EVPN

EVPN (Ethernet VPN) provides a control-plane solution for VXLAN overlay networks on NX-OS, enabling scalable Layer 2 and Layer 3 connectivity across data center fabrics through BGP-based MAC and IP route advertisement. It manages per-VNI configuration including route distinguisher assignment, route target import/export policies for both auto-derived and explicitly defined targets, and table map filtering for route policy control. EVPN also supports multisite border gateway configuration for interconnecting multiple VXLAN EVPN fabrics, including site ID assignment, PIP advertisement, delay-restore timers, DF election timers, per-site split-horizon control, and EVPN storm control for broadcast, multicast and unknown unicast traffic across the DCI. It also covers EVPN ESI multihoming (NX-OS 10.6(1) or later), including the global system MAC, designated forwarder (DF) election mode and timer, EAD/EVI route advertisement, ethernet segment delay-restore timer and L2 fast reroute anycast source IP. EVPN is essential for modern VXLAN fabric deployments, enabling distributed anycast gateway, ARP suppression, and seamless workload mobility across leaf switches.

EVPN (Ethernet VPN) provides a control-plane solution for VXLAN overlay networks on NX-OS, enabling scalable Layer 2 and Layer 3 connectivity across data center fabrics through BGP-based MAC and IP route advertisement. It manages per-VNI configuration including route distinguisher assignment, route target import/export policies for both auto-derived and explicitly defined targets, and table map filtering for route policy control. EVPN also supports multisite border gateway configuration for interconnecting multiple VXLAN EVPN fabrics, including site ID assignment, PIP advertisement, delay-restore timers, DF election timers, and per-site split-horizon control. EVPN is essential for modern VXLAN fabric deployments, enabling distributed anycast gateway, ARP suppression, and seamless workload mobility across leaf switches.

Diagram

Classes

nxos

Name	Type	Constraint	Mandatory
devices	List	devices	No
device_groups	List	device_groups	No
global	Class	global	No
templates	List	templates	No

devices (nxos)

Name	Type	Constraint	Mandatory	Default Value
configuration	Class	configuration	No

device_groups (nxos)

Name	Type	Constraint	Mandatory	Default Value
configuration	Class	configuration	No

global (nxos)

Name	Type	Constraint	Mandatory	Default Value
configuration	Class	configuration	No

templates (nxos)

Name	Type	Constraint	Mandatory	Default Value
configuration	Class	configuration	No

configuration (nxos.devices)

Name	Type	Constraint	Mandatory	Default Value
evpn	Class	evpn	No

evpn (nxos.devices.configuration)

Name	Type	Constraint	Mandatory
multisite_border_gateway	Class	multisite_border_gateway	No
multihoming	Class	multihoming	No
storm_control	Class	storm_control	No
vnis	List	vnis	No

evpn (nxos.devices.configuration)

Name	Type	Constraint	Mandatory	Default Value
multisite_border_gateway	Class	multisite_border_gateway	No
vnis	List	vnis	No

multisite_border_gateway (nxos.devices.configuration.evpn)

Name	Type	Constraint	Mandatory
site_id	Integer	min: `1`, max: `281474976710655`	Yes
dci_advertise_pip	Boolean	`true`, `false`	No
delay_restore_time	Integer	min: `30`, max: `1000`	No
df_election_time	Number	min: `1`, max: `1000`	No
fabric_advertise_pip	Boolean	`true`, `false`	No
split_horizon_per_site	Boolean	`true`, `false`	No

multihoming (nxos.devices.configuration.evpn)

Name	Type	Constraint	Mandatory
enabled	Boolean	`true`, `false`	No
system_mac	MAC		No
df_election_mode	Choice	`per-flow`, `modulo`	No
df_election_time	Number	min: `1`, max: `3`	No
ead_evi_route	Boolean	`true`, `false`	No
ethernet_segment_delay_restore_time	Integer	min: `30`, max: `1000`	No
frr_anycast_source_ip	IP		No

storm_control (nxos.devices.configuration.evpn)

Name	Type	Constraint	Mandatory
broadcast_level	Number	min: `0`, max: `100`	No
multicast_level	Number	min: `0`, max: `100`	No
unicast_level	Number	min: `0`, max: `100`	No

vnis (nxos.devices.configuration.evpn)

Name	Type	Constraint	Mandatory
vni	Integer	min: `1`, max: `16777215`	Yes
rd	String		No
route_target_both_auto	Boolean	`true`, `false`	No
route_target_imports	List	String	No
route_target_exports	List	String	No
table_map	String		No
table_map_filter	Boolean	`true`, `false`	No

Examples

Example 1: L2 VNI with auto route targets for VXLAN bridging

nxos:
  devices:
    - name: LEAF1
      configuration:
        evpn:
          vnis:
            - vni: 10101
              rd: 10.1.100.3:10101
              route_target_both_auto: true
            - vni: 10102
              rd: 10.1.100.3:10102
              route_target_both_auto: true

Example 2: L2 and L3 VNIs with explicit route targets for multi-tenant fabric

nxos:
  devices:
    - name: LEAF1
      configuration:
        evpn:
          vnis:
            # L2 VNIs for bridged traffic
            - vni: 10101
              rd: 10.1.100.3:10101
              route_target_imports:
                - "65000:10101"
              route_target_exports:
                - "65000:10101"
            - vni: 10102
              rd: 10.1.100.3:10102
              route_target_imports:
                - "65000:10102"
              route_target_exports:
                - "65000:10102"
            # L3 VNIs for routed traffic per VRF
            - vni: 11010
              rd: 10.1.100.3:11010
              route_target_imports:
                - "65000:11010"
              route_target_exports:
                - "65000:11010"
            - vni: 11020
              rd: 10.1.100.3:11020
              route_target_imports:
                - "65000:11020"
              route_target_exports:
                - "65000:11020"

Example 3: EVPN VNIs with shared route targets for cross-leaf L2 stretching and table map filtering

nxos:
  devices:
    - name: LEAF2
      configuration:
        evpn:
          vnis:
            - vni: 10101
              rd: 10.1.100.4:10101
              route_target_both_auto: true
              table_map: EVPN-TABLE-MAP
              table_map_filter: true
            - vni: 10102
              rd: 10.1.100.4:10102
              route_target_both_auto: true
            - vni: 11010
              rd: 10.1.100.4:11010
              route_target_both_auto: true
            - vni: 11020
              rd: 10.1.100.4:11020
              route_target_both_auto: true

Example 4: EVPN multisite border gateway for DCI with PIP advertisement and split-horizon

nxos:
  devices:
    - name: BORDER-GW1
      configuration:
        evpn:
          multisite_border_gateway:
            site_id: 1
            dci_advertise_pip: true
            delay_restore_time: 300
            df_election_time: 2
            fabric_advertise_pip: true
            split_horizon_per_site: true
          storm_control:
            broadcast_level: 10.5
            multicast_level: 20
            unicast_level: 15
          vnis:
            - vni: 10101
              rd: 10.1.100.5:10101
              route_target_both_auto: true
            - vni: 11010
              rd: 10.1.100.5:11010
              route_target_both_auto: true

Example 5: EVPN ESI multihoming with modulo DF election and L2 fast reroute (requires NX-OS 10.6(1) or later)

nxos:
  devices:
    - name: LEAF3
      configuration:
        evpn:
          multihoming:
            enabled: true
            system_mac: 0000.3456.3456
            df_election_mode: modulo
            df_election_time: 1
            ead_evi_route: true
            ethernet_segment_delay_restore_time: 180
            frr_anycast_source_ip: 203.0.113.1

Examples

Example 1: L2 VNI with auto route targets for VXLAN bridging

nxos:
  devices:
    - name: LEAF1
      configuration:
        evpn:
          vnis:
            - vni: 10101
              rd: 10.1.100.3:10101
              route_target_both_auto: true
            - vni: 10102
              rd: 10.1.100.3:10102
              route_target_both_auto: true

Example 2: L2 and L3 VNIs with explicit route targets for multi-tenant fabric

nxos:
  devices:
    - name: LEAF1
      configuration:
        evpn:
          vnis:
            # L2 VNIs for bridged traffic
            - vni: 10101
              rd: 10.1.100.3:10101
              route_target_imports:
                - "65000:10101"
              route_target_exports:
                - "65000:10101"
            - vni: 10102
              rd: 10.1.100.3:10102
              route_target_imports:
                - "65000:10102"
              route_target_exports:
                - "65000:10102"
            # L3 VNIs for routed traffic per VRF
            - vni: 11010
              rd: 10.1.100.3:11010
              route_target_imports:
                - "65000:11010"
              route_target_exports:
                - "65000:11010"
            - vni: 11020
              rd: 10.1.100.3:11020
              route_target_imports:
                - "65000:11020"
              route_target_exports:
                - "65000:11020"

Example 3: EVPN VNIs with shared route targets for cross-leaf L2 stretching and table map filtering

nxos:
  devices:
    - name: LEAF2
      configuration:
        evpn:
          vnis:
            - vni: 10101
              rd: 10.1.100.4:10101
              route_target_both_auto: true
              table_map: EVPN-TABLE-MAP
              table_map_filter: true
            - vni: 10102
              rd: 10.1.100.4:10102
              route_target_both_auto: true
            - vni: 11010
              rd: 10.1.100.4:11010
              route_target_both_auto: true
            - vni: 11020
              rd: 10.1.100.4:11020
              route_target_both_auto: true

Example 4: EVPN multisite border gateway for DCI with PIP advertisement and split-horizon

nxos:
  devices:
    - name: BORDER-GW1
      configuration:
        evpn:
          multisite_border_gateway:
            site_id: 1
            dci_advertise_pip: true
            delay_restore_time: 300
            df_election_time: "2.0"
            fabric_advertise_pip: true
            split_horizon_per_site: true
          vnis:
            - vni: 10101
              rd: 10.1.100.5:10101
              route_target_both_auto: true
            - vni: 11010
              rd: 10.1.100.5:11010
              route_target_both_auto: true