BGP-EVPN multi-tenancy on Spectrum-X is the mechanism by which a single physical GPU fabric is safely partitioned among multiple tenants with independent routing, security, and performance domains. The architecture layers three complementary isolation technologies: VXLAN VNIs for Layer 2 segmentation (24-bit namespace, hardware encap/decap in Spectrum-4), BGP-EVPN route-targets for Layer 3 routing isolation (Type-2 MAC-IP routes for host reachability, Type-5 IP prefix routes for subnet routing, with RT import/export governing which routes appear in which VRF), and GBP microsegmentation for fine-grained intra-tenant and cross-tenant policy enforcement in TCAM.

Symmetric IRB is the recommended IRB model for GPU fabrics because it uses the same L3 VNI in both directions, simplifying traffic engineering and telemetry correlation. VNI planning must follow a structured allocation scheme to prevent silent traffic mixing - the most operationally dangerous class of multi-tenant failure because it does not produce routing errors.

The four primary failure modes (cross-tenant route leak, missing RT import, flood-and-learn enabled, VXLAN drop in WJH) each have deterministic diagnostic paths using net show bgp evpn route type 5, nv show vrf ... router bgp route-import, and net show wjh. NVIDIA Air simulation with NetQ check evpn automation provides the validation loop that prevents isolation failures from reaching production.

Chapter 28 extends the observability model: NetQ's fabric-wide monitoring, congestion correlation, and CI/CD integration complete the operational stack built on top of the Spectrum-X hardware and EVPN control plane introduced in this chapter.