Analysis: Option B is incorrect, if the same physical firewall and ServiceLeaf are shared, only one VRF is required to communicate between VPCs. Option C and option D are wrong, depending on the scene, if two walls are connected to their own physical leaves, two interworking VRFs are requiredIf two walls are connected to the same physical leaf, only one interworking VRF is required to communicate between VPCs. Option A is correct. Bilateral FW and FW in the same device group: The two VPCs that access each other have their own virtual firewalls, traffic passes through the firewalls, and the service leaves of the two VPCs The virtual firewalls of two VPCs that access each other are distributed on two different physical firewalls, and the traffic is crossed by the firewall on both sides, and the two physical firewalls are connected to different firewalls Service Leaf 。 Bilateral FW and Service Leaf in the same device group: The virtual firewalls of two VPCs that access each other are distributed on two different physical firewalls, and traffic is bilaterally passed through the firewall, and the two physical firewalls are connected to the same Service Leaf 。

Resolution: Option B is wrong because there are no routes on DCI-GW for hosts and networks within the DCI, it only has routes for the inter-DCI GW to communicate. For other options, please refer to the following networking instructions.

•Networking Description: ▫ Add VXLAN-enabled devices as DCI-GW in the data center. BGP EVPN is deployed between DCI-GW to establish VXLAN tunnels, and BGP EVPN is deployed within Fabric , Fabric-GW ▫ As the endpoint of the VXLAN in the fabric, the common VLAN between the Fabric-GW and the DCI-GW is interconnected. Fabric-GW and DCI-GW are configured with VLAN access to VXLAN respectively. ▫ Cross-data center packets are decapsulated by Fabric-GW and turned into ordinary Ethernet packets, which are received by DCI-GW and then renewed

The VXLAN encapsulation enters the VXLAN tunnel of the DCI and is sent to the peer data center. ▫During L2 communication, Layer 2 broadcast domains between different data centers are opened, and different Layer 2 DNIs are mapped to different DCI VNIs through different VLANs. ▫In L3 interconnection, the Logic Router of the VPC that requires Layer 3 interconnection is passed through DCI on the Fabric-GW of each data center The VXLAN tunnel is directly connected to Layer 2 and an eBGPIPv4 private neighbor is established to pass VPC private routes across DCs

VLANs are then mapped to different DCI VNIs for isolation, ensuring communication and isolation between VMs across the data center.

Parse:

Resolution: Subnet and network are not a one-to-one relationship. is an n:1 relationship, and a subnet must be associated with a network