For east-west traffic between workloads on an EVPN-VXLAN city fabric, where is GBP policy commonly enforced?
Select an answer to reveal the explanation.
Short Explanation
East-west arguments get settled at the leaf where the overlay lives—the VTEP that knows the endpoint’s group. The Internet firewall never sees most server-to-server chatter, and bare spine underlay links are the wrong courtroom.
Full Explanation
GBP for overlay east-west traffic is commonly enforced at the leaf/VTEP, where VXLAN encapsulation and tenant context exist. Relying only on an Internet edge firewall misses intra-fabric flows. Spine underlay interfaces typically lack the tenant group context needed for overlay GBP, and ERB/CRB leaf roles are expected to participate in fabric policy rather than act as unaware L2 pipes.