DEV Community: Rusdy Krisman

EVPN/VXLAN/BGP Fabrics Fundamentals – Part 1: The Foundations

Rusdy Krisman — Fri, 04 Sep 2026 05:18:54 +0000

A Beginner’s Guide to Modern Ethernet Fabrics for HPC and AI Environments

vendor-neutral fundamental, packet walks, AI/HPC design context , and troubleshooting

Part 1 — The Foundations ← You are here
Part 2 — VXLAN and EVPN
Part 3 — Distributed Networking Services
Part 4 — How The Fabric Works
Part 5 — HPC and AI Environments
Part 6 — Operations, Automation, and Troubleshooting
Part 7 — Design Examples, Glosary, and References

The one-sentence version

EVPN, VXLAN, and BGP are related but different. VXLAN encapsulates traffic. EVPN advertises reachability. BGP transports routing information. The physical underlay forwards the outer IP packet.

_ The central mental model: logical services ride over a routed physical fabric._

Overview

Modern data-centre fabrics separate physical IP reachability from logical tenant and workload networks. A leaf-spine underlay provides many equal-cost routed paths. VXLAN carries logical Layer-2 or Layer-3 segments across that underlay. EVPN, carried as an MP-BGP address family, distributes endpoint and network reachability so the fabric can make better forwarding decisions than a flood-and-learn overlay alone.

This guide starts with that mental model and then builds the details gradually: leaf-spine architecture, the BGP underlay, VXLAN encapsulation, EVPN route types, distributed gateways, IRB, multihoming, packet walks, automation, observability, and troubleshooting. The final third focuses on HPC and AI environments, where east-west bandwidth, RDMA, congestion control, multi-rail topology, and failure behaviour change the design priorities.

What Is an EVPN/VXLAN/BGP Fabric?

In plain English, an EVPN/VXLAN/BGP fabric is a network in which the physical switches form a routed IP mesh, while logical networks are carried across that mesh as overlays. BGP is commonly used to build IP reachability and to distribute EVPN information. VXLAN is the encapsulation that carries an original Ethernet frame—or, in some designs, routed tenant traffic—between tunnel endpoints called VTEPs.

The most useful beginner mental model is to picture two networks at the same time. The underlay is the real network of cables, switch ports, IP addresses, and routes. The overlay is the logical view presented to applications and tenants: subnets, bridge domains, VRFs, and VNIs. The overlay depends on the underlay, but the underlay does not need to understand every tenant MAC address or subnet.

Figure 1 – Underlay versus overlay: the overlay is logical; the underlay is the physical forwarding medium.

A second separation matters just as much: control plane versus data plane. The control plane learns and distributes information used to make forwarding decisions. The data plane moves packets and frames using the resulting forwarding tables. EVPN is primarily control plane. VXLAN is primarily data-plane encapsulation. The ASIC in a switch forwards the actual traffic.

Common misconception

EVPN does not encapsulate user packets, and VXLAN does not by itself tell every VTEP where each endpoint lives. EVPN and VXLAN solve complementary problems.

Why Data-Centre Networking Changed

Traditional enterprise data centres often extended Layer 2 through several tiers of switching. Spanning Tree Protocol (STP) prevented loops by blocking redundant paths. This was understandable when most traffic was north-south—client to server or server to external network—but it wastes links and creates awkward failure domains when servers communicate heavily with one another.

Virtualization, private cloud, containers, and large distributed systems increased the number of endpoints and made east-west communication dominant. Operators also wanted small repeatable switches instead of a few very large chassis, and they wanted automation that could configure thousands of similar links predictably. A routed Clos/leaf-spine topology matched these needs because every leaf can reach every other leaf through multiple equal-cost spine paths.

Traditional tendency	Modern fabric tendency
Large Layer-2 domains	Routed Layer-3 underlay with smaller physical failure domains
STP blocks redundant links	ECMP actively uses many equal-cost paths
Chassis scale-up	Leaf/spine horizontal scale-out
VLAN-centric segmentation	VRF/VNI-based logical segmentation
Flood-and-learn endpoint discovery	Control-plane distribution with EVPN where applicable
Manual per-device configuration	Templates, source of truth, validation and CI/CD
Mostly north-south assumptions	Heavy east-west traffic, especially AI/HPC

AI and HPC amplify the east-west problem. Distributed training may cause hundreds or thousands of accelerators to exchange synchronized data. Scale-out storage and checkpointing can add large flows at the same time. A fabric therefore needs not only connectivity but predictable path count, high bisection bandwidth, clear failure behaviour, and observable congestion.

A Short History

Ethernet first gave data centres a simple shared link-layer model. VLANs, standardized in IEEE 802.1Q, added logical separation inside a switched network. STP and its successors kept those networks loop-free, but at the cost of disabling some redundant paths. As data centres grew, routed Layer 3 boundaries were pushed closer to servers to reduce Layer-2 failure domains and make all links usable.

Clos topologies—often implemented as leaf-spine—provided many short parallel paths using repeated building blocks. BGP, historically associated with the Internet, proved attractive inside very large data centres because it is mature, policy-capable, horizontally scalable, and well suited to simple point-to-point routed adjacencies. RFC 7938 documented a practical eBGP approach for large-scale data-centre routing.

Virtualization then created a different requirement: keep the operational advantages of a routed IP fabric while offering logical segments that can span racks. VXLAN, documented in RFC 7348, added a 24-bit VNI and UDP/IP encapsulation. EVPN, defined first for BGP/MPLS in RFC 7432 and adapted to network virtualization overlays in RFC 8365, supplied a BGP-based control plane for endpoint and service reachability.

Foundation Concepts

Leaf-Spine Architecture

In a leaf-spine fabric, endpoints connect to leaf switches. Every leaf connects to every spine in the same fabric plane. Spines normally do not connect directly to endpoints, and leaves normally do not connect directly to other leaves. The result is a two-stage Clos network with a predictable number of hops between racks.

Figure 2 – A simple two-spine, four-leaf fabric. Every leaf has a path through every spine.

Because the leaf-to-spine links have equal routing cost, the forwarding plane can use Equal-Cost Multipath (ECMP). Instead of blocking redundant links, the network hashes flows across several active next hops. Adding spines can increase aggregate fabric capacity until leaf port limits or other design boundaries are reached.

Oversubscription describes the ratio between potential server-facing bandwidth and uplink bandwidth. A 1:1 design is often called nonblocking at the intended tier because the total leaf downlink capacity is matched by uplink capacity. Many enterprise networks deliberately oversubscribe because workloads rarely transmit at line rate simultaneously. Large distributed AI jobs can make that assumption unsafe, so compute fabrics are often designed with much lower oversubscription.

Figure 3 – East-west traffic has multiple active paths instead of a single STP-selected tree.

What to remember

Leaf-spine is a topology, not an overlay protocol. You can build a perfectly valid leaf-spine network with plain Layer-3 routing and no VXLAN or EVPN at all.

The IP Underlay

The underlay’s job is deliberately simple: provide resilient IP reachability between infrastructure addresses, especially VTEP loopbacks. A common design uses numbered or unnumbered point-to-point Layer-3 links between leaves and spines, plus loopback addresses that remain stable even when an individual physical link changes state.

Any routing protocol that meets the requirements can build this reachability. Some fabrics use OSPF or IS-IS. Many large designs use eBGP because each point-to-point adjacency can be modeled simply, operational boundaries are explicit, and BGP already exists for the EVPN overlay. Using BGP twice does not mean the two functions are the same: the underlay address family carries infrastructure IP prefixes, while the overlay EVPN address family carries EVPN routes.

Figure 4 – Illustrative underlay addressing. The exact scheme varies by implementation.

The underlay generally does not need to know Tenant-A’s MAC addresses, every VM subnet, or every Kubernetes service. It just forwards outer IP packets between VTEPs. Keeping this role narrow makes the physical network easier to reason about and troubleshoot.

BGP for Beginners

Routing protocols let routers exchange reachability. BGP is a path-vector protocol: it advertises prefixes together with attributes that describe how those prefixes can be reached and how paths should be selected. BGP speakers form explicit neighbor relationships, exchange routes, and install selected paths into routing tables.

An Autonomous System (AS) is a routing domain identified by an AS number. eBGP operates between different AS numbers; iBGP operates within the same AS. Data-centre designs often assign AS numbers in ways that make leaf-spine relationships easy to automate—for example one AS per leaf and one common or grouped AS for spines—but many models are valid.

Figure 5 – BGP peers exchange reachability and attributes; they do not forward user traffic merely because a BGP session exists.

MP-BGP (Multiprotocol BGP) extends BGP so it can carry multiple address families. IPv4 unicast is one address family. IPv6 unicast is another. EVPN is another. That is why you will often hear “MP-BGP EVPN”: BGP is the transport and route-selection framework, while EVPN defines the information model carried in that address family.

BGP role	Typical information	Purpose
Underlay BGP	Infrastructure IP prefixes, loopbacks, point-to-point reachability	Make VTEP and fabric addresses reachable
MP-BGP EVPN overlay	MAC/IP advertisements, IMET information, IP prefixes, Ethernet-segment information	Distribute logical service and endpoint reachability

Common misconception

BGP is not “only for the Internet.” The protocol is used inside large data centres because its operational model also fits horizontally scaled Clos fabrics.

Next: Part 2 — VXLAN and EVPN

Generative AI for Beginners – Part 2: How It Works

Rusdy Krisman — Thu, 03 Sep 2026 04:35:53 +0000

A Beginner’s Guide to the Fundamentals

A practical, concept-first guide for technology professionals and curious beginners

Part 1 — What It Is and Why It Matters
Part 2 — How It Works ← You are here

How Large Language Models Work

An LLM can be understood at a useful level without deriving the mathematics. The important idea is that text becomes numerical representations, passes through many transformer layers, and is used to predict what should come next.

Step 1: text becomes tokens

The tokenizer converts text into token IDs. The exact token boundaries depend on the model’s tokenizer. Common words may be one token, while unusual words may be split into several pieces. The model does not operate directly on visible characters or words; it operates on these numerical token representations.

Step 2: tokens become vectors

Each token ID is mapped to a vector representation called an embedding. The network transforms these vectors through many layers. During this process, representations become context-sensitive: the representation of a word such as “bank” differs depending on whether nearby text is about money or a river.

Step 3: transformer layers relate the context

Self-attention lets the model weigh relationships among tokens. Other transformations inside each layer refine the representation. Repeating this process across many layers lets the model capture syntax, semantics, patterns of reasoning, styles, and task structures that emerged during training.

Step 4: the model predicts a distribution for the next token

At generation time, the model calculates probabilities for possible next tokens. A decoding strategy chooses one token. That token is appended to the context, and the process repeats. Sophisticated behavior emerges because the model has learned rich internal representations and because each prediction is conditioned on the entire available context—not because it is simply looking up a canned phrase.

Figure 5 – The autoregressive generation loop

Why models can appear to reason—and why they can fail

Large models can learn patterns that support decomposition, analogy, code execution planning, mathematical transformations, and multi-step explanation. Some models are trained or run with techniques that allocate more computation to difficult problems. However, their outputs are still generated by a learned model under uncertainty. A fluent chain of reasoning can contain a hidden error, and a confident answer can still be wrong.

Common Mistake

“Next-token prediction” is a correct description of a common training and generation objective, but calling an LLM “just autocomplete” hides the important part: the network has learned complex representations that make those token predictions useful across many tasks.

The Transformer Architecture

Transformers are the architectural foundation of most modern LLMs. The key innovation is attention: a way to dynamically relate parts of a sequence to one another.

Attention in intuitive terms

Suppose the sentence says, “The server could not reach the database because it was offline.” To interpret “it,” the model must decide which earlier words are most relevant. Attention provides a learned mechanism for assigning importance to relationships in the context rather than relying only on a fixed-size memory of previous steps.

Query, Key, and Value

A common analogy is information retrieval. A Query represents what a token is looking for. Keys represent what other tokens offer for matching. Values contain the information that can be combined if a match is important. The analogy is useful, but the real mechanism is numerical: learned projections create query, key, and value vectors, and attention weights determine how information is mixed.

Position still matters

Attention alone does not inherently encode word order, so transformer systems include positional information. Different architectures implement this in different ways. The goal is the same: let the model distinguish “dog bites man” from “man bites dog.”

Transformer blocks

Figure 6 – Simplified transformer block

Encoder-only, decoder-only, and encoder-decoder

Architecture	Strength	Typical role
Encoder-only	Builds representations of an input	Classification, embeddings, understanding tasks
Decoder-only	Generates sequences autoregressively	Most conversational LLMs and code generators
Encoder-decoder	Encodes input then generates output	Translation and sequence-to-sequence tasks

Foundation Models and Large Language Models

A foundation model is a reusable base. An application can use it directly, adapt its behavior, ground it with external data, or place it inside a larger workflow.

What makes a model a foundation model?

A foundation model is trained broadly enough to support many downstream tasks rather than one narrow prediction target. It can be adapted through prompts, retrieval, fine-tuning, tools, or application logic. Language models are the most familiar example, but foundation models can also span vision, audio, and multimodal inputs.

General-purpose versus specialized models

General-purpose models are designed to handle a wide range of topics and instructions. Specialized models may be optimized for coding, mathematics, embeddings, safety classification, speech, or a specific industry. The best model for a workload is not necessarily the largest general-purpose model.

Open-weight versus proprietary

Open-weight models make trained model weights available under a license, allowing organizations to run, inspect, adapt, or redistribute them within the license terms. Proprietary models are normally consumed through a hosted service or API. “Open-weight” does not automatically mean fully open-source: training data, training code, or licensing terms may still be restricted.

Small Language Models and Large Language Models

Smaller models can be cheaper, faster, easier to deploy privately, and sufficient for well-defined tasks. Larger models tend to offer broader capability and robustness but need more compute and memory. Production systems increasingly route different tasks to different models rather than assuming one model should handle everything.

Dimension	Smaller model	Larger model
Cost	Usually lower per request/self-host footprint	Usually higher
Latency	Often lower	Can be higher
Deployment	More feasible on edge or modest GPUs	Often requires larger accelerators or hosted APIs
Capability breadth	Best when task is bounded	Often stronger across diverse tasks
Privacy/control	Can be easier to self-host	Depends on deployment option

The GenAI Model Lifecycle

The model lifecycle separates the expensive process of creating or adapting a model from the operational process of serving it to applications.

Figure 7 – Model lifecycle

Data and pre-training

Pre-training exposes a model to a very large dataset and optimizes it to learn general patterns. This is computationally expensive and is usually performed by model developers rather than ordinary enterprise application teams. Data quality, mixture, filtering, deduplication, and rights management can strongly affect the resulting model.

Instruction tuning and alignment

A raw pre-trained model may be good at continuing text but poor at behaving like an assistant. Instruction tuning trains it on examples of instructions and desired responses. Alignment techniques use preference or policy signals to make behavior more useful and safer. RLHF is one well-known family of methods; newer approaches can use AI-generated preference data or direct preference optimization techniques.

Evaluation before deployment

A model should be measured against the tasks it must perform. General benchmark scores are useful but not enough. An enterprise needs workload-specific evaluation sets covering accuracy, groundedness, safety, latency, cost, and failure modes.

Inference and operations

Inference is the production phase in which users and applications submit requests. Serving systems batch work, manage GPU memory, cache reusable information, enforce quotas, monitor latency, and scale capacity. The operational lifecycle includes observability, safety monitoring, model versioning, and controlled upgrades.

Beginner Mental Model

Most companies should not start by asking, “How do we train our own foundation model?” A more practical sequence is: select a model, evaluate it, ground it with data, add application controls, and only fine-tune if there is a clear reason.

Previous: Part 1 – What It Is and Why It Matters

Generative AI for Beginners – Part 1: What It Is and Why It Matters

Rusdy Krisman — Thu, 03 Sep 2026 03:06:19 +0000

A Beginner’s Guide to the Fundamentals

A practical, concept-first guide for technology professionals and curious beginners

Part 1 — What It Is and Why It Matters ← You are here
Part 2 — How It Works

The one-sentence version

Think of Generative AI as a new software capability built around models that can generate useful content from context. The model is important, but a production GenAI system is usually much larger than the model: it includes applications, data retrieval, security controls, tools, identity, monitoring, and operational infrastructure.

Introduction: What Is Generative AI?

Generative AI is easiest to understand by starting with what it does: it creates new output from patterns learned during training and from the context supplied at run time.

A plain-English definition

Generative Artificial Intelligence (GenAI) is a class of AI systems that can produce new content such as text, software code, images, audio, video, structured data, and combinations of these formats. A GenAI model does not normally retrieve a pre-written answer from a database. Instead, it generates an output step by step according to patterns represented in its learned parameters and the information available in the current context.

For a text model, generation usually means predicting a useful sequence of tokens. For an image model, it means constructing an image representation that matches the user’s instructions. Multimodal systems can accept several forms of input at once—for example, a screenshot plus a question—and produce text, code, or another media type in response.

What “generative” means

Traditional analytical systems often classify, score, forecast, rank, or detect. Generative systems can do those things as part of a larger task, but their defining feature is that they can synthesize a new output. The output may be highly constrained, such as a JSON object that follows a schema, or open-ended, such as a draft article.

Approach	Typical Input	Typical Output	Simple Example
Predictive AI	Historical features	Score, class, forecast	Estimate fraud probability
Generative AI	Prompt + context	New text, code, image, audio, etc.	Draft a customer reply
Search	Query	Ranked sources or documents	Find pages about a topic
Traditional software	Explicit inputs	Deterministic programmed behavior	Calculate tax from rules
Automation	Trigger + workflow	Execution of predefined steps	Create a ticket when an alert fires

GenAI is usually a component, not the whole application

A chatbot makes the model visible, so it is tempting to equate “GenAI application” with “LLM.” In production, however, the model is normally one component inside a broader system. The application may authenticate the user, retrieve enterprise data, enforce policies, call external tools, validate outputs, log events, and route requests to different models.

Figure 1 – A minimal GenAI request

Common Mistake

Do not use “AI,” “machine learning,” “GenAI,” and “LLM” as if they were exact synonyms. GenAI is one part of AI, and LLMs are one important class of generative model.

Why Generative AI Matters

The importance of GenAI is not just that it can write. The deeper shift is that natural language can now act as a flexible interface to software, knowledge, and workflows.

Natural language becomes a computing interface

For decades, people adapted themselves to software: they learned menus, commands, query languages, forms, APIs, and application-specific workflows. GenAI adds another interface model. A person can describe an objective, provide context, and ask the system to transform, explain, analyze, or create. This lowers the interaction cost for many tasks and makes sophisticated software capabilities accessible to a wider population.

Knowledge work augmentation

Many knowledge-work tasks involve reading, synthesizing, transforming, and communicating information. GenAI can accelerate the mechanical parts of that work: summarize a large document, compare alternatives, create a first draft, translate between technical and executive language, generate test cases, or turn a natural-language request into code. The best use is often augmentation rather than blind substitution: the human defines the objective, reviews the output, and handles judgment that cannot safely be delegated.

Software development acceleration

Code generation is a particularly strong example because software has explicit structure and can be tested. Models can explain unfamiliar code, draft functions, generate unit tests, propose refactors, produce configuration, and help debug failures. This changes the developer’s workflow from typing every token manually toward specifying intent, reviewing results, and validating behavior.

Enterprise automation and decision support

When connected to trusted data and controlled tools, GenAI can become the reasoning and language layer in a workflow. For example, it can read a support case, retrieve the relevant runbook, explain the likely cause, and—after approval—call an IT service-management API. This combination of language understanding, retrieval, and tool use is a foundation for agentic workflows.

Why This Matters

GenAI compresses the distance between intent and execution. That is powerful, but it also means security, permissions, data quality, validation, and human oversight become part of the application design—not optional add-ons.

A Short History of Artificial Intelligence and Generative AI

Modern GenAI did not appear suddenly. It is the result of decades of progress in algorithms, data, computing hardware, software frameworks, and large-scale engineering.

From symbolic AI to learned representations

Early AI research often focused on symbolic reasoning: humans encoded knowledge as rules, logical statements, or expert-system structures. These systems could perform well in narrow domains, but they were expensive to build and brittle when the real world did not fit the encoded rules.

Machine learning shifted part of the burden from explicit rules to data. Instead of programming every decision, engineers trained statistical models to learn patterns from examples. Neural networks extended this idea by learning layered representations, and deep learning made those networks much larger and more capable.

Why GPUs mattered

Training deep neural networks requires enormous numbers of matrix operations. Graphics Processing Units (GPUs) were originally designed to execute many numerical operations in parallel for graphics. Their parallel structure also proved highly effective for neural-network workloads. Improvements in GPU hardware, programming libraries, and distributed computing made it practical to train models on previously impossible scales.

From sequence models to attention and transformers

Earlier language systems often used recurrent neural networks (RNNs) and Long Short-Term Memory (LSTM) networks to process sequences. These architectures were useful but difficult to parallelize across long sequences. Attention mechanisms allowed a model to focus on the most relevant parts of an input. The Transformer architecture, introduced in 2017, built on attention and enabled much more parallel training and more effective modeling of long-range relationships.

Foundation models, instruction tuning, and the conversational breakthrough

As model scale, data, and compute increased, researchers found that a model trained broadly could be adapted to many downstream tasks. These became known as foundation models. GPT-style decoder models demonstrated strong general language generation. Instruction tuning and alignment methods such as Reinforcement Learning from Human Feedback (RLHF) made models better at following human instructions and interacting conversationally.

RAG, multimodality, tools, and agents

The next major shift was architectural. Instead of expecting one model to contain every useful fact, applications began retrieving external knowledge at run time through Retrieval-Augmented Generation (RAG). Multimodal models expanded beyond text. Tool use allowed models to call APIs, search systems, calculators, code runtimes, and databases. By the mid-2020s, these capabilities were increasingly assembled into agentic systems that could plan and execute multi-step workflows under policy and human control.

Figure 2 – Simplified GenAI evolution

The AI Family Tree

A clear vocabulary prevents a great deal of confusion. The terms overlap, but they refer to different scopes and capabilities.

Figure 3 – A practical AI family tree

Artificial Intelligence

Artificial Intelligence is the broadest term. It covers software techniques intended to perform tasks associated with perception, prediction, planning, language, problem solving, or decision support. Not all AI uses machine learning.

Machine Learning and Deep Learning

Machine Learning (ML) refers to systems that learn patterns from data rather than relying only on explicitly programmed rules. Deep Learning is a subset of ML that uses neural networks with many layers and large numbers of parameters. Modern language and multimodal models are primarily deep-learning systems.

Generative AI and Foundation Models

Generative AI focuses on producing new content. A foundation model is trained broadly enough to serve as a base for many tasks and applications. An LLM is a foundation model specialized in language, although modern LLMs increasingly participate in multimodal systems.

AI Agents

An AI agent is not simply a bigger chatbot. It is an application pattern in which a model can decide among actions, use tools, observe results, maintain state, and continue toward an objective. The surrounding runtime determines what the agent is allowed to do and when a human must approve an action.

Core Concepts for Beginners

The vocabulary of GenAI becomes much easier once each term is connected to a simple mental model.

Concept	Beginner-friendly meaning
Model	A learned mathematical system that maps inputs to outputs.
Parameters	Learned numerical values inside the model. They encode statistical patterns, not a human-readable encyclopedia.
Training	The process of adjusting model parameters using data and an optimization objective.
Dataset	The examples used for training, evaluation, fine-tuning, or testing.
Inference	Running a trained model to produce an output.
Token	A unit of text processed by a language model. It may be a word, part of a word, punctuation, or another symbol.
Tokenization	Converting raw text into tokens and token IDs.
Context window	The amount of input and generated history a model can consider in one request or session.
Prompt	Instructions and context supplied to a model.
System prompt	Higher-priority instructions that define behavior, boundaries, role, or policy for an application.
Temperature	A sampling control that can influence output variability; exact behavior depends on the model/API.
Embedding	A numerical vector that represents semantic properties of content.
Vector similarity	A mathematical way to estimate how close two embeddings are in semantic space.
Hallucination	A plausible-sounding output that is unsupported, incorrect, or invented.
Grounding	Connecting model output to trusted external evidence or context.
Fine-tuning	Additional training that adapts a base model to desired behavior or a domain.
Quantization	Representing model weights or calculations with lower numerical precision to reduce memory or improve performance.
Latency	How long one request takes.
Throughput	How much work a system completes per unit of time.
Requests per second	A common throughput measure for serving systems.
Input vs output tokens	Tokens sent to the model versus tokens generated by the model; they often have different cost and performance characteristics.

Figure 4 – From text to generated tokens

Beginner Mental Model

Training changes the model. Inference uses the model. RAG usually changes the context supplied at inference time; it does not normally change the model’s weights.

Next: Part 2 – How It Works