1. What Is Leaf-Spine Architecture?

Leaf-spine architecture is a two-tier network topology commonly used in data centers.

• Leaf switches: Connect servers, storage, firewalls, and other endpoints to the network.
• Spine switches: Provide routed connectivity between the leaf switches.

In a typical design, every leaf switch connects to every spine switch. Leaf switches usually do not connect directly to other leaf switches, and spine switches generally do not connect to each other within the same two-tier fabric.

               SPINE LAYER
          +---------+  +---------+
          | Spine 1 |  | Spine 2 |
          +---------+  +---------+
             |\  \        /  /|
             | \  \      /  / |
             |  \  \    /  /  |
          +---------+  +---------+
          |  Leaf 1 |  |  Leaf 2 |
          +---------+  +---------+
             |   |         |   |
           Server Server  Server Server

                LEAF LAYER
        

2. What Does a Leaf Switch Do?

A leaf switch sits at the edge of the data center fabric and connects workloads to the network.

Typical responsibilities

• Connect physical servers and virtualization hosts.
• Provide Ethernet connectivity to storage and other infrastructure.
• Support VLANs and access policies.
• Perform Layer 2 switching and, in routed fabrics, Layer 3 forwarding.
• Act as a VXLAN tunnel endpoint when the platform and design support it.
• Connect to multiple spine switches for path diversity.

Leaf switches may also host first-hop routing, network segmentation, and other services depending on the architecture.

3. What Does a Spine Switch Do?

A spine switch connects leaf switches and provides high-speed transit across the fabric. In a common Layer 3 leaf-spine design, spine switches route packets between leaf switches.

Typical responsibilities

• Provide high-capacity links to leaf switches.
• Forward routed traffic between leaves.
• Support multiple equal-cost paths where the routing design allows it.
• Provide an alternative path when a supported link or device fails.

In a conventional two-tier design, endpoints connected to different leaves can generally reach one another through a spine. The exact path and forwarding behavior depend on the topology and protocols in use.

4. How Does Traffic Flow in Leaf-Spine?

Example A: Two servers on the same leaf

Server A ---- Leaf 1 ---- Server B
        

If the servers are on the same leaf and their traffic can be forwarded locally, communication may remain within that leaf without traversing a spine.

Example B: Servers connected to different leaves

Server A
   |
 Leaf 1
   |
 Spine 1
   |
 Leaf 2
   |
Server B
        

In a routed leaf-spine fabric, traffic between different leaves normally crosses a spine. When multiple equal-cost paths exist, routing and forwarding mechanisms may distribute traffic across the available paths.

Why is this useful?

The design provides a predictable number of fabric hops between leaf-connected endpoints. In a basic two-tier topology, traffic between different leaves usually crosses one spine, regardless of which leaf pair is communicating.

5. Leaf-Spine vs Traditional Three-Tier Architecture

Neither architecture is universally best. The right design depends on application traffic patterns, scale, operational requirements, existing infrastructure, and cost.

6. What Is East-West and North-South Traffic?

East-west traffic

East-west traffic moves between workloads inside an environment. Examples include an application server communicating with a database or two services communicating with each other.

North-south traffic

North-south traffic moves between the data center and external networks, such as user traffic entering a website or application traffic reaching an external service.

            External Users
                  |
                  | North-South
                  v
             Edge / Firewall
                  |
             Leaf-Spine Fabric
             /              \
            v                v
        Web Servers <----> Database
                 East-West
        

Leaf-spine designs are particularly useful when applications generate substantial east-west traffic, but they can also support north-south traffic through appropriate border leaves, routers, firewalls, and service infrastructure.

7. What Is ECMP?

ECMP stands for Equal-Cost Multi-Path. It allows a router or switch to use multiple routes with the same routing cost to reach a destination.

In a leaf-spine fabric, a leaf may have equal-cost routes through several spine switches. ECMP can distribute traffic flows across these paths.

                   +---------+
                   | Spine 1 |
                   +---------+
                  /           \
                 /             \
          +---------+       +---------+
          | Leaf 1  |       | Leaf 2  |
          +---------+       +---------+
                 \             /
                  \           /
                   +---------+
                   | Spine 2 |
                   +---------+
        

The diagram illustrates multiple paths between the leaf switches. In an actual fabric, each leaf typically connects directly to each spine, and the routing table determines which equal-cost paths are available.

Important ECMP points

• ECMP uses multiple equal-cost paths when they are available in the forwarding table.
• Traffic is often distributed by hashing packet or flow fields.
• Hashing helps keep packets from the same flow on a consistent path.
• Traffic distribution may be uneven because individual flows can have different sizes.
• ECMP is not the same as an application load balancer.

8. What Is Oversubscription?

Oversubscription compares the total bandwidth offered by connected devices with the available upstream network capacity.

For example, suppose a leaf switch connects 48 server ports running at 25 Gbps each. The total server-facing link capacity is:

48 × 25 Gbps = 1,200 Gbps
               = 1.2 Tbps
        

If the leaf has four 100 Gbps uplinks to the spine layer, its total uplink capacity is:

4 × 100 Gbps = 400 Gbps
              = 0.4 Tbps
        

The nominal server-facing-to-uplink bandwidth ratio is therefore 1.2 Tbps to 0.4 Tbps, or 3:1.

This is a theoretical port-capacity comparison. Actual traffic demand, protocol overhead, hardware architecture, and the availability of links affect real performance.

Why does oversubscription matter?

• A high ratio can reduce infrastructure cost.
• Heavy simultaneous traffic may create congestion.
• Applications with large east-west traffic demands may need more uplink capacity.
• Engineers should design capacity around expected traffic patterns and failure scenarios.

9. How Does Leaf-Spine Provide Redundancy?

Connecting each leaf to multiple spine switches provides alternative paths through the fabric.

             Spine 1       Spine 2       Spine 3
                |\            |            /|
                | \           |           / |
                |  \          |          /  |
                |   \         |         /   |
              Leaf 1         Leaf 2         Leaf 3
        

If a spine or one of its links fails, traffic may use other available paths if routing, link-state detection, and forwarding are configured correctly.

Design considerations

• Provide enough paths to meet availability requirements.
• Ensure surviving links have enough capacity during failures.
• Monitor interface errors and link status.
• Test failure scenarios before production deployment.
• Use consistent configurations and appropriate routing policies.

Redundancy reduces the impact of certain failures, but it does not remove every possible failure mode. Power, software, configuration, and shared infrastructure risks must also be considered.

10. Leaf-Spine with VXLAN and EVPN

Leaf-spine describes the physical or routed fabric topology. VXLAN and EVPN add overlay networking and endpoint reachability services when required.

VXLAN

VXLAN encapsulates Ethernet frames in UDP/IP packets, allowing logical network segments to span a routed IP fabric.

EVPN

EVPN uses BGP to advertise endpoint and service reachability information. It is commonly used as the control plane for VXLAN overlays.

        Virtual Machines / Servers
                   |
                   v
              Leaf Switches
              (VXLAN VTEPs)
                   |
                   v
              Spine Switches
             (IP Underlay)
                   |
                   v
            Other Leaf Switches

       BGP EVPN: Reachability Control Plane
       VXLAN: Overlay Data Plane
        

In this type of design, the underlay provides IP connectivity between VTEPs, VXLAN carries encapsulated overlay traffic, and EVPN distributes reachability information. Specific roles can vary by platform and architecture.

11. Common Leaf-Spine Design Mistakes

• Insufficient uplink capacity: Underestimating traffic demand can create congestion.
• Incorrect routing: Bad addressing or routing configuration can prevent expected paths from being installed.
• MTU mismatch: VXLAN encapsulation adds packet overhead that the underlay must accommodate.
• Weak failure planning: Surviving links may not have enough capacity after a failure.
• Unplanned expansion: Adding leaves requires sufficient spine ports and fabric capacity.
• Limited monitoring: Without telemetry and alerts, congestion or failures may go unnoticed.
• Assuming all traffic is balanced perfectly: ECMP hashing does not guarantee equal bandwidth use for every path.

12. Quick Quiz

13. Key Takeaways

• Leaf-spine is a two-tier topology commonly used in modern data centers.
• Leaf switches connect workloads; spine switches provide connectivity between leaves.
• ECMP can distribute traffic across multiple equal-cost routed paths.
• Oversubscription helps engineers reason about capacity and potential congestion.
• Multiple links and spine switches can improve resilience when properly designed.
• VXLAN and EVPN can add scalable overlay networking and reachability services to the fabric.
• Capacity planning, MTU, routing, monitoring, and failure testing are essential for reliable operation.