A county open-data pod leaks routes between research and production EVPN tenants after a change. What is the most likely cause to investigate first?
Select an answer to reveal the explanation.
Short Explanation
When research suddenly sees production routes, it's usually a door left open between EVPN apartments—wrong route-target export, not an ESI mismatch. Start with the BGP-EVPN multi-tenancy config that broke isolation.
Full Explanation
When a county open-data pod suddenly leaks routes between research and production EVPN tenants after a change, the first investigation target should be BGP-EVPN multi-tenancy configuration—especially incorrect route-target export or import between tenants. Route targets define which EVPN routes a VRF accepts. A typo, copied RT, or automation template that exports production routes into the research tenant (or the reverse) produces exactly the symptom: research hosts suddenly learn production prefixes. On Spectrum-X civic fabrics, that leakage is a control-plane policy failure until proven otherwise. A mismatched MTU setting on spine uplinks causing VXLAN encapsulation fragmentation fails as the first suspect because MTU problems break or fragment transport between switches; they do not leak EVPN routes between tenants, and the issue appeared after a tenant policy change. A duplicated anycast gateway IP-MAC binding applied for distributed IRB across research leaf switches fails as the cause because it would corrupt local gateway forwarding or blackhole research traffic, not advertise production prefixes into the research tenant. An inconsistent EVPN ESI identifier assignment for multihomed compute nodes in the production rack also fails—ESI mismatch affects multihoming redundancy and designated forwarder election, not cross-tenant route leaking between VRFs. Exam caveat: not every cross-tenant visibility issue is an RT mistake (host mis-VLAN, shared gateway, or automation writing the wrong VRF are also possible), but RT/VRF policy is still the highest-yield first check after a tenant-leak change. Operational check: diff the pre/post EVPN RT import/export for research and production, list EVPN routes newly present in the research VRF that match production prefixes, roll back or correct the RT policy, and re-verify isolation with show commands plus a negative ping or traceroute from a research GPU before closing the county incident.