VXLAN EVPN Spine and Leaf

Introduction Link to heading

The VXLAN EVPN Leaf and Spine architecture has become the backbone of scalable, multi-tenant network design. This blog post showcases a lab simulation built around this topology, highlighting configuration examples, verification tests, and insights into why this design is foundational for modern data centers.

We’ll explore:

  • Why leaf and spine is ideal for multi-tenant overlays
  • Configuration snippets from the lab topology
  • Ping and trace outputs between tenant workloads
  • Mnemonic VNI/VLAN/VRF schemes that reinforce automation and clarity

Network

Lab Topology Overview Link to heading

Our lab features:

  • Spine Switches: SPINE1, SPINE2
  • Leaf Switches: LEAF1, LEAF2, LEAF3
  • Tenants:
    • Tenant 1
      • VLANs: 10, 11
      • L2VNIs: 100010, 100011
      • L3VNI: 903966
    • Tenant 2
      • VLAN: 20
      • L2VNI: 100020
      • L3VNI: 903965
  • Servers: Vx-Server0x (distributed across leafs by VLAN)
  • External Gateway: External-GW with internet access

This setup allows isolated traffic per tenant with VXLAN encapsulation across the fabric, tested with L2 and L3 verification.

Why Leaf and Spine? Link to heading

Leaf and spine is more than just symmetry—it’s scalability and determinism rolled into a modular fabric. Here’s why it shines in this context:

  • Predictable Latency: Every leaf has an equal-cost path to every spine, avoiding bottlenecks.
  • Efficient East-West Traffic: Ideal for VM-to-VM or container-to-container flows across racks.
  • Horizontal Scalability: Need more ports or tenants? Add leaf switches without redesign.
  • Overlay Ready: Perfect base for VXLAN EVPN, allowing tenant separation with route reflectors, control plane learning, and gateway integration.

For labs like this one, it offers a rich playground to test tenant isolation and path validation—without compromising clarity or control.

Configurations Link to heading

SPINE1 Configuration Link to heading 

hostname SPINE1
vdc SPINE1 id 1
  limit-resource vlan minimum 16 maximum 4094
  limit-resource vrf minimum 2 maximum 4096
  limit-resource port-channel minimum 0 maximum 511
  limit-resource m4route-mem minimum 58 maximum 58
  limit-resource m6route-mem minimum 8 maximum 8

nv overlay evpn
feature ospf
feature bgp
feature pim
feature fabric forwarding
feature interface-vlan
feature vn-segment-vlan-based
feature nv overlay

no password strength-check
username admin password 5 $5$HPNPAK$nM/4cmiWsr//sYW4DSVkVXbeUNffKAzPT/5wfuteXe2 role network-admin
no ip domain-lookup
ip domain-name dc1.null0labs.net
copp profile strict
snmp-server user admin network-admin auth md5 0064FB27814D8DBE514A18B8E8BFE6279D
DE priv aes-128 0070D410AF7AE39744422FF7A7E0A67AD998 localizedV2key
rmon event 1 log trap public description FATAL(1) owner PMON@FATAL
rmon event 2 log trap public description CRITICAL(2) owner PMON@CRITICAL
rmon event 3 log trap public description ERROR(3) owner PMON@ERROR
rmon event 4 log trap public description WARNING(4) owner PMON@WARNING
rmon event 5 log trap public description INFORMATION(5) owner PMON@INFO

ip pim rp-address 10.0.0.254 group-list 224.0.0.0/4
ip pim ssm range 232.0.0.0/8
ip pim anycast-rp 10.0.0.254 10.0.0.1
ip pim anycast-rp 10.0.0.254 10.0.0.2
vlan 1

vrf context management

interface Vlan1

interface Ethernet1/1
  description SPINE1-TO-LEAF1
  mtu 9216
  medium p2p
  ip unnumbered loopback0
  ip router ospf UNDERLAY area 0.0.0.0
  ip pim sparse-mode
  no shutdown

interface Ethernet1/2
  description SPINE1-TO-LEAF2
  mtu 9216
  medium p2p
  ip unnumbered loopback0
  ip router ospf UNDERLAY area 0.0.0.0
  ip pim sparse-mode
  no shutdown

interface Ethernet1/3
  description SPINE1-TO-LEAF3
  mtu 9216
  medium p2p
  ip unnumbered loopback0
  ip router ospf UNDERLAY area 0.0.0.0
  ip pim sparse-mode
  no shutdown


interface mgmt0
  vrf member management

interface loopback0
  description SPINE1-LOOPBACK
  ip address 10.0.0.1/32
  ip router ospf UNDERLAY area 0.0.0.0
  ip pim sparse-mode

interface loopback1
  description SPINE1-RP
  ip address 10.0.0.254/32
  ip router ospf UNDERLAY area 0.0.0.0
  ip pim sparse-mode
icam monitor scale

line console
line vty
boot nxos bootflash:/nxos64-cs.10.5.2.F.bin
router ospf UNDERLAY
  log-adjacency-changes
router bgp 64500
  log-neighbor-changes
  address-family ipv4 unicast
  address-family l2vpn evpn
    retain route-target all
  template peer LEAF
    remote-as 64500
    update-source loopback0
    address-family ipv4 unicast
      send-community extended
      route-reflector-client
      soft-reconfiguration inbound
    address-family l2vpn evpn
      send-community
      send-community extended
      route-reflector-client
  neighbor 10.0.0.3
    inherit peer LEAF
  neighbor 10.0.0.4
    inherit peer LEAF
  neighbor 10.0.0.5
    inherit peer LEAF
cli alias name wr copy running-config startup-config

SPINE2 Configuration Link to heading 

hostname SPINE2
vdc SPINE2 id 1
  limit-resource vlan minimum 16 maximum 4094
  limit-resource vrf minimum 2 maximum 4096
  limit-resource port-channel minimum 0 maximum 511
  limit-resource m4route-mem minimum 58 maximum 58
  limit-resource m6route-mem minimum 8 maximum 8

nv overlay evpn
feature ospf
feature bgp
feature pim
feature fabric forwarding
feature interface-vlan
feature vn-segment-vlan-based
feature nv overlay

no password strength-check
username admin password 5 $5$FBKENH$GsbygrPlMOEe8uPuwwT1xxFEz8z.DtzRULg0fNHaM13 role network-admin
no ip domain-lookup
ip domain-name dc1.null0labs.net
copp profile strict
snmp-server user admin network-admin auth md5 056AE430FF7A1C696E0CEDAAF1AE6DC9C1
FD priv aes-128 057ED31EC814357C663BA2E5AEEE308D87F8 localizedV2key
rmon event 1 log trap public description FATAL(1) owner PMON@FATAL
rmon event 2 log trap public description CRITICAL(2) owner PMON@CRITICAL
rmon event 3 log trap public description ERROR(3) owner PMON@ERROR
rmon event 4 log trap public description WARNING(4) owner PMON@WARNING
rmon event 5 log trap public description INFORMATION(5) owner PMON@INFO

ip pim rp-address 10.0.0.254 group-list 224.0.0.0/4
ip pim ssm range 232.0.0.0/8
ip pim anycast-rp 10.0.0.254 10.0.0.1
ip pim anycast-rp 10.0.0.254 10.0.0.2
vlan 1

vrf context management

interface Vlan1

interface Ethernet1/1
  description SPINE2-TO-LEAF1
  mtu 9216
  medium p2p
  ip unnumbered loopback0
  ip router ospf UNDERLAY area 0.0.0.0
  ip pim sparse-mode
  no shutdown

interface Ethernet1/2
  description SPINE2-TO-LEAF2
  mtu 9216
  medium p2p
  ip unnumbered loopback0
  ip router ospf UNDERLAY area 0.0.0.0
  ip pim sparse-mode
  no shutdown

interface Ethernet1/3
  description SPINE2-TO-LEAF3
  mtu 9216
  medium p2p
  ip unnumbered loopback0
  ip router ospf UNDERLAY area 0.0.0.0
  ip pim sparse-mode
  no shutdown

interface mgmt0
  vrf member management

interface loopback0
  description SPINE2-LOOPBACK
  ip address 10.0.0.2/32
  ip router ospf UNDERLAY area 0.0.0.0
  ip pim sparse-mode

interface loopback1
  description SPINE2-RP
  ip address 10.0.0.254/32
  ip router ospf UNDERLAY area 0.0.0.0
  ip pim sparse-mode
icam monitor scale

line console
line vty
boot nxos bootflash:/nxos64-cs.10.5.2.F.bin
router ospf UNDERLAY
  log-adjacency-changes
router bgp 64500
  log-neighbor-changes
  address-family ipv4 unicast
  address-family l2vpn evpn
    retain route-target all
  template peer LEAF
    remote-as 64500
    update-source loopback0
    address-family ipv4 unicast
      send-community extended
      route-reflector-client
      soft-reconfiguration inbound
    address-family l2vpn evpn
      send-community
      send-community extended
      route-reflector-client
  neighbor 10.0.0.3
    inherit peer LEAF
  neighbor 10.0.0.4
    inherit peer LEAF
  neighbor 10.0.0.5
    inherit peer LEAF    
cli alias name wr copy running-config startup-config

LEAF1 Configuration Link to heading 

hostname LEAF1
vdc LEAF1 id 1
  limit-resource vlan minimum 16 maximum 4094
  limit-resource vrf minimum 2 maximum 4096
  limit-resource port-channel minimum 0 maximum 511
  limit-resource m4route-mem minimum 58 maximum 58
  limit-resource m6route-mem minimum 8 maximum 8

nv overlay evpn
feature ospf
feature bgp
feature pim
feature fabric forwarding
feature interface-vlan
feature vn-segment-vlan-based
feature nv overlay

no password strength-check
username admin password 5 $5$JFHIKL$Z79VngrOdMmeIRuhNdhwHilYkYPSYztAhy02lhCNjq1 role network-admin
no ip domain-lookup
ip domain-name dc1.null0labs.net
copp profile strict
hardware access-list tcam region racl 512
hardware access-list tcam region arp-ether 256 double-wide
snmp-server user admin network-admin auth md5 3229F65BF9CE8ACA0ADFC00054F0077F31
55 priv aes-128 3228F153D7CF85C611D9D73140E1127D665A localizedV2key
rmon event 1 log trap public description FATAL(1) owner PMON@FATAL
rmon event 2 log trap public description CRITICAL(2) owner PMON@CRITICAL
rmon event 3 log trap public description ERROR(3) owner PMON@ERROR
rmon event 4 log trap public description WARNING(4) owner PMON@WARNING
rmon event 5 log trap public description INFORMATION(5) owner PMON@INFO

fabric forwarding anycast-gateway-mac 0000.1111.1111
ip pim rp-address 10.0.0.254 group-list 224.0.0.0/4
ip pim ssm range 232.0.0.0/8
vlan 1,10,11,20,3965-3966
vlan 10
  vn-segment 100010
vlan 11
  vn-segment 100011
vlan 20
  vn-segment 100020
vlan 3965
  vn-segment 903965
vlan 3966
  vn-segment 903966

vrf context OVERLAY-TENANT-1
  vni 903966
  rd auto
  address-family ipv4 unicast
    route-target both auto
    route-target both auto evpn
vrf context OVERLAY-TENANT-2
  vni 903965
  rd auto
  address-family ipv4 unicast
    route-target both auto
    route-target both auto evpn
vrf context management

interface Vlan1

interface Vlan10
  no shutdown
  vrf member OVERLAY-TENANT-1
  ip address 10.10.1.254/24
  fabric forwarding mode anycast-gateway

interface Vlan11
  no shutdown
  vrf member OVERLAY-TENANT-1
  ip address 10.11.1.254/24
  fabric forwarding mode anycast-gateway

interface VLAN20
  no shutdown
  vrf member OVERLAY-TENANT-2
  ip address 10.20.1.254/24
  fabric forwarding mode anycast-gateway

interface Vlan3965
  no shutdown
  vrf member OVERLAY-TENANT-2
  ip forward

interface Vlan3966
  no shutdown
  vrf member OVERLAY-TENANT-1
  ip forward

interface nve1
  description NVE1
  no shutdown
  host-reachability protocol bgp
  source-interface loopback0
  member vni 100010
    suppress-arp
    mcast-group 224.1.1.10
  member vni 100011
    suppress-arp
    mcast-group 224.1.1.11
  member vni 100020
    suppress-arp
    mcast-group 224.1.1.20
  member vni 903965 associate-vrf
  member vni 903966 associate-vrf

interface Ethernet1/1
  description SPINE1
  mtu 9216
  medium p2p
  ip unnumbered loopback0
  ip router ospf UNDERLAY area 0.0.0.0
  ip pim sparse-mode
  no shutdown

interface Ethernet1/2
  description SPINE2
  mtu 9216
  medium p2p
  ip unnumbered loopback0
  ip router ospf UNDERLAY area 0.0.0.0
  ip pim sparse-mode
  no shutdown

interface Ethernet1/3
  description TENANT1-VLAN10-SERVER01
  switchport
  switchport access vlan 10
  no shutdown

interface Ethernet1/4
  description TENANT1-VLAN11-SERVER01
  switchport
  switchport access vlan 11
  no shutdown

interface Ethernet1/5
  description TENANT2-VLAN20-SERVER01
  switchport
  switchport access vlan 20
  no shutdown


interface mgmt0
  vrf member management

interface loopback0
  description LEAF1-LOOPBACK
  ip address 10.0.0.3/32
  ip router ospf UNDERLAY area 0.0.0.0
  ip pim sparse-mode
icam monitor scale

line console
line vty
boot nxos bootflash:/nxos64-cs.10.5.2.F.bin
router ospf UNDERLAY
  log-adjacency-changes
router bgp 64500
  log-neighbor-changes
  address-family ipv4 unicast
  address-family l2vpn evpn
  template peer SPINE
    remote-as 64500
    update-source loopback0
    address-family ipv4 unicast
      send-community extended
      soft-reconfiguration inbound
    address-family l2vpn evpn
      send-community
      send-community extended
  neighbor 10.0.0.1
    inherit peer SPINE
  neighbor 10.0.0.2
    inherit peer SPINE
  vrf OVERLAY-TENANT-1
    log-neighbor-changes
    address-family ipv4 unicast
      network 10.10.1.0/24
      network 10.11.1.0/24
  vrf OVERLAY-TENANT-2
    log-neighbor-changes
    address-family ipv4 unicast
      network 10.20.1.0/24
evpn
  vni 100010 l2
    rd auto
    route-target import auto
    route-target export auto
  vni 100011 l2
    rd auto
    route-target import auto
    route-target export auto
  vni 100020 l2
    rd auto
    route-target import auto
    route-target export auto
cli alias name wr copy running-config startup-config

LEAF2 Configuration Link to heading 

hostname LEAF2
vdc LEAF2 id 1
  limit-resource vlan minimum 16 maximum 4094
  limit-resource vrf minimum 2 maximum 4096
  limit-resource port-channel minimum 0 maximum 511
  limit-resource m4route-mem minimum 58 maximum 58
  limit-resource m6route-mem minimum 8 maximum 8

nv overlay evpn
feature ospf
feature bgp
feature pim
feature fabric forwarding
feature interface-vlan
feature vn-segment-vlan-based
feature nv overlay

no password strength-check
username admin password 5 $5$LBPCDG$tYuyUoEnyr/59n5V1PS21wHl5KpS.e.4JiDUCNN0Ja6 role network-admin
no ip domain-lookup
ip domain-name dc1.null0labs.net
copp profile strict
hardware access-list tcam region racl 512
hardware access-list tcam region arp-ether 256 double-wide
snmp-server user admin network-admin auth md5 21607CCB4AC38FD18B1D1E2F7FF389DF62
BA priv aes-128 054F52F75EADD2DF841B086B2DA7DEA1479D localizedV2key
rmon event 1 log trap public description FATAL(1) owner PMON@FATAL
rmon event 2 log trap public description CRITICAL(2) owner PMON@CRITICAL
rmon event 3 log trap public description ERROR(3) owner PMON@ERROR
rmon event 4 log trap public description WARNING(4) owner PMON@WARNING
rmon event 5 log trap public description INFORMATION(5) owner PMON@INFO

fabric forwarding anycast-gateway-mac 0000.1111.1111
ip pim rp-address 10.0.0.254 group-list 224.0.0.0/4
ip pim ssm range 232.0.0.0/8
vlan 1,10,11,20,3965-3966
vlan 10
  vn-segment 100010
vlan 11
  vn-segment 100011
vlan 20
  vn-segment 100020
vlan 3965
  vn-segment 903965
vlan 3966
  vn-segment 903966

vrf context OVERLAY-TENANT-1
  vni 903966
  rd auto
  address-family ipv4 unicast
    route-target both auto
    route-target both auto evpn
vrf context OVERLAY-TENANT-2
  vni 903965
  rd auto
  address-family ipv4 unicast
    route-target both auto
    route-target both auto evpn
vrf context management

interface Vlan1

interface Vlan10
  no shutdown
  vrf member OVERLAY-TENANT-1
  ip address 10.10.1.254/24
  fabric forwarding mode anycast-gateway

interface Vlan11
  no shutdown
  vrf member OVERLAY-TENANT-1
  ip address 10.11.1.254/24
  fabric forwarding mode anycast-gateway

interface Vlan20
  no shutdown
  vrf member OVERLAY-TENANT-2
  ip address 10.20.1.254/24
  fabric forwarding mode anycast-gateway

interface Vlan3965
  no shutdown
  vrf member OVERLAY-TENANT-2
  ip forward

interface Vlan3966
  no shutdown
  vrf member OVERLAY-TENANT-1
  ip forward

interface nve1
 description NVE1
  no shutdown
  host-reachability protocol bgp
  source-interface loopback0
  member vni 100010
    suppress-arp
    mcast-group 224.1.1.10
  member vni 100011
    suppress-arp
    mcast-group 224.1.1.11
  member vni 100020
    suppress-arp
    mcast-group 224.1.1.20
  member vni 903965 associate-vrf
  member vni 903966 associate-vrf

interface Ethernet1/1
  description SPINE1
  mtu 9216
  medium p2p
  ip unnumbered loopback0
  ip router ospf UNDERLAY area 0.0.0.0
  ip pim sparse-mode
  no shutdown

interface Ethernet1/2
  description SPINE2
  mtu 9216
  medium p2p
  ip unnumbered loopback0
  ip router ospf UNDERLAY area 0.0.0.0
  ip pim sparse-mode
  no shutdown

interface Ethernet1/3
  description TENANT1-VLAN10-SERVER02
  switchport
  switchport access vlan 10
  no shutdown

interface Ethernet1/4
  description TENANT1-VLAN11-SERVER02
  switchport
  switchport access vlan 11
  no shutdown

interface Ethernet1/5
  description TENANT2-VLAN20-SERVER02
  switchport
  switchport access vlan 20
  no shutdown


interface mgmt0
  vrf member management

interface loopback0
  description LEAF2-LOOPBACK
  ip address 10.0.0.4/32
  ip router ospf UNDERLAY area 0.0.0.0
  ip pim sparse-mode
icam monitor scale

line console
line vty
boot nxos bootflash:/nxos64-cs.10.5.2.F.bin
router ospf UNDERLAY
  log-adjacency-changes
router bgp 64500
  log-neighbor-changes
  address-family ipv4 unicast
  address-family l2vpn evpn
  template peer SPINE
    remote-as 64500
    update-source loopback0
    address-family ipv4 unicast
      send-community extended
      soft-reconfiguration inbound
    address-family l2vpn evpn
      send-community
      send-community extended
  neighbor 10.0.0.1
    inherit peer SPINE
  neighbor 10.0.0.2
    inherit peer SPINE
  vrf OVERLAY-TENANT-1
    log-neighbor-changes
    address-family ipv4 unicast
      network 10.10.1.0/24
      network 10.11.1.0/24
  vrf OVERLAY-TENANT-2
    log-neighbor-changes
    address-family ipv4 unicast
      network 10.20.1.0/24
evpn
  vni 100010 l2
    rd auto
    route-target import auto
    route-target export auto
  vni 100011 l2
    rd auto
    route-target import auto
    route-target export auto
  vni 100020 l2
    rd auto
    route-target import auto
    route-target export auto
cli alias name wr copy running-config startup-config

LEAF3 Configuration Link to heading 

hostname LEAF3
vdc LEAF3 id 1
  limit-resource vlan minimum 16 maximum 4094
  limit-resource vrf minimum 2 maximum 4096
  limit-resource port-channel minimum 0 maximum 511
  limit-resource m4route-mem minimum 58 maximum 58
  limit-resource m6route-mem minimum 8 maximum 8

nv overlay evpn
feature ospf
feature bgp
feature pim
feature fabric forwarding
feature interface-vlan
feature vn-segment-vlan-based
feature nv overlay

no password strength-check
username admin password 5 $5$ENGEOD$ozMfvIAsvrcVUnmFwZhrBB6OfumOwG3aaCe6RKpB6u5
 role network-admin
no ip domain-lookup
ip domain-name dc1.null0labs.net
copp profile strict
snmp-server user admin network-admin auth md5 365F7CC2DDC1215EC5A9D405754494B1B1
F7 priv aes-128 32097A88C099290695A086562044E98FE0BC localizedV2key
rmon event 1 log trap public description FATAL(1) owner PMON@FATAL
rmon event 2 log trap public description CRITICAL(2) owner PMON@CRITICAL
rmon event 3 log trap public description ERROR(3) owner PMON@ERROR
rmon event 4 log trap public description WARNING(4) owner PMON@WARNING
rmon event 5 log trap public description INFORMATION(5) owner PMON@INFO

fabric forwarding anycast-gateway-mac 0000.1111.1111
ip pim rp-address 10.0.0.254 group-list 224.0.0.0/4
ip pim ssm range 232.0.0.0/8
vlan 1,10-11,20,1001,3965-3966
vlan 10
  vn-segment 100010
vlan 11
  vn-segment 100011
vlan 20
  vn-segment 100020
vlan 1001
  vn-segment 101001
vlan 3965
  vn-segment 903965
vlan 3966
  vn-segment 903966

vrf context OVERLAY-TENANT-1
  vni 903966
  rd auto
  address-family ipv4 unicast
    route-target both auto
    route-target both auto evpn
    route-target import 64500:101001
    route-target import 64500:903965
    route-target import 64500:903965 evpn
    import vrf advertise-vpn
vrf context OVERLAY-TENANT-2
  vni 903965
  rd auto
  address-family ipv4 unicast
    route-target both auto
    route-target both auto evpn
    route-target import 64500:101001
    route-target import 64500:903966
    route-target import 64500:903966 evpn
    import vrf advertise-vpn
vrf context external
  vni 101001
  rd auto
  address-family ipv4 unicast
    route-target both auto
    route-target both auto evpn
    route-target import 64500:903965
    route-target import 64500:903965 evpn
    route-target import 64500:903966
    route-target import 64500:903966 evpn
vrf context management

interface Vlan1

interface Vlan10
  no shutdown
  vrf member OVERLAY-TENANT-1
  ip address 10.10.1.254/24
  fabric forwarding mode anycast-gateway

interface Vlan11
  no shutdown
  vrf member OVERLAY-TENANT-1
  ip address 10.11.1.254/24
  fabric forwarding mode anycast-gateway

interface Vlan20
  no shutdown
  vrf member OVERLAY-TENANT-2
  ip address 10.20.1.254/24
  fabric forwarding mode anycast-gateway

interface Vlan1001
  no shutdown
  vrf member external
  ip forward

interface Vlan3965
  no shutdown
  vrf member OVERLAY-TENANT-2
  ip forward

interface Vlan3966
  no shutdown
  vrf member OVERLAY-TENANT-1
  ip forward

interface nve1
  no shutdown
  description NVE1
  host-reachability protocol bgp
  source-interface loopback0
  member vni 100010
    mcast-group 224.1.1.10
  member vni 100011
    mcast-group 224.1.1.11
  member vni 100020
    mcast-group 224.1.1.20
  member vni 101001 associate-vrf
  member vni 903965 associate-vrf
  member vni 903966 associate-vrf

interface Ethernet1/1
  description SPINE1
  mtu 9216
  medium p2p
  ip unnumbered loopback0
  ip router ospf UNDERLAY area 0.0.0.0
  ip pim sparse-mode
  no shutdown

interface Ethernet1/2
  description SPINE2
  mtu 9216
  medium p2p
  ip unnumbered loopback0
  ip router ospf UNDERLAY area 0.0.0.0
  ip pim sparse-mode
  no shutdown

interface Ethernet1/3
  description TENANT1-VLAN10-SERVER03
  switchport
  switchport access vlan 10
  no shutdown

interface Ethernet1/4
  description TENANT1-VLAN11-SERVER03
  switchport
  switchport access vlan 11
  no shutdown

interface Ethernet1/5
  description TENANT2-VLAN20-SERVER03
  switchport
  switchport access vlan 20
  no shutdown

interface Ethernet1/6
  description UPSTREAM-GW
  vrf member external
  ip address 10.100.0.2/30
  no shutdown


interface mgmt0
  vrf member management

interface loopback0
  description LEAF3-LOOPBACK
  ip address 10.0.0.5/32
  ip router ospf UNDERLAY area 0.0.0.0
  ip pim sparse-mode
icam monitor scale

cli alias name wr copy running-config startup-config
line console
line vty
boot nxos bootflash:/nxos64-cs.10.5.2.F.bin
router ospf UNDERLAY
  log-adjacency-changes
router bgp 64500
  log-neighbor-changes
  address-family ipv4 unicast
  address-family l2vpn evpn
  template peer SPINE
    remote-as 64500
    update-source loopback0
    address-family ipv4 unicast
      send-community extended
      soft-reconfiguration inbound
    address-family l2vpn evpn
      send-community
      send-community extended
  neighbor 10.0.0.1
    inherit peer SPINE
  neighbor 10.0.0.2
    inherit peer SPINE
  vrf OVERLAY-TENANT-1
    log-neighbor-changes
    address-family ipv4 unicast
      network 10.10.1.0/24
      network 10.11.1.0/24
  vrf OVERLAY-TENANT-2
    log-neighbor-changes
    address-family ipv4 unicast
      network 10.20.1.0/24
  vrf external
    address-family ipv4 unicast
      aggregate-address 10.10.1.0/24 summary-only
      aggregate-address 10.11.1.0/24 summary-only
      aggregate-address 10.20.1.0/24 summary-only
    neighbor 10.100.0.1
      remote-as 64501
      address-family ipv4 unicast
evpn
  vni 100010 l2
    rd auto
    route-target import auto
    route-target export auto
  vni 100011 l2
    rd auto
    route-target import auto
    route-target export auto
  vni 100020 l2
    rd auto
    route-target import auto
    route-target export auto

Tenant Connectivity Tests Link to heading

Tenant 1 Link to heading

Ping VLAN 10 host to VLAN 11 host and Traces Link to heading

Ping Tenant 1 V10 ↔ V11

Tenant Link to heading

Ping within VLAN 20 and to External and VLAN 10 Link to heading

Ping Tenant 2

Wrapping Up Link to heading

This lab demonstrates VXLAN EVPN overlays in a leaf-spine fabric.