VXLAN: Data Center Deployment
VXLAN (Virtual Extensible LAN) is the standard overlay protocol for extending L2 over L3, expanding beyond the 4094 traditional VLAN limit to 16M VNIs. It is deployed in all modern data centers and increasingly across campus networks. Complete guide to VXLAN deployment in 2026: underlay, BGP EVPN, and multicast vs ingress replication.
VXLAN vs traditional VLANs
- 802.1Q VLAN: 12 bits = 4094 VLANs max, L2 only, limited to one broadcast domain
- VXLAN: 24 bits = 16M VNIs, encapsulated in UDP/IP and routable across L3
- MTU: VXLAN overhead = 50 bytes (8 VXLAN + 20 IP + 8 UDP + 14 MAC)
- Recommended underlay MTU: 9000 bytes (jumbo) to prevent fragmentation
Underlay network
- Routed L3 connectivity between all VTEPs (leaf switches)
- Common protocols: OSPF, IS-IS, eBGP
- ECMP (Equal-Cost Multi-Path) is required to use all spine-leaf links
- BFD is recommended for fast convergence (<50ms)
VXLAN control planes
Flood & Learn (deprecated)
With no control plane, all VTEPs flood ARP traffic. It does not scale beyond a few dozen VTEPs and should no longer be used.
BGP EVPN (current standard)
MP-BGP with the l2vpn evpn address family distributes:
- Type-2: MAC and optionally IP (ARP broadcast suppression)
- Type-3: multicast routes (for BUM traffic)
- Type-5: IP prefix routes (inter-VNI routing)
- Type-4: ESI auto-discovery (multi-homing)
BUM traffic handling
Ingress replication (IR)
Each source VTEP replicates BUM traffic to all VTEPs belonging to the VNI. It is simple and requires no multicast, but places additional load on the source VTEP.
Multicast underlay
PIM Sparse Mode with one multicast group per VNI. It is more efficient at scale but introduces PIM/RP complexity and is rarely deployed in practice.
Cisco Nexus configuration (example)
- feature nv overlay
- feature vn-segment-vlan-based
- feature bgp
- feature interface-vlan
- interface nve1 ; source-interface loopback0 ; host-reachability protocol bgp ; member vni 10010 associate-vrf ingress-replication protocol bgp
- vlan 10 ; vn-segment 10010
- router bgp 65001 ; neighbor 10.0.0.2 remote-as 65001 ; address-family l2vpn evpn ; send-community extended
Juniper configuration (EVPN-VXLAN)
- set protocols evpn encapsulation vxlan
- set protocols evpn extended-vni-list all
- set routing-instances EVPN-VRF instance-type mac-vrf
- set routing-instances EVPN-VRF vtep-source-interface lo0.0
- set routing-instances EVPN-VRF vni-list 10010
Anycast gateway
Each VTEP acts as the gateway for the VNI using the same IP+MAC. This allows VMs to migrate (vMotion) without losing connectivity. Implementation:
VXLAN troubleshooting
- show nve peers (Cisco): view active VTEP peers
- show bgp l2vpn evpn summary: check BGP EVPN status
- show mac address-table dynamic vni 10010: check MAC learning
- ping with MTU 8950 (without fragmentation) to validate the underlay MTU
- tcpdump -i eth0 'udp port 4789': capture VXLAN traffic
Order from OPTINOC
Turnkey VXLAN EVPN fabric configuration for Cisco Nexus, Juniper QFX, and Arista 7050. Design and automation via Apstra/NSX-T/ACI. Quote for data centers with 20-500 switches within 48 hours.