Cisco IOS / IOS-XEConfig1 downloads

BGP EVPN / VXLAN — Cisco IOS-XE (Catalyst 9000)

Generate a VXLAN BGP EVPN configuration for Cisco Catalyst 9300/9500 (IOS-XE 16.11+). Supports symmetric IRB, distributed anycast gateway, ingress replication, and per-tenant VRF routing. Designed for campus DC pods and branch aggregation.

↓ example.txt

What is it?

Cisco IOS-XE on Catalyst 9000 series (9300, 9500) supports VXLAN BGP EVPN as of IOS-XE 16.11 (Catalyst 9300) and IOS-XE 17.x (Catalyst 9500). The syntax differs significantly from NX-OS: IOS-XE uses 'l2vpn evpn instance' with 'vlan configuration' to map VLANs to VNIs, and 'vrf definition' instead of NX-OS 'vrf context'. The BGP EVPN control plane is identical in function — Type-2 MAC/IP routes, Type-3 BUM via ingress replication, Type-5 external prefixes — but Catalyst 9000 is designed for campus data center pods and branch DC aggregation rather than hyperscale DC fabrics. It supports symmetric IRB, distributed anycast gateway (via per-SVI mac-address), and ingress replication. Catalyst 9000 does not support vPC — it uses port-channel with LACP for dual-homing.

When to use

·Campus data center pods (IDF/MDF) requiring VXLAN segmentation across a small number of switches
·Branch DC aggregation with 2-8 leaf switches needing multi-tenant isolation
·Environments already running Catalyst 9000 wanting to modernize from VLAN-based to VXLAN overlay
·Migrations from traditional campus networks to a lightweight spine-leaf design using existing Catalyst hardware
·Environments requiring IOS-XE feature parity (QoS, NetFlow, NBAR) alongside VXLAN overlay

When NOT to use

·Large hyperscale DC fabrics (>20 leaves) — use Nexus 9000 with NX-OS for production DC scale
·Environments requiring vPC for dual-homing — Catalyst 9000 does not support vPC
·Deployments needing NX-OS-specific features (VXLAN OAM, Multisite BGW, NVE fabric peering)
·Teams expecting NX-OS syntax — Catalyst 9000 VXLAN config is structurally different and cannot be copy-pasted from NX-OS templates

How it compares

vs NX-OS BGP EVPN (Nexus 9000)NX-OS is the gold standard for DC-scale VXLAN: supports vPC, Multisite DCI, NVE Fabric Peering, and scales to thousands of VNIs. Catalyst 9000 IOS-XE VXLAN is simpler and less mature — no vPC, no Multisite, but better integration with campus features (QoS, NBAR, NetFlow) and uses the same IOS-XE CLI as the rest of the campus stack.

vs Traditional VLAN-based Catalyst campusTraditional campus uses STP for loop prevention and restricts to 4094 VLANs. VXLAN on Catalyst 9000 provides L2 overlay over L3, eliminates STP between distribution and access, and scales to 16M VNIs for multi-tenant environments. Migration path: keep access ports in VLANs, use VXLAN only for inter-switch segments.

vs SD-Access (Cisco DNA Center)SD-Access uses VXLAN BGP EVPN under the hood but requires Cisco DNA Center (DNAC) for orchestration. Manual IOS-XE VXLAN config gives full control without DNAC licensing cost, but loses zero-touch provisioning, policy-based segmentation UI, and ISE integration. Use manual VXLAN for environments without DNAC or for learning/lab purposes.

Prerequisites

→Cisco Catalyst 9300 (IOS-XE 16.11.1 or later) or Catalyst 9500 (IOS-XE 17.3.1 or later)
→DNA Advantage license required for VXLAN BGP EVPN on Catalyst 9000
→MTU 9100 minimum on all fabric links (VXLAN adds 50 bytes overhead)
→Loopback0 (router-ID) and Loopback1 (VTEP source) must be routable across the underlay
→BGP and OSPF/IS-IS knowledge required — Catalyst 9000 VXLAN uses same BGP EVPN control plane as NX-OS
→IOS-XE syntax differs from NX-OS — review l2vpn evpn and vlan configuration commands before deployment

Config Generator

Hostname *

BGP AS Number *

iBGP AS — same across all fabric nodes

Loopback0 IP (Router-ID) *

Loopback0 IP — used as BGP router-ID and OSPF router-ID

Loopback1 IP (NVE Source) *

Loopback1 IP — used as source-interface for NVE (VTEP)

BUM Replication Type *

Ingress replication (unicast head-end replication) is simplest. Multicast requires PIM in the underlay.

Underlay Protocol *

IGP for loopback reachability. OSPF is most common for campus DC.

BGP Neighbors (Spines or RRs)

Layer-2 VNIs (VLANs stretched over VXLAN)

Layer-3 VNIs (one per VRF/tenant)

Fabric Uplink Interfaces (leaf to spine)

Verification commands

show l2vpn evpn peers vxlan

VTEP peer state on IOS-XE

ExpectedShows all remote VTEPs with their state. Up = functional VXLAN tunnel.

show bgp l2vpn evpn summary

BGP EVPN session state to spines/RRs

ExpectedState/PfxRcd column shows a number (received prefixes), not Idle/Active/Connect.

show l2vpn evpn evi detail

EVPN instance (EVI) state per L2 VNI

ExpectedEach EVI should show State: Established and list remote VTEPs.

show nve peers

NVE peer table

ExpectedShows remote VTEP IPs and their state. Works on both NX-OS and IOS-XE.

show bgp l2vpn evpn route-type 2

MAC/IP host routes (Type-2) from all VTEPs

ExpectedShould see MAC+IP entries for all remote hosts, with VTEP next-hop.

show ip route vrf TENANT-A

Per-VRF routing table

ExpectedRemote subnets should appear via VXLAN next-hop. Directly connected subnets from SVIs should also be present.

Debug commands

show l2vpn evpn evi

List all EVPN instances and their VLAN/VNI mapping

WarningVerify each EVI has the correct VNI and is associated with the right VLAN.

show bgp l2vpn evpn neighbors X.X.X.X routes

Routes received from specific BGP EVPN neighbor

WarningUse to verify RR is sending Type-2 and Type-3 routes from remote VTEPs.

debug l2vpn evpn error

Live EVPN error debugging

WarningUse with caution in production. Logs EVPN errors to console. Disable with undebug all.

Common mistakes & fixes

SymptomDNA Advantage license not active — VXLAN features not available

CauseCatalyst 9000 requires DNA Advantage license for VXLAN BGP EVPN. Base or Essentials license does not include this feature.

FixVerify with show license summary. Activate DNA Advantage license via Cisco Smart Licensing or PLR (Permanent License Reservation).

SymptomSVI not forwarding traffic despite being up

Causemac-address not configured on SVI — IOS-XE anycast gateway uses per-SVI MAC, not a global MAC like NX-OS

FixAdd mac-address aabb.cc00.XXXX to each VLAN SVI. Unlike NX-OS, IOS-XE does not use a global anycast-gateway-mac command.

SymptomNVE interface shows no peers

CauseLoopback1 not reachable via OSPF, or source-interface Loopback1 missing from NVE

FixVerify show ip ospf neighbor on fabric links. Confirm Loopback1 is in OSPF area 0 with ip ospf 1 area 0.

SymptomBGP EVPN sessions up but no routes exchanged

Causesend-community extended missing on BGP neighbor — EVPN uses extended communities for RT, which requires this command

FixAdd neighbor X.X.X.X send-community extended under address-family l2vpn evpn.

SymptomHosts in same VRF cannot reach each other across VTEPs

Causeadvertise l2vpn evpn missing under VRF address-family in BGP

FixAdd advertise l2vpn evpn under router bgp / address-family ipv4 vrf TENANT-A. This redistributes EVPN Type-5 routes into the VRF.

Further learning

Recommended books to go deeper on this topic.

Building Data Centers with VXLAN BGP EVPN

Lukas Krattiger, Shyam Kapadia, David Jansen · Cisco Press · Clos fabric design with VXLAN EVPN: route types, symmetric IRB, multihoming, multi-site

Paperback ↗

BGP Design and Implementation

Randy Zhang & Micah Bartell · Cisco Press · BGP fundamentals needed before EVPN — attributes, route reflection, policy

Kindle ↗Hardcover ↗Paperback ↗

NX-OS and Cisco Nexus Switching: Next-Generation Data Center Architectures

Ron Fuller, David Jansen, Matthew McPherson · Cisco Press · VXLAN BGP EVPN on NX-OS — overlay design and configuration

Hardcover ↗