A county security team inserts an underlay firewall that drops UDP destination port 4789 between leaves and spines. What class of failure should operators expect?
Select an answer to reveal the explanation.
Short Explanation
UDP 4789 is the VXLAN tunnel’s licensed plate. Block it in the underlay and the trucks never leave the driveway—overlay goes dark even if BGP still looks chatty. Open the path or you’re troubleshooting a self-inflicted road closure.
Full Explanation
Standard VXLAN uses UDP destination port 4789 for encapsulated data-plane traffic. Filtering that port between VTEPs prevents delivery of overlay frames regardless of VNI configuration quality. Control-plane sessions may still appear partially healthy if they use other protocols/ports, which can mislead triage. Municipal change control should treat underlay ACL/firewall rules as direct risks to VXLAN data-plane health.