Check route tags, source protocol, import-route statements and re-advertisement history. This check would diagnose Redistribution route tag loop avoidance, but would not first isolate the described EVPN Type-2 MAC/IP route interpretation. Begin with: Inspect EVPN NLRI route types, MAC/IP attributes, VNI bindings and desired prefix routes.

Test bidirectional peer IP routing, TCP port 179 and BGP neighbor socket state. This check would diagnose BGP TCP reachability and port, but would not first isolate the described EVPN Type-2 MAC/IP route interpretation. Begin with: Inspect EVPN NLRI route types, MAC/IP attributes, VNI bindings and desired prefix routes.

Compare external route type, advertised metric, internal ASBR reachability cost and route selection. This check would diagnose OSPF E1 versus E2 external metric, but would not first isolate the described EVPN Type-2 MAC/IP route interpretation. Begin with: Inspect EVPN NLRI route types, MAC/IP attributes, VNI bindings and desired prefix routes.

Configure an exact supported policy-based route match and viable next hop for the authorized traffic class. This is a legitimate response to the different issue of Policy-based routing for approved application, but it does not correct the specific Prefix-list network and mask matching condition reported. The relevant technical distinction is: Prefix lists match both an address prefix and a configurable prefix-length range.

Apply a narrow supported Level-2-to-Level-1 route-leak policy only for authorized service prefixes. This is a legitimate response to the different issue of IS-IS selective L2-to-L1 route leaking, but it does not correct the specific Prefix-list network and mask matching condition reported. The relevant technical distinction is: Prefix lists match both an address prefix and a configurable prefix-length range.

Bind the correct MQC classifier, behavior, and traffic-policy in the intended interface direction. This is a legitimate response to the different issue of MQC classifier and behavior association, but it does not correct the specific Prefix-list network and mask matching condition reported. The relevant technical distinction is: Prefix lists match both an address prefix and a configurable prefix-length range.

A simulated PBR next-hop outage selects the approved alternate without routing loops. That observation would support a separate case of PBR failed-next-hop fallback, not verification of the reported Prefix-list network and mask matching. The relevant observable outcome here is: The route-policy accepts the intended subnet lengths and rejects a specifically tested unauthorized length.

The partner prefix appears as an external route where allowed and test traffic reaches its next hop. That observation would support a separate case of OSPF type-5 external advertisement, not verification of the reported Prefix-list network and mask matching. The relevant observable outcome here is: The route-policy accepts the intended subnet lengths and rejects a specifically tested unauthorized length.

Every prefix has a stable authoritative origin and route import does not recursively reappear. That observation would support a separate case of Redistribution route tag loop avoidance, not verification of the reported Prefix-list network and mask matching. The relevant observable outcome here is: The route-policy accepts the intended subnet lengths and rejects a specifically tested unauthorized length.

Huawei MQC separates class identification, traffic behavior and applied traffic-policy binding. This explains MQC classifier and behavior association, but not why the issue in this scenario occurs. The specific mechanism is: Prefix lists match both an address prefix and a configurable prefix-length range.

Packet filtering depends on first relevant ACL matches and the direction of filter application. This explains ACL packet filter rule order and direction, but not why the issue in this scenario occurs. The specific mechanism is: Prefix lists match both an address prefix and a configurable prefix-length range.

AS_PATH length is one BGP best-path criterion after important preceding preferences. This explains BGP AS_PATH length egress choice, but not why the issue in this scenario occurs. The specific mechanism is: Prefix lists match both an address prefix and a configurable prefix-length range.

An attribute-only change without forwarding checks can create a silent blackhole. This consequence is associated more directly with Route-policy next-hop and preference application. For the stated conditions the immediate exposure is: An overbroad prefix filter can propagate unauthorized specifics or conceal desired routes.

Simultaneous active stack fragments can duplicate gateways or destabilize Layer 2 forwarding. This consequence is associated more directly with Switch stacking split-brain. For the stated conditions the immediate exposure is: An overbroad prefix filter can propagate unauthorized specifics or conceal desired routes.

Unrealistically short timers can trigger false failures and route flapping. This consequence is associated more directly with BFD detection timers and false alarms. For the stated conditions the immediate exposure is: An overbroad prefix filter can propagate unauthorized specifics or conceal desired routes.

Review ingress marks, traffic policy counters, queue occupancy and congestion test results. This check would diagnose QoS DSCP remarking and trust, but would not first isolate the described Prefix-list network and mask matching. Begin with: Inspect ip-prefix sequence, mask-length qualifiers and test candidate routes.

Inspect EVPN NLRI route types, MAC/IP attributes, VNI bindings and desired prefix routes. This check would diagnose EVPN Type-2 MAC/IP route interpretation, but would not first isolate the described Prefix-list network and mask matching. Begin with: Inspect ip-prefix sequence, mask-length qualifiers and test candidate routes.

Inspect root bridge ID, path cost, port roles and current bridge priorities. This check would diagnose RSTP root bridge location, but would not first isolate the described Prefix-list network and mask matching. Begin with: Inspect ip-prefix sequence, mask-length qualifiers and test candidate routes.

Assign a distinct stable OSPF router ID to each device and restart the affected process under change control. This is a legitimate response to the different issue of OSPF duplicate router IDs, but it does not correct the specific Prefix-list network and mask matching condition reported. The relevant technical distinction is: Prefix lists match both an address prefix and a configurable prefix-length range.

Use an ordered narrow ACL with the correct interface and traffic direction for the required filter. This is a legitimate response to the different issue of ACL packet filter rule order and direction, but it does not correct the specific Prefix-list network and mask matching condition reported. The relevant technical distinction is: Prefix lists match both an address prefix and a configurable prefix-length range.

Add supported PBR next-hop reachability tracking or failover logic consistent with service requirements. This is a legitimate response to the different issue of PBR failed-next-hop fallback, but it does not correct the specific Prefix-list network and mask matching condition reported. The relevant technical distinction is: Prefix lists match both an address prefix and a configurable prefix-length range.

Affected prefixes select the planned reachable next hop with correct preference while unrelated paths remain stable. That observation would support a separate case of Route-policy next-hop and preference application, not verification of the reported Prefix-list network and mask matching. The relevant observable outcome here is: The route-policy accepts the intended subnet lengths and rejects a specifically tested unauthorized length.

A test prohibited prefix is rejected while authorized matching routes retain expected attributes. That observation would support a separate case of Route-policy permit and deny node order, not verification of the reported Prefix-list network and mask matching. The relevant observable outcome here is: The route-policy accepts the intended subnet lengths and rejects a specifically tested unauthorized length.

The restricted destination is denied and authorized comparison traffic succeeds in a controlled test. That observation would support a separate case of ACL packet filter rule order and direction, not verification of the reported Prefix-list network and mask matching. The relevant observable outcome here is: The route-policy accepts the intended subnet lengths and rejects a specifically tested unauthorized length.

QoS differentiation depends on packet classification, marking trust and congestion-aware queuing. This explains QoS DSCP remarking and trust, but not why the issue in this scenario occurs. The specific mechanism is: Prefix lists match both an address prefix and a configurable prefix-length range.

IP forwarding uses longest-prefix match; protocol route preference decides among competing candidates for the same prefix. This explains Longest-prefix and route preference, but not why the issue in this scenario occurs. The specific mechanism is: Prefix lists match both an address prefix and a configurable prefix-length range.

BGP exchanges routing control messages over an established TCP transport connection. This explains BGP TCP reachability and port, but not why the issue in this scenario occurs. The specific mechanism is: Prefix lists match both an address prefix and a configurable prefix-length range.

Disabling all BFD checks to suppress authentication errors can undermine route-failure detection. This consequence is associated more directly with BFD authentication mismatch. For the stated conditions the immediate exposure is: An overbroad prefix filter can propagate unauthorized specifics or conceal desired routes.

Ignoring community-scoped policy can expose unintended network reachability. This consequence is associated more directly with BGP community filtering in routing control. For the stated conditions the immediate exposure is: An overbroad prefix filter can propagate unauthorized specifics or conceal desired routes.

Misordered or misplaced ACLs can allow forbidden flows or deny legitimate services. This consequence is associated more directly with ACL packet filter rule order and direction. For the stated conditions the immediate exposure is: An overbroad prefix filter can propagate unauthorized specifics or conceal desired routes.

Inspect ACL rule numbers, match counts, attachment direction and permitted/denied test flows. This check would diagnose ACL packet filter rule order and direction, but would not first isolate the described Prefix-list network and mask matching. Begin with: Inspect ip-prefix sequence, mask-length qualifiers and test candidate routes.

Inspect route communities on received paths and the community-filter and route-policy match results. This check would diagnose BGP community filtering in routing control, but would not first isolate the described Prefix-list network and mask matching. Begin with: Inspect ip-prefix sequence, mask-length qualifiers and test candidate routes.

Inspect port roles, proposal/agreement exchanges, physical link state and failover logs. This check would diagnose RSTP alternate port failover, but would not first isolate the described Prefix-list network and mask matching. Begin with: Inspect ip-prefix sequence, mask-length qualifiers and test candidate routes.