Introduction

Traditional three-tier data center networks were designed around north-south traffic.

Modern data centers are dominated by east-west traffic. Servers talk to servers, applications talk to databases, containers move around, virtual machines move around, and suddenly your network topology is expected to behave more like a fabric than a hierarchy.

That is where spine-leaf and EVPN-VXLAN come in.

Spine-leaf

A spine-leaf architecture uses leaf switches as the access layer and spine switches as the fabric.

Every leaf connects to every spine, creating multiple equal-cost paths.

Instead of relying on a large spanning-tree topology, modern fabrics commonly use Layer 3 routing and ECMP.

The result is predictable, scalable connectivity and much better use of available links.

Underlay vs overlay

The underlay is the physical routed network.

Its job is simple: provide IP reachability between the devices that participate in the fabric.

The overlay is built on top of it.

Keeping the two concepts separate makes troubleshooting dramatically easier.

If the underlay cannot reach a VTEP, the overlay cannot magically fix that.

VXLAN

VXLAN encapsulates Layer 2 Ethernet frames inside UDP/IP.

This allows Layer 2 segments to be extended across a Layer 3 transport network.

VXLAN uses a 24-bit VNI, giving a vastly larger identifier space than traditional VLANs.

That matters because data centers increasingly need segmentation beyond what traditional VLAN numbering was designed to provide.

VTEPs

VXLAN Tunnel Endpoints, or VTEPs, encapsulate and decapsulate VXLAN traffic.

Typically, the leaf switch performs this role.

A host sends an ordinary Ethernet frame. The leaf determines where the destination lives, encapsulates the traffic in VXLAN and sends it across the IP underlay.

The remote VTEP removes the VXLAN header and delivers the original frame.

EVPN

VXLAN solves encapsulation. EVPN provides a control plane.

BGP EVPN distributes information about MAC addresses, IP addresses and network reachability.

This is important because large networks should not rely on flooding and learning everything dynamically through data-plane behavior.

The control plane knows where things are and can advertise that information across the fabric.

Anycast gateway

Modern fabrics often use an anycast gateway on multiple leaf switches.

The default gateway IP and MAC are consistent across the fabric, allowing endpoints to use the same gateway regardless of which leaf they are connected to.

This is especially useful for workload mobility and distributed Layer 3 forwarding.

Troubleshooting EVPN-VXLAN

Again, work from the bottom up.

First check the physical links.

Then check the underlay routing.

Then verify VTEP loopback reachability.

Then check VXLAN tunnels and VNIs.

Then check BGP EVPN sessions and route advertisements.

Finally check MAC/IP learning and the endpoint itself.

Do not start troubleshooting EVPN by staring at a MAC address table for twenty minutes. If the underlay cannot reach the VTEP, the MAC table is not where your problem lives.

What actually matters

The biggest conceptual shift is this:

The data center is no longer a collection of isolated VLANs connected by a giant tree.

It is a routed fabric.

The underlay provides transport. VXLAN provides encapsulation. EVPN provides the control plane.

Once those roles are clear, EVPN-VXLAN stops looking like a collection of random acronyms and starts looking like a reasonably logical system.