VXLAN/EVPN Overlay Networking
How VXLAN works
VXLAN wraps the original Ethernet frame in a UDP/IP packet (destination UDP port 4789) with an 8-byte VXLAN header carrying a 24-bit VNI - up to roughly 16 million segments. The encapsulating device is a VTEP, normally identified by a loopback address. The underlay routes between VTEPs; the overlay is the tenant's Layer 2/Layer 3 world. Allow about 50 bytes of overhead when sizing MTU.
Why EVPN replaced flood-and-learn
With multicast or ingress-replication VXLAN, MAC learning is data-plane driven and BUM traffic is flooded. EVPN makes BGP the control plane and distributes reachability: type 1 Ethernet auto-discovery, type 2 MAC/IP, type 3 inclusive multicast (BUM), type 4 Ethernet segment, type 5 IP prefix. Type 2 is the workhorse for MAC and ARP; type 5 carries prefix routes in L3VNI designs. Route targets control import/export; route distinguishers make routes unique per VTEP. Know distributed anycast gateway (same IP and virtual MAC on every leaf) and ARP/ND suppression, which stop ARP flooding across the fabric.
Traps
- Sessions Established but no prefixes: missing extended-community sending, so RTs never leave the router.
- VNI-to-VLAN mapping mismatch: VLAN exists, tunnel is up, nothing forwards.
- Expecting EVPN to build the underlay - it carries only the overlay.
- Assuming ARP suppression caches everything; silent hosts and first packets still flood.
- Confusing type 5 (prefix) with type 2 (MAC/IP) when asked what carries a subnet.
Rule of thumb
Troubleshoot in layers: is the VTEP loopback reachable (underlay), is the type 3 route present for every VNI (control plane), is the type 2 present (learning), does the VNI map to the right VLAN (data plane)?