EVPN VXLAN with Cisco Nexus One

Takuya Kishida of Cisco explains how Nexus One delivers standards-based VXLAN EVPN interoperability between Cisco ACI and NX-OS fabrics. The session covers the evolution from multi-pod to multi-site designs, the new ACI border gateway, end-to-end segmentation with VXLAN GPO, and a Nexus Dashboard demo of unified multi-site configuration and cross-fabric visibility. Kishida, a principal technical marketing engineer in Cisco’s Data Center Networking Group, presented at Networking Field Day 41, building on Sai Natarajan’s Nexus One overview.

Kishida traced how ACI and NX-OS both moved from multi-pod, where a single large VXLAN domain limits protocol scalability, to multi-site with hierarchical domains. Because EVPN multi-site has become the de facto standard for inter-site connectivity, ACI now supports anycast border gateways alongside its original approach, which Cisco is not retiring. The border gateway decapsulates and re-encapsulates traffic, so ACI keeps iVXLAN internally while presenting standard VXLAN externally. Inside ACI, spines translate COOP endpoint data into EVPN Type 2 routes and border gateways translate L3VPN into Type 5, while COOP avoids consuming TCAM by not pushing every endpoint to every leaf. ACI supports six border gateways per site today, rising to 14 in ACI 6.3.1, and uniquely offers two-way VNID and SGT translation. VRF-lite and L3Out on ACI border gateways are targeted for next year but not committed.

Kishida stressed that mixing operating systems is optional but valuable when an acquisition or new data center adds an ACI fabric to an NX-OS multi-site deployment, or the reverse, with SONiC, HyperFabric, and non-Cisco fabrics able to join later. End-to-end segmentation through VXLAN GPO currently works between ACI and NX-OS, while SONiC support depends on ASIC capability. Delegates questioned the long-term need for Layer 2 extension, with several citing migration as the main driver. The demo showed Nexus Dashboard fabric groups applying identical link, tenant, and network-stretch workflows to both fabrics, including VMM domain association. Its connectivity analysis traced a packet from ACI across the border gateways and pinpointed a security group deny at the NX-OS border gateway, demonstrating cross-fabric troubleshooting from a single view.