Practice Activity: Design Your VXLAN Network

In this activity, you will design a scalable Virtual Extensible LAN (VXLAN) fabric for a distributed multitenant data center environment. Your solution must support both virtualized and bare-metal workloads. It should also extend tenant segmentation across two sites and ensure high availability and efficiency for customer applications in both locations.

Scenario

You are working as a network architect for a service provider operating a multitenant data center in Chicago, Illinois. The Chicago data center network is small and uses four Cisco Nexus 9000 Series switches, connected for redundancy. These switches serve as both access and core, with Cisco UCS rack servers attached. These servers run VMware ESXi hypervisors that provide resources for customer virtual machines (VMs).

The company is onboarding new customers who require isolated network segments for their virtual machines. Since traditional VLANs are limited to 4096 IDs, you must design a VXLAN fabric that can scale with demand. Both VMware ESXi hypervisors and the Cisco Nexus switches can operate as VXLAN Tunnel Endpoints (VTEPs), which provides flexibility in configuring the overlay network.

One of your goals is to allow virtual machines to communicate at Layer 2 as if they were on the same VLAN even when they are hosted on different servers. A second cluster of Cisco UCS servers will soon be added in the Chicago data center. Unlike the existing hypervisor-based servers, this new cluster will run as bare-metal systems and must connect to the same VXLAN segments as virtual machines.

The company is also preparing to expand services to a second data center in Detroit, Michigan. Two major customers plan to deploy workloads in both locations, with additional virtual machines and physical servers in Detroit serving as backup systems. To ensure high availability and disaster recovery, they plan to replicate applications across the two facilities so that services remain resilient in the event of a site failure. To meet this requirement, evaluate an EVPN multisite architecture to connect the Chicago and Detroit data centers. This will enable segmentation, workload replication, and smooth disaster recovery.

Initial Topology

Requirements

The VXLAN fabric must meet the following requirements:

Ability to scale beyond VLAN limitations
Support for both virtualized and bare-metal workloads
VTEPs deployed where most effective for performance and flexibility
Control-plane design that allows scalability for long-term growth
Seamless inter-VXLAN routing when required by tenants
Reduced unnecessary flooding of Address Resolution Protocol (ARP) and MAC traffic to improve overlay efficiency
Minimized unnecessary Broadcast, Unknown unicast, and Multicast (BUM) traffic across sites to improve efficiency and scalability
High availability through Distributed Anycast Gateways
Reliable connectivity between the data centers

Final Topology

Consider the requirements and topology images then answer the following series of questions.

Content Review Question

Before the second bare-metal cluster is added to the Chicago data center, where should you configure the VTEP role and why?

leaf switches, to concentrate traffic processing
hypervisors, since all endpoints are virtual machines
hypervisors, to maximize overlay flexibility
leaf switches, to leverage hardware forwarding power

Content Review Question

In a VXLAN design using multicast-based flood-and-learn, how should network identifiers be configured so that VMs on different physical servers can communicate at Layer 2 as if they were on the same VLAN?

Configure VM1 and VM2 with the same VNI but different multicast groups.
Configure VM1 and VM2 with the same VNI and the same multicast group.
Configure VM1 and VM2 with different VNIs but the same multicast group.
Configure VM1 and VM2 with different VNIs and different multicast groups.

Content Review Question

How should you configure the network so that workloads running on the new bare-metal servers can communicate with the existing VMs on the same Layer 2 network?

Configure the leaf switches that connect to physical servers as VXLAN gateways.
Configure the leaf switches that connect to physical servers as VXLAN routers.
There is no way to use VXLANs if you mix bare-metal servers and VMs in your network.
Configure VXLANs directly on the physical servers.

Content Review Question

Which VXLAN control plane should be implemented to ensure scalability, efficient forwarding, and seamless connectivity between the Chicago and Detroit data centers?

Use multicast flood-and-learn because it is easier to configure and sufficient for small-scale deployments.
Use MP-BGP EVPN because it provides scalability, efficient forwarding, and supports advanced features.
Use static VXLAN tunnels as they are simpler than control-plane options.
Use both MP-BGP EVPN and multicast flood-and-learn to provide redundancy.

Content Review Question

What should be configured in an EVPN multisite architecture to control BUM traffic and prevent unnecessary flooding across intersite links?

Multicast replication using PIM Sparse Mode across sites
Flood-and-learn with static VXLAN tunnels
Ingress replication using the BGW Primary VTEP IP address
Local ARP suppression within each site only

Content Review Question

Which VXLAN feature in the MP-BGP EVPN control plane should be enabled to minimize flooding and reduce excessive broadcast traffic from ARP requests?

ARP suppression, so that VTEPs can locally respond to ARP requests using their ARP suppression cache
Gratuitous ARP, so that end hosts announce themselves and eliminate the need for ARP requests
Reverse ARP, so that all VTEPs proactively query the network for unknown hosts
MAC aging, so that unknown MAC addresses are removed from the ARP tables more quickly

Content Review Question

When enabling a Distributed Anycast Gateway, how should the virtual default gateway be consistently configured across all VTEPs in the network?

Distributed Anycast Gateway is not supported in MP-BGP EVPN.
All VTEPs will have different virtual gateway IP addresses but the same virtual gateway MAC address.
All VTEPs will have the same virtual gateway IP address and virtual gateway MAC address.
All VTEPs will have the same virtual gateway IP address but a different virtual gateway MAC address.