VXLAN EVPN Spine and Leaf

Introduction

#

The VXLAN EVPN Leaf and Spine architecture has become the backbone of scalable, multi-tenant network design. This blog post showcases a lab simulation built around this topology, highlighting configuration examples, verification tests, and insights into why this design is foundational for modern data centers.

We’ll explore:

• Why leaf and spine is ideal for multi-tenant overlays
• Configuration snippets from the lab topology
• Ping and trace outputs between tenant workloads
• Mnemonic VNI/VLAN/VRF schemes that reinforce automation and clarity

Lab Topology Overview

#

Our lab features:

• Spine Switches: SPINE1, SPINE2
• Leaf Switches: LEAF1, LEAF2, LEAF3
• Tenants:
  • Tenant 1
    • VLANs: 10, 11
    • L2VNIs: 100010, 100011
    • L3VNI: 903966
  • Tenant 2
    • VLAN: 20
    • L2VNI: 100020
    • L3VNI: 903965
• Servers: Vx-Server0x (distributed across leafs by VLAN)
• External Gateway: External-GW with internet access

This setup allows isolated traffic per tenant with VXLAN encapsulation across the fabric, tested with L2 and L3 verification.

Why Leaf and Spine?

#

Leaf and spine is more than just symmetry—it’s scalability and determinism rolled into a modular fabric. Here’s why it shines in this context:

• Predictable Latency: Every leaf has an equal-cost path to every spine, avoiding bottlenecks.
• Efficient East-West Traffic: Ideal for VM-to-VM or container-to-container flows across racks.
• Horizontal Scalability: Need more ports or tenants? Add leaf switches without redesign.
• Overlay Ready: Perfect base for VXLAN EVPN, allowing tenant separation with route reflectors, control plane learning, and gateway integration.

For labs like this one, it offers a rich playground to test tenant isolation and path validation—without compromising clarity or control.

Configurations

#

SPINE1 Configuration

#

hostname SPINE1
vdc SPINE1 id 1
  limit-resource vlan minimum 16 maximum 4094
  limit-resource vrf minimum 2 maximum 4096
  limit-resource port-channel minimum 0 maximum 511
  limit-resource m4route-mem minimum 58 maximum 58
  limit-resource m6route-mem minimum 8 maximum 8

nv overlay evpn
feature ospf
feature bgp
feature pim
feature fabric forwarding
feature interface-vlan
feature vn-segment-vlan-based
feature nv overlay

no password strength-check
username admin password 5 $5$HPNPAK$nM/4cmiWsr//sYW4DSVkVXbeUNffKAzPT/5wfuteXe2 role network-admin
no ip domain-lookup
ip domain-name dc1.null0labs.net
copp profile strict
snmp-server user admin network-admin auth md5 0064FB27814D8DBE514A18B8E8BFE6279D
DE priv aes-128 0070D410AF7AE39744422FF7A7E0A67AD998 localizedV2key
rmon event 1 log trap public description FATAL(1) owner PMON@FATAL
rmon event 2 log trap public description CRITICAL(2) owner PMON@CRITICAL
rmon event 3 log trap public description ERROR(3) owner PMON@ERROR
rmon event 4 log trap public description WARNING(4) owner PMON@WARNING
rmon event 5 log trap public description INFORMATION(5) owner PMON@INFO

ip pim rp-address 10.0.0.254 group-list 224.0.0.0/4
ip pim ssm range 232.0.0.0/8
ip pim anycast-rp 10.0.0.254 10.0.0.1
ip pim anycast-rp 10.0.0.254 10.0.0.2
vlan 1

vrf context management

interface Vlan1

interface Ethernet1/1
  description SPINE1-TO-LEAF1
  mtu 9216
  medium p2p
  ip unnumbered loopback0
  ip router ospf UNDERLAY area 0.0.0.0
  ip pim sparse-mode
  no shutdown

interface Ethernet1/2
  description SPINE1-TO-LEAF2
  mtu 9216
  medium p2p
  ip unnumbered loopback0
  ip router ospf UNDERLAY area 0.0.0.0
  ip pim sparse-mode
  no shutdown

interface Ethernet1/3
  description SPINE1-TO-LEAF3
  mtu 9216
  medium p2p
  ip unnumbered loopback0
  ip router ospf UNDERLAY area 0.0.0.0
  ip pim sparse-mode
  no shutdown


interface mgmt0
  vrf member management

interface loopback0
  description SPINE1-LOOPBACK
  ip address 10.0.0.1/32
  ip router ospf UNDERLAY area 0.0.0.0
  ip pim sparse-mode

interface loopback1
  description SPINE1-RP
  ip address 10.0.0.254/32
  ip router ospf UNDERLAY area 0.0.0.0
  ip pim sparse-mode
icam monitor scale

line console
line vty
boot nxos bootflash:/nxos64-cs.10.5.2.F.bin
router ospf UNDERLAY
  log-adjacency-changes
router bgp 64500
  log-neighbor-changes
  address-family ipv4 unicast
  address-family l2vpn evpn
    retain route-target all
  template peer LEAF
    remote-as 64500
    update-source loopback0
    address-family ipv4 unicast
      send-community extended
      route-reflector-client
      soft-reconfiguration inbound
    address-family l2vpn evpn
      send-community
      send-community extended
      route-reflector-client
  neighbor 10.0.0.3
    inherit peer LEAF
  neighbor 10.0.0.4
    inherit peer LEAF
  neighbor 10.0.0.5
    inherit peer LEAF
cli alias name wr copy running-config startup-config

SPINE2 Configuration

#

hostname SPINE2
vdc SPINE2 id 1
  limit-resource vlan minimum 16 maximum 4094
  limit-resource vrf minimum 2 maximum 4096
  limit-resource port-channel minimum 0 maximum 511
  limit-resource m4route-mem minimum 58 maximum 58
  limit-resource m6route-mem minimum 8 maximum 8

nv overlay evpn
feature ospf
feature bgp
feature pim
feature fabric forwarding
feature interface-vlan
feature vn-segment-vlan-based
feature nv overlay

no password strength-check
username admin password 5 $5$FBKENH$GsbygrPlMOEe8uPuwwT1xxFEz8z.DtzRULg0fNHaM13 role network-admin
no ip domain-lookup
ip domain-name dc1.null0labs.net
copp profile strict
snmp-server user admin network-admin auth md5 056AE430FF7A1C696E0CEDAAF1AE6DC9C1
FD priv aes-128 057ED31EC814357C663BA2E5AEEE308D87F8 localizedV2key
rmon event 1 log trap public description FATAL(1) owner PMON@FATAL
rmon event 2 log trap public description CRITICAL(2) owner PMON@CRITICAL
rmon event 3 log trap public description ERROR(3) owner PMON@ERROR
rmon event 4 log trap public description WARNING(4) owner PMON@WARNING
rmon event 5 log trap public description INFORMATION(5) owner PMON@INFO

ip pim rp-address 10.0.0.254 group-list 224.0.0.0/4
ip pim ssm range 232.0.0.0/8
ip pim anycast-rp 10.0.0.254 10.0.0.1
ip pim anycast-rp 10.0.0.254 10.0.0.2
vlan 1

vrf context management

interface Vlan1

interface Ethernet1/1
  description SPINE2-TO-LEAF1
  mtu 9216
  medium p2p
  ip unnumbered loopback0
  ip router ospf UNDERLAY area 0.0.0.0
  ip pim sparse-mode
  no shutdown

interface Ethernet1/2
  description SPINE2-TO-LEAF2
  mtu 9216
  medium p2p
  ip unnumbered loopback0
  ip router ospf UNDERLAY area 0.0.0.0
  ip pim sparse-mode
  no shutdown

interface Ethernet1/3
  description SPINE2-TO-LEAF3
  mtu 9216
  medium p2p
  ip unnumbered loopback0
  ip router ospf UNDERLAY area 0.0.0.0
  ip pim sparse-mode
  no shutdown

interface mgmt0
  vrf member management

interface loopback0
  description SPINE2-LOOPBACK
  ip address 10.0.0.2/32
  ip router ospf UNDERLAY area 0.0.0.0
  ip pim sparse-mode

interface loopback1
  description SPINE2-RP
  ip address 10.0.0.254/32
  ip router ospf UNDERLAY area 0.0.0.0
  ip pim sparse-mode
icam monitor scale

line console
line vty
boot nxos bootflash:/nxos64-cs.10.5.2.F.bin
router ospf UNDERLAY
  log-adjacency-changes
router bgp 64500
  log-neighbor-changes
  address-family ipv4 unicast
  address-family l2vpn evpn
    retain route-target all
  template peer LEAF
    remote-as 64500
    update-source loopback0
    address-family ipv4 unicast
      send-community extended
      route-reflector-client
      soft-reconfiguration inbound
    address-family l2vpn evpn
      send-community
      send-community extended
      route-reflector-client
  neighbor 10.0.0.3
    inherit peer LEAF
  neighbor 10.0.0.4
    inherit peer LEAF
  neighbor 10.0.0.5
    inherit peer LEAF    
cli alias name wr copy running-config startup-config

LEAF1 Configuration

#

hostname LEAF1
vdc LEAF1 id 1
  limit-resource vlan minimum 16 maximum 4094
  limit-resource vrf minimum 2 maximum 4096
  limit-resource port-channel minimum 0 maximum 511
  limit-resource m4route-mem minimum 58 maximum 58
  limit-resource m6route-mem minimum 8 maximum 8

nv overlay evpn
feature ospf
feature bgp
feature pim
feature fabric forwarding
feature interface-vlan
feature vn-segment-vlan-based
feature nv overlay

no password strength-check
username admin password 5 $5$JFHIKL$Z79VngrOdMmeIRuhNdhwHilYkYPSYztAhy02lhCNjq1 role network-admin
no ip domain-lookup
ip domain-name dc1.null0labs.net
copp profile strict
hardware access-list tcam region racl 512
hardware access-list tcam region arp-ether 256 double-wide
snmp-server user admin network-admin auth md5 3229F65BF9CE8ACA0ADFC00054F0077F31
55 priv aes-128 3228F153D7CF85C611D9D73140E1127D665A localizedV2key
rmon event 1 log trap public description FATAL(1) owner PMON@FATAL
rmon event 2 log trap public description CRITICAL(2) owner PMON@CRITICAL
rmon event 3 log trap public description ERROR(3) owner PMON@ERROR
rmon event 4 log trap public description WARNING(4) owner PMON@WARNING
rmon event 5 log trap public description INFORMATION(5) owner PMON@INFO

fabric forwarding anycast-gateway-mac 0000.1111.1111
ip pim rp-address 10.0.0.254 group-list 224.0.0.0/4
ip pim ssm range 232.0.0.0/8
vlan 1,10,11,20,3965-3966
vlan 10
  vn-segment 100010
vlan 11
  vn-segment 100011
vlan 20
  vn-segment 100020
vlan 3965
  vn-segment 903965
vlan 3966
  vn-segment 903966

vrf context OVERLAY-TENANT-1
  vni 903966
  rd auto
  address-family ipv4 unicast
    route-target both auto
    route-target both auto evpn
vrf context OVERLAY-TENANT-2
  vni 903965
  rd auto
  address-family ipv4 unicast
    route-target both auto
    route-target both auto evpn
vrf context management

interface Vlan1

interface Vlan10
  no shutdown
  vrf member OVERLAY-TENANT-1
  ip address 10.10.1.254/24
  fabric forwarding mode anycast-gateway

interface Vlan11
  no shutdown
  vrf member OVERLAY-TENANT-1
  ip address 10.11.1.254/24
  fabric forwarding mode anycast-gateway

interface VLAN20
  no shutdown
  vrf member OVERLAY-TENANT-2
  ip address 10.20.1.254/24
  fabric forwarding mode anycast-gateway

interface Vlan3965
  no shutdown
  vrf member OVERLAY-TENANT-2
  ip forward

interface Vlan3966
  no shutdown
  vrf member OVERLAY-TENANT-1
  ip forward

interface nve1
  description NVE1
  no shutdown
  host-reachability protocol bgp
  source-interface loopback0
  member vni 100010
    suppress-arp
    mcast-group 224.1.1.10
  member vni 100011
    suppress-arp
    mcast-group 224.1.1.11
  member vni 100020
    suppress-arp
    mcast-group 224.1.1.20
  member vni 903965 associate-vrf
  member vni 903966 associate-vrf

interface Ethernet1/1
  description SPINE1
  mtu 9216
  medium p2p
  ip unnumbered loopback0
  ip router ospf UNDERLAY area 0.0.0.0
  ip pim sparse-mode
  no shutdown

interface Ethernet1/2
  description SPINE2
  mtu 9216
  medium p2p
  ip unnumbered loopback0
  ip router ospf UNDERLAY area 0.0.0.0
  ip pim sparse-mode
  no shutdown

interface Ethernet1/3
  description TENANT1-VLAN10-SERVER01
  switchport
  switchport access vlan 10
  no shutdown

interface Ethernet1/4
  description TENANT1-VLAN11-SERVER01
  switchport
  switchport access vlan 11
  no shutdown

interface Ethernet1/5
  description TENANT2-VLAN20-SERVER01
  switchport
  switchport access vlan 20
  no shutdown


interface mgmt0
  vrf member management

interface loopback0
  description LEAF1-LOOPBACK
  ip address 10.0.0.3/32
  ip router ospf UNDERLAY area 0.0.0.0
  ip pim sparse-mode
icam monitor scale

line console
line vty
boot nxos bootflash:/nxos64-cs.10.5.2.F.bin
router ospf UNDERLAY
  log-adjacency-changes
router bgp 64500
  log-neighbor-changes
  address-family ipv4 unicast
  address-family l2vpn evpn
  template peer SPINE
    remote-as 64500
    update-source loopback0
    address-family ipv4 unicast
      send-community extended
      soft-reconfiguration inbound
    address-family l2vpn evpn
      send-community
      send-community extended
  neighbor 10.0.0.1
    inherit peer SPINE
  neighbor 10.0.0.2
    inherit peer SPINE
  vrf OVERLAY-TENANT-1
    log-neighbor-changes
    address-family ipv4 unicast
      network 10.10.1.0/24
      network 10.11.1.0/24
  vrf OVERLAY-TENANT-2
    log-neighbor-changes
    address-family ipv4 unicast
      network 10.20.1.0/24
evpn
  vni 100010 l2
    rd auto
    route-target import auto
    route-target export auto
  vni 100011 l2
    rd auto
    route-target import auto
    route-target export auto
  vni 100020 l2
    rd auto
    route-target import auto
    route-target export auto
cli alias name wr copy running-config startup-config

LEAF2 Configuration

#

hostname LEAF2
vdc LEAF2 id 1
  limit-resource vlan minimum 16 maximum 4094
  limit-resource vrf minimum 2 maximum 4096
  limit-resource port-channel minimum 0 maximum 511
  limit-resource m4route-mem minimum 58 maximum 58
  limit-resource m6route-mem minimum 8 maximum 8

nv overlay evpn
feature ospf
feature bgp
feature pim
feature fabric forwarding
feature interface-vlan
feature vn-segment-vlan-based
feature nv overlay

no password strength-check
username admin password 5 $5$LBPCDG$tYuyUoEnyr/59n5V1PS21wHl5KpS.e.4JiDUCNN0Ja6 role network-admin
no ip domain-lookup
ip domain-name dc1.null0labs.net
copp profile strict
hardware access-list tcam region racl 512
hardware access-list tcam region arp-ether 256 double-wide
snmp-server user admin network-admin auth md5 21607CCB4AC38FD18B1D1E2F7FF389DF62
BA priv aes-128 054F52F75EADD2DF841B086B2DA7DEA1479D localizedV2key
rmon event 1 log trap public description FATAL(1) owner PMON@FATAL
rmon event 2 log trap public description CRITICAL(2) owner PMON@CRITICAL
rmon event 3 log trap public description ERROR(3) owner PMON@ERROR
rmon event 4 log trap public description WARNING(4) owner PMON@WARNING
rmon event 5 log trap public description INFORMATION(5) owner PMON@INFO

fabric forwarding anycast-gateway-mac 0000.1111.1111
ip pim rp-address 10.0.0.254 group-list 224.0.0.0/4
ip pim ssm range 232.0.0.0/8
vlan 1,10,11,20,3965-3966
vlan 10
  vn-segment 100010
vlan 11
  vn-segment 100011
vlan 20
  vn-segment 100020
vlan 3965
  vn-segment 903965
vlan 3966
  vn-segment 903966

vrf context OVERLAY-TENANT-1
  vni 903966
  rd auto
  address-family ipv4 unicast
    route-target both auto
    route-target both auto evpn
vrf context OVERLAY-TENANT-2
  vni 903965
  rd auto
  address-family ipv4 unicast
    route-target both auto
    route-target both auto evpn
vrf context management

interface Vlan1

interface Vlan10
  no shutdown
  vrf member OVERLAY-TENANT-1
  ip address 10.10.1.254/24
  fabric forwarding mode anycast-gateway

interface Vlan11
  no shutdown
  vrf member OVERLAY-TENANT-1
  ip address 10.11.1.254/24
  fabric forwarding mode anycast-gateway

interface Vlan20
  no shutdown
  vrf member OVERLAY-TENANT-2
  ip address 10.20.1.254/24
  fabric forwarding mode anycast-gateway

interface Vlan3965
  no shutdown
  vrf member OVERLAY-TENANT-2
  ip forward

interface Vlan3966
  no shutdown
  vrf member OVERLAY-TENANT-1
  ip forward

interface nve1
 description NVE1
  no shutdown
  host-reachability protocol bgp
  source-interface loopback0
  member vni 100010
    suppress-arp
    mcast-group 224.1.1.10
  member vni 100011
    suppress-arp
    mcast-group 224.1.1.11
  member vni 100020
    suppress-arp
    mcast-group 224.1.1.20
  member vni 903965 associate-vrf
  member vni 903966 associate-vrf

interface Ethernet1/1
  description SPINE1
  mtu 9216
  medium p2p
  ip unnumbered loopback0
  ip router ospf UNDERLAY area 0.0.0.0
  ip pim sparse-mode
  no shutdown

interface Ethernet1/2
  description SPINE2
  mtu 9216
  medium p2p
  ip unnumbered loopback0
  ip router ospf UNDERLAY area 0.0.0.0
  ip pim sparse-mode
  no shutdown

interface Ethernet1/3
  description TENANT1-VLAN10-SERVER02
  switchport
  switchport access vlan 10
  no shutdown

interface Ethernet1/4
  description TENANT1-VLAN11-SERVER02
  switchport
  switchport access vlan 11
  no shutdown

interface Ethernet1/5
  description TENANT2-VLAN20-SERVER02
  switchport
  switchport access vlan 20
  no shutdown


interface mgmt0
  vrf member management

interface loopback0
  description LEAF2-LOOPBACK
  ip address 10.0.0.4/32
  ip router ospf UNDERLAY area 0.0.0.0
  ip pim sparse-mode
icam monitor scale

line console
line vty
boot nxos bootflash:/nxos64-cs.10.5.2.F.bin
router ospf UNDERLAY
  log-adjacency-changes
router bgp 64500
  log-neighbor-changes
  address-family ipv4 unicast
  address-family l2vpn evpn
  template peer SPINE
    remote-as 64500
    update-source loopback0
    address-family ipv4 unicast
      send-community extended
      soft-reconfiguration inbound
    address-family l2vpn evpn
      send-community
      send-community extended
  neighbor 10.0.0.1
    inherit peer SPINE
  neighbor 10.0.0.2
    inherit peer SPINE
  vrf OVERLAY-TENANT-1
    log-neighbor-changes
    address-family ipv4 unicast
      network 10.10.1.0/24
      network 10.11.1.0/24
  vrf OVERLAY-TENANT-2
    log-neighbor-changes
    address-family ipv4 unicast
      network 10.20.1.0/24
evpn
  vni 100010 l2
    rd auto
    route-target import auto
    route-target export auto
  vni 100011 l2
    rd auto
    route-target import auto
    route-target export auto
  vni 100020 l2
    rd auto
    route-target import auto
    route-target export auto
cli alias name wr copy running-config startup-config

LEAF3 Configuration

#

hostname LEAF3
vdc LEAF3 id 1
  limit-resource vlan minimum 16 maximum 4094
  limit-resource vrf minimum 2 maximum 4096
  limit-resource port-channel minimum 0 maximum 511
  limit-resource m4route-mem minimum 58 maximum 58
  limit-resource m6route-mem minimum 8 maximum 8

nv overlay evpn
feature ospf
feature bgp
feature pim
feature fabric forwarding
feature interface-vlan
feature vn-segment-vlan-based
feature nv overlay

no password strength-check
username admin password 5 $5$ENGEOD$ozMfvIAsvrcVUnmFwZhrBB6OfumOwG3aaCe6RKpB6u5
 role network-admin
no ip domain-lookup
ip domain-name dc1.null0labs.net
copp profile strict
snmp-server user admin network-admin auth md5 365F7CC2DDC1215EC5A9D405754494B1B1
F7 priv aes-128 32097A88C099290695A086562044E98FE0BC localizedV2key
rmon event 1 log trap public description FATAL(1) owner PMON@FATAL
rmon event 2 log trap public description CRITICAL(2) owner PMON@CRITICAL
rmon event 3 log trap public description ERROR(3) owner PMON@ERROR
rmon event 4 log trap public description WARNING(4) owner PMON@WARNING
rmon event 5 log trap public description INFORMATION(5) owner PMON@INFO

fabric forwarding anycast-gateway-mac 0000.1111.1111
ip pim rp-address 10.0.0.254 group-list 224.0.0.0/4
ip pim ssm range 232.0.0.0/8
vlan 1,10-11,20,1001,3965-3966
vlan 10
  vn-segment 100010
vlan 11
  vn-segment 100011
vlan 20
  vn-segment 100020
vlan 1001
  vn-segment 101001
vlan 3965
  vn-segment 903965
vlan 3966
  vn-segment 903966

vrf context OVERLAY-TENANT-1
  vni 903966
  rd auto
  address-family ipv4 unicast
    route-target both auto
    route-target both auto evpn
    route-target import 64500:101001
    route-target import 64500:903965
    route-target import 64500:903965 evpn
    import vrf advertise-vpn
vrf context OVERLAY-TENANT-2
  vni 903965
  rd auto
  address-family ipv4 unicast
    route-target both auto
    route-target both auto evpn
    route-target import 64500:101001
    route-target import 64500:903966
    route-target import 64500:903966 evpn
    import vrf advertise-vpn
vrf context external
  vni 101001
  rd auto
  address-family ipv4 unicast
    route-target both auto
    route-target both auto evpn
    route-target import 64500:903965
    route-target import 64500:903965 evpn
    route-target import 64500:903966
    route-target import 64500:903966 evpn
vrf context management

interface Vlan1

interface Vlan10
  no shutdown
  vrf member OVERLAY-TENANT-1
  ip address 10.10.1.254/24
  fabric forwarding mode anycast-gateway

interface Vlan11
  no shutdown
  vrf member OVERLAY-TENANT-1
  ip address 10.11.1.254/24
  fabric forwarding mode anycast-gateway

interface Vlan20
  no shutdown
  vrf member OVERLAY-TENANT-2
  ip address 10.20.1.254/24
  fabric forwarding mode anycast-gateway

interface Vlan1001
  no shutdown
  vrf member external
  ip forward

interface Vlan3965
  no shutdown
  vrf member OVERLAY-TENANT-2
  ip forward

interface Vlan3966
  no shutdown
  vrf member OVERLAY-TENANT-1
  ip forward

interface nve1
  no shutdown
  description NVE1
  host-reachability protocol bgp
  source-interface loopback0
  member vni 100010
    mcast-group 224.1.1.10
  member vni 100011
    mcast-group 224.1.1.11
  member vni 100020
    mcast-group 224.1.1.20
  member vni 101001 associate-vrf
  member vni 903965 associate-vrf
  member vni 903966 associate-vrf

interface Ethernet1/1
  description SPINE1
  mtu 9216
  medium p2p
  ip unnumbered loopback0
  ip router ospf UNDERLAY area 0.0.0.0
  ip pim sparse-mode
  no shutdown

interface Ethernet1/2
  description SPINE2
  mtu 9216
  medium p2p
  ip unnumbered loopback0
  ip router ospf UNDERLAY area 0.0.0.0
  ip pim sparse-mode
  no shutdown

interface Ethernet1/3
  description TENANT1-VLAN10-SERVER03
  switchport
  switchport access vlan 10
  no shutdown

interface Ethernet1/4
  description TENANT1-VLAN11-SERVER03
  switchport
  switchport access vlan 11
  no shutdown

interface Ethernet1/5
  description TENANT2-VLAN20-SERVER03
  switchport
  switchport access vlan 20
  no shutdown

interface Ethernet1/6
  description UPSTREAM-GW
  vrf member external
  ip address 10.100.0.2/30
  no shutdown


interface mgmt0
  vrf member management

interface loopback0
  description LEAF3-LOOPBACK
  ip address 10.0.0.5/32
  ip router ospf UNDERLAY area 0.0.0.0
  ip pim sparse-mode
icam monitor scale

cli alias name wr copy running-config startup-config
line console
line vty
boot nxos bootflash:/nxos64-cs.10.5.2.F.bin
router ospf UNDERLAY
  log-adjacency-changes
router bgp 64500
  log-neighbor-changes
  address-family ipv4 unicast
  address-family l2vpn evpn
  template peer SPINE
    remote-as 64500
    update-source loopback0
    address-family ipv4 unicast
      send-community extended
      soft-reconfiguration inbound
    address-family l2vpn evpn
      send-community
      send-community extended
  neighbor 10.0.0.1
    inherit peer SPINE
  neighbor 10.0.0.2
    inherit peer SPINE
  vrf OVERLAY-TENANT-1
    log-neighbor-changes
    address-family ipv4 unicast
      network 10.10.1.0/24
      network 10.11.1.0/24
  vrf OVERLAY-TENANT-2
    log-neighbor-changes
    address-family ipv4 unicast
      network 10.20.1.0/24
  vrf external
    address-family ipv4 unicast
      aggregate-address 10.10.1.0/24 summary-only
      aggregate-address 10.11.1.0/24 summary-only
      aggregate-address 10.20.1.0/24 summary-only
    neighbor 10.100.0.1
      remote-as 64501
      address-family ipv4 unicast
evpn
  vni 100010 l2
    rd auto
    route-target import auto
    route-target export auto
  vni 100011 l2
    rd auto
    route-target import auto
    route-target export auto
  vni 100020 l2
    rd auto
    route-target import auto
    route-target export auto

Tenant Connectivity Tests

#

Tenant 1

#

Ping VLAN 10 host to VLAN 11 host and Traces

#

Tenant

#

Ping within VLAN 20 and to External and VLAN 10

#

Wrapping Up

#

This lab demonstrates VXLAN EVPN overlays in a leaf-spine fabric.