Data Center Network Design
Data Center Network Design
This domain tests spine-leaf IP fabrics, EVPN-VXLAN overlays, QFX platform choices, automation and security segmentation for east-west traffic. The exam expects a clear underlay and overlay story.
Core rules
- Build a spine-leaf IP fabric with an eBGP underlay, unique leaf ASNs and stable loopbacks. Keep the underlay simple and the overlay policy-rich.
- Use EVPN as the overlay control plane and VXLAN as the data plane. Anycast gateway provides consistent first-hop services; ESI multihoming or MC-LAG provides server redundancy.
- Size underlay MTU for VXLAN overhead. VXLAN adds 50 bytes, so jumbo frames are common on fabric links.
- Plan oversubscription from east-west traffic. One-to-one or three-to-one is typical at the leaf; spine capacity follows server and storage flows.
- Segment tenants and workloads with VLANs, VRFs and firewall insertion. vSRX or SRX provides tenant security, while Policy Enforcer can coordinate enforcement.
- Automate with Apstra intent-based templates, Contrail or ZTP. Consistent ASN, loopback and MTU intent prevents drift.
Worked example
Two spines and eight leaves support 40 racks. Reasoning: eBGP underlay with unique leaf ASNs and ECMP provides resilient paths. EVPN-VXLAN with anycast gateways supports workload mobility; ESI multihoming connects dual-homed servers without STP. Underlay MTU is raised for VXLAN overhead, and a vSRX pair inspects inter-tenant traffic. Apstra templates enforce ASN, loopback and MTU intent. Oversubscription is sized for east-west storage replication, not just north-south internet traffic.
Traps that cost marks
- Extending spanning tree across a large fabric.
- Forgetting VXLAN MTU overhead.
- Inconsistent anycast gateway MAC or ASN design.
- Sizing only for north-south traffic.
- Applying security only at the data-center edge.