Arista Eos

---
name: arista-eos
description: "Expert coverage of Arista EOS across all versions: Sysdb architecture, VXLAN/EVPN fabric design, MLAG, eAPI, CloudVision, AVD automation, spine-leaf BGP design, and DC fabric operations. Use for \"Arista EOS\", \"eAPI\", \"CloudVision\", \"MLAG\", \"AVD\", \"Arista VXLAN\", \"Arista BGP\", \"pyeapi\", \"Sysdb\", \"CloudVision Studios\". Do NOT use for cross-vendor comparison, platform selection, or category-wide architecture -- use the `routing-switching` skill."
license: MIT
---

# Arista EOS

This skill covers Arista EOS (Extensible Operating System) across all supported versions (4.28+). Areas of expertise include:

- Linux-based architecture with Sysdb (System Database) centralized state
- Multi-process architecture with fault isolation and stateful restarts
- VXLAN/EVPN fabric design (symmetric IRB, ARP suppression, multi-site DCI)
- MLAG (Multi-Chassis Link Aggregation) and EVPN Multihoming (ESI-LAG)
- eAPI (JSON-RPC 2.0) programmatic interface
- CloudVision (CVP/CVaaS) management, Studios, and Change Control
- AVD (Arista Validated Designs) for IaC fabric automation
- Spine-leaf BGP design with eBGP underlay and EVPN overlay
- gNMI streaming telemetry with OpenConfig and EOS-native paths

## How to Approach Tasks

1. **Classify** the request:
   - **Troubleshooting** -- Load `references/diagnostics.md` for show commands, eAPI queries, MLAG/VXLAN troubleshooting
   - **Design / Architecture** -- Load `references/architecture.md` for Sysdb, eAPI, CloudVision, MLAG, VXLAN/EVPN
   - **Best practices** -- Load `references/best-practices.md` for DC fabric design, BGP, MLAG vs ESI, AVD, upgrades
   - **Configuration** -- Apply EOS expertise directly
   - **Automation** -- Focus on eAPI, AVD, CloudVision Studios, pyeapi, Ansible arista.eos

2. **Identify version** -- EOS uses `4.MAJOR.MINOR[F|M]` versioning. F = Feature, M = Maintenance. 36-month support per train.

3. **Identify platform** -- 7050X (ToR leaf), 7060X (high-density spine/leaf), 7280R (universal spine), 7500R/7800R (modular), 720XP (campus PoE).

4. **Load context** -- Read the relevant reference file.

5. **Recommend** -- Provide actionable guidance with EOS CLI examples.

6. **Verify** -- Suggest validation with specific show commands.

## Core Architecture

### Sysdb -- The Heart of EOS

Sysdb is an in-memory, centralized key-value store that is the authoritative source for ALL switch state:

- All agents (processes) read/write state through Sysdb, never directly to each other or hardware
- Publish/subscribe model: agents subscribe to Sysdb paths; changes trigger automatic notifications
- State survives individual agent crashes -- BGP crash does not disturb FIB
- Hardware abstraction: ASIC driver reads Sysdb and programs hardware; protocol agents never touch hardware
- Foundation for stateful restart and ISSU

### Multi-Process Architecture

100+ independent agents (separate Linux processes): `Bgp`, `Ospf`, `Isis`, `Stp`, `Mlag`, `Vxlanctl`, etc.

- Process crash does not affect others; watchdog auto-restarts failed agents
- ASIC continues forwarding during agent restarts
- ISSU upgrades agents one-by-one while forwarding continues

### Linux Foundation

EOS runs on unmodified Linux (AlmaLinux base). Direct shell access:
```
switch# bash
[admin@switch ~]$ tcpdump -i eth0
[admin@switch ~]$ python3 /mnt/flash/myscript.py
```

Full GNU tools, Python 3, EOS SDK (C++/Python) for custom agents.

### eAPI

JSON-RPC 2.0 interface over HTTPS for programmatic CLI execution:
```
management api http-commands
   protocol https
   no shutdown
```

Returns structured JSON output. Libraries: pyeapi (Python), curl, Ansible arista.eos modules.

### CloudVision (CVP / CVaaS)

| Feature | Description |
|---|---|
| Telemetry | Streaming per-device state via gRPC |
| Config Management | Configlets, desired-state enforcement |
| Change Control | Approval-gated config change workflows |
| Studios | Intent-based provisioning (L3LS, Campus) |
| Image Management | EOS software upgrades via Change Control |
| Compliance | Config drift detection, audit trail |

### gNMI Telemetry

```
management api gnmi
   transport grpc openmgmt
      port 6030
   provider eos-native
```

Supports OpenConfig and EOS-native Sysdb paths. Subscribe modes: ONCE, POLL, STREAM (SAMPLE, ON_CHANGE).

## VXLAN/EVPN Design

### Key Configuration Pattern

```
ip virtual-router mac-address 00:1c:73:00:00:01

interface Vxlan1
   vxlan source-interface Loopback1
   vxlan udp-port 4789
   vxlan vlan 100 vni 10100
   vxlan vrf TENANT-A vni 50001

router bgp 65101
   no bgp default ipv4-unicast
   maximum-paths 4 ecmp 4
   neighbor SPINE-EVPN peer group
   neighbor SPINE-EVPN remote-as 65100
   neighbor SPINE-EVPN update-source Loopback0
   neighbor SPINE-EVPN ebgp-multihop 3
   neighbor SPINE-EVPN send-community extended
   address-family evpn
      neighbor SPINE-EVPN activate
   vlan 100
      rd auto
      route-target both 100:100
      redistribute learned
   vrf TENANT-A
      rd 10.0.255.3:50001
      route-target import evpn 50001:50001
      route-target export evpn 50001:50001
      redistribute connected
```

### ARP Suppression

Automatic when `redistribute learned` is configured and SVIs exist with `ip address virtual`. Eliminates BUM flooding for ARP.

### MLAG vs EVPN Multihoming (ESI-LAG)

| Aspect | MLAG | EVPN MH (ESI-LAG) |
|---|---|---|
| Standard | Arista proprietary | RFC 7432/8365 |
| Max switches | 2 per domain | 4+ per segment |
| Peer-link | Required | Not required |
| Configuration | Simpler | More complex |
| Multi-vendor | No | Yes |
| Feature compat | Broadest in EOS | Growing |

### MLAG with VXLAN

Both MLAG peers share identical Loopback1 (VTEP) address. Configure:
```
interface Vxlan1
   vxlan virtual-router encapsulation mac-address mlag-system-id
```

## Automation Ecosystem

### AVD (Arista Validated Designs)

AVD is the gold-standard for IaC DC fabric automation:
1. Define fabric intent in YAML group_vars
2. `eos_designs` role generates structured data model
3. `eos_cli_config_gen` renders EOS CLI configurations
4. `cv_deploy` pushes to CVaaS or `eos_config_deploy_eapi` pushes direct

### Ansible arista.eos Collection

Key modules: `eos_command`, `eos_config`, `eos_facts`, `eos_vlans`, `eos_bgp_global`, `eos_interfaces`

### Terraform arista/eos Provider

Manages EOS configuration as infrastructure code.

## Common Pitfalls

1. **MLAG Loopback1 mismatch** -- Both MLAG peers must have identical Loopback1 (VTEP) IP. Mismatched addresses cause VXLAN tunnel failures.
2. **Missing `redistribute learned`** -- Without this under each `vlan X` in BGP, Type-2 MAC/IP routes are not advertised. ARP suppression and remote learning fail.
3. **MTU not 9214** -- VXLAN adds 50 bytes. All spine-leaf and peer-link interfaces must be MTU 9214. Check with `show interfaces Ethernet1 | include MTU`.
4. **No BFD on BGP sessions** -- Without BFD, BGP failover depends on hold timers. Enable BFD on all underlay and overlay peers.
5. **`bgp default ipv4-unicast` not disabled** -- Leave IPv4 unicast active only where needed. Disable globally: `no bgp default ipv4-unicast`.
6. **MLAG reload-delay not set** -- Without `reload-delay mlag 300` and `reload-delay non-mlag 330`, traffic can blackhole during reboot. Always configure reload delays.
7. **Missing `send-community extended`** -- EVPN requires extended communities for Route Target. Without this on EVPN peers, routes are exchanged but not imported.

## Version-Specific Guidance

| Version | Reference | What's version-specific |
|---|---|---|
| 4.35 | `references/versions/4.35.md` | Current recommended train; Cluster Load Balancing, Measured Boot, Adjacency Sharing |

## Reference Files

- `references/architecture.md` -- Sysdb, multi-process, eAPI, CloudVision, gNMI, MLAG architecture, VXLAN/EVPN, EOS SDK
- `references/diagnostics.md` -- Show commands for interfaces, routing, VXLAN/EVPN, MLAG, security, system
- `references/best-practices.md` -- DC fabric design (spine-leaf, BGP underlay, EVPN overlay), MLAG vs ESI, MTU, BFD, management, AVD, upgrades