Four-Spine Fabric Sizing and STP-Free Migration
Your company is replacing a 3-tier STP network with a Juniper EVPN-VXLAN spine-leaf fabric for a single data center. The design has 12 racks, each with two 48-port 25G leaf switches, and four 100G spine switches. Each leaf has six 100G uplinks; each server is dual-homed 25G to its rack leaves. Two tenants need Layer 2 extension, 500 VLANs total, and a shared services VRF. The business requires no more than 4:1 oversubscription from leaf to spine and no STP in the server-facing topology. The existing network has 8-second outages during STP reconvergence and a flat OSPF area. You must choose an underlay routing design, place border functionality, and plan the migration. The CIO also asks whether four spines are enough for full redundancy during a single spine failure.
1. Calculate the leaf-to-spine oversubscription for one leaf using the stated port counts, and determine whether a single spine failure still meets the 4:1 requirement. State your assumptions about server dual-homing.
Read the worked answer
Access port capacity per leaf is 48 x 25G = 1,200G. Uplink capacity is 6 x 100G = 600G, so the port-level subscription is 2:1. Because each server is dual-homed, each leaf has only 24 directly attached servers, so offered access bandwidth is 24 x 25G = 600G; that is 1:1 against the uplinks, but the 2:1 port-level figure is the safer design number.
For a single spine failure, six uplinks cannot be split evenly across four spines: two spines will carry two links and two will carry one. If a two-link spine fails, the leaf retains 4 x 100G = 400G; 1,200/400 = 3:1, which still meets the 4:1 requirement. If a one-link spine fails, the ratio is 1,200/500 = 2.4:1. Therefore four spines are sufficient for the stated requirement, but the uplink distribution must be documented and verified per leaf; if any leaf has a different pattern, recalculate it.
2. Recommend an underlay routing design and ASN plan for this fabric. Explain why you would not simply extend the existing flat OSPF area, and how the design supports fast reconvergence and ECMP.
Read the worked answer
Use an eBGP underlay with a common spine AS, for example 65000 on all four spines, and a unique leaf AS from 65101 to 65124. Assign a /31 per leaf-spine link and a /32 loopback per device; advertise only loopbacks and fabric links via an export policy. Enable BFD on every underlay session and multipath so the four equal-cost paths to each remote loopback are installed. The overlay can be iBGP with the spines as route reflectors in a separate overlay AS.
I would not extend the flat OSPF area because it preserves the same failure domain and gives less control over summarization and policy. The 8-second STP outages are a Layer 2 problem, but a flat IGP also makes reconvergence and troubleshooting less predictable. eBGP gives explicit neighbor policy, fast BFD-driven failure detection, and clear ECMP behavior. OSPF could be made to work with BFD and areas, but it adds design work without a clear advantage here.
3. Where should border functionality and anycast gateway be placed for the two tenants and shared services VRF, and how does this avoid STP while allowing controlled route leaking?
Read the worked answer
Place border functionality on a dedicated pair of border leaves, not on every leaf, and connect them to the DCI and firewall. Each tenant gets a VRF; shared services gets its own VRF. Configure distributed anycast gateway on every leaf for the tenant VLANs using the same virtual MAC and IP per subnet, so a server default gateway is local and no STP is needed in the server-facing topology. Dual-homed servers use ESI-LAG with EVPN multihoming.
Route leaking between tenant VRFs and shared services is done at the border with explicit route-target import and export policies, not by stretching every VLAN. For migration, build the fabric in parallel, migrate one rack at a time, use ESI-LAG for dual-homed servers, and keep the old STP network until each rack passes validation. This avoids a flag-day cutover and keeps STP out of the new server-facing design.