EVPN-VXLAN Data Center Fabric: Design Guide 2026

EVPN-VXLAN has become the standard for enterprise and hyperscaler data centers, replacing spanning-tree-based designs and aging DCI technologies like OTV, which reaches end-of-support in April 2026. This guide covers the full stack of modern fabric design: leaf-spine Clos topology with an eBGP underlay, the critical choice between symmetric and asymmetric IRB, native multi-tenancy through VRFs and route targets, multi-site DCI, and the interoperability gotchas when mixing Arista, Cisco, Juniper and Nokia. Use it as a decision framework before you touch a single CLI.

Leaf-Spine Fabric Design Principles

Every EVPN-VXLAN fabric is built on a Clos topology: every leaf connects to every spine, with no leaf-to-leaf or spine-to-spine links. ECMP provides equal-cost paths between any two leaves — typically 2-16 spines. Production sizing ranges from small fabrics (4-16 leaves, 2 spines) to hyperscale (256+ leaves, 16-32 spines). The underlay is almost always eBGP IPv4 per RFC 7938 because it scales beyond any IGP and terminates ECMP at the leaf.

Asymmetric vs Symmetric IRB

Asymmetric IRB runs an SVI for every tenant VLAN on every leaf and routes on the ingress leaf using only EVPN Type-2 routes — simpler, but it does not scale past roughly 10-15 tenants. Symmetric IRB adds a dedicated L3 VNI per tenant; ingress and egress leaves each do their half of the bridging while routing happens across the L3 VNI, using both Type-2 and Type-5 routes. Rule of thumb: symmetric IRB for most new designs, asymmetric only for small, simple environments.

Multi-Tenancy: The Killer Feature

Isolation is enforced in the control plane via VRF-to-L3-VNI mapping and route targets:

Tenant A:
  Route-Target: 100:100
  L3 VNI: 50100
  VLANs: VNI 10101, VNI 10102

Tenant B:
  Route-Target: 200:200
  L3 VNI: 50200
  VLANs: VNI 10201, VNI 10202

There is no way for Tenant A broadcast to reach Tenant B switches — compare that with VLAN-based isolation where one misconfigured trunk breaks the boundary instantly.

Multi-Site DCI and Interoperability

EVPN Multi-Site lets each data center run its own fabric independently, with border gateways re-originating EVPN routes and BUM suppression preventing cross-site flooding. In practice, the interoperability gotchas are almost always route-target auto-derivation (each vendor picks different defaults), ESI handling in multi-homing, and BUM replication tree selection (ingress replication vs multicast). For AI clusters, add PFC and ECN for lossless RoCEv2 plus entropy-based ECMP hashing.

Continue with EVPN MAC-VRF validation on ACX7000, the Arista MLAG run book, and SONiC troubleshooting.

原文链接：https://netpilot.io/blog/evpn-vxlan-data-center-guide