VXLAN with MP-BGP EVPN Control Plane: Design and Configuration

Original RFC 7348 VXLAN relies on multicast-based flood-and-learn: VTEPs discover each other from data traffic, and unknown hosts are flooded across the overlay. That works at small scale but struggles with scalability, and it forces multicast into the underlay. MP-BGP EVPN replaces this model with a standards-based control plane that distributes host MAC and IP reachability like any other BGP route. This article explains the architecture shift and walks through the Nexus 9000 configuration steps from Cisco's design guide.

What MP-BGP EVPN Changes

• Control-plane learning — host MAC/IP routes are advertised over BGP instead of learned by flooding, minimizing overlay broadcast.
• VTEP discovery and authentication — VTEPs learn each other through BGP and only accept VXLAN traffic from learned peers, blocking rogue VTEPs.
• Integrated bridging and routing — the EVPN address family carries both L2 (MAC) and L3 (IP) reachability, enabling symmetric IRB.
• ARP suppression — local VTEPs answer ARP on behalf of remote hosts from a suppression cache, cutting ARP flooding dramatically.

Key Constructs: VNI, RD, RT

EVPN uses route distinguishers (RDs) to keep identical routes unique across VRFs and route targets (RTs) to control import/export. On all-Cisco Nexus fabrics, NX-OS can auto-generate RD and RT values; in multi-vendor deployments, configure them manually for consistency.

Configuration Steps on Nexus 9000

1. Configure the tenant VRF and a Layer-3 VNI per VRF.
2. Map VLANs to Layer-2 VNIs and define their EVPN parameters.
3. Configure SVIs with the distributed anycast gateway (same virtual MAC + IP on every VTEP in the VNI).
4. Create the VXLAN tunnel interface and associate L2/L3 VNIs:

interface nve1
  source-interface loopback0
  member vni 20010
    ingress-replication protocol bgp
  member vni 20000
    mcast-group 239.1.1.1

5. Configure BGP with the L2VPN EVPN address family:

router bgp 65001
  router-id 10.0.0.1
  neighbor 10.0.0.2 remote-as 65001
    address-family l2vpn evpn
      send-community extended
  address-family l2vpn evpn

Design Options

MP-iBGP EVPN commonly uses route reflectors on the spine; MP-eBGP EVPN peers each leaf in its own AS with the spine preserving next-hop and RT attributes. Border leaves connect the fabric to external networks, redistributing tenant routes and advertising public subnets out — usually as summarized prefixes rather than /32 host routes.

Continue with Cisco EVPN/VXLAN Multisite 排障 for EVPN/VXLAN fault isolation and EVPN 数据中心 BGP 设计 for BGP design choices in EVPN fabrics.

原文链接：https://www.cisco.com/c/en/us/products/collateral/switches/nexus-9000-series-switches/guide-c07-734107.html