4A0-D03 Nokia SR Linux EVPN and Data Center Interconnect Questions and Answers

Comprehensive and Detailed 150 to 250 words of Explanation From [SR Linux EVPN and Data Center Interconnect/Course Guide/topics]:

This setup represents a Layer 2 EVPN multi-homing attachment where the host is connected to Leaf1 and Leaf2 through an Ethernet Segment named ES-1. In SR Linux EVPN multi-homing, the Ethernet Segment must be associated with the physical or logical attachment interfaces facing the host. This allows the PEs to advertise Ethernet Segment information into EVPN, participate in DF election, and apply the appropriate forwarding behavior for single-active or all-active redundancy. Option D is therefore correct. Option A is not necessarily true because the exhibit indicates an active/standby style attachment, not all-active operation. Option B is also incorrect because ECMP on the remote MAC-VRF is not the mechanism that defines the local ES association or single-active behavior. Option C is wrong in this setup because a host LAG is required for common all-active L2 multi-homing with LACP, but the shown design uses an active/standby-style attachment where the Ethernet Segment is bound to the host-facing ports. The technical anchor is that ES-1 must be associated to the access ports connecting the host into the multi-homed MAC-VRF service. Reference: L2 EVPN multi-homing, Ethernet Segment interface association, DF behavior.

================

Comprehensive and Detailed 150 to 250 words of Explanation From [SR Linux EVPN and Data Center Interconnect/Course Guide/topics]:

The scenario describes Layer 3 EVPN multi-homing with an IP-VRF service and an external CE VNF advertising the 40.40.40.0/24 prefix through BGP. A DF election can occur among the leaf routers participating in the Ethernet Segment, and the active/primary forwarding node is used for the relevant service behavior. The AD per EVI route can participate in identifying service-level reachability for the Ethernet Segment, and the prefix traffic follows the valid advertised path toward the CE VNF. Because Leaf3 has the BGP connection to the CE VNF, traffic for 40.40.40.0/24 is forwarded through Leaf3. Option B is false because it incorrectly states that all connected leaf routers will use single-active redundancy. The exhibit and answer context indicate a more specific forwarding/primary selection for the service, not a blanket statement that every connected leaf operates using single-active redundancy. In L3 multi-homing, redundancy behavior depends on the ES mode, prefix advertisement, next-hop association, and CE connectivity. The forwarding decision for the customer prefix is tied to the active/valid route advertisement, not to every leaf uniformly acting as single-active. Reference: L3 EVPN multi-homing, DF election, AD per EVI role, PE-CE BGP prefix forwarding.

================

Comprehensive and Detailed 150 to 250 words of Explanation From [SR Linux EVPN and Data Center Interconnect/Course Guide/topics]:

In interface-less symmetric routing, the EVPN fabric exchanges host forwarding information using EVPN route type 2 MAC/IP advertisements. RT-2 carries the host MAC address and, when present, the associated host IP address, allowing remote PEs to build the forwarding state needed for distributed gateway operation. Unlike asymmetric routing, interface-less symmetric routing does not require every MAC-VRF to be instantiated on every PE. The design scales better because each leaf only needs the locally attached MAC-VRFs plus the shared IP-VRF/routed VXLAN construct for inter-subnet forwarding. Option B describes an asymmetric forwarding pattern more than a symmetric one; in symmetric routing, both ingress and egress PEs perform routed forwarding functions through the IP-VRF. Option C is also incorrect because anycast gateway is fundamental when multiple leaves provide the same default-gateway service for a subnet. Therefore, the true statement is that forwarding information is exchanged using EVPN route type 2 updates. Reference: interface-less symmetric routing, EVPN RT-2 host MAC/IP signaling, distributed IRB operation.

================

Comprehensive and Detailed 150 to 250 words of Explanation From [SR Linux EVPN and Data Center Interconnect/Course Guide/topics]:

In an SR Linux Layer 2 EVPN MAC-VRF, locally attached MAC addresses are learned through the data plane on local access interfaces, while remote MAC addresses are learned from MP-BGP EVPN control-plane advertisements and installed with a VXLAN next-hop. The exhibit shows one local learned MAC on an Ethernet subinterface and another MAC learned through EVPN with a VXLAN interface and VNI 100. The remote VTEP or next-hop information identifies the remote endpoint, and the VNI maps the received VXLAN traffic to the correct MAC-VRF service. The false statement is C because saying that the MAC address associated with the vxlan-interface “will not age out” is too absolute. A remote EVPN MAC is not aged in the same way as a local data-plane-learned MAC, but it can still be removed when the corresponding EVPN route is withdrawn, invalidated, or no longer present in the control plane. The “N/A” style aging behavior does not mean permanent retention. Reference: SR Linux MAC-VRF verification, local MAC learning, EVPN-learned remote MACs, VXLAN VNI mapping.

================

Comprehensive and Detailed 150 to 250 words of Explanation From [SR Linux EVPN and Data Center Interconnect/Course Guide/topics]:

In asymmetric L3 EVPN routing, each participating PE must have the MAC-VRFs needed to forward traffic in the destination bridge domain. However, the specific exhibit describes two MAC-VRFs interconnected through IP-VRF3, with Leaf-1 hosting MAC-VRF1 and Leaf-2 hosting MAC-VRF2. The false statement is that Leaf-1 and Leaf-2 must both have instances of MAC-VRF1 and MAC-VRF2. That requirement is not true for this described deployment. Each local MAC-VRF connects to IP-VRF3 using an IRB interface, and host MAC/IP information is advertised using EVPN route type 2 so remote PEs can learn endpoint reachability. The question's answer also implies that IP prefix advertisement using route type 5 is part of the control-plane exchange between the leaves for the routed service context. What matters is that the fabric can resolve host and prefix reachability through EVPN without forcing every PE to instantiate every MAC-VRF in this topology. Option B overstates the MAC-VRF placement requirement and is therefore false. Reference: asymmetric L3 EVPN routing, RT-2 host advertisements, RT-5 IP prefix routes, IRB attachment.

================

Comprehensive and Detailed 150 to 250 words of Explanation From [SR Linux EVPN and Data Center Interconnect/Course Guide/topics]:

In interface-less symmetric L3 EVPN routing, hosts in a subnet may be attached to different leaf routers, while inter-subnet forwarding is performed through the IP-VRF using VXLAN routed interfaces. The ingress and egress PEs both participate in L3 forwarding, and the routed VXLAN interface provides the per-IP-VRF overlay data-plane construct needed for symmetric routing. The IRB interfaces on the local MAC-VRFs must advertise learned local host routes so that remote PEs have the necessary host reachability information. The MAC-VRFs also need the appropriate EVPN control-plane configuration so host MAC/IP information can be exchanged, while the IP-VRF participates in L3 VPN-style route exchange for routed reachability. Option A is false because anycast gateway is not optional in this design for Leaf1 and Leaf2. Anycast gateway allows the same default-gateway IP and virtual MAC behavior to exist consistently on multiple leaves serving the same subnet. Without it, host default-gateway behavior would be inconsistent and traffic mobility across the fabric would break expected distributed gateway operation. Reference: interface-less symmetric routing, IRB, anycast gateway, routed VXLAN interface.

================

Comprehensive and Detailed 150 to 250 words of Explanation From [SR Linux EVPN and Data Center Interconnect/Course Guide/topics]:

A distributed Layer 2 EVPN in SR Linux is implemented using MAC-VRF network instances, EVPN control-plane signaling, and VXLAN data-plane encapsulation. A common mistake is assuming that every PE must use the same EVI value for the same L2 service. In SR Linux, the important operational requirement is that the correct EVPN routes are imported and exported using matching route-target policy, not necessarily that every PE has the same locally configured EVI. Therefore, option A is false. The route distinguisher can be automatically generated using local values such as the autonomous system number and EVI, giving each PE's EVPN routes uniqueness in MP-BGP. A MAC-VRF is associated with VXLAN encapsulation for its data-plane service mapping, and route targets may need to be manually configured when leaf routers are in different autonomous systems because automatic derivation may not produce matching import/export policy across AS boundaries. The key separation is this: the RD gives uniqueness, the route target controls service membership, and the EVI is a local service identifier rather than a universal mandatory match in all designs. Reference: SR Linux distributed L2 EVPN configuration, EVI, RD auto-generation, route-target policy.

================

Comprehensive and Detailed 150 to 250 words of Explanation From [SR Linux EVPN and Data Center Interconnect/Course Guide/topics]:

In all-active Layer 2 EVPN multi-homing, the host is typically dual-homed to two or more leaf routers using a LAG. The participating leaf routers must configure the LAG and associate it with the Ethernet Segment so EVPN can advertise the common ESI and apply aliasing, split-horizon, and DF procedures. If VLAN tagging is used for service separation, tagging must be configured on the LAG interface so that the correct subinterfaces can bind into the MAC-VRF and Ethernet Segment. Option C is false because it states that the LACP system-id-mac must uniquely identify each leaf router. In an all-active EVPN multihomed LAG, the opposite principle applies: from the host's LACP perspective, the multihomed leaf pair must appear as a single logical LACP system. That generally requires a shared LACP system ID or coordinated system MAC behavior across the participating PEs. If each leaf presented a unique LACP system identity, the host would treat them as separate LAG partners and the all-active bundle would not form correctly. Reference: all-active L2 EVPN multi-homing, LAG attachment, LACP system ID behavior, Ethernet Segment association.

================

Comprehensive and Detailed 150 to 250 words of Explanation From [SR Linux EVPN and Data Center Interconnect/Course Guide/topics]:

When Host-1 sends its first Ethernet frame into MAC VRF-1, Leaf-1 performs normal local data-plane MAC learning on the access interface and installs Host-1's MAC address into the MAC forwarding table. In an L2 EVPN MAC-VRF, host MAC reachability is then advertised into the EVPN control plane using EVPN route type 2, the MAC/IP Advertisement route. Route type 5 is not used for host MAC advertisement; RT-5 is used for IP prefix advertisement in Layer 3 EVPN services. Therefore, option B is false because it incorrectly states that Leaf-1 generates an EVPN RT-5 update with the host MAC address. In this topology, Leaf-1 sends the correct EVPN update to the route reflector, Spine-1. The route reflector then reflects the update to Leaf-2 and Leaf-3, and those remote leaves import the route if the route target matches their MAC VRF-1 import policy. The route target controls service membership, ensuring that only PEs participating in the same EVPN instance import the MAC route. Reference: L2 EVPN MAC learning, RT-2 MAC/IP advertisement, route-reflector distribution, route-target import.

================

Comprehensive and Detailed 150 to 250 words of Explanation From [SR Linux EVPN and Data Center Interconnect/Course Guide/topics] :

In an integrated gateway-based data center interconnect design, the gateway must interwork between the data center EVPN/VXLAN domain and the WAN VPN transport domain. For Layer 3 VPN connectivity on a Nokia 7750 SR integrated gateway, the base BGP instance must support the relevant VPN address families, such as VPN-IPv4 and EVPN, because the gateway participates in control-plane exchange between the data center and WAN sides. The VPRN must also be associated with the WAN transport, normally through MPLS tunnel binding, and the VRF target must match the corresponding VPRN on the remote gateway so that VPN routes are imported and exported correctly. A routed VXLAN interface, however, is an SR Linux IP-VRF/VXLAN construct used for symmetric L3 EVPN forwarding inside a VXLAN-based data center fabric. In this question, dcgw10 is acting as the integrated WAN gateway for L3VPN connectivity, so a routed VXLAN interface is not the required configuration item on the VPRN instance. Reference: integrated gateway DCI, VPRN over MPLS, EVPN-to-VPN interworking.

================

Comprehensive and Detailed 150 to 250 words of Explanation From [SR Linux EVPN and Data Center Interconnect/Course Guide/topics]:

A decoupled gateway-based DCI model separates the data center border-leaf function from the WAN PE function. This separation is the key design point. The border leaf remains part of the data center EVPN/VXLAN environment, while the WAN PE participates in WAN VPN transport and policy enforcement. Because the roles are split across two devices, the handoff between the border leaf and WAN PE provides a clean administrative and operational boundary. That boundary is useful for security policy, QoS marking, traffic classification, and troubleshooting ownership. The WAN does not need direct reachability to every leaf and route reflector as in a gateway-less model. The WAN PE also does not peer directly with the data center route reflector in a decoupled model; route exchange occurs through the border-leaf/WAN-PE handoff. VXLAN tunnels between leaf routers across different data centers are characteristic of gateway-less extension, not decoupled gateway operation. Therefore, the statement about clear demarcation between the data center border leaf and WAN PE is the accurate description. Reference: decoupled gateway-based DCI, security/QoS demarcation, WAN PE separation.

================

Comprehensive and Detailed 150 to 250 words of Explanation From [SR Linux EVPN and Data Center Interconnect/Course Guide/topics]:

Proxy ARP in a Layer 2 EVPN service allows the leaf to answer ARP requests locally using learned IP/MAC bindings, reducing broadcast flooding across the overlay. SR Linux can also monitor IP duplication and MAC/IP inconsistencies in the proxy ARP table. A pending state indicates that the system has detected suspicious or conflicting information and is monitoring the binding before declaring it duplicate. If the entry becomes duplicate, SR Linux can use a blackhole behavior to prevent forwarding traffic toward a conflicted endpoint, and a special discard MAC such as 00:00:00:00:DE:AD can be associated with the duplicate entry. Option D is false because it incorrectly states that all traffic destined to 192.168.100.1 will be discarded for exactly 9 minutes. The exhibit references monitoring and hold-down behavior, but the answer key rejects the fixed “9 minutes” traffic-discard statement. The key concept is that duplicate handling protects the EVPN service from unstable or conflicting IP/MAC bindings, but the specific discard duration in option D is not correct. Reference: proxy ARP, IP duplication monitoring, duplicate-state blackhole behavior.

================

Comprehensive and Detailed 150 to 250 words of Explanation From [SR Linux EVPN and Data Center Interconnect/Course Guide/topics]:

The route target is the extended community consistently associated with EVPN updates to control route import and export between EVPN instances. In SR Linux EVPN services, route targets determine which MAC-VRF or IP-VRF should import a received EVPN route. This is essential for tenant separation because multiple tenants may use overlapping MAC or IP address spaces while sharing the same physical fabric and BGP control plane. The AFI/SAFI is not an extended community; it identifies the BGP address family and subsequent address family used to carry EVPN NLRI. The EVPN route type is also not an extended community; it is part of the EVPN NLRI structure and identifies whether the route is RT-1, RT-2, RT-3, RT-4, RT-5, and so on. The VXLAN network ID may be carried or inferred through service and encapsulation-specific attributes, but it is not universally present as the required extended community in every EVPN update. The route target is the mandatory policy element that enables receiving PEs to place EVPN routes into the correct service context. Reference: EVPN extended communities, route-target import/export policy, tenant service identification.

================