0.3/32 secondary
interface nve1
   source-interface loopback1

Single Switch Configuration

content_copy zoom_out_map
interface loopback1
   IP address 10.0.0.1/32
interface nve1
   source-interface loopback1

Logical VTEPs

Arista Logical VTEPs

Apstra IP Allocation

Logical VTEP configured as primary IP on loopback1 interface for both MLAG and singleton switches

All top of rack nodes share same logical VTEP IP:

  • MLAG leaf devices share same logical VTEP IP
  • Singleton leaf device gets its own VTEP IP

MLAG Configuration

content_copy zoom_out_map
interface loopback1
   IP address: 10.0.0.1/32
   IP address: 10.0.0.4/32 secondary
interface vxlan1
   vxlan source-interface loopback1
content_copy zoom_out_map
interface loopback1
   IP address: 10.0.0.1/32
   IP address: 10.0.0.4/32 secondary
interface vxlan1
   vxlan source-interface loopback1

Single Switch Configuration

content_copy zoom_out_map
interface loopback1
   IP address: 10.0.0.5/32
   IP address 10.0.0.4/32 secondary
interface vxlan1
   vxlan source-interface loopback1

Anycast VTEP

Anycast VTEPs do not apply to Cisco.

Arista Anycast VTEPs

Apstra IP Allocation

One anycast VTEP for entire blueprint, shared between all Arista leaf devices

Configured as secondary IP on loopback1 interface

MLAG Configuration

content_copy zoom_out_map
interface loopback1
   IP address 10.0.0.1/32
   IP address 10.0.0.5/32 secondary
interface vxlan1
   vxlan source-interface loopback1
content_copy zoom_out_map
interface loopback1
   IP address 10.0.0.1/32
   IP address 10.0.0.5/32 secondary
interface vxlan1
   vxlan source-interface loopback1

Single Switch Configuration

content_copy zoom_out_map
interface loopback1
   IP address 10.0.0.5/32
   IP address 10.0.0.4/32 secondary
interface vxlan1
   vxlan source-interface loopback1
arrow_backward PREVIOUS Apstra CLI Commands
NEXT arrow_forward Apstra Server Configuration File
footer-navigation

© 1999 - 2025 Juniper Networks, Inc. All rights reserved.

Scroll to top