During a county audit, Parks and Transit are discovered on the same VLAN even though policy requires Layer 2 tenant isolation. What is the primary isolation failure?
Select an answer to reveal the explanation.
Short Explanation
Same VLAN means same party line—everyone hears everyone else's ARP. If Parks and Transit share that broadcast domain, Layer 2 tenant isolation is already broken no matter what pretty VRF names you stuck on a slide. Fix the L2 boundary first; underlay timers and RD trivia will not save you.
Full Explanation
Layer 2 tenant isolation requires separate broadcast domains (distinct VLANs/VNIs). When unrelated departments share a VLAN, ARP, unknown unicast, and broadcast frames can cross tenant boundaries. Underlay IGP timers, management-VRF RDs, and MAC aging are unrelated to that failure mode. Restore isolation by placing each tenant in its own L2 domain before applying L3 VRF controls.