EVPN with VRF instances provides the required Layer 3 segmentation and traffic isolation. Each environment (development, testing, production) can be placed in its own VRF, which is then mapped to specific VNIs. The use of BGP EVPN route-targets allows for precise control over which routes (and thus which VNIs) are imported into each VRF, ensuring complete isolation while maintaining a single, scalable underlay IP fabric. This is the standard and scalable method for multi-tenancy in a VXLAN/EVPN fabric.

The core function of the leaf switch acting as a default gateway for a VXLAN segment is tied to its Bridge Domain configuration. The BD must be associated with the correct VNI, and critically, it must have both Layer 2 and Layer 3 configurations enabled. If the Layer 3 configuration (often an IRB or Integrated Routing and Bridging interface) is missing or misconfigured, the switch will not perform routing for that VNI, causing the symptom described. This is a fundamental and common configuration point to verify.

FCoE requires a lossless Ethernet service, which is provided by Data Center Bridging (DCB) protocols like Priority Flow Control (PFC). A VXLAN BGP EVPN fabric typically uses an IP (routed) underlay, which does not provide this lossless service. Therefore, to support FCoE, a common design is to have a separate physical network or a dedicated set of VLANs/VNIs configured with DCB across the same physical switches, creating a parallel, lossless transport layer for storage traffic.

In a multi-pod ACI design, the APIC cluster is typically housed in one pod (or a dedicated out-of-band management pod). The IPN carries both control plane traffic (including APIC communication to leaf switches in other pods) and data plane traffic. If the IPN fails, the APICs lose connectivity to the switches in the remote pod. This means policy cannot be pushed or synchronized, and the APICs cannot learn new endpoints from the remote pod. However, the local control planes in each pod remain functional, so forwarding within a pod continues. Existing remote endpoint entries may age out and not be refreshed.

The peer-gateway feature allows a vPC peer switch to act as the active gateway for packets destined to the other peer’s MAC address, which is essential for handling certain traffic flows (like orphaned ports) without hair-pinning traffic across the peer-link. The peer-switch feature allows both switches in the vPC pair to appear as a single spanning-tree root, which is crucial for proper Layer 2 loop prevention in conjunction with the vPC peer-link. These features are foundational for a stable and loop-free vPC design.

This describes the standard border leaf design for EVPN fabrics. A vPC pair provides device-level redundancy. eBGP sessions to the upstream router provide path redundancy and allow for flexible policy control. Most importantly, using the EVPN address family (specifically, the EVPN route-type 5, or IP Prefix route) allows the border leaf to import external routes from BGP, convert them into EVPN routes, and advertise them into the fabric via the route reflectors. This provides seamless integration of external prefixes into the fabric’s tenant VRFs.

This is a classic WAN edge QoS scenario. The most direct and network-centric solution is to apply QoS policies on the routers interfacing with the inter-DC link. Marking traffic (based on ACLs matching the backup VLAN, for instance) and applying queuing (for VoIP) and policing/shaping (for backups) allows for precise control over how the limited 1 Gbps bandwidth is allocated. This operates at the network layer and is transparent to the servers. The other options are either specific to certain technologies (ACI, FabricPath) or are application-layer solutions (WAN accelerator) that don’t directly address network prioritization.

This is a core ACI differentiator. A Bridge Domain (BD) is a policy construct that defines a Layer 2 flooding boundary and is linked to a Layer 3 subnet configuration. It is decoupled from the underlying physical/virtual wiring. An EPG (Endpoint Group) is placed in a BD. The physical VLAN used on a switch access port is just a local tag to identify traffic belonging to an EPG; it does not need to match across switches. The BD provides the consistent forwarding and policy domain across the fabric, unlike a traditional VLAN which is a simple tag carried in trunks.

Synchronous storage replication requires that an I/O operation is only acknowledged to the host application after it has been committed to storage at both the primary and remote sites. This process is extremely sensitive to latency and, more importantly, latency variation (jitter). High or unpredictable latency directly increases I/O wait times, crippling application performance. While bandwidth is important, insufficient bandwidth causes congestion which also increases latency/jitter. Therefore, achieving a low, stable latency (often via dedicated, dark fiber links) is the paramount network design goal for synchronous replication.

EVPN with VRF instances provides the required Layer 3 segmentation and traffic isolation. Each environment (development, testing, production) can be placed in its own VRF, which is then mapped to specific VNIs. The use of BGP EVPN route-targets allows for precise control over which routes (and thus which VNIs) are imported into each VRF, ensuring complete isolation while maintaining a single, scalable underlay IP fabric. This is the standard and scalable method for multi-tenancy in a VXLAN/EVPN fabric.0