ADR-021 DC EVPN to backbone L3VPN interconnect pattern

Context and Problem Statement

The datacenter lane uses EVPN/VXLAN and the backbone uses L3VPN over SR-MPLS. Without a fixed interconnect pattern, teams introduce inconsistent route leaks, uncontrolled L2 extension, and unclear failover ownership.

We need one default EVPN-to-backbone pattern and a strict exception path for L2 stretch.

Decision Drivers

• Predictable and auditable tenant VRF interconnect behavior.
• Bounded failure domains across sites.
• Measurable route-policy and failover evidence.

Considered Options

1. Default L3 interconnect: EVPN VRF to L3VPN VRF at border gateways.
2. Default L2 stretch across sites for mobility scenarios.
3. Mixed default without a canonical pattern (case-by-case by team).

Decision Outcome

Decision remains draft. Working direction is Option 1.

Default interconnect uses L3 VRF handoff at border gateways (EVPN VRF -> border -> L3VPN VRF). L2 stretch across sites is exception-only and requires ADR-level approval with explicit rollback controls.

Next Decision Trigger

• Decision owner: Network Architecture with Platform Architecture review.
• Promote to accepted when border policy templates are approved and route-leak negative tests pass in operational evidence.
• Any workload requesting cross-site L2 semantics requires a dedicated exception ADR before production enablement.

Pros and Cons of the Options

Option 1 – Default L3 VRF interconnect (working direction)

• Good: Keeps WAN/backbone clear of broadcast-domain expansion.
• Good: Concentrates route policy control at border gateways.
• Bad: Requires disciplined policy design and testing per tenant class.

Option 2 – Default L2 stretch

• Good: Simplifies some mobility cases.
• Bad: Expands fault domains and operational risk.

Option 3 – No canonical pattern

• Good: Short-term local flexibility.
• Bad: Inconsistent implementation and audit outcomes.