On this page
The underlay from Part 3 delivers exactly one thing: every switch loopback reaches every other switch loopback over equal-cost paths, with jumbo frames surviving end to end. This part spends that. VXLAN builds tunnels between those loopbacks, EVPN becomes the directory that tells every switch who lives behind which tunnel, and the first tenant network stretches across all ten leaves without a single VLAN trunk between switches.
This is also the part with the single most instructive failure of the whole build. If you take one thing from this post, take the route-target section.
What the overlay actually solves
The fabric is purely routed, which Part 3 celebrated. But servers still want L2 semantics: the three masters sit in one subnet, 10.110.0.0/24, and they expect ARP and a default gateway even when their leaves are four routed hops apart. And different subnets still need to route to each other inside one tenant boundary. VXLAN solves both by wrapping frames in UDP and carrying them between loopbacks; EVPN solves the part VXLAN alone cannot, which is knowing where everything is without flooding and guessing.
Two kinds of virtual network ride the same machinery. An L2VNI stretches one VLAN across the fabric: vlan 110 becomes VNI 10110, and a master on cluster-leaf-1 can ARP for a master on cluster-leaf-3 as if they shared a switch. The L3VNI, 50000 here, is subtler and does the routing: it is the tenant VRF's transit segment, the path a routed packet takes between subnets that live on different leaf pairs. One L3VNI per tenant, L2VNIs per VLAN as needed.
