VXLAN EVPN packet walk

IRB model for same-VRF routing

1 · Access-side frame

2 · Across the fabric

3 · Destination-side frame

Underlay headers VXLAN context Tenant Ethernet Tenant IP and payload

Header terms

Flags 0x08 (I=1)
The VXLAN I bit says the 24-bit VNI is valid. With all reserved flag bits zero, the first byte is 0x08; the first four on-wire bytes are 08 00 00 00, or 0x08000000 as one network-order 32-bit word.
RMAC
The VTEP’s overlay router/system MAC. Symmetric IRB uses ingress and egress RMACs for the inner router-to-router Ethernet header carried by an L3 VNI; it is not the destination host MAC.
IRB-MAC-20
The MAC of the IRB/SVI joining VRF_A to VLAN 20/bridge domain 20—usually VLAN 20’s anycast-gateway MAC. In asymmetric IRB it becomes the source MAC of the routed frame sent toward Server B.

Control plane: RT, RD, and EVPN route types decide what is installed, but none of them appears as a packet header.

Assumptions: remote destination leaves; direct EVPN route import for VRF_B; no default, static, policy, or service route from VRF_A to VRF_C.

Asymmetric IRB is standards-defined here for same-VRF A→B. RT leaking alone does not provide the destination MAC-VRF state needed for a generic asymmetric A→D path, so that case retains the symmetric IP-VRF path.

Address legend: 192.0.2.11 = Leaf 1’s VTEP loopback (Site A — the loopback the NVE/VXLAN interface sources tunnels from); 203.0.113.21 = Leaf 4’s VTEP loopback (Site B); 192.0.2.100 / 203.0.113.200 = VIP-A / VIP-B, each site’s gateway VIP — an anycast loopback configured with the same address on both of that site’s border gateways (on NX-OS, the loopback named under evpn multisite border-gateway interface). Site A numbers from 192.0.2.0/24, Site B from 203.0.113.0/24.

Cases 4–7 — two DCI and two forwarding models: cases 4 and 6 stretch one EVPN domain across the DCI, so leaf VTEP loopbacks must be reachable site to site and the packet rides one tunnel. Cases 5 and 7 keep each site a separate EVPN domain stitched at border gateways. In Cisco Multi-Site the redundant BGWs share the anycast VIP shown; underlay ECMP picks one per flow, replies may transit the other, and the designated-forwarder election applies to BUM only. Arista’s multi-domain EVPN gateways (RFC 9014) perform the same three-leg decap/re-encap stitch, but each gateway re-originates routes with its own VTEP IP (redundancy through ECMP across the re-originated routes, or an MLAG shared VTEP) rather than a site-wide anycast VIP.

Different VLAN does not always mean destination L2 VNI: cases 6 and 7 cross from VLAN 10 to VLAN 20. Symmetric IRB carries the routed packet in tenant L3VNI_A 50001; asymmetric IRB carries the already-routed frame in destination L2VNI_20 1020. The VNI is normally consistent across the three Multi-Site tunnel legs. Cisco’s separately named “asymmetric VNI” feature means remapping VNI numbers between sites, not asymmetric IRB.

Multi-domain and IRB references: Cisco documents the BGW as a VXLAN tunnel termination and re-origination point and the Multi-Site VIP as the data-plane address used both inside a site and between sites. See the Cisco Multi-Site design white paper, the vendor-neutral RFC 9014 EVPN overlay interconnect model, and RFC 9135’s symmetric/asymmetric IRB comparison.

Server access links may be untagged. The leaf maps the local VLAN/bridge domain to a VNI. If both endpoints are on one leaf, forwarding is local and there is no VXLAN header.