Check attached bits in LSPs, candidate L1/L2 routes and default forwarding behavior. This check would diagnose IS-IS L1 default to nearest attached L1L2, but would not first isolate the described BGP peer autonomous-system mismatch. Begin with: Inspect configured peer AS, received OPEN messages and BGP neighbor reset reasons.

Compare received candidate paths, LOCAL_PREF values, route policy and installed best path. This check would diagnose BGP local preference internal egress, but would not first isolate the described BGP peer autonomous-system mismatch. Begin with: Inspect configured peer AS, received OPEN messages and BGP neighbor reset reasons.

Inspect ACL rule numbers, match counts, attachment direction and permitted/denied test flows. This check would diagnose ACL packet filter rule order and direction, but would not first isolate the described BGP peer autonomous-system mismatch. Begin with: Inspect configured peer AS, received OPEN messages and BGP neighbor reset reasons.

Check earlier best-path attributes and prefer the supported origin order IGP, then EGP, then Incomplete where reached. This is a legitimate response to the different issue of BGP origin attribute tie break, but it does not correct the specific Loopback-based iBGP update source condition reported. The relevant technical distinction is: BGP peer addressing and actual TCP source must correspond, and loopback peering needs a reachable underlay.

Apply a narrow supported Level-2-to-Level-1 route-leak policy only for authorized service prefixes. This is a legitimate response to the different issue of IS-IS selective L2-to-L1 route leaking, but it does not correct the specific Loopback-based iBGP update source condition reported. The relevant technical distinction is: BGP peer addressing and actual TCP source must correspond, and loopback peering needs a reachable underlay.

Build a supported source-rooted multicast path using IGMPv3 source membership and PIM RPF toward S. This is a legitimate response to the different issue of Multicast SSM and RPF source path, but it does not correct the specific Loopback-based iBGP update source condition reported. The relevant technical distinction is: BGP peer addressing and actual TCP source must correspond, and loopback peering needs a reachable underlay.

DR and BDR maintain required Full adjacencies while DROther-to-DROther neighbors may remain 2-Way. That observation would support a separate case of Broadcast OSPF DR and BDR election, not verification of the reported Loopback-based iBGP update source. The relevant observable outcome here is: The loopback-sourced BGP session remains Established across the designated physical uplink change.

Traffic captures show intended markings and low-delay queue behavior during representative congestion. That observation would support a separate case of QoS DSCP remarking and trust, not verification of the reported Loopback-based iBGP update source. The relevant observable outcome here is: The loopback-sourced BGP session remains Established across the designated physical uplink change.

The EVPN table shows appropriate host MAC/IP mapping and separately advertised intended IP prefixes. That observation would support a separate case of EVPN Type-2 MAC/IP route interpretation, not verification of the reported Loopback-based iBGP update source. The relevant observable outcome here is: The loopback-sourced BGP session remains Established across the designated physical uplink change.

BGP exchanges routing control messages over an established TCP transport connection. This explains BGP TCP reachability and port, but not why the issue in this scenario occurs. The specific mechanism is: BGP peer addressing and actual TCP source must correspond, and loopback peering needs a reachable underlay.

BGP ORIGIN ranks IGP ahead of EGP and Incomplete after preceding path-selection rules. This explains BGP origin attribute tie break, but not why the issue in this scenario occurs. The specific mechanism is: BGP peer addressing and actual TCP source must correspond, and loopback peering needs a reachable underlay.

BGP OPEN negotiation validates the expected peer AS and session parameters. This explains BGP peer autonomous-system mismatch, but not why the issue in this scenario occurs. The specific mechanism is: BGP peer addressing and actual TCP source must correspond, and loopback peering needs a reachable underlay.

A BGP Established session alone does not prove EVPN address family exchange works. This consequence is associated more directly with MP-BGP address-family activation. For the stated conditions the immediate exposure is: Treating an iBGP authentication issue as pure reachability can mask an unexpected transport source.

A permissive export filter can leak confidential topology and disrupt other routing domains. This consequence is associated more directly with BGP prefix export-filter leak. For the stated conditions the immediate exposure is: Treating an iBGP authentication issue as pure reachability can mask an unexpected transport source.

Changing static-route priority will not fix unintended OSPF intra-area path cost. This consequence is associated more directly with OSPF SPF path-cost comparison. For the stated conditions the immediate exposure is: Treating an iBGP authentication issue as pure reachability can mask an unexpected transport source.

Review ingress marks, traffic policy counters, queue occupancy and congestion test results. This check would diagnose QoS DSCP remarking and trust, but would not first isolate the described Loopback-based iBGP update source. Begin with: Inspect peer addresses, source interfaces, loopback routes and TCP endpoint addresses.

Inspect reflector cluster ID, reflected path attributes and RR-client membership. This check would diagnose BGP route reflector cluster loop prevention, but would not first isolate the described Loopback-based iBGP update source. Begin with: Inspect peer addresses, source interfaces, loopback routes and TCP endpoint addresses.

Inspect SSID authentication mode, RADIUS exchange, role/VLAN assignment and authentication failure logs. This check would diagnose WLAN 802.1X authentication and NAC, but would not first isolate the described Loopback-based iBGP update source. Begin with: Inspect peer addresses, source interfaces, loopback routes and TCP endpoint addresses.

Configure supported RR-client relationships and confirm intended reflection rules between client and nonclient sessions. This is a legitimate response to the different issue of BGP route-reflector client scoping, but it does not correct the specific Loopback-based iBGP update source condition reported. The relevant technical distinction is: BGP peer addressing and actual TCP source must correspond, and loopback peering needs a reachable underlay.

Configure the actual authorized remote AS consistently with the peer's BGP OPEN identity. This is a legitimate response to the different issue of BGP peer autonomous-system mismatch, but it does not correct the specific Loopback-based iBGP update source condition reported. The relevant technical distinction is: BGP peer addressing and actual TCP source must correspond, and loopback peering needs a reachable underlay.

Mark imported routes and deny reimport of already redistributed origins with controlled route tags. This is a legitimate response to the different issue of Redistribution route tag loop avoidance, but it does not correct the specific Loopback-based iBGP update source condition reported. The relevant technical distinction is: BGP peer addressing and actual TCP source must correspond, and loopback peering needs a reachable underlay.

A simulated PBR next-hop outage selects the approved alternate without routing loops. That observation would support a separate case of PBR failed-next-hop fallback, not verification of the reported Loopback-based iBGP update source. The relevant observable outcome here is: The loopback-sourced BGP session remains Established across the designated physical uplink change.

The selected route follows the expected shorter path unless an explicitly higher-priority attribute overrides it. That observation would support a separate case of BGP AS_PATH length egress choice, not verification of the reported Loopback-based iBGP update source. The relevant observable outcome here is: The loopback-sourced BGP session remains Established across the designated physical uplink change.

Approved users reach necessary services over resilient paths while sensitive management segments remain isolated. That observation would support a separate case of Enterprise campus layered design, not verification of the reported Loopback-based iBGP update source. The relevant observable outcome here is: The loopback-sourced BGP session remains Established across the designated physical uplink change.

AS_PATH length is one BGP best-path criterion after important preceding preferences. This explains BGP AS_PATH length egress choice, but not why the issue in this scenario occurs. The specific mechanism is: BGP peer addressing and actual TCP source must correspond, and loopback peering needs a reachable underlay.

BGP aggregation reduces advertised prefix count but must preserve valid forwarding for component destinations. This explains BGP prefix aggregation and specifics, but not why the issue in this scenario occurs. The specific mechanism is: BGP peer addressing and actual TCP source must correspond, and loopback peering needs a reachable underlay.

BGP best-path and route installation require reachable NEXT_HOP; iBGP advertising does not always rewrite it. This explains iBGP next-hop reachability, but not why the issue in this scenario occurs. The specific mechanism is: BGP peer addressing and actual TCP source must correspond, and loopback peering needs a reachable underlay.

Stripping a no-export marker can leak intended internal reachability to other networks. This consequence is associated more directly with BGP route policy community NO_EXPORT. For the stated conditions the immediate exposure is: Treating an iBGP authentication issue as pure reachability can mask an unexpected transport source.

An overbroad prefix filter can propagate unauthorized specifics or conceal desired routes. This consequence is associated more directly with Prefix-list network and mask matching. For the stated conditions the immediate exposure is: Treating an iBGP authentication issue as pure reachability can mask an unexpected transport source.

A permissive export filter can leak confidential topology and disrupt other routing domains. This consequence is associated more directly with BGP prefix export-filter leak. For the stated conditions the immediate exposure is: Treating an iBGP authentication issue as pure reachability can mask an unexpected transport source.

Review pre/post-NAT tuple, VIP rule, service selector, session log and backend listener. This check would diagnose Destination NAT and security-policy pair, but would not first isolate the described Loopback-based iBGP update source. Begin with: Inspect peer addresses, source interfaces, loopback routes and TCP endpoint addresses.

Check attached bits in LSPs, candidate L1/L2 routes and default forwarding behavior. This check would diagnose IS-IS L1 default to nearest attached L1L2, but would not first isolate the described Loopback-based iBGP update source. Begin with: Inspect peer addresses, source interfaces, loopback routes and TCP endpoint addresses.

Inspect adjacency graph, route source type and advertisement history on the transit router. This check would diagnose iBGP split-horizon route propagation, but would not first isolate the described Loopback-based iBGP update source. Begin with: Inspect peer addresses, source interfaces, loopback routes and TCP endpoint addresses.