For east-west traffic between workloads on an EVPN-VXLAN city fabric, where is GBP policy commonly enforced?
Select an answer to reveal the explanation.
Short Explanation
East-west arguments get settled at the leaf where the overlay lives—the VTEP that knows the endpoint’s group. The Internet firewall never sees most server-to-server chatter, and bare spine underlay links are the wrong courtroom.
Full Explanation
For east-west traffic between workloads on an EVPN-VXLAN city fabric, GBP policy is commonly enforced on the VXLAN leaf and VTEP devices that handle overlay forwarding for those endpoints. Leaves see tenant context, encapsulation, and group membership, so they are the natural enforcement points for municipal east-west allow and deny decisions between application groups. Enforcing only on the Internet edge firewall with no leaf involvement misses intra-fabric flows that never hairpin to the edge. Solely using spine underlay P2P interfaces that never see tenant groups places policy where overlay group context typically does not exist. Enforcing only inside the hypervisor when the leaf operates as a pure Layer-2 dumb pipe understates the common fabric role of EVPN-VXLAN leaves that participate in overlay policy rather than acting as unaware pipes. Exam caveat: locate GBP east-west enforcement at the leaf or VTEP overlay edge on describe-level questions unless a stem explicitly relocates it. Operational check: enable an inter-group deny on the civic leaves, generate east-west traffic that never leaves the data center, confirm drops at the leaf or VTEP path, and show the Internet edge counters do not need to see that flow for the deny to work.