For decades, connecting enterprise headquarters, satellite branches, and primary data centres required relying on carrier-managed Layer 2 services: either Multiprotocol Label Switching (MPLS) Virtual Private LAN Service (VPLS) or provider-bridged IEEE 802.1ad (QinQ). While these delivered simple layer-2 transparency, they introduced structural limitations: uncontained broadcast floods, brittle Spanning Tree interactions, and carrier MAC address throttling.
With the mainstream enterprise adoption of spine-leaf switching architectures from Arista, Cisco (NX-OS), and Juniper (Junos), modern multi-site networks are standardising on EVPN-VXLAN (Ethernet VPN with Virtual Extensible LAN) as the de facto transport overlay.
Control Plane Learning vs. Flood-and-Learn
The fundamental architectural distinction between EVPN-VXLAN and legacy VPLS lies in how the network learns endpoint MAC and IP reachability:
- VPLS (Data-Plane Flood-and-Learn): VPLS switches behave like a single, geographically distributed Ethernet switch. When a host transmits a frame toward an unknown MAC address, the Provider Edge (PE) router must broadcast that frame across every pseudowire in the mesh. Broadcast storms at one site inevitably propagate across the WAN, consuming expensive transit bandwidth.
- EVPN-VXLAN (Control-Plane Distribution): Standardised under RFC 7432, EVPN replaces data-plane flooding with Multiprotocol BGP (MP-BGP). Whenever a host connects to a leaf switch (VTEP), its MAC and IP addresses are advertised to peer switches via Type-2 (MAC/IP Advertisement) routes. Unknown unicast flooding across the WAN is eliminated.
Architectural Comparison Matrix
The table below contrasts EVPN-VXLAN against legacy carrier VPLS and double-tagged QinQ services across key operational criteria:
| Operational Attribute | EVPN-VXLAN (RFC 7432) | Carrier VPLS (RFC 4762) | 802.1ad (QinQ Tagging) |
|---|---|---|---|
| Control Plane Architecture | MP-BGP EVPN (RFC 7432) Route Types 2 & 5 distribute MAC/IP reachability | Data-plane flood-and-learn (functions as a distributed broadcast bridge) | No control plane (pure IEEE 802.1ad double-tag encapsulation) |
| Multi-Homing & Loop Control | Native All-Active ESI (Ethernet Segment Identifier); eliminates STP & MLAG | Active/Standby pseudowires or complex vendor-proprietary MC-LAG clusters | Spanning Tree Protocol (STP / MSTP) required to block redundant loops |
| Underlay MTU Overhead | Requires 1,600+ bytes MTU (50-byte VXLAN + IP + UDP outer header) | Requires 1,518–1,526 bytes (4–8 byte MPLS label stack overhead) | Requires 1,522 bytes (4-byte 802.1ad outer Service VLAN tag) |
| ARP & Broadcast Handling | Local ARP/ND suppression via BGP distributed routing information base | Broadcast and ARP flooded across the full pseudowire mesh to all PEs | ARP frames broadcast across all trunked switches within the S-Tag domain |
| Segmentation & Scale | 16 Million VNIs (24-bit VNI space) with distributed Anycast Gateway | Limited by provider edge MAC table limits and full-mesh pseudowire state | 4,094 S-VLAN IDs per physical carrier demarc |
| Suitability Verdict | Recommended | Limited | Not Recommended |
Active-Active Multi-Homing via ESI
A persistent pain point in enterprise Layer 2 architectures has been multi-homing customer premises equipment (CPE) to dual carrier routers without triggering forwarding loops.
Legacy designs relied on Multi-Chassis Link Aggregation (MC-LAG, vPC), requiring proprietary vendor inter-switch links and tight firmware synchronisation. EVPN introduces open-standard Ethernet Segment Identifiers (ESI). Dual leaf switches or CPEs advertise the same 10-byte ESI identifier into BGP via Type-1 (Ethernet Auto-discovery) and Type-4 (Ethernet Segment) routes. This enables:
- True All-Active load balancing across both physical WAN bearers.
- Zero Spanning Tree Protocol (STP) blocked links across the core network.
- Sub-second convergence on link failure without relying on carrier switch renegotiation.
Designing a Multi-Site EVPN Overlay?
ManagedByUs provisions high-MTU (up to 9,216 bytes) point-to-point Layer 2 dark fibre and Ethernet circuits across the UK, engineered specifically for enterprise EVPN-VXLAN and multi-datacenter data fabrics. Model your throughput with our Bandwidth Sizing Calculator or consult directly with an infrastructure specialist.