Calder University: EVPN-VXLAN, PoE, and Multicast in a 10-Week Summer Window
Calder University is refreshing a three-building campus: 14,000 wired ports, 850 Mist APs, 2,100 PoE cameras, and 600 VLANs accumulated over 15 years. The core is a pair of EX9200s; building distribution is EX4650; access is mixed EX3400 and EX4300. The 10G riser is at 70% peak utilization during class changes. Wi-Fi 6E APs need 2.5G/5G uplinks and PoE+, cameras need 802.3at, and the IPTV service uses dense multicast that currently floods every access switch. A new CIO wants EVPN-VXLAN, but the network team has no BGP or VXLAN experience and a 10-week summer window. The residence halls need segmented guest access with per-user policy, and the campus has a single 40G internet edge.
1. Should Calder deploy EVPN-VXLAN in the summer window, and what architecture would you actually commit to?
Read the worked answer
EVPN-VXLAN is the right target but not a 10-week big-bang with no BGP or VXLAN skills. Use a two-step. First stabilize the underlay and collapse VLANs with a routed access layer or a limited EVPN fabric in one building. Second extend to all three after training and a pilot. If the CIO insists on the full fabric, require a partner for design review and a lab proof of concept, and keep the summer window for physical work.
EVPN-VXLAN solves VLAN sprawl and enables anycast gateways and per-tenant segmentation, but it does not fix a 70% utilized 10G riser. Uplift the riser to 40G or add a second 10G pair before overlay. Keep multicast in the underlay with PIM-SM and IGMP snooping; do not stretch it blindly across VXLAN without an RP design. The decision is sequencing, not ideology.
2. How do you calculate PoE and uplink capacity for 850 Wi-Fi 6E APs and 2,100 cameras?
Read the worked answer
Calculate PoE per switch, not per building. 850 Wi-Fi 6E APs at PoE+ (30W) is 25.5 kW; 2,100 cameras at 802.3at (30W) is 63 kW; total about 88.5 kW before cable loss and headroom. At 80% utilization, plan roughly 110 kW of PoE capacity. Verify power supplies and UPS/generator load.
Wi-Fi 6E APs need multi-gigabit uplinks, so access switches need 2.5G or 5G ports, and the riser needs 40G. Do not buy 1G access for 6E APs and then cap throughput at the port. Model peak simultaneously powered ports, because cameras and APs are always on. Include a spare-port and spare-power budget of at least 10% so a failed supply does not force a closet redesign.
3. How do you handle residential segmentation, per-user policy, and IPTV multicast without recreating VLAN sprawl?
Read the worked answer
Segment residences from academic and administrative networks at the fabric edge. Use EVPN with separate VRFs or VLANs per policy domain, and enforce guest-to-guest isolation at the access switch or AP. For per-user policy, authenticate students with 802.1X or Mist Access Assurance and map to a role; do not rely on VLAN sprawl.
Multicast for IPTV should use IGMP snooping and a defined RP, with the source in a services VRF and receivers in the residential VRF only if the design supports it; otherwise keep IPTV in its own underlay VLAN. Test failover of the 40G internet edge and the fabric before the semester, and document the rollback to the legacy design for each phase. Per-user policy should be expressed as role and intent, not as a new VLAN per cohort.