City security wants aggressive underlay ACLs on fabric links and immediately breaks BGP between leaves and spines. What lesson applies to IP fabric routing?
Select an answer to reveal the explanation.
Short Explanation
Lock the freeway on-ramps and the delivery trucks never show up—same with underlay ACLs that crush BGP. Filter with a plan that still allows routing and fabric forwarding. Security that kills the control plane is just an outage with paperwork.
Full Explanation
The underlay must permit routing-protocol and fabric forwarding traffic; careless aggressive ACLs on fabric links break BGP between leaves and spines and collapse the city IP fabric. Underlay ACLs should not deny all BGP so overlays can run with empty routing tables. ACL breakage does not prove fabrics should revert to STP. Sourcing BGP only from server VLANs to dodge fabric ACLs is not sound underlay design. Exam caveat: Filter with explicit permits for underlay control and forwarding planes. Operational check: Review fabric-link ACLs for BGP (or underlay protocol) permits, restore adjacency, then tighten with a tested allowlist. In civic data-center operations, record the expected CLI or collector evidence for this concept so the next on-call engineer can validate fabric behavior without re-deriving the design under incident pressure. In civic data-center operations, record the expected CLI or collector evidence for this concept so the next on-call engineer can validate fabric behavior without re-deriving the design under incident pressure. In civic data-center operations, record the expected CLI or collector evidence for this concept so the next on-call engineer can validate fabric behavior without re-deriving the design under incident pressure.