A county security team inserts an underlay firewall that drops UDP destination port 4789 between leaves and spines. What class of failure should operators expect?
Select an answer to reveal the explanation.
Short Explanation
UDP 4789 is the VXLAN tunnel’s licensed plate. Block it in the underlay and the trucks never leave the driveway—overlay goes dark even if BGP still looks chatty. Open the path or you’re troubleshooting a self-inflicted road closure.
Full Explanation
When a county security team inserts an underlay firewall that drops UDP destination port 4789 between leaves and spines, the VXLAN overlay data plane breaks because encapsulated packets cannot traverse the underlay. Standard VXLAN uses UDP/4789 for data-plane encapsulation; filtering that port between VTEPs prevents delivery regardless of how clean the VNI configuration looks.
It is incorrect that only EVPN Type-5 routes disappear while L2 VXLAN unicast continues normally—data-plane encapsulation itself is blocked. Access-port STP does not usefully “converge faster” because VXLAN UDP is no longer competing. IRB gateway MAC addresses do not renumber automatically to avoid the filter.
Exam caveat: underlay ACL/firewall changes on 4789 are direct overlay data-plane risks; control-plane BGP may still look healthy and mislead triage.
Operational check: verify mid-path firewalls permit UDP/4789 between VTEP addresses; temporarily permit and retest overlay while noting whether BGP EVPN remained up during the blackhole—document that split-symptom pattern in the county runbook. Add automated checks that probe 4789 connectivity between VTEP loopbacks after security policy changes. Keep EVPN TCP/179 and VXLAN UDP/4789 as separate allowlist lines in firewall change templates.