Cloud-Managed EVPN Fabric Overview
Cisco Cloud-Managed Fabric provides a cloud-first campus architecture built on standards-based BGP EVPN and VXLAN. Use Meraki Dashboard to define, deploy, monitor, and operate the fabric.
The architecture separates the physical Layer 3 Underlay from the logical EVPN VXLAN Overlay. OSPFv2 provides IP reachability between fabric nodes, Multiprotocol BGP EVPN distributes MAC, IP, and IP-prefix reachability, and VXLAN carries segmented Layer 2 and Layer 3 services between VXLAN tunnel endpoints (VTEPs).
Meraki Dashboard automates fabric workflows and provides a unified operational view of device roles, virtual routing and forwarding instances (VRFs), Underlay and Overlay subnets, BGP peers, VXLAN tunnels, and fabric health.
The fabric summary provides a single view of device roles, VRFs, Underlay and Overlay subnets, BGP peers, VXLAN tunnels, and fabric health.
Fabric fundamentals
An EVPN VXLAN fabric separates the physical transport network from the logical services delivered to endpoints.
| Component | Purpose |
|---|---|
| Underlay | The physical Layer 3 network that provides IP reachability between fabric nodes. Cloud-Managed Fabric uses OSPFv2 for Underlay unicast routing. |
| Overlay | The logical Layer 2 and Layer 3 services carried across the Underlay. VXLAN Network Identifiers (VNIs) provide segmentation and tenant isolation. |
| Control plane | Multiprotocol BGP with the EVPN address family distributes MAC and IP reachability. Common EVPN routes include Type 2 MAC/IP advertisements, Type 3 Inclusive Multicast Ethernet Tag routes, and Type 5 IP-prefix routes. |
| Data plane | VXLAN encapsulates Ethernet frames in UDP/IP packets. VXLAN tunnel endpoints (VTEPs) encapsulate and decapsulate traffic and support symmetric integrated routing and bridging (IRB). |
Key protocols and capabilities include:
-
BGP EVPN for Overlay route exchange
-
VXLAN for data-plane encapsulation
-
OSPFv2 for Underlay reachability
-
Cisco ISE or Cisco Access Manager integration for Adaptive Policy, Security Group Tags (SGTs), and group policies
Fabric roles
| Role | Primary function |
|---|---|
| Border | Provides connectivity between the Fabric and external networks. |
| Spine | A Spine commonly acts as a BGP route reflector for EVPN routes. It interconnects Leaf and Border switches and provides redundant forwarding paths. |
| Leaf | Connects endpoints or Layer 2 Access switches and operates as a VTEP (VXLAN tunnel endpoint). It supports Layer 2 bridging within VNIs, Layer 3 routing through IRB, ARP suppression, and host mobility. |
| Intermediate | Provides Layer 2 or Layer 3 Underlay transport without terminating the VXLAN Overlay. |
Intermediate devices: Provide Underlay transport and are onboarded and managed in Meraki Dashboard as regular devices. They are not assigned a Fabric role and do not terminate the VXLAN Overlay.
Catalyst 9300 and Catalyst 9500 Series switches can combine roles. Supported roles and combinations currently include Spine, Leaf, Border, Border-Spine, and Border-Leaf.
Dependencies and requirements
Wired platform support
| Network layer | Supported platform | Minimum software | Fabric role |
|---|---|---|---|
| Access (Cisco cloud-managed switching) | Cisco 9350; Catalyst 9300, 9300L, 9300LM, and 9300X; Catalyst 9200 and Catalyst 9200L; Catalyst 9200CX; MS390 | IOS XE 17.18.2 | Layer 2, outside the fabric |
| Access (Meraki switching) | MS130; MS150 | MS 17 or later | Layer 2, outside the fabric |
| Distribution | Catalyst 9300; Catalyst 9300L; MS390; Catalyst 9300X; Catalyst 9500 High Performance | IOS XE 17.18.5 | Leaf or Border-Leaf |
| Core | Catalyst 9300; Catalyst 9300L; MS390; Catalyst 9300X; Catalyst 9500 High Performance | IOS XE 17.18.5 | Spine or Border-Spine |
| External connectivity / network edge | Catalyst 9300; Catalyst 9300L; MS390; Catalyst 9300X; Catalyst 9500 High Performance | IOS XE 17.18.5 | Border or Border-Leaf |
Licensing: Cloud Switching Advanced licensing is required for fabric and Adaptive Policy features.
Wireless platform support
| Wireless vendor | Supported access points | Operational mode | Forwarding mode |
|---|---|---|---|
| Cisco | All supported MR and CW access points | Cloud | Distributed |
Recommended platforms
-
Spine: Catalyst 9500-24Y4C, 9500-48Y4C, 9500-32C, Catalyst 9300X models
-
Border: Catalyst 9500-24Y4C, 9500-48Y4C, 9500-32C, Catalyst 9300X models
-
Leaf: Catalyst 9500-24Y4C, Catalyst 9500-48Y4C, and Catalyst 9500-32C for standalone or EVPN Multi-Homing deployments; Catalyst 9300X models with StackWise or EVPN Multi-Homing support; and Catalyst 9300, Catalyst 9300L, and MS390 models
-
Access: Cisco or Meraki Layer 2 switches that support SGT/TrustSec, including Cisco 9350; Catalyst 9300, 9300L, 9300LM, and 9300X; Catalyst 9200, Catalyst 9200L, and Catalyst 9200CX; and the MS390, MS150, and MS130 families
-
Wireless Access Points: MR and CW Access Points
Software and service requirements
| Requirement | Minimum or recommended value |
|---|---|
| Licensing | Cloud Switching Advanced license for EVPN and Adaptive Policy |
| Management | Cisco Meraki Dashboard; API key and internet access over TCP 443 when API access is used |
| Authentication | Cisco Identity Services Engine (ISE) 3.2 or later, or Cisco Meraki Access Manager |
| Underlay routing | OSPFv2 for unicast routing |
Resource reservations
Automatic Underlay and Overlay provisioning uses reserved VLANs, Loopbacks, VNIs, and address space. Before deployment, confirm that these resources are unused and do not overlap with the existing network. The Underlay address pool can be customized during fabric creation. A custom Underlay bypasses automatic Underlay provisioning and does not require the automatic Underlay VLAN reservation.
| Resource | Default or base value | Allocation or reserved range | Notes |
|---|---|---|---|
| Fabric ID | 1 | 1–256 | Unique fabric identifier |
| VRF ID | 1 | 1–64 | Unique VRF identifier |
| Core VLAN | 965 | 965–1028 | Allocated from the base according to the VRF index |
| Underlay VLAN | 900 | 900–915 | Required only for the routed SVI automatic Underlay |
| Layer 2 VNI | 10000 | Offset 1–4094 | Derived from the VLAN allocation |
| Layer 3 VNI | 20000 | Offset 1–64 | Derived from the VRF allocation |
| Fabric Loopback | Loopback100 | One per fabric node | Used as the fabric VTEP Loopback |
| Core VLAN Loopback | Loopback200 | Loopback200–263 | Allocated according to the VRF index |
| Anycast RP Loopback | Loopback300 | Loopback300–363 | Used when multicast replication is enabled |
| Route distinguisher | — | <fabric-Loopback-IP>:<core-VLAN-ID> | Automatically derived |
| Route target | — | <fabric-ASN>:<core-VLAN-ID> | Automatically derived |
| Underlay subnet pool | 172.16.0.0/16 | One /24 per Underlay subnet | Customizable during fabric creation |
Release support and scale
| Capability | IOS XE 17.18.2 | IOS XE 17.18.5 / 26.1.1 |
|---|---|---|
| Cloud-managed mode | Managed | Managed |
| Release status | Generally available (GA) | Generally available (GA) |
| Access platforms | MS, Catalyst 9200, Catalyst 9300 | MS, Catalyst 9200, Catalyst 9300 |
| Distribution Leaf | Catalyst 9300X | Catalyst 9300; Catalyst 9300L; MS390; Catalyst 9300X; Catalyst 9500 High Performance |
| Core Spine | Catalyst 9500 High Performance (recommended), Catalyst 9300X | Catalyst 9300; Catalyst 9300L; MS390; Catalyst 9300X; Catalyst 9500 High Performance |
| Network Edge / Border | Catalyst 9500 High Performance (recommended), Catalyst 9300X | Catalyst 9300; Catalyst 9300L; MS390; Catalyst 9300X; Catalyst 9500 High Performance |
| Leaf system modes | Cisco StackWise | EVPN Multi-Homing and Cisco StackWise |
| Network support | Wired and Distributed Wireless | Wired and Distributed Wireless |
| Segmentation | Macro-segmentation and Micro-segmentation | Macro-segmentation and Micro-segmentation |
| Policy engines | Cisco ISE and Cisco Access Manager | Cisco ISE and Cisco Access Manager |
Scale and capacity
| Metric | IOS XE 17.18.2 | IOS XE 17.18.5 |
|---|---|---|
| Access points | 300 | 1,000 |
| VRFs | 64 | 64 |
| Distribution blocks (fabric Leaf switches) | 4 | 32 |
| Fabric clients per Distribution Block | 3,000 | 10,000 |
| Access switches (in stacks) | 384 | 768 |
| Fabric subnets | 300 | 300 |
Dashboard device scale
These Dashboard-level limits are separate from the Fabric release-specific scale values above.
| Dashboard device scale | Maximum |
|---|---|
| Devices per Organization | 50,000 |
| Devices per Network (standalone and combined) | 5,000 |
Devices per Network limits
| Product type | Limit |
|---|---|
| Access Points | 5,000 |
| Switches | 5,000 |
The product-specific limits are not additive; a standalone or combined network remains limited to 5,000 total devices.
For additional Dashboard limits and design guidance, see Building a Scalable Meraki Solution.
Fabric design options
Fabric at the Distribution Layer
The EVPN VXLAN Fabric begins at the Distribution Layer. Supported switches operate as Leaf nodes and connect to traditional Layer 2 Access switches. This model introduces segmentation and mobility services without replacing the existing Access Layer, making it suitable for brownfield migrations, office buildings, and campus networks.
EVPN Multi-Homing at the Distribution Layer
EVPN Multi-Homing is generally available (GA) with IOS XE 17.18.5 at the Distribution Layer. Catalyst 9300, Catalyst 9300L, Catalyst 9300X, Catalyst 9500 High Performance, and MS390 switches can form an EVPN Multi-Homing pair. These platforms are supported in the Leaf role for this Distribution-Layer design. An EVPN Multi-Homing pair preserves the existing Layer 2 Access design while providing active/active forwarding, independent management and control planes, and distributed forwarding across the two Leaf switches.
Create the EVPN Multi-Homing pair before adding it to the fabric and assigning it the Leaf role:
-
In Meraki Dashboard, go to Switching > EVPN Multi-Homing.
-
Create the EVPN Multi-Homing pair.
-
In the fabric workflow, add the EVPN Multi-Homing pair and assign it the Leaf role.
-
Use the Add subnet workflow to provision the required Overlay subnets on the pair.
For downstream connectivity, aggregate the member links on both sides:
-
On the Access switch, select the links under Switching > Switch ports, and then select Aggregate to create the port channel.
-
On the EVPN Multi-Homing pair, select both Leaf switches and their respective downstream links, and then select Aggregate.
Fabric at the Access Layer with Routed Access
In a Routed Access design, Fabric Leaves operate at the Access Layer and connect upstream through routed Layer 3 uplinks. The Fabric uses multiple available paths between Access Leaves and upstream nodes, moving the Layer 3 boundary closer to endpoints and keeping Access Layer 2 domains local.
-
Current scale: Supports up to 32 Access switches operating in the Leaf role.
-
Wireless design: Limit each seamless wireless domain to 32 Access switches in a Routed Access environment.
Routed Access design with Fabric Leaves at the Access Layer.
Overlay subnet types
Cloud-Managed Fabric supports three Overlay subnet types. Select the least expansive forwarding behavior that meets endpoint requirements. In this section, BUM refers to broadcast, unknown-unicast, and multicast traffic.
Routed
-
Gateway and scope: A Layer 3 subnet exists on one Leaf and is not stretched.
-
BUM behavior: BUM traffic remains local to the Leaf.
-
VLAN and subnet requirements: Subnets must be unique; VLAN IDs do not need to match across Leaves.
-
Recommended use: Use this as the default when subnet mobility is not required.
-
Scale profile: Highly scalable.
DAG routed
-
Gateway and scope: A Layer 3 subnet is stretched across selected Leaves using a Distributed Anycast Gateway.
-
BUM behavior: BUM replication is restricted to the access edge and is not bridged between Leaves.
-
VLAN and subnet requirements: Participating Leaves use the same VLAN ID and Layer 3 subnet.
-
Recommended use: Choose this for IP endpoints and seamless wired or wireless mobility without extending the Layer 2 flood domain.
-
Scale profile: Scalable across medium to large networks.
DAG bridged
-
Gateway and scope: A Layer 3 subnet is stretched across selected Leaves using a Distributed Anycast Gateway.
-
BUM behavior: Layer 2 BUM traffic is replicated across participating Leaves.
-
VLAN and subnet requirements: Participating Leaves use the same VLAN ID and Layer 3 subnet.
-
Recommended use: Use this selectively for non-IP endpoints, silent hosts, and applications that require Layer 2 flooding.
-
Scale profile: Lower scale; use selectively.
For more information: For detailed design guidance, configuration requirements, and workflow steps for Routed, DAG Routed, and DAG Bridged Overlay subnets, see the Cloud-Managed EVPN Fabric Technical Guide.