Spine-Leaf EVPN-VXLAN Fabric Design

April 15, 2026·3 min read·439 words

EVPN-VXLAN has become the de facto standard for modern data centers with spine-leaf architectures. It combines BGP EVPN (control plane) and VXLAN (data plane) to overcome the limitations of STP/HSRP. This comprehensive design guide covers topology, symmetric vs asymmetric IRB selection, multi-homing, and multi-site deployments.

Spine-leaf architecture

Spine: high-density 100G/400G switches (e.g., Cisco Nexus 9300-GX, Juniper QFX5130)
Leaf: switches with 25G server ports and 100G uplinks (e.g., Nexus 93180YC-FX, QFX5120-48Y)
Spine-leaf links: full-mesh ECMP
No spine-to-spine links and no leaf-to-leaf links
Scale: N spines × M leaves = 1:N oversubscription (e.g., 4 spines × 32 leaves = 8:1 oversubscription)

Underlay routing

eBGP underlay

The most common choice. Each leaf has a unique private AS, while the spines share an AS. eBGP multihop peering runs between loopbacks. It is simple, scales well, and is easy to automate.

OSPF/IS-IS underlay

The traditional alternative. OSPF area 0 spans the entire fabric, with aggressive BFD timers (50/150ms). It is less scalable than eBGP beyond 50 switches.

BGP EVPN overlay

iBGP EVPN: spines = route reflectors, leaves = RR clients
eBGP EVPN: possible, but more complex
The l2vpn evpn address family is enabled
Route targets (RTs) provide multi-tenant isolation

Symmetric vs Asymmetric IRB

Symmetric IRB (recommended)

Each leaf performs local routing for all subnets. Inter-subnet traffic is forwarded through an L3 transit VNI. It scales better and requires fewer routes per leaf.

Asymmetric IRB

The source leaf routes, while the destination leaf bridges. This requires every VNI on every leaf and does not scale beyond 10-15 VNIs.

Multi-homing (ESI LAG)

EVPN Ethernet Segment Identifier (ESI) for multi-homed servers
Type-4 routes for auto-discovery
Type-1 routes for per-ES auto-discovery
Per-flow load balancing (hashing) or active/active MAC forwarding
A more flexible alternative to vPC (Cisco) or MLAG

Multi-site EVPN

For DC1 + DC2 interconnection:

Border leaves (or border gateways) at each DC
EVPN multi-site: inter-DC RT import/export
DCI (Data Center Interconnect): dark fiber, MPLS, Internet IPsec
Global anycast gateway: out of scope without VPC-LACP (Cisco) or MH-EVPN (Juniper)

Fabric sizing

Small (50 racks)

2× QFX5120-32C spine switches
10× QFX5120-48Y leaf switches (48×25G server ports)
Budget: ~€280,000 excluding tax
Capacity: 480 25G servers

Medium (200 racks)

4× QFX5200-32C spine switches
40× leaf switches
Budget: ~€1.2M excluding tax

Large (>500 racks, super-spine)

5-stage architecture: super-spine + spine + leaf
Pod-based design
Budget: €5-15M excluding tax

Alternatives

Cisco ACI: intent-based networking + GUI; APIC controllers required
VMware NSX: hypervisor overlay, not a hardware fabric
Juniper Apstra: multi-vendor automation for EVPN-VXLAN fabrics

Order from OPTINOC

Turnkey spine-leaf EVPN-VXLAN fabric. Cisco Nexus, Juniper QFX, and Arista. Compatible 100G/400G transceivers offering 50% savings. Quotes for data centers with 20-500 racks within 48 hours.