VXLAN / EVPN
VXLAN / EVPN
Modern DC Fabric
1. Why VXLAN?2. Why EVPN as the Control Plane?3. The Standard Fabric: Spine-Leaf4. Gateway Models5. NX-OS Configuration Skeleton6. Verification Commands7. Where You Meet It
1. Why VXLAN?
Classic VLANs top out at 4094 IDs and require stretching L2 (STP, broadcast storms) across the DC. VXLAN encapsulates L2 frames in UDP/IP, giving 16 million segment IDs (VNIs) over a routed L3 underlay — scale without spanning tree.
| Term | Meaning |
|---|---|
| VNI | VXLAN Network Identifier — 24-bit segment ID (the "VLAN" of VXLAN) |
| VTEP | VXLAN Tunnel Endpoint — encapsulates/decapsulates (switch or hypervisor) |
| Underlay | Plain routed IP fabric (OSPF/IS-IS + ECMP) carrying VXLAN packets |
| Overlay | The virtual L2/L3 segments running on top |
| UDP 4789 | Standard VXLAN destination port |
2. Why EVPN as the Control Plane?
- •Original VXLAN used flood-and-learn — BUM traffic everywhere, slow, fragile
- •EVPN (BGP address family l2vpn evpn) advertises MAC/IP reachability instead
- •VTEPs learn remote MACs from BGP, not flooding
- •Adds ARP suppression, multihoming, MAC mobility
- •Same protocol engineers already run — it is just BGP
| EVPN Route Type | Carries |
|---|---|
| Type 2 | MAC/IP advertisement (host routes) |
| Type 3 | IMET — BUM traffic replication |
| Type 5 | IP prefix routes (inter-subnet, external) |
3. The Standard Fabric: Spine-Leaf
spine1 spine2
/ \ / \
leaf1 leaf2 leaf3 leaf4 <- VTEPs
| | | |
hosts hosts hosts hosts
Underlay: eBGP or OSPF, ECMP everywhere
Overlay: iBGP EVPN, spines as route reflectors- •Every leaf is equidistant (2 hops) from every other leaf
- •Add bandwidth by adding spines; add ports by adding leaves
- •No STP — all links forwarding via L3 ECMP
- •Hosts/VMs attach to leaves; VNIs stretch wherever needed
4. Gateway Models
| Model | How it works |
|---|---|
| Centralized | One pair of border leaves routes between VNIs — simple, bottleneck |
| Distributed Anycast GW | Every leaf hosts the same gateway MAC/IP — routing at first hop, standard today |
| Symmetric IRB | Both ingress and egress leaf route via a transit L3VNI (most common) |
| Asymmetric IRB | Ingress leaf routes directly to destination VNI — needs all VNIs everywhere |
5. NX-OS Configuration Skeleton
Leaf essentials (Cisco Nexus)
feature nv overlay
feature vn-segment-vlan-based
nv overlay evpn
vlan 100
vn-segment 10100
interface nve1
source-interface loopback1
host-reachability protocol bgp
member vni 10100
ingress-replication protocol bgp
router bgp 65001
address-family l2vpn evpn
neighbor 10.0.0.1 remote-as 65000
address-family l2vpn evpn
send-community extended6. Verification Commands
| Command (NX-OS) | Shows |
|---|---|
| show nve peers | Remote VTEPs discovered |
| show nve vni | VNI status and mode |
| show bgp l2vpn evpn | EVPN routes (Type 2/3/5) |
| show l2route evpn mac all | MACs learned via EVPN vs local |
| show ip arp suppression-cache | ARP suppression entries |
7. Where You Meet It
- •Cisco ACI — VXLAN/EVPN under the hood, APIC abstracts it
- •NSX, OVN — hypervisor VTEPs, same encapsulation
- •EVPN also runs DC interconnect and is replacing MPLS L2VPN in some WANs
- •Interview staple: "walk me through a packet from host A on leaf1 to host B on leaf3"
That packet walk
Host A ARPs → leaf1 suppresses/answers from EVPN cache → frame hits leaf1, encapped in VXLAN (VNI + leaf3 VTEP IP) → routed over spine via ECMP → leaf3 decaps → delivers to host B. Return traffic mirrors it.