Analysis: A error, vsys1 and vsys2 are in the same service leaf, if they are in the same FW, they are interworking through fw, if they are in different ways fw, the interworking needs to be passed serviceleaf Nothing to do with borderleaf. B is correct, because the vsys appears on the fw that connects to the serviceleaf, there must be a docking vsys on the serviceleaf VRF, Change the VRF to belong to the corresponding VPC. C is incorrect, the tenant only needs to specify which pair of VPCs can communicate with each other on the controller, and does not need to consider how the underlying layer implements interoperability or specifies the interworking vrf. D is correct, in the scenario where the VPC is interconnected over the wall, two VSYS may fall on one FW, or they may fall on different FWs , the interoperability is only related to fw and serviceleaf, and has nothing to do with borderleaf. So the traffic model has nothing to do with how the border leaf is deployed.