"Spine-Leaf Data Center Design Guide: Building EVPN-VXLAN with Aruba CX or Juniper QFX"
Three-tier core/aggregation/access networks were built for north-south traffic, but modern data centers run east-west: virtualization, container clusters, distributed storage, and AI pipelines all move traffic server-to-server. A spine-leaf fabric with an EVPN-VXLAN overlay gives every workload a consistent, low-latency, horizontally scalable path. This guide walks through the spine-leaf design decisions that matter and helps you decide between an Aruba CX and a Juniper QFX fabric.
Why spine-leaf, and why EVPN-VXLAN
In a spine-leaf topology, every leaf switch connects to every spine switch and never to another leaf. Any server is exactly two hops from any other server, so latency is predictable and you scale by adding leaves (more ports) or spines (more bandwidth) without re-architecting. This is the foundation of a modern data center fabric design.
The physical fabric is the underlay, typically a Layer 3 routed network using eBGP or OSPF with ECMP load-balancing across all spine uplinks. On top of it you run an overlay: VXLAN tunnels carry Layer 2 and Layer 3 traffic between leaf switches (VTEPs), while MP-BGP EVPN is the control plane that advertises MAC and MAC/IP bindings between VTEPs. EVPN replaces legacy flood-and-learn behavior, supports active-active multihoming, and lets you stretch subnets and VRFs anywhere in the fabric. EVPN-VXLAN is the common language both the Aruba CX and Juniper QFX platforms speak, which is what makes a head-to-head comparison fair.
Designing the underlay and overlay
A few decisions shape every spine-leaf build, regardless of vendor:
- Routing design. Most fabrics use eBGP in the underlay (one ASN per leaf, shared or per-spine ASN on the spines) for simple, deterministic ECMP. EVPN runs as an overlay BGP session, often over the same physical links.
- Gateway placement. Edge-Routed Bridging (ERB) puts the Layer 3 gateway on the leaf for optimal east-west routing and is the dominant choice for new builds. Centrally-Routed Bridging (CRB) keeps gateways on spines or border leaves and can be simpler for smaller fabrics.
- Oversubscription. Size leaf uplinks so server-facing capacity does not starve. A common target is 3:1 or lower; AI and storage fabrics often aim for non-blocking.
- Border and services leaves. Dedicate leaves for data center interconnect (DCI), firewalls, and external routing rather than overloading server leaves.
- Redundancy at the access edge. Dual-home servers to a pair of leaves using Aruba VSX or Juniper EVPN multihoming (ESI-LAG) so a single leaf or link failure is non-disruptive.
How to choose: Aruba CX vs Juniper QFX
Both lines now sit inside HPE's networking portfolio, so the decision is less about who you trust and more about operating model, automation, and the rest of your stack.
Aruba CX runs AOS-CX, a single modern OS across the family, and is managed through the CX command line, NetEdit, or Aruba Fabric Composer for guided EVPN-VXLAN provisioning. If your team already runs an Aruba campus on Central, the operational familiarity is a real advantage. The CX 10000, with embedded AMD Pensando DPUs, is unique: it pushes stateful firewalling, NAT, and rich telemetry into the leaf itself, collapsing east-west segmentation into the fabric.
Juniper QFX runs Junos and is most powerful when paired with Juniper Apstra, an intent-based, multivendor fabric controller. You declare the fabric you want; Apstra generates the device configs, validates the running state against that intent continuously, and flags drift as a policy violation rather than a silent config diff. For larger fabrics and teams that want true Day-0-to-Day-2 automation, Apstra is the differentiator.
| Decision factor | Aruba CX | Juniper QFX |
|---|---|---|
| Operating system | AOS-CX (single OS) | Junos / Junos Evolved |
| Typical leaf models | CX 8325, 8360, 9300 | QFX5120, QFX5130 |
| Typical spine models | CX 9300, 10000 | QFX5220, QFX5700 |
| Distributed L4 firewall in leaf | Yes (CX 10000 + Pensando DPU) | No (use SRX/services leaf) |
| Server multihoming | VSX | EVPN multihoming (ESI-LAG) |
| Fabric automation | Fabric Composer / NetEdit | Apstra (intent-based, multivendor) |
| Best fit | Aruba campus shops, in-fabric segmentation | Large fabrics, automation-first teams, multivendor |
A practical rule of thumb: if you want segmentation and stateful security built into the leaf, look hard at the Aruba CX 10000. If your priority is a large, automated, continuously-validated fabric (and possibly a mixed-vendor environment), look hard at Juniper QFX with Apstra. Use our comparison page to line up exact models side by side, or browse the catalog to confirm current availability.
Sizing the fabric
Start from the workload, not the switch. Count physical servers and their NIC speeds (10/25/100GbE) to size leaf access ports. Multiply by your oversubscription target to size leaf uplinks, then choose a spine port count and speed (commonly 100GbE or 400GbE) that supports your current leaf count plus growth. Confirm three numbers before you commit: usable VXLAN/VNI scale, EVPN route scale (MAC and IP), and ECMP path width. Then verify your candidate models are on the same supported AOS-CX or Junos/Apstra release so features line up. When you are ready to translate a topology into a bill of materials, request a quote and we will build it with optics, breakout cables, licensing, and support included.
How Uniqcli helps
Uniqcli is an authorized reseller for HPE, HPE Aruba Networking, and HPE Juniper Networking, so we can design and source a complete spine-leaf fabric from a single partner.
- Scope and design. We help validate your underlay/overlay design, ERB vs CRB gateway placement, oversubscription, and the leaf/spine model mix for your workloads, including AI and storage fabrics.
- Accurate quote. We build a complete BOM, switches, the right optics and DAC/AOC breakout cables, EVPN-VXLAN and Apstra or Fabric Composer licensing, and support, so nothing is missing at install. Start at /quote.
- Compliant procurement. We support TAA-compliant configurations and federal, SLED, and education buying through vehicles and programs including GSA, NASA SEWP, and E-Rate, with country-of-origin documentation for compliance reviews.
- Deploy and support. We coordinate staging, factory integration, and rollout, and connect you to the right HPE/Aruba/Juniper support tier so Day-2 operations are covered.
Browse the products and catalog pages to start scoping, or send us your rack and workload counts via /quote.
FAQ
Can I mix Aruba CX and Juniper QFX in one fabric? Within a single EVPN-VXLAN fabric, keep the spine and leaf platforms consistent for predictable feature and support behavior. If you need a multivendor environment, Juniper Apstra is explicitly designed to manage mixed-vendor fabrics, which is one reason automation-first teams choose it.
Do I need 400GbE spines today? Not necessarily. Many enterprise fabrics run comfortably on 100GbE spines. Move to 400GbE when leaf uplink aggregation, AI/GPU clusters, or high-throughput storage push you past 100GbE per uplink. Sizing the oversubscription ratio first tells you which you need.
What is the advantage of the Aruba CX 10000 over a standard leaf? The CX 10000 embeds AMD Pensando DPUs, so it performs stateful firewalling, NAT, and telemetry line-rate in the leaf. That collapses east-west (server-to-server) security into the fabric instead of hairpinning traffic to a separate firewall, reducing both cost and latency.
Are these switches available on federal contract vehicles? Yes. As an authorized HPE/Aruba/Juniper reseller, Uniqcli can quote TAA-compliant data center switching through federal and SLED vehicles such as GSA and NASA SEWP, and education buyers can apply eligible E-Rate funding. Request a quote and tell us your contract vehicle.