EVPN First Hop Security#

Ali Sajassi, Lukas Krattiger, Krishna Ananthamurthy (Cisco), Jorge Rabadan (Nokia), Wen Lin (Juniper).

• Why: First Hop Security functions (DHCP snooping, DAI, ND Inspection, Source Guard) depend on a local DHCP snoop binding database — which silently breaks in EVPN fabrics where hosts move and multi-home across PEs, causing legitimate traffic to be dropped or spoofed traffic to pass.
• What: A WG-adopted BESS draft defining a new EVPN BGP route to distribute and synchronize DHCP snooping bindings (IPv4/IPv6-to-MAC, binding state, lease/create time) among all PEs in an EVI, covering host mobility, multi-homing, and distributed IRB.
• How: Straightforward BGP route distribution with binding attributes; major technical issues are resolved and the authors consider the document ready for Working Group Last Call.
• Where applicable: Any EVPN datacenter or campus fabric running FHS — broadly applicable, multi-vendor co-authored, and the most mature item in the DC-security space at this meeting.