Data Center

View Only

Back to discussions

Expand all | Collapse all

EVPN-VXLAN data-plane forwarding issue on QFX5120 while control plane operates correctly

1. EVPN-VXLAN data-plane forwarding issue on QFX5120 while control plane operates correctly

Recommend

Oleksandr Soroka

Posted 08-10-2026 06:15

Hi guys, we have multiple QFX5120 switches running different Junos releases.
One QFX5120 running 21.x forwards traffic correctly.
Another QFX5120 running 21.x exhibits the same issue as a QFX5120 running 24.4:

EVPN control plane is established.
Type-2 MAC/IP routes are exchanged.
Remote MACs are installed.
VTEP is operational.
However, no Layer-2 traffic is forwarded over VXLAN.

Therefore, the issue does not appear to be specific to Junos 24.4 and may instead be related to QFX5120 EVPN/VXLAN forwarding or a platform-specific software defect. We also observed intermittent data-plane behavior. ARP resolution is inconsistent. After changing the MX EVPN instance type from virtual-switch to mac-vrf, a single ICMP echo was successfully forwarded, after which traffic stopped forwarding again. This suggests that the forwarding state is briefly programmed correctly and then becomes invalid.

MX204-NODE-5-ATH> ping 184.104.X.250 source 184.104.X.251
PING 184.104.X.250 (184.104.X.250): 56 data bytes
ping: sendto: Can't assign requested address
ping: sendto: Can't assign requested address
64 bytes from 184.104.X.250: icmp_seq=93 ttl=64 time=12.459 ms
^[OA
^C
--- 184.104.X.250 ping statistics ---
245 packets transmitted, 1 packets received, 99% packet loss
round-trip min/avg/max/stddev = 12.459/12.459/12.459/0.000 ms

QFX5120 

show configuration interfaces xe-0/0/4| display set

set interfaces xe-0/0/4 description HurricaneElectric
set interfaces xe-0/0/4 unit 0 family ethernet-switching interface-mode access
set interfaces xe-0/0/4 unit 0 family ethernet-switching vlan members vlan4016.HE


set protocols bgp group EVPN_OVERLAY type internal
set protocols bgp group EVPN_OVERLAY local-address 10.254.1.220
set protocols bgp group EVPN_OVERLAY family evpn signaling
set protocols bgp group EVPN_OVERLAY local-as 65277
set protocols bgp group EVPN_OVERLAY neighbor 10.1.100.15 peer-as 65277

set routing-instances VRF-EVPN-MX5 instance-type mac-vrf
set routing-instances VRF-EVPN-MX5 protocols evpn encapsulation vxlan
set routing-instances VRF-EVPN-MX5 protocols evpn default-gateway no-gateway-community
set routing-instances VRF-EVPN-MX5 protocols evpn extended-vni-list 4016
set routing-instances VRF-EVPN-MX5 vtep-source-interface lo0.0
set routing-instances VRF-EVPN-MX5 service-type vlan-based
set routing-instances VRF-EVPN-MX5 interface xe-0/0/4.0
set routing-instances VRF-EVPN-MX5 route-distinguisher 10.254.1.220:4016
set routing-instances VRF-EVPN-MX5 vrf-target target:65277:4016
set routing-instances VRF-EVPN-MX5 vlans vlan4016.HE vlan-id 4016
set routing-instances VRF-EVPN-MX5 vlans vlan4016.HE vxlan vni 4016
set routing-instances VRF-EVPN-MX5 vlans vlan4016.HE vxlan ingress-node-replication

run show interfaces vtep.32769

  Logical interface vtep.32769 (Index 833) (SNMP ifIndex 541)
    Flags: Up SNMP-Traps 0x4000 Encapsulation: ENET2
    VXLAN Endpoint Type: Shared Remote, VXLAN Endpoint Address: 10.1.100.15, L3 Routing Instance: default
    VTEP additional tokens: 2
    Token:  Additional VTEP token[0] 8
    Token:  Additional VTEP token[1] 9
    Input packets : 5
    Output packets: 10654
    Protocol eth-switch, MTU: Unlimited
      Flags: Is-Primary, Trunk-Mode, 0x8000000

run show evpn instance extensive

Instance: VRF-EVPN-MX5
  Route Distinguisher: 10.254.1.220:4016
  VLAN ID: 4016
  Encapsulation type: VXLAN
  Control word enabled
  Duplicate MAC detection threshold: 5
  Duplicate MAC detection window: 180
  MAC database status                     Local  Remote
    MAC advertisements:                       1       1
    MAC+IP advertisements:                    1       3
    Default gateway MAC advertisements:       0       1
  Number of local interfaces: 2 (2 up)
    Interface name  ESI                            Mode             Status     AC-Role
    .local..10      00:00:00:00:00:00:00:00:00:00  single-homed     Up         Root
    xe-0/0/4.0      00:00:00:00:00:00:00:00:00:00  single-homed     Up         Root
  Number of IRB interfaces: 0 (0 up)
  Number of protect interfaces: 0
  Number of bridge domains: 1
    VLAN  Domain-ID Intfs/up   IRB-intf  Mode            MAC-sync v4-SG-sync v6-SG-sync
    4016  4016         1  1              Extended        Enabled  Disabled   Disabled
  Number of neighbors: 1
    Address               MAC    MAC+IP        AD        IM        ES Leaf-label DCI-Peer Flow-label DT2U-SID           DT2M-SID
    10.1.100.15             1         3         0         1         0                           NO
  Number of ethernet segments: 0
  Router-ID: 10.254.1.220
  Source VTEP interface IP: 10.254.1.220
  SMET Forwarding: Disabled
  RIB Table-ID: 184549387, Kernel Table-ID: 10, Kernel Table-Generation: 4
  EVPN instance flags: 0x801814000
  RTT Update Timestamp: Aug  7 11:26:44.283 2026
  L2ALD state change Timestamp: Aug  7 11:26:44.286 2026
  Core-Isolation change TS: Aug  7 13:39:36.342 2026, Core-Isolated: N
  Last Core-Isolation Change Reason: bgp-peer-transition

Instance: __default_evpn__
  Route Distinguisher: 10.254.1.220:0
  Number of bridge domains: 0
  Number of neighbors: 0

run show evpn database
Instance: VRF-EVPN-MX5
VLAN  DomainId  MAC address        Active source                  Timestamp        IP address
     4016       28:b8:29:c8:02:1c  10.1.100.15                    Aug 07 13:39:27  184.104.X.251
                                                                                   2001:X:X::2
                                                                                   fe80::2ab8:290f:b0c8:21c
     4016       d8:84:66:ea:76:2e  xe-0/0/4.0                     Aug 07 13:32:21  fe80::da84:66ff:feea:762e

run show mac-vrf forwarding mac-table instance VRF-EVPN-MX5

MAC flags (S - static MAC, D - dynamic MAC, L - locally learned, P - Persistent static, C - Control MAC
           SE - statistics enabled, NM - non configured MAC, R - remote PE MAC, O - ovsdb MAC,
           B - Blocked MAC)


Ethernet switching table : 2 entries, 2 learned
Routing instance : VRF-EVPN-MX5

Ethernet switching table : 2 entries, 2 learned
Routing instance : VRF-EVPN-MX5
   Vlan                MAC                 MAC       GBP    Logical                SVLBNH/      Active
   name                address             flags     tag    interface              VENH Index   source
   vlan4016.HE         28:b8:29:c8:02:1c   DR               vtep-10.32769                       10.1.100.15
   vlan4016.HE         d8:84:66:ea:76:2e   D                xe-0/0/4.0


run show mac-vrf forwarding instance VRF-EVPN-MX5
Information for routing instance and VLAN:

Flags (DL - disable learning, SE - stats enabled,
       AD - packet action drop, LH - MAC limit hit,
       MI - mac+ip limit hit)

Inst Logical   Routing             VLAN name          Index IRB   Flags Tag
type system    instance                                     index
RTT  Default   VRF-EVPN-MX5                           10
vlan Default   VRF-EVPN-MX5        vlan4016.HE        23                4016


MX204

show interfaces irb.4016| display set
set interfaces irb unit 4016 description vlan4016.HE
set interfaces irb unit 4016 family inet mtu 1500
set interfaces irb unit 4016 family inet sampling input
set interfaces irb unit 4016 family inet sampling output
set interfaces irb unit 4016 family inet address 184.104.X.251/31
set interfaces irb unit 4016 family inet6 mtu 1500
set interfaces irb unit 4016 family inet6 address 2001:X:X::2/126

 show routing-instances VRF-EVPN-QFX-KOROPI| display set
set routing-instances VRF-EVPN-QFX-KOROPI instance-type virtual-switch
set routing-instances VRF-EVPN-QFX-KOROPI protocols evpn encapsulation vxlan
set routing-instances VRF-EVPN-QFX-KOROPI protocols evpn extended-vni-list 4016
set routing-instances VRF-EVPN-QFX-KOROPI vtep-source-interface lo0.0
set routing-instances VRF-EVPN-QFX-KOROPI bridge-domains vlan4016.HE vlan-id 4016
set routing-instances VRF-EVPN-QFX-KOROPI bridge-domains vlan4016.HE routing-interface irb.4016
set routing-instances VRF-EVPN-QFX-KOROPI bridge-domains vlan4016.HE vxlan vni 4016
set routing-instances VRF-EVPN-QFX-KOROPI bridge-domains vlan4016.HE vxlan ingress-node-replication
set routing-instances VRF-EVPN-QFX-KOROPI route-distinguisher 10.1.100.15:4016
set routing-instances VRF-EVPN-QFX-KOROPI vrf-target target:65277:4016

run show interfaces vtep.32769
  Logical interface vtep.32769 (Index 370) (SNMP ifIndex 603)
    Flags: Up SNMP-Traps Encapsulation: ENET2
    VXLAN Endpoint Type: Remote, VXLAN Endpoint Address: 10.254.100.222, L2 Routing Instance: VRF-EVPN-QFX-MILAN, L3 Routing Instance: default
    Input packets : 76718091054
    Output packets: 16106535883
    Protocol bridge, MTU: Unlimited
      Flags: Is-Primary, Trunk-Mode, 0xc000000

      
run show evpn instance VRF-EVPN-QFX-KOROPI extensive
Instance: VRF-EVPN-QFX-KOROPI
  Route Distinguisher: 10.1.100.15:4016
  Encapsulation type: VXLAN
  Duplicate MAC detection threshold: 5
  Duplicate MAC detection window: 180
  MAC database status                     Local  Remote
    MAC advertisements:                       1       1
    MAC+IP advertisements:                    3       1
    Default gateway MAC advertisements:       1       0
  Number of local interfaces: 1 (1 up)
    Interface name  ESI                            Mode             Status     AC-Role
    .local..10      00:00:00:00:00:00:00:00:00:00  single-homed     Up         Root
  Number of IRB interfaces: 1 (1 up)
    Interface name  VLAN   VNI    Status  L3 context
    irb.4016               4016    Up     master
  Number of protect interfaces: 0
  Number of bridge domains: 1
    VLAN  Domain-ID Intfs/up   IRB-intf  Mode            MAC-sync v4-SG-sync v6-SG-sync
    4016  4016         0  0    irb.4016  Extended        Enabled  Disabled   Disabled
  Number of neighbors: 1
    Address               MAC    MAC+IP        AD        IM        ES Leaf-label DCI-Peer Flow-label DT2U-SID           DT2M-SID
    10.254.1.220            1         1         0         1         0                           NO
  Number of ethernet segments: 1
    ESI: 05:00:00:fe:5b:00:00:0f:b0:00
      Local interface: irb.4016, Status: Up/Forwarding
  Router-ID: 10.1.100.15
  Source VTEP interface IP: 10.1.100.15
  SMET Forwarding: Disabled

run show evpn database instance VRF-EVPN-QFX-KOROPI
Instance: VRF-EVPN-QFX-KOROPI
VLAN  DomainId  MAC address        Active source                  Timestamp        IP address
     4016       28:b8:29:c8:02:1c  irb.4016                       Aug 07 13:39:27  184.104.X.251
                                                                                   2001:X:X::2
                                                                                   fe80::2ab8:290f:b0c8:21c
     4016       d8:84:66:ea:76:2e  10.254.1.220                   Aug 07 13:39:26  fe80::da84:66ff:feea:762e

run show mac-vrf forwarding mac-table instance VRF-EVPN-QFX-KOROPI

MAC flags (S - static MAC, D - dynamic MAC, L - locally learned, P - Persistent static, C - Control MAC
           SE - statistics enabled, NM - non configured MAC, R - remote PE MAC, O - ovsdb MAC,
           B - Blocked MAC)


Ethernet switching table : 1 entries, 1 learned
Routing instance : VRF-EVPN-QFX-KOROPI
   Vlan                MAC                 MAC       GBP    Logical                SVLBNH/      Active
   name                address             flags     tag    interface              VENH Index   source
   vlan4016.HE         d8:84:66:ea:76:2e   DR               vtep.32771                          10.254.1.220

run show mac-vrf forwarding instance VRF-EVPN-QFX-KOROPI
Information for routing instance and bridge domain:

Flags (DL -disable learning, SE -stats enabled,
       AD -packet action drop, LH -mac limit hit,
       MI - mac+ip limit hit)

Inst  Logical    Routing              Bridging            Index  IRB     Flags     BD
Type  System     Instance             Domain                     Index             vlan
RTT   Default    VRF-EVPN-QFX-KOROPI                      10
      Default    VRF-EVPN-QFX-KOROPI  vlan4016.HE         5      374               4016

------------------------------
Oleksandr Soroka
------------------------------

2. RE: EVPN-VXLAN data-plane forwarding issue on QFX5120 while control plane operates correctly

Recommend
Kalle
Posted 08-11-2026 01:09
Edited by Kalle 08-11-2026 01:10

Reply Reply Privately
Looking at your output, I can see an issue that may causing your forwarding problems. This is independent of Junos version, which explains why you see the same behavior on both 21.x and 24.4.

Missing shared-tunnels on QFX5120

On QFX5120 with mac-vrf, you need to enable shared VTEP tunnels. Without it, the forwarding table can become inconsistent across instances:

set forwarding-options evpn-vxlan shared-tunnels set forwarding-options vxlan-routing next-hop 32768 set forwarding-options vxlan-routing overlay-ecmp

Important: Adding evpn-vxlan shared-tunnels requires a full reboot of the QFX to take effect. A commit alone is not sufficient - the forwarding ASIC needs to be re-initialized with the new tunnel model.

Junos version

Juniper's recommended releases for IP fabric / EVPN-VXLAN deployments are:

Latest 22.2R3-Sx

Latest 23.4R2-Sx

Running 21.x or 24.4 outside of these recommended trains means you may be hitting known bugs that are already fixed in the suggested releases. Aligning to one of these would be a good step regardless of the other fixes above.

------------------------------
Kalle Andersson
------------------------------
3. RE: EVPN-VXLAN data-plane forwarding issue on QFX5120 while control plane operates correctly

Recommend
Oleksandr Soroka
Posted 08-11-2026 02:26
Edited by Oleksandr Soroka 08-11-2026 02:26

Reply Reply Privately
Hi Kalle,

Thanks for taking the time to review my issue and for the recommendations!

Regarding `shared-tunnels`: it is actually already configured on both of my QFX5120 switches (both on the stable node and on the problematic one). Here is a snippet from the configuration:

show configuration forwarding-options | display set set forwarding-options evpn-vxlan shared-tunnels

Regarding the other two commands (`vxlan-routing next-hop` and `overlay-ecmp`): this specific setup on the QFX side acts purely as an L2 EVPN-VXLAN VTEP (bridging the client VLAN directly into the VNI without any L3 IRB routing inside this instance on the QFX itself-the IRB gateway resides on the MX). Do you know if `vxlan-routing next-hop` is strictly required by the Trident3 ASIC allocation tables even for pure L2 bridging instances when `shared-tunnels` is enabled?

As for the Junos version, we actually tested 23.4 earlier before upgrading to 24.4 (on our KOROPI node with mac-vrf), but hit the exact same data-plane behavior. So it seems independent of these releases.

------------------------------
Oleksandr Soroka
------------------------------

Original Message
4. RE: EVPN-VXLAN data-plane forwarding issue on QFX5120 while control plane operates correctly

Recommend
Kalle
Posted 30 days ago

Reply Reply Privately
Hi,

I think the next step is to compare your configuration with Juniper's JVD at https://github.com/Juniper/jvd/tree/main so you know it follows the validated configuration.

------------------------------
Kalle Andersson
------------------------------

Original Message

Data Center

EVPN-VXLAN data-plane forwarding issue on QFX5120 while control plane operates correctly

Oleksandr Soroka08-10-2026 06:15

Kalle08-11-2026 01:09

Oleksandr Soroka08-11-2026 02:26

Kalle30 days ago

1. EVPN-VXLAN data-plane forwarding issue on QFX5120 while control plane operates correctly

2. RE: EVPN-VXLAN data-plane forwarding issue on QFX5120 while control plane operates correctly

3. RE: EVPN-VXLAN data-plane forwarding issue on QFX5120 while control plane operates correctly

4. RE: EVPN-VXLAN data-plane forwarding issue on QFX5120 while control plane operates correctly

Related Content

VTEP discovery in VXLAN BGP/EVPN

EVPN-VXLAN using duplicate VLANs on QFX5120

EVPN VXLAN DCI stitching not working in Lab with vMX ? 23.4.

Does "Type VRF" and the default switch play ok together? QFX EVPN VXLAN campus.

VXLAN EVPN Multiple VLANS