EVPN-VXLAN fabrics for 400G and 800G data centers

An EVPN-VXLAN leaf-spine data center fabric is a scale-out network that grows by adding switches. Every leaf is a VXLAN tunnel endpoint, BGP carries the underlay between leaf and spine, and EVPN advertises MAC and IP host routes, as well as IP prefixes, so the fabric learns reachability in the control plane instead of by flood and learn. IP Infusion delivers it as one system: the switch, OcNOS-DC pre-loaded, and one support contract, with a distributed anycast gateway, EVPN multihoming, and multi-tenant VRF isolation.

Each tenant gets its own set of VXLAN network identifiers (VNIs): Layer 2 VNIs carry bridged traffic and Layer 3 VNIs carry routed traffic inside a per-tenant VRF. Because traffic is encapsulated per VNI and routed inside a VRF, one tenant cannot see another tenant on the shared fabric. Where two tenants need to reach each other, inter-VRF route leaking over EVPN-VXLAN passes only the specific prefixes you permit, so isolation stays the default and sharing is explicit. Support for routed tenants varies by switch model; check each platform in the OcNOS Feature Matrix.

EVPN multihoming lets a server attach to two or more leaves on one Ethernet segment (ESI), in single-active or port-active mode, so if a leaf or link fails the server's traffic moves to the other leaf. It is signaled entirely in the EVPN control plane, so there is no dedicated peer-link and no proprietary pairing between the leaves. MLAG, by contrast, pairs exactly two switches over a peer-link and runs active-active. OcNOS-DC supports both, so a design that needs both links forwarding at once can use MLAG.

The border leaf in each fabric connects the two fabrics at Layer 3 with the EVPN Layer 3 gateway and VXLAN Layer 3 stitching, and each fabric advertises its tenant IP prefixes to the other as EVPN IP-prefix routes, with per-tenant VRF isolation kept across the sites. For the transport, a 400G OpenZR+ coherent optic in the port of a ZR+ capable switch lights the wavelength directly, so there is no separate transponder. For the optics deep dive, see the routed-optical solution, and for the coherent reach math see the coherent DCI technology page.

Yes. OcNOS-DC runs what an EVPN-VXLAN leaf-spine fabric needs on merchant-silicon switches: EVPN-VXLAN with a distributed anycast gateway, EVPN multihoming, a BGP-unnumbered underlay, multi-tenant VNIs, and ZTP with gNMI and NETCONF for operations. Madeo Consultant replaced its incumbent switches with OcNOS on Edgecore and UfiSpace. IP Infusion delivers the switch, the software, and the support as one system under one contract, so you can source hardware from more than one vendor and refresh the switch and the software on their own cycles. Support varies by switch model.

A new switch boots and pulls its configuration through Zero Touch Provisioning, so a switch goes from the box to a production leaf without a console session. From there the fabric is operated with streaming telemetry over gNMI, NETCONF and OpenConfig models, and Ansible, and the same models let you push and verify EVPN and VXLAN state as code. IP Infusion ships the switch with OcNOS-DC preloaded and a Day 0 baseline, so every leaf and spine starts from a known configuration.