EVPN control state without usable tenant transport
Two leaves participate in an EVPN control plane through a route reflector. Both sessions are established, and the receiving leaf imports the intended route target. The advertised endpoint route resolves toward a VTEP loopback, but a recent underlay policy blocks the required VXLAN traffic while allowing small ICMP probes. One local VNI is also missing its intended VLAN binding. The route reflector is not a tunnel endpoint in this topology. A management dashboard reports healthy BGP sessions, and the project owner assumes that proves the application segment is functional across the fabric. The engineer must determine which observations concern route distribution, which concern local segment deployment, and which concern the actual encapsulated data path.
1. What independent checks are needed?
Read the worked answer
Check route type and import, next-hop resolution, VTEP underlay reachability, permitted encapsulation, relevant MTU, and the particular VNI/VLAN binding. Peer-session state does not establish all these conditions, and small ICMP traffic does not validate the VXLAN transport policy.
2. Does the route reflector need to terminate every tenant tunnel?
Read the worked answer
No. Its control-plane reflection role is separate from the tenant-data path in this stated topology. Verify data between the actual VTEPs after targeted corrections instead of adding unnecessary tunnel termination to the reflector.