Hardware Distributed VXLAN Using the Gateway/Spine/Leaf Three-Layer Architecture
Figure 1 shows the hardware distributed VXLAN using the gateway/spine/leaf three-layer architecture. Border leaf nodes function as egress gateways, also called north-south gateways. Leaf nodes are used as distributed VXLAN gateways, also called east-west gateways. Spine nodes aggregate east-west traffic.
- Overall design:
- Extend the border leaf node group flexibly based on the service type and scale, as shown in Figure 2.
- Deploy ARP broadcast suppression globally and traffic suppression on an interface to prevent broadcast traffic from being flooded. ARP proxy can be also configured, which is the secondary choice. Then traffic is imported to the corresponding gateway, and the gateway monitors Layer 2 traffic.
- Border leaf node:
- Border leaf nodes can constitute an M-LAG or a stack. It is easier to deploy and maintain the stack, but the service interruption time is long during version upgrade. M-LAG is therefore recommended.
- Routers, border leaf nodes, and spine nodes are connected through Layer 3 routed interfaces, implementing ECMP-based forwarding. This design achieves load balancing of traffic, non-blocking forwarding, and fast convergence.
- Spine node:
- The spine node is deployed in standalone mode and aggregates east-west traffic, so it needs to provide large-capacity switching. You are advised to use the CE12800 as the spine node because the CE12800 can allow connected leaf nodes to be extended.
- The spine node is used as the RR of BGP EVPN.
- Leaf node:
- When NICs of a server are connected in load balancing mode, leaf nodes support multiple networking such as the stack, M-LAG, and SVF composed of fixed devices. M-LAG is recommended because of its high reliability. When NICs of a server are connected in active/standby mode, leaf nodes use the standalone mode.
- When server leaf nodes constitute an M-LAG, the Monitor Link group needs to be deployed. The uplink is associated with all downlinks, preventing traffic interruption when the uplink fails.