Secure EVPN — draft-ietf-bess-secure-evpn#
IETF 122 (Bangkok) digest Program Core pick Bangkok · 15–21 March 2025
- Tier: Core
- Why: EVPN underpins most modern DC and DCI fabrics; today, encrypting it usually means bolting on separate IPsec. A native security story for EVPN closes a real gap for anyone running encrypted fabric or DCI.
- What: A WG-adopted BESS draft presenting a solution where BGP point-to-multipoint signaling is leveraged for key and policy exchange among PE devices, creating private pairwise IPsec Security Associations without IKEv2 point-to-point signaling or direct peer-to-peer session establishment. (from abstract only)
- How: Reuses EVPN's existing BGP control plane to distribute IPsec keying material, avoiding a separate IKEv2 signaling mesh between every PE pair.
- Where applicable: DC, Service Provider, and Enterprise fabric overlays and DCI needing tenant-traffic confidentiality/integrity comparable to IPsec, without per-peer IKEv2 sessions.