The modern data-centre and large-campus fabric: a routed spine-leaf underlay carrying a VXLAN overlay, with EVPN as the control plane. It sounds like alphabet soup, but the idea is simple — build a fast, loop-free, any-to-any Layer-3 fabric, then float Layer-2 tenant networks on top of it. This is the architecture, demystified.
Spine-leaf solves a problem old campus designs can't: at data-centre scale, you want Layer-2 adjacency anywhere (so VMs can move and clusters can span racks) but Layer-2 at scale means giant broadcast domains and spanning-tree blocking half your links. The fix is to separate the physical fabric from the tenant networks. The underlay is pure routed Layer-3 spine-leaf — every link active via ECMP, no STP, deterministic bandwidth. The overlay is VXLAN: tenant Ethernet frames tunnelled in UDP across that routed fabric, so a VLAN can appear on any leaf regardless of physical topology. EVPN (BGP-based) is the control plane that distributes which MAC/IP lives behind which leaf, replacing flood-and-learn with something that scales.
Underlay routes packets; overlay carries tenants; EVPN tells the overlay where everything is. That's the whole model. It's genuinely powerful and genuinely overkill for most businesses — you reach for it in a data centre, a large virtualised campus, or a multi-tenant environment, and the topology post is where you decide whether you're actually there.
01
The physical fabric is pure Layer-3: every leaf-to-spine link is a routed point-to-point, all active, load-balanced by ECMP. No spanning tree, no blocked links, predictable latency.
Each leaf-spine link is a small routed subnet (or unnumbered); a routing protocol — usually eBGP per switch, sometimes OSPF — gives every switch reachability to every other switch's loopback. Because it's routed, all links forward simultaneously via equal-cost multipath, and there's no spanning tree to block half your capacity or converge slowly. The underlay's only job is to move packets between leaf loopbacks (the VXLAN tunnel endpoints) fast and reliably. Keep it boring: a clean addressing plan for the fabric links and loopbacks, one routing protocol, no policy. All the interesting per-tenant behaviour happens in the overlay.
02
VXLAN wraps tenant Ethernet frames in UDP and tunnels them leaf-to-leaf across the routed underlay. A VLAN becomes a VNI that can live on any leaf, decoupled from the physical wiring.
A VTEP (VXLAN Tunnel Endpoint — the leaf) encapsulates a host's Ethernet frame into a VXLAN/UDP packet, ships it across the underlay to the destination leaf's VTEP, which decapsulates and delivers it. The tenant network is identified by a 24-bit VNI (16 million of them, vs 4,094 VLANs — the scale win). The effect: a server in rack 1 and a server in rack 40 can sit in the same Layer-2 segment even though the fabric between them is entirely routed. VM mobility, stretched clusters, and multi-tenancy all follow from this decoupling — the segment is defined in software, not in the cabling.
03
Early VXLAN flooded to learn MACs — fine for a lab, a disaster at scale. EVPN uses BGP to advertise MAC/IP-to-VTEP mappings, so leaves learn reachability from a control plane instead of flooding.
Without a control plane, a VTEP finds a remote MAC by flooding (multicast/ingress-replication) and learning from the reply — noisy and unscalable. EVPN (a BGP address family, MP-BGP) fixes it: each leaf advertises the MACs and IPs behind it, so every other leaf knows where a host lives without flooding. It also brings ARP suppression (leaves answer ARP locally from the EVPN table), distributed anycast gateways (the same gateway IP/MAC on every leaf, so a host's default gateway is always local), and clean multi-tenancy via route-targets. EVPN is why VXLAN went from "neat lab trick" to "how data centres are built" — it's the difference between a fabric that scales and one that drowns in broadcast.
Spine-leaf/VXLAN/EVPN is powerful, but be honest about the cost: it needs capable hardware (data-centre switches — Nexus, Catalyst 9k in fabric mode, Arista; MikroTik does VXLAN but EVPN support is limited and version-dependent), a team comfortable with BGP and overlays, and disciplined automation because per-box config doesn't scale. Deploying it for a network that a three-tier or even collapsed-core design would serve is a classic over-engineering trap — you buy complexity you'll pay for at every 2am incident. Use it when east-west traffic, tenant scale, or VM mobility genuinely demand it, and commit to the automation and skills it requires.
Takeaways
NOCTIS designs modern fabrics and the routing beneath them — spine-leaf, VXLAN/EVPN, and the automation to run them — and, just as often, tells you honestly when a simpler design is the right call.
Book a Discovery Call →