This is the full lesson list with technical depth. Read it to confirm that every topic you care about is included.
Lesson 1: Why behind VXLAN with BGP EVPN
The lesson opens with the cap on traditional VLAN design. A standard VLAN field is twelve bits, so the absolute upper limit is 4096 segments per Layer 2 domain. That limit was set when one data center hosted a handful of customers and a few hundred workloads. Modern data centers run thousands of tenants, with workloads that move between racks and even between sites. The lesson then covers the new requirements: multi tenant separation, Layer 2 extension across an IP backbone, and a path that does not depend on Spanning Tree at scale. By the end you can answer two interview level questions: why VXLAN exists, and why a separate control plane named BGP-EVPN was added on top of the data plane.
Lesson 2: Underlay and Overlay
The core mental model for any modern fabric is the split between underlay and overlay. The underlay is the physical, routed IP network of spine and leaf switches. Its only job is to deliver IP packets between VTEP loopbacks. The overlay is the logical Layer 2 network that lives on top, encapsulated inside VXLAN headers, and identified by a VNI (VXLAN Network Identifier). The lesson explains the VTEP concept, the role of the loopback as the source and destination of VXLAN packets, and the way the underlay is intentionally kept simple so the overlay can be flexible. A full end to end packet path is drawn on the whiteboard so you can see the layers cleanly.
Lesson 3: MTU Considerations in Underlay
This lesson exists because a perfectly configured underlay can still break VXLAN traffic. VXLAN adds around 50 bytes of header on every frame: outer Ethernet, outer IP, outer UDP, and the VXLAN header itself. If the underlay MTU stays at the default 1500 bytes, the encapsulated frame becomes larger than 1500 and the underlay either fragments it (a real performance problem) or drops it silently. The lesson covers the math behind the overhead, the recommended MTU value for VXLAN underlays, how to set jumbo MTU on point to point links, and how to verify the path with end to end MTU tests. This is one of the most common root causes of mysterious VXLAN failures in real networks.
Lesson 4: BUM Traffic handling in VXLAN
Broadcast, Unknown unicast and Multicast traffic must still reach every host inside a VNI, even though the underlay is a pure IP routed fabric with no Layer 2 broadcast. Two methods exist. The first is to build a multicast underlay using PIM, where each VNI maps to an underlay multicast group. The second is Ingress Replication, also known as head end replication, where the local VTEP creates one unicast copy of the BUM frame for every remote VTEP in the same VNI. The lesson walks both methods with their trade offs. Multicast underlay is more efficient on the wire but requires multicast in the underlay. Ingress Replication is simpler to deploy but uses more bandwidth on the source leaf. After this lesson you can defend either choice in a design review.
Lesson 5: Let us build Underlay of VXLAN
This is the first full hands lab. You open EVE-NG, build a small spine and leaf topology, and configure the underlay step by step. The lesson covers loopback design (every VTEP needs a unique loopback), point to point IP addressing on spine to leaf links, the choice of IGP, and the verification of full loopback reachability across the fabric. By the end the underlay is ready to carry any kind of overlay traffic. The lesson also explains why the underlay is kept small and stable. Every minute spent debugging the underlay later is a minute lost from VXLAN work.
Lesson 6: Flood and Learn in VXLAN
The original VXLAN design used no control plane. Each VTEP learned remote MAC addresses by observing the source MAC inside frames it received. When a destination MAC was unknown, the VTEP flooded the frame to all remote VTEPs in the VNI using one of the BUM methods. The lesson walks the full Flood and Learn frame path: a host on Leaf 1 sends a frame to a host on Leaf 3, the destination MAC is unknown, Leaf 1 floods, every leaf receives the copy, and the reply teaches Leaf 1 the MAC. The lesson shows why this is wasteful at scale and why it cannot support modern features like ARP suppression. This is the necessary pain that makes BGP-EVPN feel like a relief in the next lesson.
Lesson 7: Why behind BGP-EVPN
The data center industry already had a control plane that scales to the entire internet: BGP. The clean idea was to add a new address family to BGP that carries MAC and IP information instead of only IP prefixes. That address family is named EVPN. The lesson explains why BGP was the right base (proven scalability, route reflectors, policy controls), why Ethernet Segment and Route Distinguishers exist, and how a leaf VTEP becomes both a BGP speaker and a VXLAN tunnel endpoint at the same time. You finish the lesson with a clear picture of the marriage between the BGP control plane and the VXLAN data plane. If your BGP is rusty, please pair this lesson with
BGP from Scratch.
Lesson 8: VXLAN Control Plane: BGP EVPN
This lesson decodes the three EVPN route types that matter most in VXLAN fabrics. Route Type 2 carries MAC, MAC plus IP, and supports MAC mobility. Route Type 3 advertises which remote VTEPs are members of a given VNI so that BUM traffic can be replicated only to the right set. Route Type 5 carries IP prefixes between VRFs, which is how Layer 3 routing between VNIs is achieved. Each route type is shown with a real packet capture and with the BGP table output on the device. By the end you can read an EVPN route in production and explain what every field means.
Lesson 9: Inter and Intra-VXLAN Configuration
A real fabric must serve two patterns. Hosts on the same VNI must communicate at Layer 2 across leafs (Intra VXLAN bridging). Hosts on different VNIs must communicate at Layer 3 through a router on the fabric (Inter VXLAN routing). The lesson configures both. For Intra VXLAN it shows the bridge domain configuration, the VNI to VLAN mapping on each leaf, and the verification on the EVPN table. For Inter VXLAN it covers the symmetric IRB design, which is the current best practice. Asymmetric IRB is also explained so you understand why the industry moved away from it. A complete packet walk is drawn for each case.
Lesson 10: Enhancements due to BGP VXLAN
With a control plane in place, the fabric gains features that Flood and Learn could not offer. ARP suppression lets each leaf answer ARP locally on behalf of remote hosts, saving uplink bandwidth and reducing broadcast. MAC mobility supports virtual machine moves between leafs without manual cleanup. Anycast gateway allows every leaf to share the same gateway IP and MAC, so when a workload moves from one leaf to another, it keeps the same default gateway and sessions do not break. Host route advertisement allows fine grained traffic engineering. The lesson covers each feature with the why behind it and the configuration that turns it on.
Lesson 11: External Connectivity
A VXLAN fabric does not live alone. It must connect to the WAN, the internet, and often to other data centers. The bridge between the fabric and the outside world is the Border Leaf. This lesson covers the role of the Border Leaf, the redistribution of external prefixes into the EVPN address family, the placement of firewalls, and the integration with WAN edge devices. If your next step is interconnecting sites, the natural follow up is
SD-WAN from Scratch, where the WAN side of the design is taught in the same why first style.
