Automation at Scale Across Domains: DC, Campus, and WAN#

Christian Breunig · Network Architect — Rohde & Schwarz

• Why: A full EVPN-VXLAN fabric program — dual DCs, campus, WAN — with a quantitative answer to "how much Day-2 work will there really be?" (much more than you think).
• What: 500+ devices under unified Git/Ansible/GitLab CI. Change volume grew from 109 (2021) to 1,060 (2025) as the network became a service-provider-like internal backbone — the "few VLANs a year" assumption died quickly. They maintain a 100% EVE-NG replica of the network at all times and spend ~80% of their time in the QA environment.
• How: Declarative, data-driven model: NetBox as SoT, data determines what gets rendered (VLANs on port-channels, VLAN database, VNIs). One inventory per domain (DC/LAN/WAN) with domain-specific inheritance (DC.yml/LAN.yml/WAN.yml); ANTA for post-change validation (e.g., detecting decommissioned endpoint ports); ansible-lint/yamllint enforced. Scaling tips include 2-byte vs 4-byte ASN pitfalls (the RD is only 32-bit) and careful MLAG peer-link addressing to avoid customer-VRF conflicts.
• Where applicable: Single-vendor (Arista + AVD + CloudVision) — that's the constraint. The QA-digital-twin discipline, the change-rate data, and the MLAG/ASN gotchas transfer to any EVPN fabric program.