Resilient Network Segmentation Using EVPN-VXLAN and IP Fabric Architectures for Saudi Critical Data Centers under Vision 2030

Abstract

Saudi critical data centres are becoming strategic platforms for digital government, industrial automation, cloud services and data-intensive national programmes. Their network architecture must therefore sustain service continuity while constraining lateral movement, isolating failures and producing auditable evidence of policy enforcement. This review examines how Ethernet Virtual Private Network and Virtual Extensible LAN overlays, operating across routed leaf-spine IP fabrics, can provide a resilient segmentation foundation for that requirement. It synthesises protocol standards, security guidance and Saudi regulatory controls published between 2020 and 2025. The analysis distinguishes transport resilience from security isolation, showing that neither equal-cost forwarding nor a large overlay namespace is sufficient without explicit policy, controlled route propagation, authenticated infrastructure, service insertion and tested recovery procedures. It identifies four design principles: keep the underlay simple and failure-bounded; express tenant, application and trust boundaries in separate virtual routing domains; use control-plane learning and suppression mechanisms to reduce unnecessary flooding; and connect segmentation intent to operational telemetry, configuration assurance and incident response. A Saudi-oriented reference architecture is proposed for active-active critical sites, with distributed anycast gateways, multihoming, rapid designated-forwarder recovery, policy groups, controlled inter-site exchange and independent management-plane protection. The review concludes that EVPN-VXLAN should be treated as a programmable enforcement substrate rather than a security product. Its contribution to Vision 2030 depends on governance that links each segment, route and exception to data classification, criticality, recovery objectives and accountable ownership.