A city still maintains per-agency VRFs and VNIs while introducing GBP for finer controls inside some overlays. What layered-isolation principle applies?
Select an answer to reveal the explanation.
Short Explanation
Think castle walls (VRF/VNI) plus room keys (GBP). You keep the outer walls for agencies and add interior keys for app tiers. Turning on badges does not mean bulldozing the castle.
Full Explanation
When a city still maintains per-agency VRFs and VNIs while introducing GBP for finer controls inside some overlays, the layered-isolation principle that applies is that GBP complements—and does not always replace—VRF and VNI tenant isolation. Routing instances and VNIs remain the foundational multitenancy tools that hard-separate Parks from Courts, while GBP adds microsegmentation within or across those overlays for application-tier or role-based east-west controls. Enabling GBP does not require deleting all routing instances immediately; doing so would collapse agency table separation the municipality still needs. VNIs do not become unnecessary once any GBP tag exists on a leaf; tags refine policy inside overlays rather than abolishing overlay segmentation. VRFs and GBP are also not forbidden to coexist on the same EVPN fabric—layered designs are common in civic zero-trust rollouts. Exam caveat: keep tenant isolation (VRF/VNI) and microsegmentation (GBP) as complementary controls, not mutually exclusive checkboxes. Operational check: document which agencies remain VRF-isolated, enable GBP only inside an approved overlay lab tenant, prove inter-agency VRF isolation still holds, and show intra-tenant GBP denies between tiers without removing the outer VRF boundary.