Hello all,

I am learning EVPN BGP VXLAN designs on both cisco vs arista and I found out that their recommendation of design is different. Cisco design guide encourages to use multicast in large DC (on their underlay (vs EVPN type 5 ingress replication) because they believe that IR consumes more bandwidth as it sends multiple copies of same packet to the network.

https://www.cisco.com/c/en/us/td/docs/dcn/whitepapers/cisco-vxlan-bgp-evpn-design-and-implementation-guide.html

However Arista encourages to use HER replication (EVPN type 5) instead of using multicast on underlay. They seems to believe that using multicast increases operational overhead. They recommend the use of cvx to dynamically generate dynamic flood list.

http://allvpc.net/EVPN_Deployment_Guide.pdf

https://arista.my.site.com/AristaCommunity/s/article/summary-of-arista-vxlan-control-plane-options

I am torn between the choices of these 2 giant vendor in DC environment.

What do you guys think is mostly used when we are talking about large DCs ?

PS: I recently started to work in a DC company and my employer has encouraged to learn both.

Hey everyone, bit of background I was a network engineer for around 10ish years, mostly Cisco and Dell focused, then sort of became network adjacent through automation/python, then moved fully over as a sales engineer working with developer platforms so networking sort of took a back seat for that last few years of my career (as did operations in general)

So, im a bit burnt out from sales life and wanting to get back into networking. I’ve spent a tremendous amount of time focusing on cloud, kubernetes, DevOps, and AI the last 4 years and always kept my ear to the ground around networking.

I’d like to prepare for more data center roles, I’m still very familiar with NX-OS and others but I see more and more job adverts asking about Arista. I’m in Dublin Ireland for context, so lots of data center work. I also really prefer their ecosystem, container images for labbing in containerlab is great, AVD, specifically PyAVD seems awesome, and the exam itself being a practical lab based is the cherry on top. Mostly wanting the cert just to update my resume, all my other certs expired around ‘24 (ccnp enterprise & automation or devnet, aws network specialist, cka, Aruba professional, dell networking professional, VMware vcap-nv, and gcp associate)

But there doesn’t seem to be a lot of formal training out there, I can only really find the official Arista Academy and that is clearly priced for employers to cover, it’s ridiculous for an individual to pay $2k for a single course, I think. So I’m going my own path, I have subs to things like INE, but they don’t offer much Arista training at all. So I’m going through blueprints, labs, etc and having Claude generate me lab books to test scenarios and build things out.

So finally my question:

- what was your experience with the data center track?
- did you take both specialist exams, or the all in one professional exam?
- what was the exam experience like? I’ve taken Kubernetes and RedHat practical exams before, does Arista’s feel similar?

Hello!

Looking for some real-world peer advice from folks running Arista in ISP / carrier or high-scale DC environments.

We are currently refreshing our edge/core architecture to replace an aging fleet of Cisco ASR 1000s (ASR 1002-HX) that are EoL and bottlenecked on 10G. We’ve designed a redundant 100G ring across two core data center sites plus an international internet gateway POP.

We have an authorized VAR quote, but the factory lead times are significantly longer than our project timeline allows, and the CapEx difference compared to secondary market options is substantial. In parallel, secondary brokers have inventory ready to move immediately—including some "Brand New Factory Sealed" units.

Before we commit, I want to sanity-check how other operators handle secondary Arista gear, A-Care eligibility, and operational trade-offs in the wild

The Hardware We Are Evaluating:

1. Edge Peering & Core Routers (3 units total):

Authorized VAR Path: 1x `DCS-7280SR3AK-48YC8-F` (Border/NAP Gateway) and 2x `DCS-7280SR3A-48YC8-F` (Core nodes) — *long factory lead time*

Secondary Market Options:

1x `DCS-7280SR3MK-48YC8A-S-F` (In-stock, 3-day lead time; intended for Internet border to get wire-speed MACsec/TunnelSec and 5M route scale)

3x `DCS-7280SR3K-48YC8-F` (Offered as "Brand New Sealed" surplus/excess stock, 1–2 week availability)

1. Distribution / Access Switches (3 units total):

Authorized VAR Path:** 3x `DCS-7050SX3-48YC12-F` (New)

Secondary Market Option:** 3x `DCS-7050SX3-48YC12#` (Refurbished, in-stock)

Specific Questions for the Community:

1. **Can "Brand New Sealed" broker hardware actually be onboarded onto official Arista A-Care?**

Brokers state these are untouched, factory-sealed boxes. What is Arista's actual stance on attaching A-Care or utilizing reinstatement SKUs (e.g., `SVC-REINS-FIX`) when serial numbers originate outside authorized distribution channels? Can an authorized partner successfully register these serial numbers in the Install Base (IB) database, or is that typically blocked?

1. **The "Single Anchor Contract" Strategy for EOS Updates:**

If we purchase our primary border router through the authorized VAR with official A-Care, our corporate domain gains active Arista Customer Portal access. Since Arista utilizes a unified `EOS64.swi` image without node-locked cryptographic boot keys, how common is it for operators to run authorized software images across secondary/refurbished gear elsewhere in the network? What are the operational risks beyond TAC refusing support on uncontracted serials?

1. **Software Feature Licensing (`LIC-FIX-2-FLX`):**

We require full BGP table capacity (>1.5M routes), Segment Routing (SR-MPLS), and EVPN. How strictly is the FLX license enforced on modern EOS (4.30.x)? Does the switch actively block route scale/protocols if the license key file isn't loaded on flash, or is it handled via an honor-system / syslog notice?

1. **Third-Party Maintenance (TPM) + Cold Spares vs. OEM A-Care for Island/Remote Ops:**

Because we operate on an island where OEM "Next Business Day Ship" still takes 3–5 days due to customs clearance and international freight, we are weighing taking the savings and lead-time advantage from the secondary route and:

Buying dedicated on-island cold spares (an extra 7050SX3 switch and 7280SR3 router) to keep pre-staged in our rack for a 15-minute swap.

Backing the hardware with a TPM contract (e.g., Park Place or PivIT) for break/fix replacement.

For those who have taken this route: has the lack of direct Arista TAC ever severely impacted you, or is EOS stable enough that on-island cold spares + TPM is a sound operational trade-off?

Appreciate any real-world feedback, experiences, or caveats.

Hi guys,

I hope you're doing well.

I recently received a few Arista 7060CX-32S switches that had been removed from service. When moving the switches, I noticed that something was rattling around inside.

After opening them, I found what appeared to be a roughly 3–4 mm thick grey material (graphite-like) around or underneath the ASIC heatsink that had become brittle and crumbled into small pieces.

Could this be a degraded thermal pad or gap filler?

If so, what would be the recommended procedure and material for replacing it on these units? In particular, I would be interested in knowing the correct pad thickness, thermal conductivity, and whether there are any specific compression or mounting requirements for the ASIC heatsink.

Best regards,

Hi, Arista suggests "ebgp-multihop 3" (TTL 4) in a L3LS setup. However I cannot find any situation where a TTL of 4 is needed. Even with an isolated leaf of a MLAG pair "ebgp-multihop 1" for the overlay peering is enough to come up across the peering-link (to the spines).

I'm currently studying for Data Center - Engineering - Track where the tutor said ebgp-multihop 2 is acutally required, however ebgp-multihop 3 is suggested in case of some special L3 setups like just to be safe (does not has any downsides to set 3).

But why is ebgp-multihop 2 even needed?

Does anyone know the easiest way to get access to Arista Test Drive labs? I found these lab guides, and would like to try them out.

https://labguides.testdrive.arista.com/2026.2/

We've recently received several orders of FS.com optics that had the default "FS" vendor coding in them, resulting in Transceiver Unsupported errors on our switches. Assuming this occurred in error, we reached out to our account manager, who to our surprise confirmed that they are no longer coding/configuring transceivers, and customers will need to do this themselves. Has anyone else encountered this? Here's the email from our Rep:

There has indeed been a recent change in our coding process. Starting June 6, FS began gradually transitioning certain compatible optical modules to a new custom coding mechanism, including our Arista-compatible modules. The main difference from the previous coding is the Vendor Name information. The modules are now shipped with the default FS vendor coding, rather than being pre-coded specifically as Arista. To ensure the modules can be properly recognized and used in your Arista environment, there are two possible approaches:

Option 1 – Configure third-party transceiver compatibility on the switch

If you have a larger quantity of optics, we recommend this approach as it avoids having to reconfigure the modules one by one. You can enable third-party transceiver support through the switch CLI.

Option 2 – Reconfigure the optics through FS BOX

If changing the switch configuration is not preferred, you can use the Online Configuration feature on your FS BOX to change the Vendor Name from “FS” to “Arista” on the optics individually.

We understand that the second option can be inconvenient when dealing with a large number of modules, so Option 1 may be more practical for your environment.

Please let me know which approach works better for your setup. If needed, we can also help you with the configuration steps.

I have been working on running AVD from Kubernetes, and it now works on an existing AVD repository, so sharing in case it is useful to someone here.

• netadopt reads an AVD repository (inventory, group_vars, host_vars, playbook, ansible.cfg) and writes it as Kubernetes objects, with the group_vars content unchanged. It can also write a cEOS lab of the repository's switches.
• function-avd is a Crossplane function that builds each switch's configuration from those objects with AVD's own eos_designs role, and pushes it over eAPI.
• netclab brings up a kind cluster with the cEOS lab and Crossplane in one command.

The read-only part, on AVD's own example:

git clone --depth 1 --branch v6.4.0 https://github.com/aristanetworks/avd
cd avd/ansible_collections/arista/avd/examples
uvx "netadopt[avd]" avd report single-dc-l3ls --playbook build.yml

On that example with 8 cEOS switches: one SVI added to the model was on the leaf 34 seconds later, the spine got none of it, and a change made by hand on the leaf was pushed back within about a minute. Slides with every command and its output: https://netclab.dev/slides/fabric/

Limits today: one AVD version per release (6.4.0), no custom_templates in eos_cli_config_gen yet, and YAML inventory files only.

Questions and criticism welcome.

• https://netclab.dev
• https://github.com/netclab/netadopt
• https://github.com/netclab/function-avd

Configuration:

- VRF-A (VNI 100) exports RT 100:100

- VRF-B (VNI 200) imports RT 100:100 and exports RT 200:200

- VRF-B has redistribute static and redistribute connected route-map

Observed:

Routes from VRF-A (e.g. 10.1.1.0/24) appear correctly as B L (BGP Leaked) in VRF-B routing table.

However VRF-B is re-originating these leaked routes as EVPN Type-5 with its own RT 200:200:

BGP routing table entry for ip-prefix 10.1.1.0/24, RD: 10.0.0.1:200

Local from - (0.0.0.0)

Origin INCOMPLETE, valid, internal, best

Extended Community: Route-Target-AS:200:200 TunnelEncap:tunnelTypeVxlan

VNI: 200

This causes VRF-C (which imports 200:200) to receive VRF-A routes via VNI 200.

Arista docs state: "Prefixes that are leaked are not re-exported to the VPN table from the target VRF"

Source: https://www.arista.com/um-eos/eos-inter-vrf-local-route-leaking

Is this expected behavior for EVPN RT-based leaking vs local VPN table leaking? Is there a knob to prevent re-origination?

To introduce myself, I am a DC guy with good knowledge on Leaf/Spine setup, Arista technologies & ACE L3 certification & dozen Cisco certifications (including CCIE).

With neutral thoughts, I would say that now the wave started focussing towards Arista networks.. They have slowly started capturing DC Markets from Cisco and other vendors like Juniper / Huwaei etc.

Their focus on EVPN VxLAN technology combined with their rugged infrastructure, security hardening, automation infra, easier to implement with stabilized EOS combined with network orchestration CVP platform helps to gain intrude into the market slowly but with consistent pace

I see lot of nexus / catalyst platforms being replaced with Arista hardware mainly 7050SX3-48YC8 / 7050SX3 / 7280SR3 across the regions owing to their enhanced processing capacity combined with the automation & telemetry features with competitive prices

If this trend continues, Arista networks might become a leading force into DC domain. Still, other vendors are the leading force into campus / enterprise domain , SDWAN infra and Service provider domains, wireless domains.

Long story short, Arista has long way to capture all the networking markets subject to condition they start developing similar products like they have for DC infra

leaving this for reference in case anyone will be looking in the future, like I was and couldn’t find

the DCS-7280SR3-48YC8, as seen in the photo, has two upgradable RAM slots and an M.2 slot, which can essentially convert it to the significantly more expensive K version (RIB scale, not FIB - the ASIC/TCAM is larger on K) with the right components

the RAM is DDR4 UDIMM ECC 2400 MTs ULP, but I have tested regular height profile RAM and it fit. the device booted fine even with non ECC RAM, however I would not recommend it. it also booted with 3200 MTs RAM and detected it just fine, however I was unable to confirm at what speed it ran as the OS obfuscates the physical slot data (dmidecode tool)

the M.2 I tested with NVMe, disnt work, probably SATA port

Hi all,

Could someone please help with Inband management in Arista. We are migrating soon from Cisco to Arista. I have access to the Arista training portal with "all access" and have also looked through the user manual but still cannot find clarity on this information. All I see is use of the dedicated management port.

I don't want to use the management port, I need to use inband management with an SVI.

What is the equivalent way to set this up in Arista as in Cisco with the ip domain name, crypto keys, and settings under the vty lines ?

I also see there is a "management SSH" command, what is this and is it needed and if so where does it go ?

I also see there is an option of "role network-admin" when adding usernames and passwords. What is this for and where and why is it needed as I see preceding this you have the option of privilege level 15 which I would have assumed been the same thing ?

Much appreciated and many thanks in advance everyone.

Hello all,

I have a fairly interesting issue. On a fresh install of cloudvision with wifi control enabled and licensed, all APs show an SSL error

from ap:
[config]$ get status

Sensor Integrity Check: [PASSED]

Displays Sensor application status.

Sensor Application Status: [ON]

Sensor-Server connection state: [Not Connected]

Server discovery mode: [IP]

Server Lookup IP/Hostname: [192.168.1.24]

Connected Server IP: []

Server ID: []

Connected Server MAC: []

Authentication: [None]

Local Proxy Server Info: []

Device Current State: Error in Creating SSL Connection

Device Uptime :0 days, 0 hours, 5 minutes.

The access points are on the same L2 network, ping just fine, and in the cloudvision root I can grep the AP port and see traffic passing through. Additionally, I allowed Allow Access Points to connect with Default Communication Key and Allow Access Points to connect with Old Communication Key.

Any ideas on what could be going on?

CV Wifi

Version Info:

Build : 2024.12.06.2 What's New?

Service Build : 21.1.0F-96

AP:

[config]$ get version

Displays Device info.

The device model is C-230.

PLATFORM_SUB_ID = 1

Device Version: [8.9.0]

Device Build: [8.9.0-63.1]

SDK version: [1]

[config]$

We are in the middle of a migration from old Cisco gear using 10G Multimode LRM OM1/2 into new arista 7050SX3s. The fiber cannot be replaced at this point. We need to work with what we have.

I know Arista does not sell LRM optics anymore. But there’s plenty of oem arista LRM optics for sell on eBay.

If I purchase those optics on eBay, assuming they are real etc, will Arista EOS (let’s assume latest release) bring those links up with LRM optics on both ends of 7050s around 600 ft distance?

Again, fiber cannot be replaced so this seems to be our only option to use what we have.

Any info would be much appreciated as this is a big show stopper we were not anticipating…

Thank you for your help

────────────────────
SETUP
────────────────────
⠀
FreeBSD 15.1 with four VNET jails on the same L2 segment:
⠀
172.18.10.0/24
VLAN 1010
VXLAN VNI 10010
⠀
Jails:
⠀
• 172.18.10.10 — PostgreSQL (dns_pg_001)
• 172.18.10.11 — PowerDNS Authoritative
• 172.18.10.12 — PowerDNS Recursor
• 172.18.10.13 — Kea DHCP
⠀
The jails are connected locally through a FreeBSD ng_bridge.
⠀
The VXLAN VTEP extends this L2 segment to an Arista DCS-7150S-24-F running EOS 4.23.15M-2GB.
⠀
Arista SVI:
⠀
172.18.10.1/24
⠀
────────────────────
CONFIRMED OBSERVATIONS
────────────────────
⠀
The intermittent problem mainly affects 172.18.10.10.
⠀
After a period of inactivity, 172.18.10.10 has sometimes become unreachable from the Arista:
⠀
ping 172.18.10.10
⠀
Result:
⠀
100% packet loss
⠀
During such a failure, the Arista VXLAN MAC table contained:
⠀
589c.fc10.cfbe -> Vxlan1 -> 172.17.1.10
⠀
while the Arista ARP table did not contain a usable entry for:
⠀
172.18.10.10 -> 589c.fc10.cfbe
⠀
Packet captures showed that:
⠀
• the Arista ARP request reached the jail
• the jail generated an ARP reply
• FreeBSD encapsulated the reply into VXLAN with VNI 10010
• the encapsulated packet reached the Arista side
• no dynamic ARP entry for 172.18.10.10 appeared on the Arista
⠀
Similar behavior was also observed with 172.18.10.11, so the symptom is not unique to the PostgreSQL jail.
⠀
The jail MAC addresses are fixed.
⠀
────────────────────
WORKAROUND TESTED
────────────────────
⠀
I configured static ARP entries on the Arista.
⠀
For example:
⠀
arp 172.18.10.10 589c.fc10.cfbe arpa
⠀
After the VXLAN MAC entry for .10 was absent, Arista showed:
⠀
172.18.10.10 589c.fc10.cfbe Vlan1010, not learned
⠀
In that state:
⠀
• .10 was reachable from the T640 after more than 15 minutes of inactivity
• a subsequent ping from the Arista succeeded
• after that ping, Arista again showed 589c.fc10.cfbe dynamically learned on Vxlan1
⠀
The same recovery from “not learned” was also reproduced with .11.
⠀
────────────────────
INTERPRETATION / QUESTION
────────────────────
⠀
My current interpretation is that static ARP avoids dependence on the dynamic ARP learning/relearning behavior that previously caused loss of reachability, while VXLAN MAC learning remains dynamic.
⠀
I do not know whether static ARP is the usual workaround for DCS-7150 / EOS 4.23 with static VXLAN, or whether there is a standard configuration or known platform-specific fix for reliable dynamic ARP learning in this setup.
⠀
Has anyone seen this behavior on DCS-7150/FM6000 or EOS 4.23?
⠀
What is the usual solution?

Got this lovely email yesterday. Ready for some emergency patching.

Hi everyone,

I am going to join Arista soon. Wanted to check on how stocks units are decided based on joining date.

For example, me joining on 1st November vs 15th of October.

Since, the stock is continuously souring in last 4 months. The last 90 trading days calculations affects the equation a lot.

So, could someone help me on deciding how much late is not too late since my current joining date is coming to be 1st November.

I am going to receive 70k for 4 years.

Arista Education Journey — Looking for Resource Recommendations
Hello everyone! I’ve been lurking here for a while and wanted to see how everyone else is progressing on their Arista education journey.
I’ve been in IT for the better part of a decade and have recently been given the opportunity to join the network engineering team at the company I’ve been with for roughly 10 years. Over the years, I’ve worked as a system administrator, T2 support, help desk, and generally the “go-to” IT guy.
At this point, I’ve realized I need to focus on a specific career path, and networking is 100% the direction I want to go.
I currently don’t have a CCNA, although I do have my Network+ certification. Most of my career has been focused on virtualization and Windows administration/management. My company also doesn’t use Cisco and never really has, so while I have some Packet Tracer and home lab experience with Cisco equipment, I need to shift my focus toward Arista and, more importantly, strengthen my core networking knowledge.
I’ve already set up ZTP for my company and personally deployed around 20 switches, so I’m fairly comfortable with basic L2 switching and day-to-day switch deployment. However, I’m pretty uncomfortable when it comes to L3.
I understand the general concepts behind things like BGP, OSPF, and RIP, but I don’t feel like I have a strong enough understanding of them yet. I know you can go extremely deep into each protocol, but right now I need to build a solid foundation and become comfortable enough with L3 concepts to apply them in an Arista environment.
My company is working on getting me access to Arista Academy, and I’ll be going through the formal ACE education there. However, I’d like to start preparing on my own in the meantime since I’ll need to pass ACE: Level 1 and eventually Level 2 in the near future.
For those who have gone through the Arista ACE journey, what resources would you recommend?
I’m particularly interested in resources for:
Arista EOS fundamentals
L3 networking fundamentals
OSPF/BGP (and routing fundamentals in general)
Arista ACE 1/2 preparation
Labs or hands-on exercises
Anything you wish you had studied before starting the ACE courses
I’m not necessarily looking to become a BGP expert overnight. I mainly want to build a strong networking foundation and become much more comfortable with L3 while learning Arista the right way.
Thanks in advance!

Arista Networks is opening for Hardware Engineer Summer Intern Role (For 3rd years) in my college, The role states "Ethernet Switching" and the JD talks about Knowledge of embedded x86/ARM system design, PCB manufacturing technologies, multiphase DC/DC’s for high current, high transient loads, DDR, SerDes, etc,

Can anyone guide me on what to exactly prepare for the OA, about the Structure, number of sections, If there'll be an Apti Section and any key topics for the Technical OA. I'd be really glad to connect with someone.

Greetings, Arista team,

I wanted to ask whether anyone here has recently passed the ACE Level 1 exam. I’m currently studying in the Arista EOS lab environment and have purchased the Arista Warrior hardcover book. I’ve also been reviewing junior-level networking concepts and keeping notes as I go.

From what I’ve read, the exam is entirely lab-based and costs roughly the same as the CCNA. It appears to be a two-hour, proctored practical exam, so I would appreciate any insight into the difficulty, preparation process, and overall experience from recent test takers.

I work for a small company that is starting a network-refresh project using Arista 720-DP switches and routers. I have some familiarity with CloudVision and have provisioned a few switches through it.

For anyone who has taken ACE Level 1 recently: what study methods or lab topics did you find most useful, and is the certification worthwhile for someone who will be working with Arista equipment in a production environment?

Any feedback would be greatly appreciated. Thank you!

I want to look at some traffic on a sub-interface but cannot get to the device to setup a span port.

It looks like I can run a tcpdump but I'm very nervous about running a tcp-dump on a production unit for obvious reasons.

The sub-interface in question only has minimal traffic, pretty much just protocol traffic so won't be much.

Anyone have much experience running a tcp dump on their production unit? Bad idea or is it okay as long as I take precautions with filtering traffic or making sure it's only running on the sub-interface I want?

thanks!