Cloud Managed EVPN Fabric Technical Guide

VXLAN Encapsulation

VXLAN uses MAC-in-UDP encapsulation to tunnel Layer 2 frames over a Layer 3 network. The original Ethernet frame is encapsulated with additional headers:

VXLAN BGP EVPN Overlay

The combination of VXLAN and BGP EVPN creates a powerful, standards-based fabric solution:

Fabric Switch Roles

Fabric roles in an EVPN VXLAN fabric refer to the designated functions and positions that switches occupy within a spine-leaf architecture to enable efficient, scalable, and redundant overlay networking on top of an IP underlay.

• Border: Serves as gateways between the EVPN VXLAN fabric and external networks, facilitating Layer 2 or Layer 3 connectivity to non-fabric domains. Handles route leaking, multicast handoff, and dynamic routing peering.
• Spine: Acts as the backbone of the fabric, interconnecting all leaf switches and providing redundant paths for traffic forwarding. Typically functions as BGP Route Reflectors to distribute EVPN routes efficiently.
• Leaf: Edge devices that connect directly to hosts or access devices, operating as VTEPs to encapsulate and decapsulate VXLAN traffic. Supports Layer 2 bridging within VNIs, Layer 3 routing via IRB, and features like ARP suppression and host mobility.

Fabric Deployment Types

Hardware Requirements

Software Requirements

• OS Version: IOS XE 17.18.2 or later
• Licensing: Cloud Switching Advanced Licensing required for EVPN and Adaptive Policy
• Management Tools: Cisco Meraki Dashboard (requires API key and internet access via TCP 443)
• Authentication: Cisco Identity Services Engine (ISE) version 3.2+ or Cisco Meraki Access Manager
• Underlay Protocols: OSPFv2 for unicast routing
• Prerequisites: Layer 3 underlay network with point-to-point interfaces

Cloud Fabric Release Matrix

* Recommended platform

Phase 1 Scale and Capacity

Fabric Reserved Interfaces and Addresses

For auto-underlay creation these interfaces are used during Fabric deployment. Make sure existing interfaces don't overlap and are unused prior to fabric deployment.

Macro Segmentation (VRF)

First level segmentation ensures zero communication between forwarding domains. Ability to consolidate multiple virtual networks into one physical network.

• Virtual Routing & Forwarding (VRF) instances provide Layer 3 isolation
• Scalable up to 20 VRF instances per Organization with IOS-XE 17.18.2
• Create VRFs at scale via Fabric workflows in Dashboard

Micro Segmentation (SGT)

Second level segmentation ensures role-based access control between two groups within a Virtual Network. Provides the ability to segment the network into either line of businesses or functional blocks.

• Secure Group Tags (SGT) / Adaptive Policy
• Dynamic or Static SGT mappings support
• Up to 60 SGTs per Organization
• Integrate with Access Manager or Cisco ISE
• Extend Policy within Fabric and/or beyond Fabric

Routed Subnet

• Layer 3 subnet located solely on a single leaf and cannot be stretched across multiple leaves
• Requirements: Subnets must be unique and do not require matching VLAN IDs
• Scale: Highly scalable

DAG Routed

• Layer 3 subnet stretched across multiple leaves using a Distributed Anycast Gateway
• BUM Traffic replication is restricted to access switch and does not bridge between switches attached to the same leaf
• Requirements: Subnets require the same VLAN ID and share the same L3 subnet
• Scale: Scalable across large networks
• Recommended for scalable, secure fabric Wired and Wireless networks

DAG Bridged (DAG Routed + BUM Traffic)

• Layer 3 subnet stretched across multiple leaves using a Distributed Anycast Gateway
• Layer 2 BUM Traffic replication is distributed across all leaves
• Requirements: Subnets require the same VLAN ID and share the same L3 subnet
• Scale: Resource intensive and should be used only as required
• Use for non-IP legacy endpoints, silent hosts, AP Management VLANs

Distributed Wireless with Fabric

• AP Management VLAN: Use DAG Bridged overlay
• Client VLANs: Use DAG Routed overlay (Recommended)
• Seamless Mobility across Multiple Leaf devices within the Fabric with Subnet stretch

Scalable Wireless Architecture

• Seamless Mobility: Non-disruptive connection across network coverage
• Flood-free core and access networks
• DAG Routed provides flood-free IP subnet stretch for wireless clients

MTU Considerations

• VXLAN adds additional 50 bytes of overhead
• Higher MTU recommended in Underlay
• Change MTU to 9100 across the switches

Underlay with Routed Ports (Recommended)

• Recommended for Greenfield deployments
• Use routed ports workflow from Dashboard to create Routed ports between Leaf, Spine and Border
• Enable OSPF on routed interface for Underlay Connectivity
• Enable Custom Underlay from fabric workflow when provisioning

Underlay with SVI (Brownfield)

• For deployments where Distribution to Core can't be transitioned to Routed ports
• Underlay SVI and OSPF is automated as part of Fabric Workflows
• VLANs 901-915 are used for Underlay routing
• Allow 901-915 on the uplink trunk interfaces
• Customizable Underlay IP pool (default: 172.16.0.0/16)

DHCP Relay for Overlay Subnets

• DHCP Server in Global is supported
• DHCP server must be reachable in Underlay
• Single or Multiple DHCP Relay server support
• Loopback100 is used to source DHCP Relay requests

interface Vlan101
  vrf forwarding Fabric
  ip dhcp relay source-interface Loopback100
  ip address 10.1.101.1 255.255.255.0
  ip helper-address global 10.0.42.1

interface Loopback100
  ip address 192.168.100.4 255.255.255.255

Automatic Underlay Provisioning

Auto-Underlay creation on a fabric automates the configuration of underlay connectivity between fabric nodes using reserved VLANs and IP pools.

Border Connectivity

Border connectivity requires at least two connection types for proper fabric operation.

Brownfield Migration

Cloud Fabric supports migrating existing brownfield networks into the fabric without disruption.

Supported Device Capabilities

Scale and Capacity

* Scale numbers subject to change pending scale testing and validation.

Phase 1 (IOS-XE 17.18.2): Distribution Level Fabric

This architecture focuses on deploying the EVPN fabric at the distribution layer, where Catalyst 9500/9300x switches act as leaf nodes connected to traditional Layer 2 access switches. It enables overlay services for segmentation and mobility while maintaining existing access layer designs.

• Ideal for initial migrations
• Quick wins in scalability for multi-tenant environments
• Office buildings or campuses
• Fabric originates at the Distribution Layer
• No interruption to Access Layer devices during Fabric transition

Phase 1.5 (Coming soon in 1HCY26): EVPN Multihoming & Extended Features

Building on Phase 1, this release adds EVPN Multihoming support at the distribution layer with 9300X/9500H switches, providing dual control plane and distributed forwarding capabilities.

• EVPN Multihoming with 9300X or 9500H at Distribution Layer
• Active/Active load-balancing
• Enhanced redundancy at Distribution Layer
• 9500H support as Leaf role

Fabric Creation Workflow

Deploy and operate your network fabric in five simple steps:

Fabric Assurance

• Single Dashboard view for all Fabric Assurance
• Fabric role summary (single and multi-role devices)
• VRF summary
• BGP neighbor status across all Fabric Devices and External Handoff devices
• VXLAN tunnel status across all Fabric devices

Troubleshooting Checklist

Common CLI Commands

# Verify BGP EVPN neighbors
show bgp l2vpn evpn summary

# Check VXLAN NVE peers
show nve peers

# Verify VNI mapping
show nve vni

# Check EVPN routes for a specific MAC
show bgp l2vpn evpn route-type 2

# Verify anycast gateway
show l2vpn evpn default-gateway

# Check EVPN EVI details
show l2vpn evpn evi detail

# Verify loopback interfaces
show ip interface brief | include Loopback