Walk 5, clickable — the packet across three stitched tunnels

Source in site B, destination in site A — three tunnel legs, one per domain. Pick a case, then click a hop or step through. ◆ marks a stitch point: decapsulate, look up, re-encapsulate.

rewritten at this hop constant — the invariant to verify ◆ stitch point = decap → lookup → re-encap

Which IPs are which: every outer address is a VTEP loopback (Lo1) — 10.255.31.113 → 10.255.31.101 → 10.255.255.101 → .112 / .113. Lo0 addresses (10.255.31.21, 10.255.31.1, 10.255.99.1, 10.255.255.1) carry the BGP sessions of Walk 4 and never appear in a packet header. Site A abbreviates 10.255.255.x to .x.

The invariant per case: A and B bridge — the inner Ethernet frame is untouched end to end, only outer headers change. C routes — a VRF lookup at the head of every leg rewrites the inner MACs (the RMAC chain from Walk 4), while the inner IPs stay constant.

Every leg is its own tunnel in its own underlay: it converges, ECMPs (outer UDP source port), and fails independently — and needs the +50 B VXLAN headroom. No device ever encapsulates toward a VTEP outside its own domain.

The 6.2 comparison: the old design ran one end-to-end tunnel 10.255.31.113 → 10.255.255.112 and sent one BUM copy per site A VTEP across the DCI; multi-domain sends one copy, and the far gateway fans out locally.