City security wants aggressive underlay ACLs on fabric links and immediately breaks BGP between leaves and spines. What lesson applies to IP fabric routing?
Select an answer to reveal the explanation.
Short Explanation
Lock the freeway on-ramps and the delivery trucks never show up—same with underlay ACLs that crush BGP. Filter with a plan that still allows routing and fabric forwarding. Security that kills the control plane is just an outage with paperwork.
Full Explanation
IP fabric underlays depend on control-plane and forwarding permissions on fabric links. Overly broad ACLs that block BGP (or the underlay protocol in use) destroy adjacency and route exchange. That failure mode does not justify reverting to STP fabrics. Sourcing BGP from server VLANs to dodge fabric ACLs is not sound underlay design.