One network across multiple data centres — it sounds simple, and with a wavelength or an Ethernet line between two sites you do get there. But as soon as it becomes three or more, or you want redundant paths, classic Layer 2 runs up against the limits of its own design. EVPN-VXLAN is the answer the networking world has standardised on — and the technology on which we deliver our own multipoint L2 services.
Why classic L2 over WAN creaks
Ethernet was designed for a single cable, not for a country. Stretch a classic L2 domain across multiple locations and you take its weaknesses with you:
- Spanning tree — redundant paths are blocked instead of used. So one half of your expensive dual link just sits idle, and a topology change brings the whole domain to a brief standstill.
- Flood-and-learn — a switch that does not know a MAC address sends the frame everywhere. Over a WAN link that is flooding at its most expensive, and a broadcast storm at one site drags all sites down.
- Scale — 4,096 VLANs sounds ample, until as a service provider you have to carry several customers, each with their own VLAN ranges, over the same infrastructure.
VXLAN: the dataplane
VXLAN solves the transport problem with a simple idea: put the Ethernet frame inside a UDP packet and send it over an ordinary routed IP network. The devices that wrap and unwrap are called VTEPs (VXLAN Tunnel Endpoints); the network underneath — the underlay — sees only IP traffic.
That has two major consequences. First: the underlay stays routed, so all paths are active (ECMP) and failover is a routing matter rather than a spanning-tree event. Second: the segment ID (VNI) is 24 bits — well over 16 million separate networks instead of 4,096 VLANs. Every customer gets their own VNIs; traffic from different customers never touches.
EVPN: the control plane
VXLAN only says how frames are carried — not who sits where. Without further intelligence you still fall back on flood-and-learn, only now inside tunnels. That is where EVPN comes in: a BGP address family (RFC 7432, with VXLAN as the dataplane in RFC 8365) that distributes MAC addresses — and the IPs that go with them — as routes.
Every VTEP advertises over BGP which MAC addresses live behind it. The result:
- No flooding to learn — every VTEP knows where an address sits before the first frame leaves, and answers ARP requests locally (ARP suppression);
- Active-active multihoming — a customer connection to two switches at once (ESI), with both ports in use instead of one on standby;
- Fast convergence — if a VTEP or link drops out, BGP withdraws all the associated addresses in one go (mass withdrawal) and routes around it — no domain down for minutes but sub-second recovery, especially in combination with BFD.
That EVPN is simply BGP is not a detail: it is the same protocol that ties the internet together — proven, scalable and steerable with policy.
Old and new side by side
| Classic L2 / VPLS | EVPN-VXLAN | |
|---|---|---|
| Redundant paths | blocked (spanning tree) | all active (ECMP) |
| Learning MAC addresses | flood-and-learn | advertised over BGP |
| Multihoming | active-passive | active-active (ESI) |
| Segments | 4,096 VLANs | 16.7 million VNIs |
| Recovery after a failure | topology recalculation | route withdrawal, sub-second |
One standard — with a twist at every vendor
EVPN-VXLAN is deliberately not a vendor trick: it is an open IETF standard that virtually every manufacturer implements. That is its strength — your design is not married to a single supplier and the knowledge is transferable.
But anyone who works with it in practice knows: every vendor adds its own quirks. Subtle differences in how multihoming (ESI) is implemented, which defaults and route-target derivations apply, exactly how routing between segments (IRB) is handled. Within a single ecosystem everything clicks together seamlessly; tying equipment from different vendors into one fabric is not simply plug and play — that calls for testing, feature by feature, what is genuinely interoperable. So in practice you design a fabric within a single vendor domain, with the open standard as the guarantee that you can move away later without a redesign.
How we run it
Our network between the Dutch data centres is such an EVPN-VXLAN fabric: the underlay is our own routed network over dark fibre we light ourselves, and the fabric runs on equipment we operate ourselves. Take an EVPN service from us and you get your own, strictly separated segment on it: two, three or more data centres that behave as one LAN — with all paths active and automatic recovery in the event of a failure.
And the nice part for you: you notice none of the above. The handoff is plain Ethernet at 1 to 100 gigabit, you keep your own VLANs and IP plan, and the fabric does the rest.