Two unrelated city agencies share one L2 VNI while ops tries to separate them with different IRB subnets. Why is this a poor isolation design?
Select an answer to reveal the explanation.
Short Explanation
One shared VNI is one shared gymnasium—different painted floor circles (IRB subnets) do not stop the echo. Broadcasts and MAC learning still live in that common L2 space, so the agencies are not truly isolated. Give each tenant its own VNI if they are unrelated.
Full Explanation
When two unrelated city agencies share one L2 VNI while ops tries to separate them with different IRB subnets, the design remains poor because a shared L2 VNI keeps a common broadcast domain, so the tenants are not Layer-2 isolated. Different gateway subnets paint different circles on the same gymnasium floor; ARP, unknown unicast, and MAC learning still occur in one overlay L2 context, which defeats the municipal isolation goal even when IPv4 subnets look distinct on paper.
Different IRB subnets do not encrypt VXLAN payloads between agencies—that claim invents a security property IRBs do not provide. Sharing one VNI is not required for EVPN Type-5 to function; Type-5 is an L3 route advertisement model and does not force unrelated L2 tenants together. IRB subnet length matching across all tenants is not a BGP acceptance rule that justifies a shared VNI.
Exam caveat: L3 subnet differences never substitute for L2 domain separation when the stem asks about broadcast or MAC isolation between civic departments.
Operational check: place a host in each agency on the shared VNI, generate ARP, and confirm MACs and floods are visible across agencies; then split VNIs and retest to prove broadcasts stop crossing before accepting the design.