Two unrelated city agencies share one L2 VNI while ops tries to separate them with different IRB subnets. Why is this a poor isolation design?
Select an answer to reveal the explanation.
Short Explanation
One shared VNI is one shared gymnasium—different painted floor circles (IRB subnets) do not stop the echo. Broadcasts and MAC learning still live in that common L2 space, so the agencies are not truly isolated. Give each tenant its own VNI if they are unrelated.
Full Explanation
L2 isolation is tied to the broadcast domain identity (VLAN/VNI/bridge-domain). Sharing an L2 VNI across unrelated tenants preserves a common flooding and MAC-learning scope even if IRB addresses differ. That is a design smell, not a requirement for Type-5 or subnet-length matching. Assign distinct VNIs (and usually distinct VRFs) per tenant for proper separation.