Modern data center fabrics commonly combine BGP EVPN as the control plane with VXLAN as the data plane. In this architecture, a distributed anycast gateway places Layer 3 gateway functionality directly on multiple leaf switches (VTEPs), bringing routing closer to connected workloads.
This post summarizes how VyOS implements the anycast gateway, how traffic moves through the fabric, and why the model matters for workload mobility. For the complete configuration and validation steps, see the EVPN-VXLAN Anycast Gateway Deployment Guide.
With an anycast gateway, participating VTEPs present the same default gateway IP address and MAC address for a subnet. A host in VLAN 100, for example, uses 192.168.1.1 as its gateway whether it is attached to LEAF-1 or LEAF-2, so it keeps the same IP addressing and gateway configuration when it moves within the EVPN fabric.
Sharing the same gateway MAC is especially important for workload mobility. After a migration, the host does not need to learn a new gateway MAC, which reduces ARP and Neighbor Discovery activity and minimizes disruption during convergence.
VyOS hosts the anycast gateway IP and MAC addresses on a pseudo-Ethernet interface. This provides a consistent gateway identity across all participating VTEPs while avoiding the Duplicate Address Detection (DAD) issues that occur when the same address is configured directly on multiple interfaces.
The Layer 2 segment is mapped to a VXLAN VNI, BGP EVPN distributes reachability for endpoints across VTEPs, and the anycast gateway provides the Layer 3 boundary for communication between subnets. Conceptually, the service chain looks like this: VLAN / Bridge → VXLAN VNI → EVPN control plane → Distributed Anycast Gateway.
Traffic flow: routing at the local leaf
The deployment guide uses a Leaf-Spine topology with three leaf switches. PC1 connects to LEAF-1 in VLAN 100, PC3 connects to LEAF-2 in the same VLAN, and PC6 connects to LEAF-3 in VLAN 200. PC1 and PC3 share the same Layer 2 segment from different attachment points, making them a useful example of workload movement between leaf switches.
When PC1 communicates with PC6, the destination sits outside the PC1 subnet, so PC1 sends the packet to its default gateway, 192.168.1.1. The local VyOS leaf answers with the shared anycast gateway MAC, performs the Layer 3 lookup locally, and forwards the packet through the EVPN-VXLAN fabric toward the VTEP that provides reachability to PC6.
Unlike a centralized model, PC1 never has to reach a remote gateway before routing can happen. The local leaf serves as the gateway, while EVPN provides the control-plane information needed to reach remote endpoints and networks.
Workload mobility
If PC1 moves from LEAF-1 to LEAF-2 and stays in VLAN 100, it retains its IP address, subnet, default gateway (192.168.1.1), and gateway MAC address. From the host perspective, nothing changes at Layer 3. EVPN updates the fabric with the new attachment point, so other VTEPs forward traffic to the host's current location.
This separation of workload identity from physical location is a key benefit of EVPN-VXLAN. Applications and virtual machines can move between participating leaf switches without gateway reconfiguration, while the control plane keeps endpoint reachability up to date. The same principle underpins multi-tenant EVPN services built on VyOS.
VyOS EVPN-VXLAN with a distributed anycast gateway combines Layer 2 connectivity, distributed Layer 3 routing, and workload mobility in a single Leaf-Spine fabric. By presenting the same gateway IP and MAC on every participating VTEP, workloads keep a consistent network identity while routing happens close to the traffic source.
As workloads move, BGP EVPN updates endpoint reachability so the fabric adapts without any change to host gateway configuration. To see how this fits into a broader architecture, explore VyOS for EVPN-VXLAN data center fabrics.
Run distributed routing on VyOS.
Designing a Leaf-Spine fabric or planning workload mobility across leaf switches and want a second opinion?
Additional Links