EVPN Type-2 routes and dynamic VTEPs correct, but VXLAN FDB remote-ip stays 0.0.0.0 with learning=no (7.25rc1 / 7.26beta3)

[one]

Hello,

I’m running a hub-and-spoke EVPN/VXLAN overlay (iBGP with route reflector on the hub) and have hit a consistent problem with FDB programming.

Environment

• RouterOS 7.25rc1 (hub and most spokes) and 7.26beta3 (one spoke tested)
• Hub: RB4011, spokes: RB3011 / RB5009
• Underlay: loopbacks (10.0.127.0/24) reachable via IPSec
• Overlay: multiple VNIs, learning=no on EVPN VXLAN interfaces
• Same AS (65000), hub as ibgp-rr, nexthop-choice left at default (propagate)

What works

• BGP sessions Established with AFI=evpn
• Type-2 (macip) and Type-3 (imet) routes present with correct next-hop (remote loopback)
• Dynamic VTEPs created (D flag) with the correct remote loopbacks
  (the dont-fragment=disabled toggle helps force them on multi-VNI setups)
• With learning=yes, the FDB populates with real remote IPs via data-plane learning

What fails
When learning=no (the recommended setting for EVPN), the FDB shows the MACs but with remote-ip=0.0.0.0.

Example (after routes and dynamic VTEPs are already correct):

/interface vxlan fdb print where interface=vni-118
INTERFACE  REMOTE-IP   MAC-ADDRESS
vni-118    0.0.0.0     00:04:A3:01:A3:FA
vni-118    0.0.0.0     00:04:A3:01:A7:F6

The same MACs exist in the EVPN route table with the proper gateway, and the corresponding dynamic VTEPs exist, but the FDB never receives the remote IP from the control plane.

What I already checked

• RT import/export match per VNI (65000:)
• RD unique per device (loopback:VNI)
• Routes actually exchanged (confirmed on hub and spokes)
• Dynamic VTEPs present
• Tried 7.26beta3 (which fixed “MAC-IP route origination and withdrawal”) — FDB behavior unchanged
• Single-VNI vs multi-VNI — problem persists

Question
Is this a known limitation / bug in the Type-2 → VXLAN FDB installation path on current 7.25/7.26 versions?

Is there a workaround besides leaving learning=yes?

I can provide full configs, route dumps, vteps, and fdb outputs if useful. Happy to open a support ticket as well.

Thanks!

[BartoszP]

@one

I can provide full configs, route dumps, vteps, and fdb outputs if useful. Happy to open a support ticket as well.

Welcome on the forum

Start with post #5 from

Forum rules

Hello and welcome to the Mikrotik forum For all new users that uses RouterOS for the first time and have some questions regarding their config here is short tutorial on how to access RouterOS configuration using "WinBox" and how to export their configuration and posting it properly in their topic. So after you unpack your new device and connect it to the power supply you need to connect it to the PC. Be careful when connecting because to access your new router you need to use one of…

as AI used to prepare your post does not accpets the fact that config is a "must have" to get proper answer as otherwise usually these who want to help have to guess where the problem is.

[one]

Sorry for my ignorance
I've recreated simplified setup using CHR and VMware Workstation
Here is hub's configuration:

/interface bridge
add name=br-evpn protocol-mode=none pvid=100 vlan-filtering=yes
/interface ethernet
set [ find default-name=ether1 ] disable-running-check=no name=ether2
set [ find default-name=ether2 ] disable-running-check=no name=ether3
set [ find default-name=ether3 ] disable-running-check=no name=ether4
/interface vxlan
add bridge=br-evpn bridge-pvid=100 comment="VLAN100 (NET_MGMT)" dont-fragment=disabled learning=no local-address=10.13.127.1 mac-address=06:1D:71:FC:96:C3 name=vni-100 vni=10100
/interface vlan
add comment=NET_MGMT interface=br-evpn name=vlan100 vlan-id=100
/routing bgp instance
add as=65000 cluster-id=10.13.127.1 disabled=no name=evpn-vxlan router-id=10.13.127.1
/routing bgp template
set default disabled=yes
add afi=evpn as=65000 disabled=no multihop=yes name=evpn-vxlan
/interface bridge port
add bridge=br-evpn interface=ether4 pvid=100
/ipv6 settings
set disable-ipv6=yes
/ip address
add address=10.13.127.1 interface=lo network=10.13.127.1
add address=10.13.127.101/27 interface=ether2 network=10.13.127.96
add address=10.13.0.1/24 interface=vlan100 network=10.13.0.0
/ip route
add disabled=no dst-address=10.13.127.11/32 gateway=10.13.127.111 routing-table=main
/ip service
set ftp disabled=yes
set telnet disabled=yes
set www disabled=yes
set reverse-proxy disabled=yes
set api disabled=yes
set api-ssl disabled=yes
/routing bgp connection
add afi=evpn as=65000 disabled=no instance=evpn-vxlan listen=yes local.address=10.13.127.1 .role=ibgp-rr multihop=yes name=evpn-spoke remote.address=10.13.127.0/27 routing-table=
main templates=evpn-vxlan
/routing bgp evpn
add export.route-targets=65000:10100 import.route-targets=65000:10100 instance=evpn-vxlan name=evpn-100 rd=10.13.127.1:10100 vni=10100
/system identity
set name=HUB
/tool bandwidth-server
set enabled=no

And here is spoke:

/interface bridge
add name=br-evpn protocol-mode=none pvid=100 vlan-filtering=yes
/interface ethernet
set [ find default-name=ether1 ] disable-running-check=no name=ether2
set [ find default-name=ether2 ] disable-running-check=no name=ether3
/interface vxlan
add bridge=br-evpn bridge-pvid=100 comment="VLAN100 (NET_MGMT)" dont-fragment=disabled learning=no local-address=10.13.127.11 mac-address=1A:25:C0:70:FE:18 name=vni-100 vni=10100
/interface vlan
add comment=NET_MGMT interface=br-evpn name=vlan100 vlan-id=100
/routing bgp instance
add as=65000 disabled=no name=evpn-vxlan router-id=10.13.127.11
/routing bgp template
set default disabled=yes
add afi=evpn as=65000 disabled=no multihop=yes name=evpn-vxlan
/ipv6 settings
set disable-ipv6=yes
/ip address
add address=10.13.127.11 interface=lo network=10.13.127.11
add address=10.13.127.111/27 interface=ether2 network=10.13.127.96
add address=10.13.0.11/24 interface=vlan100 network=10.13.0.0
/ip dhcp-client
add disabled=yes interface=*2 name=client1
/ip route
add disabled=no dst-address=10.13.127.0/27 gateway=10.13.127.101 routing-table=main
/routing bgp connection
add afi=evpn as=65000 disabled=no instance=evpn-vxlan local.role=ibgp multihop=yes name=evpn-hub remote.address=10.13.127.1/32 routing-table=main templates=evpn-vxlan
/routing bgp evpn
add export.route-targets=65000:10100 import.route-targets=65000:10100 instance=evpn-vxlan name=evpn-100 rd=10.13.127.11:10100 vni=10100
/system identity
set name=SPOKE-1

Here is fdb output from spoke

/interface/vxlan/fdb/print
Columns: INTERFACE, REMOTE-IP, MAC-ADDRESS
#  INTERFACE  REMOTE-IP  MAC-ADDRESS      
0  vni-100    0.0.0.0    00:0C:29:31:BA:A

/interface/vxlan/fdb> /routing/bgp/session/print 
Flags: E - ESTABLISHED
0  E name="evpn-hub-1" instance=evpn-vxlan remote.address=10.13.127.1 .as=65000 .id=10.13.127.1 .capabilities=mp,rr,enhe,gr,as4 .afi=evpn .messages=11 .bytes=380 .eor="" local.role=ibgp
     .address=10.13.127.11 .as=65000 .id=10.13.127.11 .cluster-id=10.13.127.11 .capabilities=mp,rr,enhe,gr,as4 .afi=evpn .messages=10 .bytes=274 .eor="" output.procid=20 input.procid=20
     ibgp multihop=yes hold-time=3m keepalive-time=1m uptime=8m9s710ms last-started=2026-10-23 17:14:56 prefix-count=2

/routing/route/print
Flags: A - ACTIVE; c - CONNECT, s - STATIC, b - BGP, e - EVPN
Columns: DST-ADDRESS, GATEWAY, AFI, ROUTING-TABLE, DISTANCE, SCOPE, TARGET-SCOPE, IMMEDIATE-GW
   DST-ADDRESS                                   GATEWAY        AFI   ROUTING-TABLE  DISTANCE  SCOPE  TARGET-SCOPE  IMMEDIATE-GW        
Ac 10.13.0.0/24                                  vlan100        ip    main                  0     10             5  vlan100             
As 10.13.127.0/27                                10.13.127.101  ip    main                  1     30            10  10.13.127.101%ether2
Ac 10.13.127.11/32                               lo             ip    main                  0     10             5  lo                  
Ac 10.13.127.96/27                               ether2         ip    main                  0     10             5  ether2              
A  lo                                                           link  main                  0                                           
A  ether2                                                       link  main                  0                                           
A  ether3                                                       link  main                  0                                           
A  br-evpn                                                      link  main                  0                                           
A  vni-100                                                      link  main                  0                                           
A  vlan100                                                      link  main                  0                                           
Ab [10.13.127.1:10100]macip:0|00:0C:29:31:BA:AE  10.13.127.1    evpn                      200     40            30  10.13.127.101%ether2
Ab [10.13.127.1:10100]imet:0|10.13.127.1         10.13.127.1    evpn                      200     40            30  10.13.127.101%ether2
 e [10.13.127.11:10100]imet:0|10.13.127.11       10.13.127.11   evpn                      200     40            10                      

The main problem with 0.0.0.0 in fdb is that all trafic become unknown unicast and flooding entire EVPN fabric
This is a brief example. In my production i have hub and 6 spokes, and having a lot of unnecessary traffic combined with IPSEC realy hurts

[Larsa]

Your lab might have a VLAN problem that could hide the real issue here. vlan100 sits on br-evpn but the bridge has pvid=100 and br-evpn isn't tagged for VLAN 100 in the bridge VLAN table, so as far as I can tell vlan100 won't see any traffic. Just for testing you could temporarily put the IP straight on br-evpn and drop vlan100 like the manual EVPN example does, and then sniff the underlay to check whether it really floods.

As for the 0.0.0.0 entries I'm not aware of anything saying received Type-2 routes are supposed to program the VXLAN FDB, so it might just as well be a missing feature as a bug. It could be worth trying 7.24.5 to see if it behaved differently before 7.25 and also sending a supout to support asking exactly that. Until then learning=yes looks like the only workaround I know of.