EVPN-MH Split Horizon Filters - not filter BUM traffic not DF
Confirmed, NormalPublicBUG
Actions

Assigned To

Authored By

	fernando
	Nov 28 2025, 7:51 PM

Description

Hi team

In EVPN-MH, Designated Forwarder (DF) functionality is responsible for blocking traffic on the non-DF spine when operating in active/active mode. Currently, this behavior is not working as expected. The system forwards BUM traffic without applying any split-horizon filtering.

example :

Screenshot 2025-11-28 at 4.00.16 PM.png (866×1 px, 175 KB)

vyos-configuration :

vyos@VyOS-PE01:~$ show configuration commands
set interfaces bonding bond0 evpn es-df-pref '1000'
set interfaces bonding bond0 evpn es-id '100'
set interfaces bonding bond0 evpn es-sys-mac 'aa:bb:cc:dd:ee:f0'
set interfaces bonding bond0 lacp-rate 'fast'
set interfaces bonding bond0 member interface 'eth2'
set interfaces bonding bond0 mode '802.3ad'
set interfaces bonding bond0 system-mac 'aa:bb:cc:dd:ee:f0'
set interfaces bridge br0 address '10.0.0.2/24'
set interfaces bridge br0 ip enable-arp-ignore
set interfaces bridge br0 member interface bond0
set interfaces bridge br0 member interface dum100
set interfaces bridge br0 member interface vxlan0
set interfaces dummy dum100 mac 'aa:bb:cc:dd:ee:f0'
set interfaces ethernet eth0 address 'dhcp'
set interfaces ethernet eth0 dhcp-options default-route-distance '150'
set interfaces ethernet eth0 hw-id '50:00:00:01:00:00'
set interfaces ethernet eth0 offload gro
set interfaces ethernet eth0 offload gso
set interfaces ethernet eth0 offload sg
set interfaces ethernet eth0 offload tso
set interfaces ethernet eth1 address '10.1.2.1/24'
set interfaces ethernet eth1 hw-id '50:00:00:01:00:01'
set interfaces ethernet eth1 offload gro
set interfaces ethernet eth1 offload gso
set interfaces ethernet eth1 offload sg
set interfaces ethernet eth1 offload tso
set interfaces ethernet eth2 hw-id '50:00:00:01:00:02'
set interfaces ethernet eth2 offload gro
set interfaces ethernet eth2 offload gso
set interfaces ethernet eth2 offload sg
set interfaces ethernet eth2 offload tso
set interfaces ethernet eth3 hw-id '50:00:00:01:00:03'
set interfaces ethernet eth3 offload gro
set interfaces ethernet eth3 offload gso
set interfaces ethernet eth3 offload sg
set interfaces ethernet eth3 offload tso
set interfaces loopback lo
set interfaces pseudo-ethernet peth0 address '10.0.0.1/32'
set interfaces pseudo-ethernet peth0 ip disable-arp-filter
set interfaces pseudo-ethernet peth0 mac 'aa:bb:cc:dd:ee:f0'
set interfaces pseudo-ethernet peth0 source-interface 'br0'
set interfaces vxlan vxlan0 parameters neighbor-suppress
set interfaces vxlan vxlan0 port '4789'
set interfaces vxlan vxlan0 source-address '10.1.2.1'
set interfaces vxlan vxlan0 vni '100'
set nat source rule 10 outbound-interface name 'eth0'
set nat source rule 10 translation address 'masquerade'
set protocols bgp address-family l2vpn-evpn advertise-all-vni
set protocols bgp neighbor 10.1.2.2 peer-group 'ESI_PEERS'
set protocols bgp peer-group ESI_PEERS address-family ipv4-unicast default-originate
set protocols bgp peer-group ESI_PEERS address-family ipv4-unicast nexthop-self
set protocols bgp peer-group ESI_PEERS address-family l2vpn-evpn
set protocols bgp peer-group ESI_PEERS remote-as '65000'
set protocols bgp system-as '65000'
set protocols bgp timers holdtime '30'
set protocols bgp timers keepalive '10'

set system config-management commit-revisions '100'
set system console device ttyS0 speed '115200'
set system host-name 'VyOS-PE01'
set system login operator-group default command-poli

PE2

set interfaces bonding bond0 evpn es-df-pref '900'
set interfaces bonding bond0 evpn es-id '100'
set interfaces bonding bond0 evpn es-sys-mac 'aa:bb:cc:dd:ee:f0'
set interfaces bonding bond0 lacp-rate 'fast'
set interfaces bonding bond0 member interface 'eth2'
set interfaces bonding bond0 mode '802.3ad'
set interfaces bonding bond0 system-mac 'aa:bb:cc:dd:ee:f0'
set interfaces bridge br0 address '10.0.0.3/24'
set interfaces bridge br0 ip enable-arp-ignore
set interfaces bridge br0 member interface bond0
set interfaces bridge br0 member interface dum100
set interfaces bridge br0 member interface vxlan0
set interfaces dummy dum100 mac 'aa:bb:cc:dd:ee:f0'
set interfaces ethernet eth0 address 'dhcp'
set interfaces ethernet eth0 dhcp-options default-route-distance '150'
set interfaces ethernet eth0 hw-id '50:00:00:02:00:00'
set interfaces ethernet eth0 offload gro
set interfaces ethernet eth0 offload gso
set interfaces ethernet eth0 offload sg
set interfaces ethernet eth0 offload tso
set interfaces ethernet eth1 address '10.1.2.2/24'
set interfaces ethernet eth1 hw-id '50:00:00:02:00:01'
set interfaces ethernet eth1 offload gro
set interfaces ethernet eth1 offload gso
set interfaces ethernet eth1 offload sg
set interfaces ethernet eth1 offload tso
set interfaces ethernet eth2 hw-id '50:00:00:02:00:02'
set interfaces ethernet eth2 offload gro
set interfaces ethernet eth2 offload gso
set interfaces ethernet eth2 offload sg
set interfaces ethernet eth2 offload tso
set interfaces ethernet eth3 hw-id '50:00:00:02:00:03'
set interfaces ethernet eth3 offload gro
set interfaces ethernet eth3 offload gso
set interfaces ethernet eth3 offload sg
set interfaces ethernet eth3 offload tso
set interfaces loopback lo
set interfaces pseudo-ethernet peth0 address '10.0.0.1/32'
set interfaces pseudo-ethernet peth0 ip disable-arp-filter
set interfaces pseudo-ethernet peth0 mac 'aa:bb:cc:dd:ee:f0'
set interfaces pseudo-ethernet peth0 source-interface 'br0'
set interfaces vxlan vxlan0 parameters neighbor-suppress
set interfaces vxlan vxlan0 port '4789'
set interfaces vxlan vxlan0 source-address '10.1.2.2'
set interfaces vxlan vxlan0 vni '100'
set nat source rule 10 outbound-interface name 'eth0'
set nat source rule 10 translation address 'masquerade'
set protocols bgp address-family l2vpn-evpn advertise-all-vni
set protocols bgp neighbor 10.1.2.1 peer-group 'ESI_PEERS'
set protocols bgp peer-group ESI_PEERS address-family ipv4-unicast default-originate
set protocols bgp peer-group ESI_PEERS address-family ipv4-unicast nexthop-self
set protocols bgp peer-group ESI_PEERS address-family l2vpn-evpn
set protocols bgp peer-group ESI_PEERS remote-as '65000'
set protocols bgp system-as '65000'
set protocols bgp timers holdtime '30'
set protocols bgp timers keepalive '10'

set system host-name 'VyOS-PE02'

this problem is mentioned as well, in this post :
https://forum.vyos.io/t/evpn-multihoming-split-horizon-filters-not-functional/17154

where describe the current, behavior...if we apply the services created in this https://github.com/l0crian1/vyos-evpn-sph , where it create some nffilter rules, based state of DF :

table netdev evpn_sph {
	set vteps {
		type ipv4_addr
		flags interval
		elements = { 10.1.2.2 }
	}

	chain evpn_sph_ingress {
		type filter hook ingress device "eth2" priority filter; policy accept;
		ip saddr @vteps udp dport 4789 meta mark set 0x04fc867d counter packets 0 bytes 0 accept
	}
}
table bridge evpn_sph {
	set df_bonds {
		type ifname
		flags interval
		auto-merge
		elements = { "bond0" }
	}

	chain evpn_sph_forward {
		type filter hook forward priority 0; policy accept;
		oifname @df_bonds meta mark 0x04fc867d meta pkttype { broadcast, multicast } counter packets 0 bytes 0 drop
	}
}

PE2:

table netdev evpn_sph {
	set vteps {
		type ipv4_addr
		flags interval
		elements = { 10.1.2.1 }
	}

	chain evpn_sph_ingress {
		type filter hook ingress device "eth2" priority filter; policy accept;
	}
}
table bridge evpn_sph {
	set non_df_bonds {
		type ifname
		flags interval
		auto-merge
		elements = { "bond0" }
	}

	chain evpn_sph_forward {
		type filter hook forward priority 0; policy accept;
		iifname "vxlan*" oifname @non_df_bonds meta pkttype { broadcast, multicast } counter packets 2065 bytes 256295 drop
	}

Details

Version: VyOS 2025.11.24-0021-rolling
Is it a breaking change?: Unspecified (possibly destroys the router)
Issue type: Bug (incorrect behavior)
Forum thread: https://forum.vyos.io/t/evpn-multihoming-split-horizon-filters-not-functional/17154

Event Timeline

fernando created this task.Nov 28 2025, 7:51 PM

pasik subscribed.Nov 28 2025, 9:36 PM

fernando changed the task status from Open to Confirmed.Nov 28 2025, 11:11 PM

FRR case where there is a long explanation: https://github.com/FRRouting/frr/issues/15400

tjjh89017 subscribed.Dec 12 2025, 4:37 AM

Viacheslav triaged this task as Normal priority.Dec 24 2025, 9:45 AM

some information added which is related to SH filters as well :

https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=03dc03fa0432a9160c4fcbdb86f274e6b4587972

it was done with TC but I prefer the locrian solution :

https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=e180a33cf4636721de9c3e694aaad31e77fcdeb1

adestis subscribed.Feb 26 2026, 10:11 AM

Viacheslav assigned this task to hedrok.Mar 19 2026, 1:43 PM

For clarification.
I have created a lab

Underlay: OSPF. The main function is to distribute Loopback IPs.
Overlay:
Control Plane: MP-iBGP. The main function is to distribute EVPN routes.
Data Plane: VXLAN
RR is a router reflector.
VTEP-1A and VTEP-1B contain the same ES via interface eth1
HOST-1 and HOST-2 are in the same network. 192.168.100.10/24 and 192.168.100.20/24 respectivly.
VTEP-1B is a DF router of these ES

Configurations:

set interfaces dummy dum1 address '1.1.1.10/32'
set interfaces ethernet eth0 address '10.0.0.10/24'
set protocols bgp neighbor 1.1.1.1 peer-group 'VTEP'
set protocols bgp neighbor 1.1.1.2 peer-group 'VTEP'
set protocols bgp neighbor 1.1.1.3 peer-group 'VTEP'
set protocols bgp parameters router-id '1.1.1.10'
set protocols bgp peer-group VTEP address-family l2vpn-evpn route-reflector-client
set protocols bgp peer-group VTEP remote-as '65000'
set protocols bgp peer-group VTEP update-source 'dum1'
set protocols bgp system-as '65000'
set protocols ospf interface dum1 area '0'
set protocols ospf interface eth0 area '0'
set system host-name 'RR'

VTEP-1A

set interfaces bonding bond1 evpn es-id '00:11:11:11:11:11:11:11:11:11'
set interfaces bonding bond1 member interface 'eth1'
set interfaces bonding bond1 system-mac '00:11:11:11:11:11'
set interfaces bridge br0 enable-vlan
set interfaces bridge br0 member interface bond1 allowed-vlan '100-200'
set interfaces bridge br0 member interface bond1 allowed-vlan '100'
set interfaces bridge br0 member interface bond1 native-vlan '100'
set interfaces bridge br0 member interface vxlan1 disable-learning
set interfaces dummy dum1 address '1.1.1.1/32'
set interfaces ethernet eth0 address '10.0.0.1/24'
set interfaces vxlan vxlan1 parameters external
set interfaces vxlan vxlan1 parameters neighbor-suppress
set interfaces vxlan vxlan1 parameters nolearning
set interfaces vxlan vxlan1 parameters vni-filter
set interfaces vxlan vxlan1 source-address '1.1.1.1'
set interfaces vxlan vxlan1 vlan-to-vni 100 vni '1100'
set protocols bgp address-family l2vpn-evpn advertise-all-vni
set protocols bgp address-family l2vpn-evpn vni 1100 rd '65000:1001'
set protocols bgp address-family l2vpn-evpn vni 1100 route-target both '65000:1100'
set protocols bgp neighbor 1.1.1.10 address-family l2vpn-evpn
set protocols bgp neighbor 1.1.1.10 remote-as '65000'
set protocols bgp neighbor 1.1.1.10 update-source 'dum1'
set protocols bgp parameters router-id '1.1.1.1'
set protocols bgp system-as '65000'
set protocols ospf interface dum1 area '0'
set protocols ospf interface eth0 area '0'
set protocols ospf parameters router-id '1.1.1.1'
set system host-name 'VTEP-1A'

VTEP-1B

set interfaces bonding bond1 evpn es-df-pref '32768'
set interfaces bonding bond1 evpn es-id '00:11:11:11:11:11:11:11:11:11'
set interfaces bonding bond1 member interface 'eth1'
set interfaces bonding bond1 system-mac '00:11:11:11:11:11'
set interfaces bridge br0 enable-vlan
set interfaces bridge br0 member interface bond1 allowed-vlan '100-200'
set interfaces bridge br0 member interface bond1 native-vlan '100'
set interfaces bridge br0 member interface vxlan1 disable-learning
set interfaces dummy dum1 address '1.1.1.2/32'
set interfaces ethernet eth0 address '10.0.0.2/24'
set interfaces vxlan vxlan1 parameters external
set interfaces vxlan vxlan1 parameters neighbor-suppress
set interfaces vxlan vxlan1 parameters nolearning
set interfaces vxlan vxlan1 parameters vni-filter
set interfaces vxlan vxlan1 source-address '1.1.1.2'
set interfaces vxlan vxlan1 vlan-to-vni 100 vni '1100'
set protocols bgp address-family l2vpn-evpn advertise-all-vni
set protocols bgp neighbor 1.1.1.10 address-family l2vpn-evpn
set protocols bgp neighbor 1.1.1.10 remote-as '65000'
set protocols bgp neighbor 1.1.1.10 update-source 'dum1'
set protocols bgp parameters router-id '1.1.1.2'
set protocols bgp system-as '65000'
set protocols ospf interface dum1 area '0'
set protocols ospf interface eth0 area '0'
set protocols ospf parameters router-id '1.1.1.2'
set system host-name 'VTEP-1B'

VTEP-2

set interfaces bridge br0 enable-vlan
set interfaces bridge br0 member interface eth1 allowed-vlan '100'
set interfaces bridge br0 member interface eth1 native-vlan '100'
set interfaces bridge br0 member interface vxlan1 disable-learning
set interfaces dummy dum1 address '1.1.1.3/32'
set interfaces ethernet eth0 address '10.0.0.3/24'
set interfaces vxlan vxlan1 parameters external
set interfaces vxlan vxlan1 parameters neighbor-suppress
set interfaces vxlan vxlan1 parameters nolearning
set interfaces vxlan vxlan1 parameters vni-filter
set interfaces vxlan vxlan1 source-address '1.1.1.3'
set interfaces vxlan vxlan1 vlan-to-vni 100 vni '1100'
set protocols bgp address-family l2vpn-evpn advertise-all-vni
set protocols bgp neighbor 1.1.1.10 address-family l2vpn-evpn
set protocols bgp neighbor 1.1.1.10 remote-as '65000'
set protocols bgp neighbor 1.1.1.10 update-source 'dum1'
set protocols bgp parameters router-id '1.1.1.3'
set protocols bgp system-as '65000'
set protocols ospf interface dum1 area '0'
set protocols ospf interface eth0 area '0'
set protocols ospf parameters router-id '1.1.1.3'
set system host-name 'VTEP-2'

HOST-1

set interfaces bonding bond1 address '192.168.100.10/24'
set interfaces bonding bond1 member interface 'eth0'
set interfaces bonding bond1 member interface 'eth1'

HOST-2

set interfaces ethernet eth0 address '192.168.100.20/24'

To emulate BUM traffic, I used ping to a nonexistent IP. It creates an ARP request that goes to the broadcast address.
I created 3 situations, and in all of them, VyOS processes BUM traffic incorrectly.

RUN ping 192.168.100.30 from HOST-2. It creates broadcast traffic. If we run tcpdump on VTEP-1A and VTEP-1B on the interface eth1 with the key --direction=out, we will see these ARP requests on both routers. It is not correct.

Correct behavior: Only VTEP-1B should pass this traffic, because this router is a DF

RUN ping to a non-existent IP from network 192.168.100.0/24 so that it passes via VTEP-1B. If we run tcpdump on VTEP-1A on the interface eth1 with the key --direction=out, we will see these ARP requests. It is not correct.

Correct behavior: VTEP-1A should block such traffic because it is non-DF. Non-DF routers should not pass any BUM traffic.

RUN ping to a non-existent IP from network 192.168.100.0/24 so that it passes via VTEP-1A. If we run tcpdump on VTEP-1B on the interface eth1 with the key --direction=out, we will see these ARP requests. It is not correct.

Correct behavior: VTEP-1B should block such traffic because it receives BUM traffic from a non-df router of the same ES. The DF router should pass BUM traffic generated only by the other ESs or hosts that do not connect to any ES.
DF router blocks BUM traffic generated only from the same ES.

	F33480952: Screenshot 2025-11-28 at 4.00.16 PM.png
	Nov 28 2025, 7:51 PM

	F116608174: L2Multihoming3.jpg
	Jul 16 2026, 9:53 AM

	F116608171: L2Multihoming2.jpg
	Jul 16 2026, 9:53 AM

	F116608168: L2Multihoming1.jpg
	Jul 16 2026, 9:53 AM

	F116608104: L2Multihoming.jpg
	Jul 16 2026, 9:53 AM

EVPN-MH Split Horizon Filters - not filter BUM traffic not DFConfirmed, NormalPublicBUGActions

Description

Details

Event Timeline

EVPN-MH Split Horizon Filters - not filter BUM traffic not DF
Confirmed, NormalPublicBUG
Actions