Pass the Nokia Nokia Certified Data Center Fabric Professional 4A0-D03 Questions and answers with CertsForce

Comprehensive and Detailed 150 to 250 words of Explanation From [SR Linux EVPN and Data Center Interconnect/Course Guide/topics]:

Asymmetric routing relies heavily on host MAC/IP information because the ingress PE performs routing into the destination subnet and then sends the frame across the overlay using the destination MAC-VRF/VNI. This means PEs require enough ARP and MAC/IP binding information to forward traffic toward remote hosts correctly. If a host has multiple IP addresses on the same interface, separate EVPN route type 2 advertisements may be needed to communicate each IP-to-MAC binding. The ingress and egress PEs participate in MAC and IP forwarding across the end-to-end service path, but the forwarding responsibilities differ by direction and stage. The false statement is option C. The statement says all MAC-VRFs connected to the L3 EVPN network must exist on each PE, but that is not the correct requirement in this question's verified answer set. In practical EVPN designs, the exact MAC-VRF placement depends on whether the service is implemented as asymmetric, symmetric, interface-less, or interface-ful routing. Here, the course answer marks the universal MAC-VRF requirement as false. Reference: asymmetric L3 EVPN routing, RT-2 MAC/IP advertisements, ARP and MAC forwarding behavior.

================

Comprehensive and Detailed 150 to 250 words of Explanation From [SR Linux EVPN and Data Center Interconnect/Course Guide/topics]:

The exhibit describes an EVPN IRB environment where MAC-VRF100 and IP-VRF-100 exchange host reachability through local learning and EVPN advertisements. Leaf-1 can advertise EVPN route type 2 updates containing host MAC/IP information for MAC-VRF100. This is the normal mechanism used to distribute endpoint bindings learned from local hosts. If IP-VRF-100 is not configured for prefix advertisement, Leaf-1 will not generate EVPN route type 5 updates for that IP-VRF, so option A is consistent. The ARP cache in the IP-VRF is normally required for local subnet host resolution; remote host reachability can be learned through EVPN rather than requiring every remote ARP entry to be learned by local data-plane ARP. Option B is false because ARP/GARP snooping is not performed by the IRB interface in the manner stated. ARP/GARP learning for proxy ARP and MAC/IP advertisement is associated with the MAC-VRF bridge-domain behavior and the local access side, not with the IRB subinterface indiscriminately snooping all ARP/GARP messages as described. Reference: EVPN IRB operation, RT-2 host MAC/IP advertisement, RT-5 behavior, ARP/GARP learning scope.

================

Comprehensive and Detailed 150 to 250 words of Explanation From [SR Linux EVPN and Data Center Interconnect/Course Guide/topics]:

Proxy ARP in a Layer 2 EVPN service allows the leaf to answer ARP requests locally using learned IP/MAC bindings, reducing broadcast flooding across the overlay. SR Linux can also monitor IP duplication and MAC/IP inconsistencies in the proxy ARP table. A pending state indicates that the system has detected suspicious or conflicting information and is monitoring the binding before declaring it duplicate. If the entry becomes duplicate, SR Linux can use a blackhole behavior to prevent forwarding traffic toward a conflicted endpoint, and a special discard MAC such as 00:00:00:00:DE:AD can be associated with the duplicate entry. Option D is false because it incorrectly states that all traffic destined to 192.168.100.1 will be discarded for exactly 9 minutes. The exhibit references monitoring and hold-down behavior, but the answer key rejects the fixed “9 minutes” traffic-discard statement. The key concept is that duplicate handling protects the EVPN service from unstable or conflicting IP/MAC bindings, but the specific discard duration in option D is not correct. Reference: proxy ARP, IP duplication monitoring, duplicate-state blackhole behavior.

================

Comprehensive and Detailed 150 to 250 words of Explanation From [SR Linux EVPN and Data Center Interconnect/Course Guide/topics]:

A Gratuitous ARP is an ARP message a host sends to announce or refresh its own IP-to-MAC binding without waiting for another host to request it. In a traditional Ethernet subnet, the GARP is sent as a broadcast so that other hosts can update their ARP caches with the sender's current MAC address. This is useful after a host boots, changes NICs, moves to another attachment point, or takes over an IP address in a redundancy scenario. In EVPN environments, GARPs are also important because a leaf can snoop the ARP information and update local proxy ARP and EVPN MAC/IP state. Option D is false because recipients do not acknowledge a gratuitous ARP with a reply. GARP is an announcement mechanism, not a request/response transaction. If every receiving host acknowledged a broadcast GARP, the result would be unnecessary ARP traffic amplification. The correct behavior is passive update of ARP state by receiving systems and, in EVPN, potential control-plane propagation of the learned binding by the local PE. Reference: GARP behavior, proxy ARP learning, Layer 2 EVPN endpoint update procedures.

================

Comprehensive and Detailed 150 to 250 words of Explanation From [SR Linux EVPN and Data Center Interconnect/Course Guide/topics]:

A route distinguisher is used in MP-BGP VPN and EVPN address families to make otherwise overlapping tenant routes unique in the BGP control plane. In EVPN, different tenants or EVPN instances may legitimately use the same MAC or IP values. The route distinguisher makes the NLRI globally unique by prepending a unique value to the tenant route. It is typically unique per PE and per EVI, and it is carried in EVPN route advertisements. However, the route distinguisher does not control route import, export, or service membership. That role belongs to the route target, which is a BGP extended community used by receiving PEs to decide which EVPN instance should import the route. Therefore, option D is not part of the correct description of a route distinguisher. Saying that the RD identifies the EVPN instance in the control plane confuses RD uniqueness with route-target membership. The RD makes routes unique; the route target associates those routes with the appropriate MAC-VRF or IP-VRF import policy. Reference: EVPN route distinguisher, overlapping tenant addresses, route target separation.

================

Comprehensive and Detailed 150 to 250 words of Explanation From [SR Linux EVPN and Data Center Interconnect/Course Guide/topics]:

This scenario describes all-active Layer 2 EVPN multi-homing with a host connected through a LAG to Leaf1 and Leaf2. The LAG subinterface is associated with the MAC-VRF on both participating leaves, and the Ethernet Segment ES-1 is configured for all-active multi-homing. In all-active operation, both leaf routers can be active attachment points for host-originated traffic, and remote traffic can use EVPN multi-homing mechanisms to reach the segment. Option D is false because the host does not know or use the EVPN Designated Forwarder state when sending BUM traffic. The host forwards over its LAG based on its local LAG hashing and LACP behavior. DF election is an EVPN PE-side mechanism used mainly to control which PE forwards BUM traffic from the EVPN overlay toward the Ethernet Segment, preventing duplicate delivery to the multihomed access network. The host itself does not selectively forward all BUM traffic toward the DF. That distinction is critical: DF controls overlay-to-segment replication, while the host's LAG controls host-to-leaf link selection. Reference: all-active L2 EVPN multi-homing, host LAG behavior, DF election scope, BUM forwarding.

================

Comprehensive and Detailed 150 to 250 words of Explanation From [SR Linux EVPN and Data Center Interconnect/Course Guide/topics]:

A gateway-less DCI design extends the data center EVPN/VXLAN model across the WAN without a distinct gateway function separating the data center fabric from the WAN VPN edge. Because the leaf routers or route reflectors must establish the necessary EVPN control-plane and VXLAN data-plane reachability across data centers, the WAN must provide reachability for those fabric endpoints. This design can simplify service continuity and preserve the EVPN overlay model end-to-end, but it does not provide the clean security and QoS demarcation that exists in a decoupled gateway model. A clear demarcation between a border leaf and a separate gateway/WAN PE is specifically a property of decoupled gateway-based DCI, not gateway-less DCI. The gateway-less model also requires reachability between route reflectors or EVPN control-plane endpoints across sites. Therefore, option A is false because it incorrectly assigns the demarcation benefit to the gateway-less design. Reference: gateway-less DCI, stretched EVPN overlay, route-reflector and leaf reachability requirements.

================

Comprehensive and Detailed 150 to 250 words of Explanation From [SR Linux EVPN and Data Center Interconnect/Course Guide/topics]:

The EVPN route type used for aliasing and fast convergence in multi-homing is RT-1, the Ethernet Auto-Discovery route. RT-1 has two important forms: Ethernet A-D per Ethernet Segment and Ethernet A-D per EVI. These routes advertise reachability to a multi-homed Ethernet Segment and to a specific EVPN instance on that segment. Remote PEs use this information for aliasing, meaning they can forward traffic toward any eligible PE attached to the same Ethernet Segment, even when a specific MAC was advertised by only one PE. RT-1 also supports fast convergence because withdrawal of Ethernet A-D routes quickly informs remote PEs that an attachment path or PE is no longer valid, avoiding slow MAC aging as the primary failure-detection mechanism. RT-4 Ethernet Segment routes are related to multi-homing, but their main function is Ethernet Segment discovery and Designated Forwarder election. RT-2 advertises host MAC/IP reachability, and RT-3 builds multicast/BUM replication lists. Therefore, RT-1 is the precise answer for aliasing and fast convergence. Reference: EVPN multi-homing route types, Ethernet Auto-Discovery, aliasing and convergence behavior.

================

Comprehensive and Detailed 150 to 250 words of Explanation From [SR Linux EVPN and Data Center Interconnect/Course Guide/topics]:

In asymmetric EVPN IRB, the ingress PE performs routing from the source subnet into the destination subnet, then forwards the packet across the VXLAN overlay using the destination MAC-VRF/VNI. The egress PE does not perform another IP-VRF lookup for that packet; it performs Layer 2 forwarding in the destination MAC-VRF. In this scenario, Host-2 sends traffic toward Host-1. After the ingress routing decision, the traffic arrives at Leaf-2 in the context of the destination MAC-VRF, mac-vrf-1. Leaf-2 then performs a MAC lookup in mac-vrf-1 and forwards the frame to Host-1. Option D is therefore correct. Option A reverses the forwarding direction and misidentifies the leaf action. Option B incorrectly sends mac-vrf-2 traffic toward the IP-VRF on Leaf-2, even though Leaf-2 is acting as the egress PE for Host-1. Option C is also incorrect because the egress forwarding action is based on the MAC table in the destination MAC-VRF, not an IP-VRF ARP lookup at that stage. Reference: asymmetric L3 EVPN IRB data-plane operation, ingress routing and egress MAC forwarding.

================

Comprehensive and Detailed 150 to 250 words of Explanation From [SR Linux EVPN and Data Center Interconnect/Course Guide/topics]:

A distributed Layer 2 EVPN in SR Linux is implemented using MAC-VRF network instances, EVPN control-plane signaling, and VXLAN data-plane encapsulation. A common mistake is assuming that every PE must use the same EVI value for the same L2 service. In SR Linux, the important operational requirement is that the correct EVPN routes are imported and exported using matching route-target policy, not necessarily that every PE has the same locally configured EVI. Therefore, option A is false. The route distinguisher can be automatically generated using local values such as the autonomous system number and EVI, giving each PE's EVPN routes uniqueness in MP-BGP. A MAC-VRF is associated with VXLAN encapsulation for its data-plane service mapping, and route targets may need to be manually configured when leaf routers are in different autonomous systems because automatic derivation may not produce matching import/export policy across AS boundaries. The key separation is this: the RD gives uniqueness, the route target controls service membership, and the EVI is a local service identifier rather than a universal mandatory match in all designs. Reference: SR Linux distributed L2 EVPN configuration, EVI, RD auto-generation, route-target policy.

================