EVPN overlays and external fabric connectivity
Build the transport before trusting the overlay
VXLAN provides encapsulated connectivity between tunnel endpoints, while EVPN distributes relevant reachability and membership information. An established EVPN control session is not evidence that the underlay can carry packets between VTEP source addresses. Verify source and next-hop reachability, permitted encapsulation, end-to-end packet size, and the actual forwarding path. Small ICMP probes and management access test only a portion of those requirements.
Different route types answer different questions. MAC/IP advertisements, inclusive multicast membership, and IP-prefix advertisements should not be treated as interchangeable simply because they all appear in an EVPN control plane. A route reflector distributes control information and need not terminate the tenant's VXLAN traffic itself.
Match identity, membership, and routing context
Route distinguishers and route targets can have similar formatting but different purposes. A distinguisher provides route uniqueness, while target policy participates in import and export membership. Correct import is necessary but does not repair an unresolved or unusable transport next hop. Validate both policy and forwarding resolution.
An L2 VNI identifies the intended overlay segment. A local VLAN mapping must lead to the appropriate VNI and membership relationships on each participating leaf. Routed overlay behavior adds the VRF, gateway, L3 VNI, and associated reachability. Same-segment success is therefore not proof of inter-subnet correctness. Anycast gateways need the prescribed consistent identity and appropriate tenant attachment rather than arbitrary per-leaf identity changes.
ARP suppression and endpoint mobility depend on trustworthy binding and location information. Correlate learned state, movement sequence, and actual attachment; movement can be legitimate, stale, or duplicated. Known-unicast forwarding and BUM distribution may use distinct state, so test the failing traffic class rather than extrapolate from one successful flow.
Treat external and intersite connectivity as designs
ACI L3Out combines routed reachability with policy classification and service permission. An external security-classification prefix does not by itself install a forwarding route. Advertised subnets need the intended association, settings, and route policy. Shared services across VRFs require explicit address and permission design, especially when prefixes overlap.
Multi-Pod and Multi-Site differ in controller and fabric boundaries. Remote-leaf deployment has its own supported topology and version requirements. Validate the applicable interconnect traffic, MTU, failure domains, service dependencies, and measured recovery behavior. Stretching a VLAN or accepting one default route does not guarantee application resilience or remove the need to test return paths and inserted stateful services.