NX-OS EVPN/VXLAN Fabric Implementation and Intent Automation

On this page

Topic – NX-OS EVPN/VXLAN Fabric Implementation and Intent Automation
Overview
Context
Applicable Principles
Decisions
Current State
Fabric baseline (roles, underlay, overlay, border, services)
ESI multihoming profile (Location B)
Automation operating contract
Lifecycle procedures (canonical minimum)
OpenShift integration boundaries
Future Work

Topic – NX-OS EVPN/VXLAN Fabric Implementation and Intent Automation

Overview

Implementation profile for the Location B EVPN/VXLAN lane on Cisco Nexus 9000 with NX-OS.

This note owns execution mechanics (device profile, automation contract, runbook checkpoints). Decision authority stays in ADRs and architecture notes.

Context

Location B is the target production lane from adr-019-hybrid-network-rollout-aci-a-ai-only-evpn-b-target. This implementation must stay deterministic, evidence-backed, and compatible with border/interconnect policy from adr-021-dc-evpn-to-backbone-l3vpn-interconnect.

Source references for module behavior and platform constraints are captured in source-cisco-nxos-ansible-best-practices, source-cisco-nxos-evpn-esi-multihoming, and source-nxos-config-replace.

Applicable Principles

Automation First — config generation replaces manual changes.
Reliability and Resilience — fabric changes protect stability.
Observability by Default — evidence is captured per change.

Decisions

adr-019-hybrid-network-rollout-aci-a-ai-only-evpn-b-target sets lane scope and rollout constraints.
adr-002-nxos-config-replace sets full replace deployment as baseline.
adr-018-network-validation-ansible-vendor-cli sets mandatory gate and evidence model.
adr-021-dc-evpn-to-backbone-l3vpn-interconnect sets interconnect default and exception path.

Current State

Fabric baseline (roles, underlay, overlay, border, services)

Role	Baseline behavior
Spine	Underlay transit and EVPN control-plane peering only; no tenant gateways.
Leaf	VTEP termination, anycast gateways, tenant VRFs, and VLAN/VNI realization.
Border leaf	North-south and interconnect policy boundary with controlled route imports/exports.

Underlay uses leaf-to-spine L3 point-to-point eBGP; no leaf-to-leaf or spine-to-spine data links.
Overlay uses EVPN MP-BGP sessions with deterministic L2VNI/L3VNI mapping from NetBox.
Route-target policy enforces tenant isolation; unauthorized RT imports are blocker failures.
MTU and BFD values are train-specific and must be pinned in NetBox execution profiles.

ESI multihoming profile (Location B)

EVPN ESI is the target multihoming profile.
Next-hop behavior follows active-peer count: VIP with 2+ peers, PIP with a single peer.
L2FRR, core-link tracking, and delay-restore controls are required for stable recovery.
vPC is interoperability fallback only and cannot be mixed with ESI mode on the same VTEP role.
Scope and limits are release-pinned; for validated NX-OS 10.6(x), in-scope designs support up to 4-way ESI.

Automation operating contract

Git is the approval boundary for desired intent and generated artifacts.
NetBox is authoritative for inventory and render inputs; static host inventories are out of baseline scope.
AAP workflow stages are mandatory: precheck -> approval -> deploy -> postcheck -> evidence.
Deploy stage uses staged file plus nxos_config replace: config per adr-002-nxos-config-replace.

Gate	Minimum checks	Hard fail examples
`precheck`	inventory completeness, command profile, parser assertions	missing required data, unhealthy baseline
`approval`	human diff review and rollback plan	missing approval or rollback plan
`deploy`	staged file plus replace execution on intended device set	partial coverage, replace failure
`postcheck`	convergence checks and policy negatives	route leak, convergence regression
`evidence`	raw output, parsed output, parser version, actor/change metadata	incomplete artifact set

Lifecycle procedures (canonical minimum)

Procedure	Minimum outcome
New fabric slice	NetBox inventory complete, generated artifacts pass parser checks, first deploy closes with evidence.
Add leaf cluster	Underlay and EVPN adjacencies established, ESI status healthy, evidence attached.
Add tenant VRF and `L3VNI`	Intended routes visible only in authorized VRFs, leak negatives pass.
Add VLAN and `L2VNI`	Segment operational on intended leafs without unrelated RT drift.
Expand border interconnect	Border policy applies as rendered; interconnect evidence confirms expected behavior.
Brownfield onboarding	Reconciled inventory promotes through the same standard workflow and gates.

Detailed step-by-step runbooks are maintained in delivery assets and change procedures for wp-01-dc3-0-network-and-supporting-services.

OpenShift integration boundaries

HCP and platform services require dedicated management reachability, stable VIP handling, and MTU consistency.
Provider route import for OpenShift Virtualization and routed workloads is preferred over static per-node routes.
FRR/BGP imports must be filtered and scoped to intended VRFs only.
Pod-level VRF behavior follows source-ocp-multiple-networks-vrf.
OKEP-5088 EVPN integration remains roadmap-only until release-pinned supportability evidence is accepted.

Future Work

Publish RT policy conventions and RD mode standards with NetBox validation rules.
Add automated compliance checks for BGP, BFD, MTU, and ESI health.
Produce a lab validation report for HCP and OpenShift Virtualization route import.
Define release supportability gates before enabling OVN EVPN as a baseline path.
Add explicit interconnect failover evidence gates that separate EVPN convergence from backbone transport failover.