[c-nsp] Leaf and Spine / CLos topology - Access Layer - why always one switch shown?

[Nick Cutting]

Every single document / Diagram showing Leaf and Spine network topologies has ONE switch at the leaf layer for servers to connect to.  This goes for Cisco / Juniper / Dell

I would have thought that if you had a pair of TOR switches that they would be connected at L2 and run VPC or LBT (vmware concept) down to the servers, but I cannot see this detail in any Cisco design documents.  Obviously these are connected to each spine switch upstream at L3.

Whether running VXLAN or not, Arista has design docs that talk about anycast HSRP running on the leafs etc, has anyone deployed a Cisco Leaf Spine topology with servers connected to two leaf / TOR switches.

I am interested in the Leaf / TOR VPC / HSRP detail here - and how did you protect this traffic keeping all flows active-active at 10 gig? (firewalls in the hypervisor??) NSX ?? 

Firewalling at 10 gig per rack using ASA hardware is so expensive we wont even look at it.