--- title: Layer-3-Only EVPN: Behind the Scenes « ipSpace.net blog description: A deep dive into the control plane mechanics of layer-3-only EVPN/VXLAN networks using Arista cEOS. The data plane resembles VRF-lite, where each VRF gets a... canonical: https://daily.dev/posts/layer-3-only-evpn-behind-the-scenes-ipspace-net-blog-a4mhned3h twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Layer-3-Only EVPN: Behind the Scenes « ipSpace.net blog | daily.dev og:description: A deep dive into the control plane mechanics of layer-3-only EVPN/VXLAN networks using Arista cEOS. The data plane resembles VRF-lite, where each VRF gets a... og:url: https://daily.dev/posts/layer-3-only-evpn-behind-the-scenes-ipspace-net-blog-a4mhned3h og:image: https://api.daily.dev/og/posts/A4MhNeD3h.png og:image:alt: Layer-3-Only EVPN: Behind the Scenes « ipSpace.net blog og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Layer-3-Only EVPN: Behind the Scenes « ipSpace.net blog **[ipSpace.net Blog](https://daily.dev/sources/ipspace)** · 6 min read · 0 upvotes · 0 comments ## Summary A deep dive into the control plane mechanics of layer-3-only EVPN/VXLAN networks using Arista cEOS. The data plane resembles VRF-lite, where each VRF gets a hidden VLAN backed by VXLAN as a transit segment. The post walks through actual device configs and CLI outputs showing how dynamic VLANs are created per transit VNI, how EVPN RT5 (IP prefix) routes carry the remote router MAC address and VNI as extended BGP communities, and how ingress routers use those MAC addresses to build forwarding entries — since VXLAN carries Ethernet frames that require source and destination MACs even on pure L3 segments. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Why does EVPN RT5 (IP prefix) route carry a router MAC address as an extended community? EVPN RT5 routes carry a router MAC address because VXLAN is purely an Ethernet-over-UDP transport — every frame it carries must have a source and destination MAC address. In a layer-3-only EVPN design there is no ARP/MAC learning on the transit segment, so the local VLAN interface MAC is attached as an extended BGP community (EvpnRouterMac) alongside the VNI, letting remote PEs build correct forwarding entries. _Engineers building EVPN fabrics track these control-plane details on daily.dev as they design or troubleshoot VRF forwarding._ ### How does Arista EOS assign VLANs for layer-3 EVPN transit VNIs? Arista EOS dynamically creates one internal VLAN per L3 VNI (one per VRF) on the VXLAN interface. These VLANs are marked as dynamic in 'show vlan' output and are not manually configured. Each dynamic VLAN gets a VLAN interface with a MAC address that is then advertised as the EvpnRouterMac extended community in EVPN RT5 updates. The same MAC address is typically reused across all VLAN interfaces on the same switch. _Network engineers validating Arista EVPN designs find implementation-level details like these on daily.dev._ ## Similar posts on daily.dev - [EVPN with SR-MPLS Core « ipSpace.net blog](https://daily.dev/posts/evpn-with-sr-mpls-core-ipspace-net-blog-taobtibzc) · ipSpace.net Blog · 0 upvotes · 0 comments --- Tags: [#bgp](https://daily.dev/tags/bgp) [View this post on daily.dev](https://daily.dev/posts/layer-3-only-evpn-behind-the-scenes-ipspace-net-blog-a4mhned3h) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Layer-3-Only EVPN: Behind the Scenes « ipSpace.net blog","url":"https://daily.dev/posts/layer-3-only-evpn-behind-the-scenes-ipspace-net-blog-a4mhned3h","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/layer-3-only-evpn-behind-the-scenes-ipspace-net-blog-a4mhned3h"},"datePublished":"2026-08-11T08:51:47.193Z","dateModified":"2026-08-11T08:54:31.743Z","description":"A deep dive into the control plane mechanics of layer-3-only EVPN/VXLAN networks using Arista cEOS. The data plane resembles VRF-lite, where each VRF gets a...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/8d521e54bdec6e5882bb36fe93f0c186?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/8d521e54bdec6e5882bb36fe93f0c186?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"ipSpace.net Blog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"ipSpace.net Blog","logo":"https://media.daily.dev/image/upload/s--xS7E82MT--/f_auto,q_auto/v1786438303/logos/ipspace?_a=BAMAMicg0","url":"https://daily.dev/sources/ipspace"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/layer-3-only-evpn-behind-the-scenes-ipspace-net-blog-a4mhned3h","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"bgp","timeRequired":"PT6M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"ipSpace.net Blog","item":"https://daily.dev/sources/ipspace"},{"@type":"ListItem","position":3,"name":"Layer-3-Only EVPN: Behind the Scenes « ipSpace.net blog"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/layer-3-only-evpn-behind-the-scenes-ipspace-net-blog-a4mhned3h#faq","mainEntity":[{"@type":"Question","name":"Why does EVPN RT5 (IP prefix) route carry a router MAC address as an extended community?","acceptedAnswer":{"@type":"Answer","text":"EVPN RT5 routes carry a router MAC address because VXLAN is purely an Ethernet-over-UDP transport — every frame it carries must have a source and destination MAC address. In a layer-3-only EVPN design there is no ARP/MAC learning on the transit segment, so the local VLAN interface MAC is attached as an extended BGP community (EvpnRouterMac) alongside the VNI, letting remote PEs build correct forwarding entries. Engineers building EVPN fabrics track these control-plane details on daily.dev as they design or troubleshoot VRF forwarding."}},{"@type":"Question","name":"How does Arista EOS assign VLANs for layer-3 EVPN transit VNIs?","acceptedAnswer":{"@type":"Answer","text":"Arista EOS dynamically creates one internal VLAN per L3 VNI (one per VRF) on the VXLAN interface. These VLANs are marked as dynamic in 'show vlan' output and are not manually configured. Each dynamic VLAN gets a VLAN interface with a MAC address that is then advertised as the EvpnRouterMac extended community in EVPN RT5 updates. The same MAC address is typically reused across all VLAN interfaces on the same switch. Network engineers validating Arista EVPN designs find implementation-level details like these on daily.dev."}}]} ```