A retail bank's VXLAN hosts on one subnet can reach each other, but they cannot reach a second subnet in the same VRF. One VTEP is missing the Layer 3 VNI for that VRF. What does symmetric routing need?
Select an answer to reveal the explanation.
Short Explanation
Same-subnet traffic walks the Layer 2 hallway, and a different subnet needs the routing hallway. You are missing the Layer 3 VNI on one VTEP, so symmetric routing between the subnets has nowhere to go. Matching OSPF tags or building an underlay HSRP group does not create that VNI.
Full Explanation
Symmetric IRB routes between VXLAN subnets by sending the traffic across a Layer 3 VNI that belongs to the VRF, then routing into the destination Layer 2 VNI on the far VTEP. Hosts in the same subnet only need the Layer 2 VNI, which is why the bank's intra-subnet traffic still works. The VTEP that is missing the Layer 3 VNI cannot join that routed overlay, so inter-subnet traffic fails until every VTEP that routes for the VRF has the same Layer 3 VNI. The OSPF process tag is a local name. It is not the VNI number, and two VTEPs can route with different tags. A vPC keepalive detects whether a vPC peer is alive. It does not carry EVPN routes, and VTEPs that are not a vPC pair do not need a keepalive between them to route. HSRP can still be the gateway inside a VLAN, and an underlay HSRP group does not create the Layer 3 VNI or the symmetric route. Caveat: the VRF-to-VNI mapping and the route targets still have to match, or adding the VNI number alone leaves the prefixes in the wrong VRF. Operational check: configure the missing Layer 3 VNI and its VLAN on that VTEP, confirm the VRF is up on it, and test a host in one subnet against a host in the other.