Ops brings up EVPN BGP between municipal DCI borders and sees Type-5 prefixes exchanging, yet VXLAN-encapsulated tenant packets never arrive. Underlay ping between border VTEP addresses fails. What is the core issue?
Select an answer to reveal the explanation.
Short Explanation
Control plane up, data plane dead—classic. EVPN can gossip routes all day, but VXLAN still needs an IP path between VTEPs. If underlay ping fails, the tunnel trucks have no road.
Full Explanation
If municipal DCI borders exchange Type-5 prefixes over EVPN BGP yet VXLAN-encapsulated tenant packets never arrive, and underlay ping between border VTEP addresses fails, the core issue is that EVPN routes alone are insufficient without IP reachability for VXLAN between the DCI VTEPs. The control plane can look healthy while the data plane is dead because UDP 4789 encapsulation still requires the underlay to route to the remote VTEP IP. Type-5 exchange does not prove the VXLAN data plane is healthy, so blaming only an application bug skips the failed VTEP underlay evidence. VTEP underlay reachability is not optional whenever EVPN sessions are established; sessions may ride a management path or loopback policy while VXLAN sources remain unreachable. Missing VXLAN packets do not mean EVPN must be replaced with flood-and-learn; they mean fix underlay VTEP reachability and encapsulation path first. Exam caveat: always validate both planes—EVPN RIB health ≠ VXLAN forwarding health. Operational check: from each civic border, ping and traceroute the remote VTEP address used in VXLAN encapsulation, resolve any IGP/BGP underlay gap or firewall filter dropping UDP 4789, then retest tenant flows with a capture proving VXLAN between sites; update the DCI acceptance checklist to require VTEP ping alongside EVPN route checks.