L2VPN Overlay · RFC 7432 / 7348

EVPN over VXLAN

Ethernet VPN (RFC 7432) running on a VXLAN data plane (RFC 7348): the current standard for multi-tenant DC fabric overlays, DCI, and large-scale L2VPN on open hardware.

EVPN-VXLAN Fabric

A two-spine, three-leaf fabric with VXLAN tunnels between leaf VTEPs. The right-most leaf pair is bonded into one ESI for all-active multi-homing to a dual-attached CE.

EVPN-VXLAN fabric topology with two spines, three leaves, VXLAN tunnels, and an ESI-multihomed customer edge
EVPN-VXLAN: two-spine, three-leaf fabric with VXLAN tunnels and ESI multi-homing on the CE.

What EVPN-VXLAN Is

EVPN (RFC 7432) is a BGP address family (L2VPN EVPN, AFI 25, SAFI 70) that carries MAC and IP reachability information using a set of route types. Originally designed for MPLS transport, EVPN was extended to VXLAN in RFC 8365, making it the dominant control plane for modern DC fabric overlays.

VXLAN (RFC 7348) encapsulates L2 frames in a UDP/IP header, enabling L2 domain extension across L3 infrastructure. VTEPs (VXLAN Tunnel End Points) originate and terminate encapsulation. With EVPN as the control plane, VTEP discovery and MAC distribution are handled through BGP rather than data-plane flooding, eliminating the scale issues of legacy VXLAN deployments.

EVPN Type-2 routes carry MAC/IP bindings for host reachability within a VNI. Type-5 routes carry IP prefixes for inter-subnet and external routing: this is the key mechanism for data center interconnect (DCI) across VXLAN domains, defined in RFC 9136.

EVPN Route Types

EVPN carries reachability in a small set of BGP route types that a fabric uses together: host routes locate endpoints, the multicast route builds the flood list, and the prefix route handles Layer 3.

  • Type-1, Ethernet Auto-Discovery: announces an Ethernet Segment and enables fast convergence and aliasing for all-active multi-homing (RFC 7432).
  • Type-2, MAC/IP Advertisement: carries host MAC and IP bindings so the fabric learns endpoints through BGP instead of flooding.
  • Type-3, Inclusive Multicast Ethernet Tag (IMET): advertises a VTEP interest in a broadcast domain and builds the per-EVI flood list for broadcast, unknown-unicast, and multicast traffic.
  • Type-4, Ethernet Segment: discovers the PEs that share an Ethernet Segment and drives Designated Forwarder election so BUM traffic is never duplicated.
  • Type-5, IP Prefix: advertises IP prefixes for inter-subnet routing and data center interconnect, the basis of EVPN L3VPN (RFC 9136).

OcNOS advertises Type-2, Type-3, Type-4, and Type-5 routes, with selective multi-homing per EVI and per-VNI route-target policy.

Multi-homing and IRB

EVPN All-Active multi-homing (RFC 7432 §8) allows a CE device to connect to multiple PEs simultaneously with load sharing. Designated Forwarder (DF) election prevents BUM traffic duplication. Integrated Routing and Bridging (IRB) on the leaf nodes enables L3 gateway functionality at the access layer: traffic is routed locally at the first-hop VTEP, eliminating unnecessary hairpinning through a central gateway.

OcNOS Implementation

OcNOS-DC implements EVPN-VXLAN on Broadcom Trident 3 and Trident 4 platforms. OcNOS-SP adds EVPN over MPLS and DCI on Qumran2c and Jericho2c+ hardware.

EVPN Route Types

Type-2 (MAC/IP), Type-3 (Inclusive Multicast), Type-4 (ES), Type-5 (IP Prefix). Selective multi-homing per EVI. Per-VNI route target import/export policy.

Multi-homing

All-Active and Single-Active multi-homing. LACP-based ESI auto-derivation. DF election per RFC 8584. Mass withdrawal on upstream failure.

IRB / Anycast GW

Symmetric IRB (RFC 9135). Distributed anycast gateway: same MAC/IP on all leaf VTEPs. GARP suppression. ARP/ND proxy at the leaf.

VXLAN Data Plane

Hardware-offloaded VTEP encap/decap. Inner L2 and L3 lookup at line rate. ECMP across multiple VTEPs. UDP source port entropy for spine load distribution.

DCI: Type-5

RFC 9136 Type-5 IP prefix routes for inter-DC routing. EVPN gateway function with route leaking between L3VNIs. Supports stretched L2 and routed DCI modes.

BFD Integration

BFD for VTEP reachability detection. BGP BFD for fast peer failure. Sub-second convergence triggering EVPN withdraw and re-advertisement.

QoS: PFC/DCB

DSCP remarking inside VXLAN tunnel. PFC propagation for lossless storage and RoCEv2 traffic across VXLAN fabric. Per-VNI QoS policy support.

OpenConfig Telemetry

EVPN BGP RIB streaming via gNMI. Per-VNI MAC/IP count and VTEP utilization. OpenConfig L2VPN EVPN YANG model (OC 3.x).

OcNOS-Validated Hardware

For reference only. The platforms below are a representative subset of EVPN-VXLAN-validated hardware. The complete, current list of qualified platforms, with ASIC, port density, and version coverage, is maintained in the OcNOS Hardware Compatibility List.

Edgecore AS7326-56X
Trident 3 X7 · 48×25G + 8×100G
Edgecore AS7726-32X
Trident 3 X7 · 32×100G
Edgecore AS9726-32DB
Trident 4 · 32×400G
UfiSpace S9300-32D
Trident 4 · 32×400G
UfiSpace S8901-54XC
Trident 3 X5 · 48×25G + 6×100G
UfiSpace S9600-56DX
Qumran2c · 48×100G + 8×400G
UfiSpace S9610-36D
Jericho2c+ · 36×400G · DCI
UfiSpace S9600-32X
Qumran2c · DCI
See all platforms in Qualified Hardware → EVPN-VXLAN Feature Matrix →

Related Technologies & Solutions

EVPN multi-homing (ESI-LAG) → 400G ZR/ZR+ DCI → AI fabric topologies → RoCEv2 → BGP → SR-MPLS → DC Fabric Solution → AI Fabric Solution → OcNOS Feature Matrix → EVPN L3VPN over IS-IS SR →

Compare EVPN-VXLAN support across all OcNOS-validated platforms

Open Feature Matrix →
FAQ

Frequently asked questions

What is EVPN?
EVPN (Ethernet VPN) is a BGP control plane that delivers Layer 2 and Layer 3 services over a shared fabric, using the L2VPN EVPN address family. It advertises MAC and IP reachability in BGP, replacing flood-and-learn so the network learns endpoints through routing.
What is the difference between EVPN-VXLAN and EVPN-MPLS?
EVPN-VXLAN uses VXLAN tunnels over an IP fabric for the data plane, common in data centers, while EVPN-MPLS uses MPLS transport, common in service provider networks. Both share the same BGP EVPN control plane, differing only in how packets are encapsulated and forwarded.
What is EVPN route type 5 used for in L3VPN?
EVPN route type 5 advertises IP prefixes, providing Layer 3 VPN routing between subnets and sites across the fabric. Unlike type 2, which carries host MAC and IP entries, type 5 carries summarized prefixes, enabling inter-subnet and inter-site IP connectivity in EVPN L3VPN.
What is ESI multihoming in EVPN?
ESI multihoming connects a device to several PE switches that share an Ethernet Segment Identifier (ESI), allowing all-active forwarding where every link carries traffic at once. BGP EVPN handles load sharing and fast failover, so no link sits idle and outages are localized.
What is the difference between EVPN and plain VXLAN?
Plain VXLAN floods to discover MAC addresses and has no control plane, while EVPN adds BGP to advertise MAC and IP reachability and to coordinate multihoming. EVPN over VXLAN cuts unnecessary flooding and adds Layer 3 routing and all-active redundancy that plain VXLAN lacks.
What is EVPN IRB, and how does it deliver EVPN L3VPN?
EVPN Integrated Routing and Bridging (RFC 9135) lets a leaf both bridge within a subnet and route between subnets locally, instead of hairpinning traffic to a central gateway. Paired with Type-5 IP prefix routes (RFC 9136), it delivers EVPN L3VPN: tenant routing across the fabric and between data centers. OcNOS runs symmetric IRB with a distributed anycast gateway.
What is an EVPN Type-3 route?
An EVPN Type-3 route, formally the Inclusive Multicast Ethernet Tag (IMET) route in RFC 7432, advertises a VTEP's interest in a broadcast domain so peers know where to send broadcast, unknown-unicast, and multicast traffic. It builds the flood list for each EVPN instance, replacing data-plane flooding with control-plane signaling. OcNOS advertises Type-3 IMET routes per VNI.
What is EVPN E-Tree?
EVPN E-Tree (RFC 8317) brings the MEF rooted-multipoint model to EVPN. Root sites reach every site, but Leaf sites reach only Roots and never each other, which suits access aggregation and wholesale broadband. EVPN signals Root or Leaf status per PE, per attachment circuit, or per MAC, and filters leaf-to-leaf traffic in both the control and data plane.
What is the difference between EVPN E-LAN and E-Line?
E-LAN is a multipoint-to-multipoint Ethernet service where many sites share one broadcast domain, which EVPN delivers with VLAN-based or VLAN-aware instances (RFC 7432). E-Line is a point-to-point service between two endpoints, delivered by EVPN VPWS (RFC 8214). Use E-LAN for any-to-any tenant connectivity and E-Line for pseudowire-style circuits.
Datasheet and Solution Briefs

Go deeper. Take it with you.

The product datasheet plus short, technical downloads that go further than this page.

Datasheet

OcNOS-DC Datasheet

Full OcNOS-DC specification: the EVPN-VXLAN and Ethernet for AI feature set, software SKUs, supported hardware platforms, and the solution ordering guide.

Get the datasheet
Solution Brief

EVPN-VXLAN Data Center Fabric

Carrier-grade leaf-spine data center fabric: symmetric IRB, Type-2/Type-5 routes, and distributed anycast gateway.

Get the brief
Solution Brief

OcNOS 800G Lossless AI Fabric

Non-blocking RoCEv2 fabric on Broadcom Tomahawk 4/5 spines: SKU tiers, validated platforms, and deployment architecture.

Get the brief