Internet breakout is available from a shared edge VRF. How should municipal tenant instances receive a default route?
Select an answer to reveal the explanation.
Short Explanation
Not every agency should get the same Internet door key on day one. Import the shared default only where policy says so—Parks maybe yes, an air-gapped evidence VRF maybe never. Blanket IGP redistribution of Internet routes is a fabric-wide headache.
Full Explanation
When Internet breakout is available from a shared edge VRF, municipal tenant instances should receive a default route by importing the default or shared edge routes selectively per tenant according to policy. Each agency gets only the exit it is authorized to use—Parks may get Internet, evidence systems may not—while the shared edge remains a controlled civic service VRF.
Forcing every tenant to peer BGP directly with public Internet peers on the leaf is operationally absurd and bypasses the shared edge design. Redistributing the Internet table into the underlay IGP for all VTEPs mixes overlay Internet with underlay fabric routing. Flooding the default via Layer 2 to every VNI so IRBs learn it from ARP is not how L3 defaults should be distributed in EVPN-VXLAN.
Exam caveat: selective import from a shared edge/services VRF is the standard least-privilege Internet pattern.
Operational check: review per-tenant RT imports for the edge default, confirm unauthorized VRFs lack 0/0, and traceroute Internet from an allowed tenant versus a denied one during acceptance testing. Record which tenants are Internet-entitled in the change ticket and diff RT imports after every shared-edge policy edit.