For decades the standard campus and data center design was a hierarchy: access switches at the edge, distribution in the middle, a core at the top. It was built for users reaching a server and the internet. Modern data centers look different because the traffic looks different: servers talk to other servers more than to anyone outside. Spine-leaf is the design that answers that, and it is now the default pattern for new data center networks. This guide explains how it works, the numbers behind it, and how it is tested on Cisco CCNA and CompTIA Network+.
What is spine and leaf architecture?
A spine-leaf topology has two kinds of switch. Leaf switches are the access layer: servers, storage arrays, firewalls and load balancers plug into them. Spine switches are the backbone: each one connects to every leaf. The two rules that define the design are that every leaf connects to every spine and that leaves do not connect to other leaves, and spines do not connect to other spines. Hosts never plug into spines.
Spine 1 Spine 2 Spine 3 Spine 4
/|\ \ /|\ \ /|\ \ /|\ \
/ | \ \ / | \ \ / | \ \ / | \ \ every leaf has one link
/ | \ \ / | \ \ / | \ \ / | \ \ to every spine
Leaf 1 Leaf 2 Leaf 3 Leaf 4 ... Leaf N
| | | | |
servers servers servers servers serversThe structure is a folded Clos network. The result is a design in which the path between any two leaves is exactly two links with one spine in the middle, so a server reaches any other server on another rack in the same number of hops (within a single pod of a three-stage fabric). Servers sharing a leaf talk through that single switch.
What is the difference between three-tier and spine-leaf?
| Aspect | Traditional three-tier | Spine-leaf |
|---|---|---|
| Layers | Core, distribution, access | Spine and leaf (two tiers) |
| Optimized for | North-south traffic (users to servers and the internet) | East-west traffic (server to server) |
| Path length | Varies by where devices sit | Same for all leaf-to-leaf paths within a pod (leaf, spine, leaf) |
| Loop control | Layer 2 with Spanning Tree; redundant links blocked | Routed Layer 3 links with ECMP; all links active |
| Latency | Variable, depends on path | Predictable and low |
| Scaling | Scale up: bigger core and distribution boxes | Scale out: add spines for bandwidth, leaves for ports |
| Failure impact | Losing a core or distribution switch can remove a large share of capacity | Losing one spine of N removes 1/N of fabric bandwidth |
| Typical home | Campus and older data centers | Modern data centers, cloud and AI clusters |
North-south traffic crosses the data center boundary (a client request arriving, a response leaving). East-west traffic stays inside: a web tier calling an application tier, a database replicating, a hypervisor moving a virtual machine, a storage cluster rebalancing. Virtualization, containers and distributed applications multiplied east-west traffic, which is the main reason the industry moved away from the three-tier model in data centers. The campus still commonly uses core, distribution and access, and Spanning Tree remains essential there; see our Spanning Tree Protocol guide for that side.
Why do data centers use spine-leaf?
Data centers use spine-leaf because most of their traffic is east-west (server to server), and the design gives every leaf equal-cost paths through every spine, predictable latency and easy horizontal scaling. The main reasons:
- East-west performance. Server-to-server traffic has direct, equal paths and does not climb a hierarchy.
- Predictable latency. Every leaf-to-leaf path within a pod has the same hop count, which matters for storage, clustered databases and distributed computing.
- Full use of bandwidth. Routed ECMP uses every uplink. A Spanning Tree network keeps redundant links idle in a blocking state.
- Horizontal scaling. Need more server ports? Add a leaf. Need more bandwidth between leaves? Add a spine. No forklift replacement.
- Resilience. There are many parallel paths, so a failure shrinks capacity by a fraction instead of cutting a path.
- Simple, repeatable design. Identical building blocks are easier to automate, document and troubleshoot.
How does ECMP use the fabric?
Because leaf-to-spine links are routed (Layer 3), each leaf learns several equal-cost routes to every other leaf, one via each spine. ECMP (equal-cost multipath) lets the leaf install all of them and spread traffic across them. Switches normally hash the flow's header fields (source and destination IP, protocol, source and destination port) so that packets of one flow stay on one path and arrive in order, while different flows land on different spines. The same principle applies to any routing protocol that installs equal-cost routes, such as OSPF, which is one of the underlay choices.
The consequence for design: ECMP balances flows, not packets. A few very large flows (“elephant flows”) can still overload one uplink while others sit idle, which is why monitoring per-link utilization matters.
How do you calculate oversubscription?
Oversubscription ratio = total downlink bandwidth to servers : total uplink bandwidth to spines. A ratio of 1:1 is non-blocking: if every server sends at full rate off the leaf, the uplinks can carry it. Real fabrics usually accept some oversubscription because servers rarely all transmit at line rate at once, and the cost of a non-blocking fabric is high.
Worked example. A leaf has 48 x 25 Gbps server ports and 6 x 100 Gbps uplinks. Downlink is 48 x 25 = 1,200 Gbps and uplink is 6 x 100 = 600 Gbps. The ratio is 1,200 : 600 = 2:1.
| Leaf design | Downlink | Uplink | Ratio |
|---|---|---|---|
| 48 x 25 Gbps down, 6 x 100 Gbps up | 1,200 Gbps | 600 Gbps | 2:1 |
| 48 x 25 Gbps down, 4 x 100 Gbps up | 1,200 Gbps | 400 Gbps | 3:1 |
| 32 x 10 Gbps down, 4 x 40 Gbps up | 320 Gbps | 160 Gbps | 2:1 |
| 16 x 100 Gbps down, 16 x 100 Gbps up (32-port leaf) | 1,600 Gbps | 1,600 Gbps | 1:1 (non-blocking) |
Note two things. The ratio compares bandwidth, not port counts, and it is measured per leaf. Also, oversubscription only matters for traffic that leaves the leaf; traffic between two servers on the same leaf never touches the uplinks.
How does spine-leaf scale?
Two numbers set the size of a two-tier fabric: the port count of a spine (how many leaves it can connect) and the number of spines (how many uplinks each leaf has). Suppose each spine has 32 x 100 Gbps ports and there are 4 spines, with every leaf running one link to each spine:
- Maximum leaves: 32, one per spine port.
- Each leaf has 4 x 100 = 400 Gbps of uplink. With 48 x 25 Gbps (1,200 Gbps) server ports, the ratio is 3:1.
- Server capacity: 32 leaves x 48 ports = 1,536 server ports.
- Fabric links: 32 leaves x 4 spines = 128 leaf-to-spine links.
To lower the ratio, add spines (each leaf needs a free uplink port per spine). To add servers, add leaves until the spine ports run out. When one layer of spines is not enough, designers add a third layer, often called a super-spine or a 5-stage Clos, to join multiple spine-leaf “pods”. Border leaves connect the fabric to the WAN, firewalls and the internet so that server leaves stay uniform.
Test your network architecture knowledge
Free practice mode gives you 30 questions per session on CCNA or Network+, no card needed. The full 500-question bank and exam mode are paid.
Check yourself
Check 1. In a spine-leaf network, what do servers connect to?
Leaf switches only. Spines connect to leaves, never directly to servers or to each other.
Check 2. What type of traffic does spine-leaf optimize for?
East-west (server-to-server) traffic inside the data center.
Check 3. Which mechanism spreads traffic across all spine uplinks?
ECMP, equal-cost multipath routing. Because the fabric is routed, every equal-cost uplink can carry traffic and none is blocked.
What are the underlay and overlay: VXLAN and EVPN?
The underlay is the routed IP network between leaves and spines, the overlay (usually VXLAN) carries tenant traffic across it, and BGP EVPN is the control plane that tells VTEPs where each MAC or IP lives. In one line: underlay = IP transport; VXLAN = the tunnel; EVPN = the address book.
Underlay
Modern spine-leaf fabrics separate two networks. The underlay is the physical, routed IP network: point-to-point Layer 3 links between leaves and spines, each with an IP address, running a routing protocol for loopback reachability. Common choices are OSPF, IS-IS, or eBGP (RFC 7938 describes using BGP in large data centers). The underlay's only job is to deliver IP packets quickly between switch loopbacks over ECMP. See our guides to OSPF and BGP for those protocols.
Overlay: VXLAN
The overlay carries tenant traffic across the underlay. The most common overlay technology is VXLAN (Virtual eXtensible LAN, RFC 7348). It wraps an Ethernet frame in a VXLAN header, then in UDP (destination port 4789) and IP, and carries it between VTEPs (VXLAN tunnel endpoints), which usually run on the leaf switches. A 24-bit VXLAN Network Identifier (VNI) labels each virtual segment, allowing about 16 million segments compared with at most 4,094 usable VLAN IDs. The encapsulation adds roughly 50 bytes to each frame, so the underlay MTU must be raised accordingly (jumbo frames are commonly enabled).
Control plane: BGP EVPN
VXLAN needs to know which VTEP holds which MAC or IP. BGP EVPN (RFC 7432, with RFC 8365 covering its use with network virtualization overlays) is the control plane that distributes this reachability using BGP, replacing flood-and-learn. The practical result is that a virtual machine or container can sit on any leaf and still share a Layer 2 or Layer 3 segment with workloads elsewhere, and a distributed gateway lets each leaf act as the default gateway locally. At a conceptual level: underlay = IP transport; VXLAN = the tunnel; EVPN = the address book. For background, compare with how a plain VLAN works at Layer 2. Cisco's Nexus 9000 VXLAN BGP EVPN design guide, linked below, shows a vendor implementation.
What are common spine-leaf design pitfalls?
The common pitfalls are uneven uplinks, an underlay MTU too small for VXLAN, oversubscription chosen without traffic data, and elephant flows that ECMP cannot split. Each is described below.
- Mismatched uplinks. Uneven link speeds or a missing spine link on one leaf creates uneven ECMP and hot spots.
- Ignoring MTU. VXLAN adds about 50 bytes. If the underlay is not raised above 1,500, large frames are fragmented or dropped.
- Oversubscription chosen without data. A 3:1 ratio that works for web servers may be too tight for storage or machine-learning traffic.
- Elephant flows. ECMP balances flows, not bytes; a few huge flows can saturate one path.
- Putting services on spines. Spines should only forward. Firewalls and load balancers belong on border or service leaves.
- Stretching Layer 2 everywhere. It brings back large failure domains. Use Layer 3 boundaries and route when workloads do not need a shared Layer 2 segment.
- Overbuilding or underbuilding spines. Spine port count caps the number of leaves, so plan for growth, and remember that losing one of N spines drops capacity by 1/N.
- Treating spine-leaf as a campus design. Campus networks have many user-facing edge needs (PoE, wireless, 802.1X) that suit three-tier or collapsed-core designs.
Where does spine-leaf appear in CCNA and Network+?
Cisco CCNA 200-301 includes topology architectures in the Network Fundamentals domain, where spine-leaf is listed alongside two-tier and three-tier designs, and expects you to describe their characteristics. CompTIA Network+ N10-009 covers data center architectures and traffic flows (three-tier, spine and leaf, north-south and east-west) in its networking concepts domain. Both questions are conceptual: pick the architecture that suits a scenario, name why it suits east-west traffic, or identify what connects to what. Neither exam asks you to build a VXLAN EVPN fabric. Exam objectives are revised, so verify the exact wording on the Cisco CCNA exam topics page and the CompTIA Network+ page.
Exam traps:
- Spines do not connect to servers, and leaves do not connect to each other.
- Spine-leaf is for east-west optimization; three-tier is built around north-south flows.
- Hop count between leaves within a pod is constant, not variable.
- Scaling is horizontal (more switches), not vertical (bigger switches).
- Spine-leaf uses routing and ECMP; do not answer “Spanning Tree blocks the extra links” for a routed fabric.
For the wider list of topics, use the CCNA cheat sheet and the Network+ cheat sheet, and compare the two certifications in Network+ vs CCNA.
Spine-leaf practice questions with answers
Work through these, then try scenario questions in the Network+ practice exam or the CCNA practice exam.
1. How many switches does traffic between two servers on different leaves cross in a spine-leaf fabric?
Three: the source leaf, one spine and the destination leaf. That is two switch-to-switch links. Servers on the same leaf cross only one switch. This uniform path length is the source of the predictable latency.
2. A leaf has 32 x 10 Gbps server ports and 4 x 40 Gbps uplinks. What is the oversubscription ratio?
2:1. Downlink capacity is 32 x 10 = 320 Gbps and uplink capacity is 4 x 40 = 160 Gbps; 320 / 160 = 2. The ratio is downlink to uplink bandwidth, not port counts (8:1 would be the wrong port-count answer).
3. In a design with 4 spines, a spine switch fails. What happens?
Traffic automatically uses the three remaining equal-cost paths through ECMP, so there is no outage, and fabric bandwidth between leaves falls by 25 percent. This graceful degradation is why large fabrics use several spines.
4. Which statement about spine and leaf is false: (A) spines connect to servers, (B) every leaf connects to every spine, (C) leaves do not connect to each other, (D) adding capacity means adding spines or leaves?
(A) is false. Servers connect to leaves; spines only connect to leaves. B, C and D are all true of a standard two-tier fabric.
5. What does VXLAN add on top of the IP underlay, and which protocol carries it?
VXLAN (RFC 7348) encapsulates Layer 2 Ethernet frames inside UDP/IP packets (MAC-in-UDP, destination UDP port 4789) and identifies each virtual segment with a 24-bit VXLAN Network Identifier (VNI), giving about 16 million segments versus the 4,094 usable VLANs. Endpoints that do the encapsulation are VTEPs.
6. Why does the traditional three-tier design struggle with heavy east-west traffic?
East-west flows must travel up through the distribution and core layers and back down, paths are longer and uneven, Spanning Tree blocks redundant links so bandwidth sits idle, and the core can become a bottleneck. Spine-leaf uses routed ECMP links with uniform hop counts instead.
7. What is the main job of a border leaf?
A border leaf (or edge leaf) connects the fabric to external networks, such as the WAN, internet, firewalls or other data centers. Server leaves stay uniform and simple while north-south and external routing happens at the border.
Frequently asked questions
What is spine and leaf architecture?
Spine and leaf is a two-tier data center network design in which every leaf switch connects to every spine switch, and servers, storage and firewalls attach only to leaf switches. Spines connect only to leaves, never to each other or to servers. Any server-to-server path crosses at most one leaf, one spine and one other leaf, so latency is predictable and traffic can be spread across all spines with ECMP routing.
What is the difference between spine-leaf and three-tier architecture?
Three-tier (core, distribution, access) is a hierarchy built for north-south traffic between users and a data center, and it usually relies on Layer 2 domains and Spanning Tree that block redundant links. Spine-leaf is a flat two-tier fabric optimized for east-west traffic between servers, using routed Layer 3 links and equal-cost multipath so every uplink carries traffic. Spine-leaf has more predictable latency and scales by adding switches rather than replacing larger ones.
Why is spine-leaf better for east-west traffic?
East-west traffic is server-to-server traffic inside the data center, which grows with virtualization, microservices, storage replication and distributed applications. In a spine-leaf fabric every leaf-to-leaf path within a pod is the same length (two switch-to-switch links) and many equal paths exist at once, so east-west flows do not funnel through a single core or get stuck behind a blocked link as they can in a three-tier design.
What is oversubscription in a spine-leaf network?
Oversubscription is the ratio of the bandwidth a leaf offers to its servers (downlink) against the bandwidth it has to the spines (uplink). A leaf with 48 x 25 Gbps server ports (1,200 Gbps) and 6 x 100 Gbps uplinks (600 Gbps) has a 2:1 oversubscription ratio. A 1:1 ratio is non-blocking. The right ratio depends on how much traffic stays on the same leaf and how heavy east-west flows are.
What are the underlay and overlay in a spine-leaf fabric?
The underlay is the physical and routed IP network between switches: point-to-point Layer 3 links running OSPF, IS-IS or eBGP. The overlay is a virtual network built on top, most often VXLAN (RFC 7348), which tunnels Layer 2 or Layer 3 tenant traffic across the IP underlay. A control plane such as BGP EVPN distributes the MAC and IP reachability so endpoints can be placed on any leaf.
How many spine switches do I need?
It depends on the uplink bandwidth you want. If each leaf connects once to each spine, the number of spines equals the number of leaf uplinks. Four spines gives each leaf four equal-cost paths and survives the loss of one spine at 75 percent of capacity; more spines raises bandwidth and resilience. The spine port count limits how many leaves a two-tier fabric can have.
Is spine-leaf on the CCNA and Network+ exams?
Both exams cover network topology architectures at a conceptual level. Cisco CCNA 200-301 names spine-leaf alongside two-tier and three-tier architectures in Network Fundamentals, and CompTIA Network+ N10-009 covers data center architectures including three-tier and spine and leaf, with north-south and east-west traffic flows. You are expected to describe and compare them, not configure VXLAN. Confirm the wording in the current official objectives.
How we wrote and checked this
CertSharp is a practice-exam provider, so we have a commercial interest in exam preparation. This guide was built from RFC 7348, RFC 7432, RFC 8365 and RFC 7938 and the Cisco documentation linked below. The oversubscription and scaling arithmetic was verified with a script, and the diagrams are conceptual rather than captured from real hardware. Last reviewed on October 18, 2026. Confirm exam objective wording on the Cisco and CompTIA pages.
Sources and further reading
- RFC 7348: Virtual eXtensible Local Area Network (VXLAN)
- RFC 7432: BGP MPLS-Based Ethernet VPN (EVPN)
- RFC 8365: A Network Virtualization Overlay Solution Using EVPN
- RFC 7938: Use of BGP for Routing in Large-Scale Data Centers
- Cisco: Nexus 9000 VXLAN BGP EVPN Data Center Fabrics Design and Implementation Guide
- Cisco Learning Network: CCNA 200-301 exam topics
- CompTIA Network+ certification page
Practice network architecture questions
30 free questions per session in practice mode on CCNA and Network+, no signup and no credit card. The full 500-question bank with exam mode is $11.99 lifetime per certification, or $9.99/month Pro unlocks every CertSharp certification.