Service Provider Services like L2VPN and EVPN solve the problem of connecting two physically separate locations so they behave as if they are on the same local network, even when the service provider network in the middle uses different technology. For the 350-501 exam, understanding these concepts is critical because they underpin the most profitable services that service providers sell to enterprise customers.
Jump to a section
A simple way to picture Service Provider Services: L2VPN and EVPN
4 different companies share one office building at 742 Evergreen Terrace. Each company has its own private suite, but the building has a single mailroom that receives all packages. The mailroom is the service provider network, and each suite is a customer site.
Company A (Law Firm) needs its New York and London offices to send documents back and forth as if they were in the same room — identical IP addresses allowed. Company B (Bank) needs the same for its vaults in Chicago and Tokyo. But the bank’s vaults use the same IP scheme as the law firm’s servers. The mailroom cannot let a package for the law firm accidentally end up in the bank’s vault.
The mailroom manager sets up colour-coded mailing tubes. Company A gets a blue tube from its New York suite to its London suite. Company B gets a red tube from its Chicago vault to its Tokyo vault. Each tube is a Layer 2 Virtual Private Network (L2VPN). The packets (letters) inside each tube are completely private — no one else can read them, and the IP addresses inside each tube never collide with addresses in another tube.
Later, the mailroom upgrades to an electronic sorting system called Ethernet VPN (EVPN). Now, instead of wasting tubes for every possible conversation, the mailroom uses a smart directory (the MP-BGP control plane) to learn which suites talk to which other suites. If Company A’s London office needs to speak to Company A’s New York office, the mailroom instantly creates a virtual tube on demand. The smart directory also handles backup — if the blue tube gets a hole, the mailroom automatically reroutes through the green tube.
These are not generic concepts. An L2VPN is precisely that dedicated tube. EVPN is the intelligent directory that makes the tubes flexible and resilient. The office building mailroom is the ISP backbone, the suites are the customer networks, and the mailing tubes are the pseudowires carrying Ethernet frames exactly as if the two suites were directly connected by a single cable.
In a traditional enterprise network, you own all the cables, switches, and routers connecting your offices. If you have an office in London and one in New York, you can plug a server in London into a switch, run a long cable across the Atlantic, and plug the other end into the switch in New York. That cable carries a Layer 2 signal — Ethernet frames with MAC addresses. Every device in London can talk to every device in New York as if they were in the same room. The problem? That submarine cable costs millions and you need one for every pair of offices.
Service providers solved this by offering Virtual Private Wire Services (VPWS). Instead of a real cable, the provider creates a virtual connection called a pseudowire across its shared backbone network. Your Ethernet frames go in one end of the pseudowire and come out the other end, exactly as if they traversed a real cable. The provider’s routers encapsulate your Ethernet frame inside a tunnel (often MPLS), send it across the backbone, and decapsulate it at the far end. This is the simplest form of L2VPN — a point-to-point link between two customer sites.
But what if you have three or more offices that need to act like a single LAN? You need a multipoint L2VPN. Virtual Private LAN Service (VPLS) is the older technology that solves this. VPLS makes your provider’s cloud act like one big Ethernet switch. Every customer site connects to the provider’s network via a pseudowire. The provider runs a learning bridge in the cloud — it learns which MAC addresses are reachable through which pseudowire and forwards frames only where they need to go. If the London office sends a broadcast frame (like an ARP request), every other site in the VPLS instance receives it, just like on a real Ethernet switch.
VPLS has a limitation: it requires a full mesh of pseudowires between all provider edge (PE) routers that participate in the service. If you have 100 sites, you need nearly 5,000 pseudowires to connect them all. That is a management nightmare. Also, VPLS does not handle dual-homing (connecting one site to two different provider routers for redundancy) well — you end up with loops that require complex Spanning Tree Protocol configurations.
Enter Ethernet VPN (EVPN). EVPN keeps the same promise — connecting multiple sites as if they are one Layer 2 domain — but uses a completely different mechanism. Instead of building pseudowires between every pair of PEs, EVPN uses a control plane based on Multiprotocol Border Gateway Protocol (MP-BGP). MP-BGP is the same protocol that carries internet routing information, but EVPN extends it with new address families to advertise MAC addresses and IP prefixes.
In an EVPN network, each PE router learns the MAC addresses of devices connected to its local customer sites. It then advertises those MAC addresses to all other PE routers in the EVPN instance via MP-BGP. The advertisement says: “I have MAC address aa:bb:cc:dd:ee:ff reachable via my IP address and this Ethernet segment.” Other PE routers receive these advertisements and install the MAC addresses into their forwarding table. Now, when a frame arrives at PE-A destined for a MAC behind PE-B, PE-A can directly encapsulate the frame and send it to PE-B in a single hop — no pseudowire mesh needed.
EVPN also introduces Ethernet Segments (ES) and Ethernet Segment Identifiers (ESI). An Ethernet Segment is a group of physical links connecting one customer site to one or more PEs. The ESI uniquely identifies that segment. When a customer site is dual-homed to two PEs, the ESI allows both PEs to agree on who forwards traffic for that site. They use a Designated Forwarder (DF) election: one PE forwards traffic to the site, the other stands by. This eliminates loops without Spanning Tree.
Another powerful EVPN feature is Integrated Routing and Bridging (IRB). In traditional L2VPNs, if you wanted to route between different VLANs or subnets, you had to send traffic to a separate router. EVPN can perform routing functions directly on the PE router. The PE learns IP prefixes via MP-BGP, advertises them to other PEs, and can forward Layer 3 traffic between different EVPN instances without hair-pinning through an external router. - VPWS is point-to-point L2VPN: connects exactly two sites. - VPLS is multipoint L2VPN: connects many sites using a full mesh of pseudowires. - EVPN is multipoint L2VPN: connects many sites using MP-BGP control plane, no need for full mesh.
Why does EVPN replace VPLS? Because it is simpler to operate (no full mesh), more scalable (advertise MACs rather than build pseudowires), and supports advanced features like dual-homing, load balancing, and IRB. Service providers are rapidly migrating from VPLS to EVPN for new deployments.
Identify Customer Requirements
Determine how many customer sites need connectivity (2 for VPWS, 3+ for VPLS/EVPN), whether dual-homing is needed, and if Layer 3 routing is required. This selects the L2VPN technology.
Configure the EVPN Instance on PE Routers
Assign a Route Distinguisher (RD) and Route Target (RT) to the EVPN instance. The RD makes routes unique. The RT controls which PEs participate — only PEs that import the matching RT will learn MAC addresses for this service.
Configure Ethernet Segments (ES) for Multi-Homed Sites
For sites connected to two or more PEs, assign the same Ethernet Segment Identifier (ESI) on all PEs facing that site. This allows EVPN to elect a single Designated Forwarder, preventing loops.
Establish MP-BGP Peering between All PEs
Enable the L2VPN address family under BGP on each PE. The PEs form IBGP or EBGP sessions and exchange EVPN routes (Type 1-4). This control plane distributes MAC reachability information.
Verify MAC Learning and Forwarding
Use commands like 'show evpn mac vlan vlan-id' to confirm that MAC addresses from remote sites are learned via BGP. Send test traffic between sites to ensure frames arrive correctly.
Test Failover Scenarios
Simulate a link failure between a multi-homed site and one PE. Verify that the surviving PE becomes the Designated Forwarder and traffic resumes within milliseconds. Document the failover time and update the operations runbook.
Meet Alex, a network engineer at a regional service provider called ConnectNet. A large retail client, ShopFast, has 50 stores across the country and a central data centre. ShopFast’s point-of-sale (POS) systems in each store must talk to the inventory server in the data centre as if they were on the same VLAN. Previously, ShopFast used a VPLS service from another provider, but they complained about slow convergence when a link failed and the high cost of the full mesh.
Alex is assigned to migrate ShopFast from VPLS to EVPN. Here is what she does step by step:
First, Alex reviews ShopFast’s requirements. Each store has one router called a Customer Edge (CE) router. The data centre has two CE routers for redundancy. The service is a single Layer 2 domain: VLAN 100 carries all POS traffic. Alex notes that the data centre is dual-homed: each of the two CEs connects to a different provider edge (PE) router in ConnectNet’s network.
Second, Alex configures the EVPN instance on ConnectNet’s PE routers. She assigns a Route Distinguisher (RD) and Route Target (RT) to uniquely identify this EVPN instance. The RD ensures that if ShopFast uses the same IP addresses as another customer, they remain separate. The RT controls which PEs participate in this service — only PEs serving ShopFast stores import routes with that RT.
Third, Alex sets up the Ethernet Segment on the two PEs that connect to the data centre. She assigns the same Ethernet Segment Identifier (ESI) value to both PEs. This tells EVPN that both PEs serve the same customer site. The PEs then elect a Designated Forwarder (DF) — one PE will actively forward traffic to the data centre, the other will block traffic but stay ready. This prevents loops without Spanning Tree.
Fourth, Alex verifies MP-BGP peering. Each PE advertises the MAC addresses it learns from its locally attached stores. For the data centre, both PEs advertise the same MAC addresses because they see the same CEs. EVPN’s aliasing feature allows traffic destined for the data centre to be sent to either PE — load balancing across both links.
Fifth, Alex tests failover. She unplugs the link from one data centre CE to its PE. The remaining PE immediately becomes the sole DF because the ESI-timer expires. ShopFast’s traffic shifts to the surviving link in under 100 milliseconds — much faster than VPLS’s Spanning Tree convergence of multiple seconds.
Sixth, Alex documents the migration for operations. She writes a runbook that includes:
Commands to check EVPN MAC table: show evpn mac vlan 100
Commands to verify DF election: show evpn ethernet-segment detail
Troubleshooting steps for when a store cannot ping the inventory server — check that the store’s CE is up, that the PE has received the MAC routes via BGP, and that the RT matches.
The migration completes successfully. ShopFast reports that the new EVPN service is more reliable and actually costs less because ConnectNet uses fewer pseudowire resources. Alex earned a performance bonus and passes her 350-501 exam the following month.
The 350-501 exam tests your understanding of L2VPN, VPLS, and EVPN in several distinct ways. Expect multiple-choice questions, drag-and-drop ordering, and scenario-based questions where you must choose the correct technology or troubleshoot a misconfiguration.
Concepts the exam loves to test:
The difference between VPWS, VPLS, and EVPN. You need to know that VPWS connects two sites only (point-to-point), VPLS connects many sites using a full mesh of pseudowires, and EVPN connects many sites using MP-BGP control plane. The exam will give you a requirement (e.g., “customer needs Layer 2 connectivity between 8 sites with fast failover”) and ask which technology fits.
EVPN route types. EVPN defines several route types advertised via MP-BGP. The exam expects you to know:
- Type 1: Ethernet Auto-discovery Route — used for redundancy groups and mass withdrawal. - Type 2: MAC/IP Advertisement Route — advertises MAC addresses and optional IP prefixes. - Type 3: Inclusive Multicast Ethernet Tag Route — builds multicast trees for BUM (Broadcast, Unknown unicast, Multicast) traffic. - Type 4: Ethernet Segment Route — used for DF election. Traps: The exam might swap descriptions between route types. For example, they might describe Type 2 as “used for multicast” — that is wrong. Memorise each type’s primary function.
DF election process. Questions will test how a Designated Forwarder is chosen when a multi-homed site connects to two PEs. The PEs compare their IP addresses; the one with the lower IP becomes DF. The non-DF blocks traffic to the Ethernet Segment but forwards traffic from it. Trap: Candidates think both PEs forward traffic — wrong, that causes loops.
Route Distinguisher (RD) and Route Target (RT) roles. RD makes a route unique even if two customers use the same IP space. RT controls import/export of routes into a VPN. The exam will present a scenario where customer routes leak to another customer and ask what is misconfigured — likely the RT is too broad or uses a wrong value.
Split Horizon on VPLS. In VPLS, a PE must not forward a frame back out the pseudowire it came from. This is called split horizon. The exam might ask what mechanism prevents loops in VPLS — answer is split horizon, not Spanning Tree (which is disabled in VPLS). Trap: Candidates think STP is still running.
Common trap patterns:
Question says “all sites must be in the same broadcast domain” and offers “VPWS” as an option — VPWS is only two sites. Correct answer is VPLS or EVPN.
Question says “Which EVPN route type advertises MAC addresses?” and includes Type 1 as a distractor — Type 2 is correct.
Question says “Which feature allows load balancing across two links to the same customer site?” — answer is aliasing, but candidates pick ECMP (which is for IP routing, not EVPN MAC forwarding).
Key definitions to memorise: - Pseudowire: A virtual circuit that emulates a point-to-point connection over a packet-switched network. - Ethernet Segment: The set of physical links connecting a customer site to one or more PEs. - ESI: Unique identifier for an Ethernet Segment. - DF Election: Process that ensures only one PE forwards traffic to a multi-homed site. - BUM Traffic: Broadcast, Unknown unicast, and Multicast traffic that must be flooded to all sites in an L2VPN.
VPWS provides point-to-point Layer 2 connectivity between exactly two customer sites using a single pseudowire.
VPLS provides multipoint Layer 2 connectivity by building a full mesh of pseudowires between all participating provider edge routers.
EVPN replaces VPLS by using MP-BGP to advertise MAC addresses, eliminating the need for a full pseudowire mesh.
Route Distinguisher (RD) makes VPN routes unique across customers; Route Target (RT) controls which PEs import and export those routes.
Designated Forwarder (DF) election in EVPN ensures only one PE forwards traffic to a multi-homed site, preventing loops without Spanning Tree.
EVPN route Type 2 (MAC/IP Advertisement) carries both MAC addresses and optional IP prefixes for integrated routing and bridging.
These come up on the exam all the time. Here's how to tell them apart.
VPWS
Connects exactly two customer sites point-to-point.
Uses a single pseudowire between two PEs.
No scaling issues — only ever two endpoints.
VPLS
Connects multiple (three or more) customer sites in a single Layer 2 domain.
Uses a full mesh of pseudowires between all participating PEs.
Scaling is limited — adding one site requires N-1 new pseudowires.
VPLS
Relies on pseudowire full mesh between all PEs for data plane.
Uses split horizon to prevent loops in the mesh.
Control plane discovery of MAC addresses is done via local learning and flooding.
EVPN
Uses MP-BGP control plane to advertise MAC and IP routes.
Uses DF election to prevent loops in multi-homed topologies.
Control plane explicitly distributes MAC addresses; no flooding needed for learning.
Route Distinguisher (RD)
Purpose: Makes a VPN route globally unique across the provider network.
Scope: Local significance — usually padded to the PE router ID.
Effect: Two different customers can use overlapping IP addresses without collision.
Route Target (RT)
Purpose: Controls which PEs import (receive) and export (advertise) VPN routes.
Scope: Global significance — controls membership in a VPN.
Effect: Misconfiguring RT can cause route leaking between customers.
EVPN Route Type 2 (MAC/IP Advertisement)
Carries MAC address and optional IP prefix.
Used for unicast forwarding decisions.
Includes a label for per-VPN MPLS encapsulation.
EVPN Route Type 3 (Inclusive Multicast Ethernet Tag)
Carries information for building multicast trees.
Used for BUM traffic: Broadcast, Unknown unicast, Multicast.
Includes a tunnel endpoint IP for multicast replication.
Designated Forwarder (DF)
Elected as the single PE that forwards traffic to a multi-homed site.
Chosen by comparing PE IP addresses (lower IP wins).
Forwarding path for all downstream traffic to that Ethernet Segment.
Non-Designated Forwarder (Non-DF)
Blocks forwarding of traffic to the multi-homed site.
Still forwards traffic from the site into the provider network.
Becomes DF if the current DF fails (fast failover).
Mistake
VPLS and EVPN are the same thing because both provide multipoint Layer 2 connectivity.
Correct
VPLS uses a full mesh of pseudowires between all PEs, while EVPN uses a MP-BGP control plane to advertise MAC addresses. EVPN does not require a full mesh, supports efficient dual-homing, and scales better.
Both technologies achieve the same surface-level result (multipoint L2), so beginners assume the mechanics are identical. The exam tests the architectural difference.
Mistake
EVPN requires a separate Spanning Tree Protocol instance to prevent loops in multi-homed topologies.
Correct
EVPN prevents loops using the Designated Forwarder (DF) election process based on Ethernet Segment Identifiers. No Spanning Tree is needed because the control plane coordinates who forwards.
Traditional Ethernet switches rely on STP to block redundant paths. Beginners naturally assume the same loop-prevention logic applies to EVPN, but EVPN's control plane replaces that.
Mistake
Route Distinguisher (RD) is used to control which PEs participate in a VPN.
Correct
RD uniquely identifies a route within a VPN but does not control participation. Route Target (RT) determines which PEs import and export routes. RD is just for uniqueness.
The terms sound similar ('Distinguisher' vs 'Target'), so candidates confuse their functions. The exam deliberately uses RD in a distractor role.
Mistake
In EVPN, a single PE can be the Designated Forwarder for all Ethernet Segments in an EVPN instance.
Correct
DF election happens per Ethernet Segment. A PE might be DF for Segment A and non-DF for Segment B in the same EVPN instance, depending on IP address comparisons.
Candidates think DF is a global role for the entire PE, but it is per-Ethernet Segment. This misunderstanding comes from oversimplified explanations.
Mistake
MP-BGP in EVPN is only used to exchange MAC addresses between PEs.
Correct
MP-BGP in EVPN exchanges multiple route types: MAC/IP routes (Type 2), multicast routes (Type 3), Ethernet segment routes (Type 4), and auto-discovery routes (Type 1). It is a full control plane.
MAC address exchange is the most visible feature, so beginners assume that is the only purpose. The exam tests knowledge of all route types.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
L2VPN (Layer 2 VPN) extends a Layer 2 network across a provider backbone — customer devices see each other as if on the same Ethernet segment. L3VPN (Layer 3 VPN) connects IP networks at Layer 3; customer devices route between sites using IP addresses, not MAC addresses.
Yes. EVPN is a major topic in the exam objectives. You need to understand how it differs from VPLS, the EVPN route types, and how it handles multi-homing with DF election.
A pseudowire is a virtual circuit that emulates a point-to-point connection (like a physical cable) over a packet-switched network. It carries Layer 2 frames (Ethernet, PPP, etc.) across an MPLS or IP backbone.
EVPN does not require a full mesh of pseudowires, so it is easier to configure and scales to hundreds of sites. It also supports efficient dual-homing without Spanning Tree, faster failover (sub-100ms), and integrated routing and bridging (IRB).
Split horizon in VPLS means that a PE router will not forward a broadcast, unknown unicast, or multicast (BUM) frame back out the same pseudowire it received it from. This prevents loops in the VPLS full mesh.
The Ethernet Segment Identifier (ESI) uniquely identifies a group of physical links connecting a single customer site to one or more PEs. It allows EVPN to treat those links as a single logical segment and coordinate DF election, preventing loops.
You've finished Service Provider Services: L2VPN and EVPN. Continue through the 350-501 study guide to build a complete picture of the exam.
Done with this chapter?