Summary

  • Sabina Anja’s EVPN analysis identifies the first trust decision at an access port: a leaf can learn a host-supplied source MAC and advertise its new location to the fabric.
  • The MAC Mobility sequence number helps select a route. It does not authenticate the host that caused the advertisement.

A virtual machine moves; its MAC address follows; the fabric updates the path. That is the tidy EVPN story. Sabina Anja’s APNIC account starts at the same access port and changes one detail: a different host sends a frame using the stationary server’s source MAC. The leaf learns the address as local. The next control-plane update tells the rest of the fabric that the server moved.

The preference mechanism gives the impostor a useful credential without checking identity. RFC 7432 defines the MAC Mobility Extended Community and sequence number for EVPN MAC/IP advertisements. A leaf that treats a remote MAC as newly local can advertise a higher sequence; peers use that information to select a path. In Anja’s scenario, the forged frame is promoted from an access-layer observation into a BGP route. Traffic destined for the server can then be steered toward the attacker’s leaf.

A large move counter is a poor shortcut for deciding what happened. Anja notes that a legitimately migrating virtual machine might accumulate many moves. An attacker can instead change location slowly enough to avoid a rate-window alarm. The person reading the dashboard needs two records side by side: what the route reflectors accepted over time and which host or port was authorised to use that MAC at the edge. Neither a single high number nor one quiet alarm supplies that comparison.

Anja proposes exporting Type-2 route updates, watching the originator, ESI, sequence, sticky flag and timestamps, and checking suspicious changes against access-port bindings and inventory. That evidence chain gives an operator a place to test the claim that a server moved. Her APNIC article is a threat analysis; it supplies no named incident trace or prevalence count. A correlated route-reflector and access-port record from a real affected fabric would establish an occurrence and its path.

The design lesson is sharp: EVPN distributes what a leaf says it learned. An operator who lets any attached host claim a neighbour’s address has delegated a fabric-wide routing claim to that host. Anja puts the first control back at the access edge, where host identity can be bound to a port before the control plane amplifies it.