L2VPN Overlay · RFC 7432 / 7348

EVPN over VXLAN

Ethernet VPN (RFC 7432) running on a VXLAN data plane (RFC 7348): the current standard for multi-tenant DC fabric overlays, DCI, and large-scale L2VPN on open hardware.

EVPN-VXLAN Fabric

A two-spine, three-leaf fabric with VXLAN tunnels between leaf VTEPs. The right-most leaf pair is bonded into one ESI for all-active multi-homing to a dual-attached CE.

What EVPN-VXLAN Is

EVPN (RFC 7432) is a BGP address family (L2VPN EVPN, AFI 25, SAFI 70) that carries MAC and IP reachability information using a set of route types. Originally designed for MPLS transport, EVPN was extended to VXLAN in RFC 8365, making it the dominant control plane for modern DC fabric overlays.

VXLAN (RFC 7348) encapsulates L2 frames in a UDP/IP header, enabling L2 domain extension across L3 infrastructure. VTEPs (VXLAN Tunnel End Points) originate and terminate encapsulation. With EVPN as the control plane, VTEP discovery and MAC distribution are handled through BGP rather than data-plane flooding, eliminating the scale issues of legacy VXLAN deployments.

EVPN Type-2 routes carry MAC/IP bindings for host reachability within a VNI. Type-5 routes carry IP prefixes for inter-subnet and external routing: this is the key mechanism for data center interconnect (DCI) across VXLAN domains, defined in RFC 9135.

Multi-homing and IRB

EVPN All-Active multi-homing (RFC 7432 §8) allows a CE device to connect to multiple PEs simultaneously with load sharing. Designated Forwarder (DF) election prevents BUM traffic duplication. Integrated Routing and Bridging (IRB) on the leaf nodes enables L3 gateway functionality at the access layer: traffic is routed locally at the first-hop VTEP, eliminating unnecessary hairpinning through a central gateway.

OcNOS Implementation

OcNOS-DC implements EVPN-VXLAN on Broadcom Trident 3/4 and Tomahawk 2–5 platforms. OcNOS-SP adds DCI support on Qumran-class hardware.

EVPN Route Types

Type-2 (MAC/IP), Type-3 (Inclusive Multicast), Type-4 (ES), Type-5 (IP Prefix). Selective multi-homing per EVI. Per-VNI route target import/export policy.

Multi-homing

All-Active and Single-Active multi-homing. LACP-based ESI auto-derivation. DF election per RFC 8584. Mass withdrawal on upstream failure.

IRB / Anycast GW

Symmetric and asymmetric IRB modes. Distributed anycast gateway: same MAC/IP on all leaf VTEPs. GARP suppression. ARP/ND proxy at the leaf.

VXLAN Data Plane

Hardware-offloaded VTEP encap/decap. Inner L2 and L3 lookup at line rate. ECMP across multiple VTEPs. UDP source port entropy for spine load distribution.

DCI: Type-5

RFC 9135 Type-5 IP prefix routes for inter-DC routing. EVPN gateway function with route leaking between L3VNIs. Supports stretched L2 and routed DCI modes.

BFD Integration

BFD for VTEP reachability detection. BGP BFD for fast peer failure. Sub-second convergence triggering EVPN withdraw and re-advertisement.

QoS: PFC/DCB

DSCP remarking inside VXLAN tunnel. PFC propagation for lossless storage and RoCEv2 traffic across VXLAN fabric. Per-VNI QoS policy support.

OpenConfig Telemetry

EVPN BGP RIB streaming via gNMI. Per-VNI MAC/IP count and VTEP utilization. OpenConfig L2VPN EVPN YANG model (OC 3.x).

OcNOS-Validated Hardware

For reference only. The platforms below are a representative subset of EVPN-VXLAN-validated hardware. The complete, current list of qualified platforms, with ASIC, port density, and version coverage, is maintained in the OcNOS Hardware Compatibility List.

Edgecore AS7946-74XKSB

Trident 4 · 48×100G + 8×400G

Edgecore AS9716-32D

Trident 3 X7 · 32×400G

Edgecore AS9736-64D

Tomahawk 4 · 64×400G

Edgecore AIS800-64D

Tomahawk 5 · 64×800G

Edgecore AS9726-32DB

Trident 4 · 32×400G

UfiSpace S9600-32X

Qumran MX · DCI

UfiSpace S9321-64E

Jericho2 · 64×400G

Celestica E1031

Qumran MX · SP edge

See all platforms in Qualified Hardware → EVPN-VXLAN Feature Matrix →

Related Technologies & Solutions

Compare EVPN-VXLAN support across all OcNOS-validated platforms

Open Feature Matrix →

FAQ

Frequently asked questions

What is EVPN?

EVPN (Ethernet VPN) is a BGP control plane that delivers Layer 2 and Layer 3 services over a shared fabric, using the L2VPN EVPN address family. It advertises MAC and IP reachability in BGP, replacing flood-and-learn so the network learns endpoints through routing.

What is the difference between EVPN-VXLAN and EVPN-MPLS?

EVPN-VXLAN uses VXLAN tunnels over an IP fabric for the data plane, common in data centers, while EVPN-MPLS uses MPLS transport, common in service provider networks. Both share the same BGP EVPN control plane, differing only in how packets are encapsulated and forwarded.

What is EVPN route type 5 used for in L3VPN?

EVPN route type 5 advertises IP prefixes, providing Layer 3 VPN routing between subnets and sites across the fabric. Unlike type 2, which carries host MAC and IP entries, type 5 carries summarized prefixes, enabling inter-subnet and inter-site IP connectivity in EVPN L3VPN.

What is ESI multihoming in EVPN?

ESI multihoming connects a device to several PE switches that share an Ethernet Segment Identifier (ESI), allowing all-active forwarding where every link carries traffic at once. BGP EVPN handles load sharing and fast failover, so no link sits idle and outages are localized.

What is the difference between EVPN and plain VXLAN?

Plain VXLAN floods to discover MAC addresses and has no control plane, while EVPN adds BGP to advertise MAC and IP reachability and to coordinate multihoming. EVPN over VXLAN cuts unnecessary flooding and adds Layer 3 routing and all-active redundancy that plain VXLAN lacks.

Solution Briefs

Go deeper. Take it with you.

Two short, technical downloads that go further than this page: the EVPN-VXLAN data center reference and the lossless 800G AI fabric architecture.

Solution Brief

EVPN-VXLAN Data Center Fabric

Carrier-grade leaf-spine data center fabric: symmetric IRB, Type-2/Type-5 routes, and distributed anycast gateway.

Get the brief