Cisco NDFC EVPN Multi-Site with an eBGP underlay, step by step

Build two VXLAN EVPN sites with an NDFC-managed ISN and a stretched subnet in Nexus Dashboard 4.1 using an eBGP Multi-AS underlay. Follow every screen, deployment gotcha, validation step, and the Python automation that rebuilds it end to end.
Cisco NDFC EVPN Multi-Site with an eBGP underlay: two sites, an ISN, one stretched network, step by step in Nexus Dashboard

On this page

Two data centres, one tenant, and the request that always arrives on a Friday: the app team wants the same subnet in both sites so they can move workloads without re-addressing. You have Nexus 9000 in both halls, a pair of routers between them, and a Nexus Dashboard cluster that already manages nothing. This post builds the whole thing in Nexus Dashboard 4.1(1g): two VXLAN EVPN fabrics with eBGP underlays, an inter-site network on two core routers, an EVPN Multi-Site domain on top, and one network stretched across both sites. Every screen below was captured on the lab controller while the build ran, every command output is quoted from the recorded run, and the last section proves it with pings between hosts in different sites.

The click sequence is the same one you would follow on real hardware. The lab differences are the switch model, N9K-C9300v under containerlab, and the fact that the hosts are single-homed containers.

Lab Topology

Each site has two spines, two leaves and two border gateways. The two sites meet on core1 and core2, which form the inter-site network, or ISN. Every border gateway connects to both cores, so each site has four links into the ISN. Each leaf has one host on Ethernet1/3, and all four hosts sit in the same subnet, 192.168.100.0/24, with the anycast gateway at .254 in both sites.

Topology: DC1 and DC2, each with two spines, two leaves, two border gateways and two hosts, joined through core1 and core2 in the ISN. Orange lines are the eight border gateway to core links.
Fourteen N9K-C9300v switches and four hosts. Orange is the Multi-Site underlay, green the host ports, grey the intra-site fabric links.

The routing design follows the eBGP pattern I use everywhere: the spines of a site share one autonomous system, and every leaf and border gateway gets its own. The underlay runs on /31 point-to-point links, and the EVPN overlay is an eBGP session from each leaf and border gateway loopback to each spine loopback. Inside a site, BUM traffic uses ingress replication.

Table of the fourteen switches by site with role, BGP autonomous system and management IP: DC1 spines 65100, leaves 65101 and 65102, border gateways 65103 and 65104; ISN core routers 65500; DC2 spines 65200, leaves 65201 and 65202, border gateways 65203 and 65204; management addresses 172.29.129.31 to .46.
Autonomous systems and management addresses per switch. Spines share one AS per site; every other switch has its own.

This post is for paying subscribers only

Subscribe to LevelUp I.T. newsletter and stay updated.

Don't miss anything. Get all the latest posts delivered straight to your inbox. It's free!
Great! Check your inbox and click the link to confirm your subscription.
Error! Please enter a valid email address!