In an EVPN/VXLAN fabric managed by Apstra, enabling the DCI-facing routed interface (xe-0/0/0) on "DC-A" border leaf causes loss of connectivity to the production gateway (Palo Alto) for multiple VLANs/IRBs. This occurs even when the remote site (RJ3) is kept shut (no intended end-to-end DCI activation).

• Immediate loss of connectivity to the Palo Alto gateway from DC-A for several subnets after enabling the DCI-facing interface.
• Service restores immediately when the DCI interface is shut (rollback)
• Issue reproduces even when only the DC-A DCI interface is enabled and DC-B remains shut.
• Affected tenants/VLANs include IRBs, but impact is broader (anything depending on the gateway next-hop).

Probable cause: Enabling the DCI interface changes forwarding/control-plane behavior in a way that disrupts gateway reachability. The most common triggers are:

• Unintended routing/ECMP changes affecting reachability to the VTEP that provides the gateway adjacency
• EVPN MAC/IP mobility or duplicate detection impacting the gateway next-hop
• Hidden/inherited L2 behavior on the DCI port (via templates/groups) causing unexpected L2 learning or flooding.

Suggested next steps:

1. Validate the DCI port is truly L3-only (no inherited switching/bridge configuration from groups/templates).
2. Check what control-plane sessions/routes change at link-up and whether gateway resolution/MAC-IP state changes at the same time.
3. If an alternate path is introduced via the DCI, configured DCI route policies so only the remote site’s transport/loopback ranges are accepted and local site ranges are not re-learned via DCI.
4. Last but not least, re-test during a maintenance window and capture before/after outputs for: neighbor state, relevant underlay routes, and gateway resolution/MAC-IP stability.

Useful documentation:

https://www.juniper.net/documentation/us/en/software/junos/evpn/topics/concept/evpn-t2-t5-coexist-evpn-vxlan.html

https://www.juniper.net/documentation/us/en/software/nce/sg-005-data-center-fabric/topics/topic-map/data-center-interconnect-fabric-architecture.html