Catalyst Campus Fabric: eBGP, EVPN, VXLAN, and the Path to Macro and Microsegmentation

Campus fabric design is more than virtual local area network (VLAN) extension. It makes the campus behave like a routed, policy-aware system: a deterministic Internet Protocol (IP) underlay, an Ethernet virtual private network (EVPN) control plane, Virtual Extensible Local Area Network (VXLAN) data-plane encapsulation, virtual routing and forwarding (VRF)-level macrosegmentation, and role-aware policy with Cisco TrustSec Security Group Tags (SGTs) where the platform supports them.

Design takeaway: use virtual routing and forwarding instances (VRFs) for routing and failure-domain boundaries, use Security Group Tags (SGTs) for role policy inside those boundaries, and keep the underlay predictable enough that every overlay failure can be isolated quickly.

Reference Fabric Model

Cisco Cloud Fabric validated design describes the core building blocks: routed underlay, VXLAN overlays, and Multiprotocol Border Gateway Protocol (MP-BGP) EVPN as the control plane. Cisco SD-Access design guidance frames the segmentation model around virtual networks, policy, and fabric roles. The engineering value is not the acronym stack; it is that endpoint reachability, tenant context, and policy intent become explicit.

Architecture diagram

Campus Fabric Reference Model

Topology separates the data plane from EVPN control and policy sources, so troubleshooting follows evidence instead of guessing.

Read the diagram from left to right during troubleshooting. If the client cannot reach an app, do not start with "the fabric is broken." Validate access authentication, local virtual local area network (VLAN) or anycast gateway behavior, underlay loopback reachability, EVPN route advertisement, VXLAN network identifier (VNI) to virtual routing and forwarding (VRF) mapping, border route leaking, firewall policy, Domain Name System (DNS), and return path in that order.

Underlay Rules That Keep EVPN Stable

• Use point-to-point routed links wherever possible; avoid letting a campus L2 failure domain become a fabric transport dependency.
• Advertise loopbacks consistently; VXLAN tunnel endpoints and EVPN peering depend on stable reachability to those addresses.
• Set maximum transmission unit (MTU) deliberately. VXLAN adds overhead, so a fabric that "mostly works" with default MTU can fail with large payloads or storage-style application traffic.
• Keep summarization and filtering predictable. If a border or route reflector cannot see the right loopback or overlay prefix, the symptom often appears as an endpoint or policy problem.
• Choose IGP or external Border Gateway Protocol (eBGP) underlay based on team skill and operational fit. eBGP can help make failure domains and policy boundaries explicit, but it still needs clean neighbor design, timers, and route policy.

Macrosegmentation Versus Microsegmentation

Macrosegmentation is a routing-table decision. Microsegmentation is an access-policy decision. Confusing those two is how teams create a VRF per department, then spend years debugging route leaking and firewall exceptions.

Need	Use VRF or virtual network (VN)	Use Security Group Tag (SGT) policy	Design Note
Guest internet access	Yes	Usually minimal	Keep it out of internal routing; inspect or Network Address Translation (NAT) at a controlled edge.
Payment Card Industry (PCI) or regulated enclave	Yes	Yes	VRF creates the routing boundary; SGTs reduce lateral movement inside it.
Employee versus contractor	Usually no	Yes	Same user VN may be acceptable if identity policy is strong and enforcement is validated.
Cameras, printers, badge readers	Sometimes	Yes	Use a separate Internet of Things (IoT) VN when routing and ownership differ; use SGTs for device-class policy.
Shared DNS, Dynamic Host Configuration Protocol (DHCP), Network Time Protocol (NTP), AD	Service VRF or firewall zone	Yes	Every route leak should have an owner, a purpose, and a validation test.

Cisco EVPN microsegmentation documentation explains how Border Gateway Protocol (BGP) EVPN VXLAN can carry microsegmentation context with TrustSec integration. In the field, the important questions are simple: where is the SGT assigned, how is it propagated, where is it enforced, and what log shows a deny was caused by policy rather than routing, DNS, or authentication failure?

Control-Plane Caveats

• EVPN route types matter. Media Access Control (MAC)/IP host reachability, subnet advertisement, and external prefix advertisement are not interchangeable operational signals.
• Anycast gateway behavior must be consistent across fabric edges. A mismatched gateway, SVI, VNI, or VRF creates symptoms that look like random endpoint failure.
• Route reflectors simplify peering but centralize control-plane dependency. Treat them like critical infrastructure and validate failure behavior.
• Border nodes are policy choke points. Document every external prefix, default route, route leak, firewall handoff, and NAT boundary per VRF.
• SGT designs fail operationally when every exception becomes a new group. Keep groups tied to durable roles, not one-off tickets.

Sample Campus Slice

VRF	VNI	Example VLANs	Gateway	SGTs	Northbound Path
USER	10100	110 employee, 120 contractor	10.10.10.1, 10.10.20.1	Employee, Contractor, Admin	Firewall zone USER to shared services and internet
IOT	10200	210 camera, 220 printer, 230 facilities	10.20.10.1, 10.20.20.1	Camera, Printer, Facilities	Firewall zone IOT to video, print, and facilities apps
GUEST	10300	310 guest	10.30.10.1	Guest	NAT only; no internal route leak
SHARED	10400	410 services	10.40.10.1	DNS, DHCP, NTP, AD	Firewall-mediated access from approved VRFs

This is intentionally small. A production fabric can have more nuance, but a pilot should validate the pattern before it validates scale. If this slice cannot explain endpoint onboarding, policy enforcement, route leaking, firewall symmetry, and rollback, a larger design will only hide the gaps.

Validation Matrix

Test	Pass Condition	Fail Signal	Evidence to Keep
Underlay loopback reachability	Every VTEP and EVPN peer reaches every required loopback over routed paths.	VXLAN tunnels flap, EVPN routes withdraw, or traffic blackholes after link failure.	Routing table, neighbor state, traceroute, MTU test.
Endpoint move	Client moves between edge switches and keeps correct IP, gateway, SGT, and policy.	Stale MAC/IP route, wrong SGT, duplicate endpoint, or delayed convergence.	EVPN route output, endpoint database, authentication log.
VRF isolation	USER, IOT, and GUEST cannot reach each other except documented shared services.	Unexpected route leak or firewall bypass.	VRF route tables, firewall session logs, denied-flow tests.
SGT enforcement	Employee reaches approved apps; contractor and IoT classes are denied where expected.	Permit because of missing SGT, default rule, or unsupported enforcement point.	Identity Services Engine (ISE) session, SGT mapping, Security Group Access Control List (SGACL) hit counters.
Border failover	External prefixes and default routes converge without asymmetric firewall return path.	Forward path moves but return path stays pinned to the old border.	BGP state, firewall sessions, path trace from both directions.

Operational Runbook

1. Freeze the pilot scope to one building, two or three VRFs, and a small SGT matrix.
2. Record underlay links, loopbacks, VXLAN network identifiers (VNIs), VLANs, anycast gateways, route reflectors, borders, and firewall zones in a source of truth.
3. Baseline current user-to-application paths, including DNS answer, route, inspection point, NAT behavior, and return path.
4. Turn up underlay first and validate convergence and MTU before onboarding endpoints.
5. Add EVPN and VXLAN, then verify endpoint learning and movement without security policy complexity.
6. Add VRF handoff and route leaking only for named shared services.
7. Introduce SGT policy in monitor or limited-enforcement mode before default-deny expansion.
8. Run allowed-flow and denied-flow tests after every policy change.
9. Test rollback by removing the pilot route leak, restoring the previous gateway path, or moving the pilot VLAN back to its prior design.

Where Fabric Supports Zero Trust

A campus fabric does not become zero trust because VXLAN exists. It moves in that direction when identity, device posture, route domain, role tag, enforcement point, telemetry, and exception lifecycle all line up. The practical incident question is: can an engineer show why this endpoint got this access at this moment? If the answer requires guessing across five consoles, the architecture is not finished.

Security, Privacy, Legal, and Recovery Boundaries

Fabric segmentation reduces reachable paths; it does not patch endpoints, validate identities, or inspect every allowed flow. Protect ISE, route reflectors, fabric management, border control, and automation credentials as privileged infrastructure. Endpoint identity, location, posture, SGT assignment, and flow records can become sensitive employee or visitor data. Limit access, define retention, and involve privacy or labor counsel when policy or telemetry can be associated with a person.

Document platform support, software interoperability, and licensing before treating the sample design as deployable. Recovery requires more than a controller backup: retain the prior gateway and VLAN path, export policy and device configuration, identify a break-glass management route, and rehearse removing a route leak or SGT rule. During a rollback, confirm both forward and return paths; restoring reachability while leaving asymmetric firewall state is not recovery. Time endpoint relearning and application recovery as well as routing convergence, because healthy EVPN and BGP adjacencies do not prove that stateful traffic has recovered.

What Validation Does Not Prove

The validation matrix is documentation-backed and has not been executed in a TechGeeks lab for this revision. Passing an endpoint-move test does not prove convergence at production scale. A denied test flow does not prove every lateral path is blocked. Healthy EVPN routes do not prove application reachability, identity correctness, or firewall symmetry. Use representative traffic, failure injection, and retained logs before expanding the pilot.

Related TechGeeks

• Designing an AI-Ready Campus Network After Cisco Live 2026
• Campus Segmentation Design: From VLANs to Unified Fabric
• Cisco Live 2026: Network Announcements That Matter

Cisco References

• Cisco Cloud Fabric Validated Case Study
• Cisco SD-Access Design Guide
• Cisco EVPN Microsegmentation
• Cisco SD-Access solution page
• IETF RFC 8365: A Network Virtualization Overlay Solution Using EVPN

Related foundation post: Cisco Live 2026: Network Announcements That Matter.