EVPN Unleashed: Scaling Multi-Domain Fabrics with EVPN Gateways#

Remi Locherer - modus one ag with Arista Networks

• Why: Flat EVPN-VXLAN fabrics hit hard scale limits — per-VTEP flood lists, full-mesh EVPN state (MAC/ARP/IP/IMET routes), and state churn across every node on each failure. Anyone running multi-POD or multi-DC EVPN hits this.
• What: A walkthrough of the IETF BESS standards for hierarchical EVPN gateways — RFC 9014 (L2 interconnect), draft-ietf-bess-evpn-ipvpn-interworking (L3), plus multi-site and D-PATH drafts — with concrete per-route-type gateway behavior and three GW resiliency/loop-prevention models. Despite the Arista banner, this is a standards-centric deep-dive, not a product pitch.
• How: GW nodes scope Type-⅓/4 routes to their domain and re-originate Type-2 and Type-5 routes with the GW as next-hop (RD change optional for Type-2, unchanged for Type-5 in the Arista L3 model). Each GW originates its own Type-3 IMET per stretched bridge-domain, producing hierarchical flood lists: local VTEPs list local peers + GW only. L3 forwarding does VXLAN decap → VRF lookup → re-encap at each GW. Loop prevention differs by resiliency model: MLAG shared-VTEP (routes from peer marked invalid; single MLAG domain per site), anycast VTEP IP (no peer link, no directly attached hosts, up to 16 GWs), all-active I-ESI (routes stay valid, so D-PATH/Site-of-Origin policy is required).
• Where applicable: Multi-site/multi-POD EVPN-VXLAN datacenters and DCI over VXLAN/MPLS/SR WANs. The standards (RFC 9014, BESS drafts) are vendor-agnostic; the implementation details shown (e.g., domain remote peering config, RD/RT handling) are Arista-specific and should be re-checked against your vendor's gateway implementation.