Placing the management interface in a dedicated Management VRF (VRF-MGMT) is a core Arista security best practice. It logically isolates management traffic from data plane traffic, preventing unauthorized access from user subnets and containing management traffic to a specific, controlled path. The other options either compromise security, create operational issues, or hinder manageability.

The key distinction is between the RIB (`show ip ospf route`) and the FIB (`show ip route`). The RIB holds all routes learned by routing protocols. The FIB contains only the best, active routes installed for forwarding. If OSPF routes have an AD of 110, but the same prefixes are learned via EIGRP (AD 90) or a connected route (AD 0), the lower-AD routes will be installed in the FIB, explaining why they don’t appear in `show ip route`. The other options would affect the RIB itself.

The MLAG peer-link is a fundamental component that carries control traffic and, crucially, data traffic in specific failure scenarios (like a single peer-link failure). It must be a Layer 2 trunk that includes all VLANs configured on the MLAG member ports (the ports facing the downstream device). This allows either peer to forward traffic for the dual-homed device if the direct link to it fails. While using a LAG for the peer-link is recommended for redundancy, it’s not strictly a single connection. Identical models/versions are best practice but not always strictly required, and the downstream device connection method is a characteristic of MLAG, not its core loop-prevention mechanism.

`show policy-map interface control-plane` is the definitive command for monitoring CoPP. It displays the configured policy applied to the control-plane interface, showing counters for how many packets matched each class within the policy and, critically, how many were conformed, exceeded, or violated (and thus potentially dropped). `show cpu utilization` shows load but not cause, `show ip access-lists` shows ACL counters but not their CoPP context, and `show logging` might contain syslog messages about drops, but the policy-map command provides live, detailed statistics.

This is a key distinction. `ip address ` on an interface VlanX creates a standard, unique Layer 3 SVI address for that switch. `ip address virtual ` configured under `vlan X` creates a Virtual ARP (VARP)/Anycast Gateway address. This same virtual IP can be configured on multiple switches in the same Layer 2 domain, providing first-hop redundancy without a protocol like VRRP/HSRP. The host uses this single IP as its default gateway, and the switch owning the active forwarder role responds.

While QoS marking (DSCP/CoS) is the first step, the `scheduler strict-priority` command on an egress port scheduler is crucial for ultra-low latency. It creates a strict-priority queue that is always serviced before any weighted fair queuing (WFQ) queues, ensuring that traffic classified into that queue (e.g., voice or financial transaction data) experiences minimal forwarding delay. `portfast` relates to STP convergence, not forwarding priority. Changing MTU or using ACLs does not inherently prioritize traffic scheduling.

This is the expected output for a healthy MLAG pair. `State: active` means the local switch is operational. `Peer-link status: up` confirms the critical interconnect is healthy. `Dual-primary detection: inactive` is the desired state; it means the system is NOT detecting a “split-brain” condition where both switches think they are the primary. If `dual-primary` showed `true` or `active`, it would indicate a failure (like a peer-link failure where both switches remain up), which is a problem scenario.

`show vlan ` is a powerful, concise command for this purpose. It displays not only the VLAN information but also a list of all interfaces (both access and trunk) that are currently operationally carrying that VLAN, along with their status. `show interfaces trunk` shows all trunk ports and their allowed VLANs, but you would have to parse for VLAN 100. The other commands provide either too much or too little specific information.

VXLAN relies on a clear separation of underlay and overlay. The underlay is a Layer 3 IP network (typically using an IGP like OSPF or IS-IS). Its sole job is to provide reachability between the VTEP source and destination IP addresses. The overlay is the logical Layer 2/Layer 3 network formed by the VXLAN tunnels themselves, which carry the encapsulated user traffic. The underlay does not see or understand VXLAN headers; it simply routes IP packets between VTEPs.

Placing the management interface in a dedicated Management VRF (VRF-MGMT) is a core Arista security best practice. It logically isolates management traffic from data plane traffic, preventing unauthorized access from user subnets and containing management traffic to a specific, controlled path. The other options either compromise security, create operational issues, or hinder manageability.0