Summary

  • EVPN elects a Designated Forwarder for multi-destination traffic toward a multihomed Ethernet Segment, but the winning PE can still have a failed service attachment.
  • Ethernet Segment and Auto-Discovery withdrawals accelerate convergence, yet they do not prove synchronized forwarding tables, correct split horizon or packet continuity.
  • RFC 8584 documents how logical attachment failures can leave the candidate list unchanged and black-hole traffic even while the election remains stable.
  • A defensible failover claim joins the election record to service state, hardware programming and bidirectional packet measurements.

Imagine a maintenance window in which two Provider Edges remain visible for the same Ethernet Segment. The dashboard shows that the backup PE has become Designated Forwarder for the affected VLAN. BGP is settled, the candidate list is consistent and the incident clock stops. Yet broadcast, unknown-unicast and multicast traffic still disappears because the attachment circuit for that service is down on the elected PE. The election result is correct; the service conclusion is not.

This is a hypothetical failure, not an allegation about an operator or vendor. It exposes a narrow evidence problem: EVPN control state assigns responsibility, while actual delivery depends on several additional state machines.

What the election decides

RFC 7432 defines the default service-carving procedure. PEs attached to the same Ethernet Segment advertise Ethernet Segment routes, wait to learn the candidate set, order the originating-router addresses and select a DF for an Ethernet Tag using a modulo calculation. The elected DF unblocks multi-destination traffic toward that segment; non-DF PEs keep dropping it in that direction.

That decision matters. It reduces duplicate delivery and helps prevent loops. In All-Active mode, known unicast may use several PEs while DF status controls broadcast, unknown-unicast and multicast egress. In Single-Active mode, the active forwarding responsibility is narrower. Neither mode turns the election into a health test for every attachment circuit, bridge domain, label entry or customer bond.

The protocol has several convergence tools. An Ethernet Segment route withdrawal can retrigger service carving. Ethernet Auto-Discovery per-ES withdrawals tell remote PEs to update next-hop adjacencies for many MAC addresses without waiting for individual withdrawals. ESI-label split horizon prevents traffic received from a multihomed segment from returning to it. RFC 7432 explicitly recognizes a transient recovery hazard in which two PEs may both believe they are DF before the election settles.

A stable candidate list can hide a broken service

RFC 8584 explains why the default election needs extension. The modulo method can distribute services unevenly. More importantly for continuity, adding or losing one PE can remap services whose existing DF did not fail, creating unnecessary blocking and unblocking changes.

The harder case is a logical failure below the Ethernet Segment route. An individual attachment circuit may be shut or unprovisioned, or a MAC-VRF may be unavailable, while other services keep the Ethernet Segment operational. The active PE list does not change, so the remote PEs may not rerun the default election. RFC 8584 shows that this can black-hole BUM traffic in All-Active mode and all traffic for an affected CE in Single-Active mode.

The extensible framework lets PEs agree on an election algorithm and capabilities. Its attachment-circuit-aware capability can exclude a PE for the affected service. That improves the signal, but still leaves an operational question: did every participant interpret the same capability and service state, install the intended DF/NDF and split-horizon behavior, update MAC and next-hop state, and deliver packets within the promised interruption budget?

Measure the transition, not only the winner

A useful verification starts with one ESI, EVI and Ethernet Tag. Capture the candidate list, algorithm, capability agreement and DF/NDF result before and after the trigger. Record the redundancy mode, ES and A-D route events, attachment-circuit and bridge-domain state, ESI-label and split-horizon programming, MAC movement, next-hop changes and CE bond state.

Then measure both directions. Send known unicast and BUM probes through each expected path. Count loss, duplication, loops, reordering and convergence time during failure, steady state and recovery. Confirm that the former DF blocks what it should, the new DF forwards what it should, legitimate traffic returns, and a recovered PE does not create a second disruptive re-carve.

Sources