EVPN/VXLAN networks
in Proxmox VE

One L2 network across nodes

A classic VLAN requires the same L2 domain to be stretched across physical switches — which scales poorly and ties the network to the cabling topology. VXLAN solves this by tunnelling L2 traffic inside UDP/IP packets: two VMs in the same subnet can run on different nodes (or even different sites) as long as the nodes have IP connectivity.

Separate the two layers: VXLAN is the data plane (how packets are encapsulated and carried), while EVPN is the control plane (how nodes know where each MAC/IP lives). Together they give a scalable, programmable overlay.

A layer-2 tunnel in UDP/IP

VXLAN gives each segment a unique VNI and encapsulates Ethernet frames in UDP packets between nodes. The segment is then independent of the physical topology — all that matters is a routable underlay (e.g. an OpenFabric/OSPF fabric).

A distributed control plane (BGP)

EVPN is a family of BGP routes that distributes MAC and IP reachability across the cluster (type-2 routes). Instead of network "flooding", nodes learn address locations from BGP — a distributed controller (the FRR daemon on each node), with no single point of failure, which fits Proxmox's architecture well.

• Zone = VRF — an EVPN zone is a separate routing table (VRF). Only subnets in the same zone can route to each other — natural multi-tenant isolation.
• Anycast gateway — the subnet gateway is pushed to every node under the same address, so a VM has a local gateway wherever it runs (ideal for live migration).
• Exit nodes — 1–2 designated nodes route traffic between the zone VRF and the physical network (default VRF), acting as the way out.

Controller, zone and VNet

You set it all up under Datacenter → SDN, then click Apply after changes:

For the underlay (IP connectivity between nodes) an SDN Fabric is the easiest choice, and you can inspect EVPN state — learned MAC/IP and routes — in the UI (SDN/EVPN monitoring).