In a VXLAN EVPN fabric, VLANs are locally significant and mapped to a globally significant VXLAN Network Identifier (VNI). If a specific VLAN is not working on one leaf, the most common issue is an inconsistent or missing VLAN-to-VNI mapping on that specific switch. The other options are less likely: physical trunk configuration isn’t the primary concern in a VXLAN overlay, checking for a specific Type-2 route is too granular for an initial check, and rebooting is not an efficient troubleshooting step.

For a vPC peer-link to form, the peer-keepalive must be established first, and then the peer-link. A common cause for peer-link failure, after the keepalive is up, is a Layer 2 mismatch on the peer-link interfaces themselves. Having different native VLANs on the trunk ports constituting the peer-link will prevent the link from becoming operational, as it creates a Layer 2 inconsistency. Mismatched system parameters would affect dual-active detection but not initial bring-up, and shutdown interfaces are a more obvious issue not typically described as a ‘misconfiguration’ in this scenario.

The recommended hitless upgrade procedure for vPC pairs is to upgrade the secondary peer first. After its reboot is complete and it rejoins the vPC domain, you manually force a role change (making the original secondary the new primary), and then upgrade the original primary peer. This method ensures one vPC peer is always active and forwarding traffic, maintaining network availability. Upgrading both simultaneously or disabling the peer-link causes a full outage, and upgrading the primary first forces a single-point of failure during the secondary’s upgrade.

The `vpc orphan-port suspend` command is a critical part of FHRP filtering. It applies to access ports that are part of a vPC but whose peer port is on the other switch (i.e., the local port is an ‘orphan’ relative to the peer-link). If the peer-link fails, this command suspends these local orphan ports. This prevents the local switch from becoming the active HSRP/VRRP router for VLANs on those ports, which would cause black-hole traffic because the switch cannot reach the peer switch where the actual downstream device is connected.

BGP route dampening is a feature designed to minimize control-plane instability caused by flapping routes. In an EVPN context, a flapping host link causes the leaf switch to repeatedly advertise and withdraw MAC/IP (Type-2) routes. Enabling dampening for these specific routes will assign a penalty for each flap. Once a threshold is exceeded, the route is suppressed (not advertised) for a dampening period, stabilizing the BGP EVPN control plane. Storm control manages traffic planes, timer adjustments affect BGP session stability, and port security is for security, not route dampening.

In an ACI multi-pod architecture, each pod is a separate, fault-independent fabric with its own spines and leaves. The Inter-Pod Network (IPN) is the essential Layer 3 infrastructure (typically a set of routers) that provides the IP connectivity between the spine switches of different pods. It carries the control plane (IS-IS, BGP) and data plane (VXLAN) traffic between pods. The APIC manages policy, spines are intra-pod devices, and VTEPs are endpoints within a pod that use the IPN to reach other pods.

In VXLAN EVPN, BUM traffic is handled using ingress replication. The source leaf switch encapsulates the BUM frame and sends it to the spine. The spine replicates the packet and sends it to the outer IP addresses (loopbacks) of *all* leaf switches that have interested receivers for that VNI (typically via BGP EVPN Inclusive Multicast Ethernet Tag routes). Therefore, seeing the same packet destined to multiple leaf switch loopback IPs on the spine is the hallmark of BUM traffic replication. A unicast packet would have only one leaf’s loopback as the destination.

OSPF summarization is performed at Area Border Routers (ABRs). To summarize routes from one area before advertising them into another, you must use the `area range` command. This command is configured within the OSPF process router configuration mode and specifies the area from which the routes are being summarized (e.g., `area 1 range 10.1.0.0 255.255.0.0`). Using the `summary-address` command is for redistributing routes into OSPF from other protocols (ASBR summarization), not for inter-area summarization at an ABR.

In a VXLAN fabric, the forwarding decision for a known unicast is based on the MAC-to-VTEP mapping learned via BGP EVPN. The command `show l2route evpn mac` displays the Layer 2 routing table for EVPN, showing the EVI (VNI), the host MAC address, and the next-hop—which is the remote VTEP IP address (the loopback of the leaf switch where the host resides). This tells you exactly which leaf switch the packet will be encapsulated and sent to. Standard MAC tables show local interfaces, IP routes are for Layer 3, and traceroute shows the physical underlay path, not the logical VXLAN overlay path.

In a VXLAN EVPN fabric, VLANs are locally significant and mapped to a globally significant VXLAN Network Identifier (VNI). If a specific VLAN is not working on one leaf, the most common issue is an inconsistent or missing VLAN-to-VNI mapping on that specific switch. The other options are less likely: physical trunk configuration isn’t the primary concern in a VXLAN overlay, checking for a specific Type-2 route is too granular for an initial check, and rebooting is not an efficient troubleshooting step.0