Cisco EVPN+VxLAN Multi-AS eBGP issue

I am labbing to learn eBGP underlay for EVPN so i did create following lab

Spine: 65000

Leaf-1:65001

Leaf-2:65002

​

## spine

router bgp 65000 log-neighbor-changes address-family ipv4 unicast redistribute direct route-map TAG-UL address-family l2vpn evpn nexthop route-map NH-UNCH retain route-target all neighbor 10.1.1.1 remote-as 65001 address-family ipv4 unicast neighbor 10.1.2.1 remote-as 65002 address-family ipv4 unicast neighbor 10.255.1.1 remote-as 65001 update-source loopback0 ebgp-multihop 3 address-family l2vpn evpn disable-peer-as-check send-community route-map NH-UNCH out rewrite-evpn-rt-asn neighbor 10.255.2.1 remote-as 65002 update-source loopback0 ebgp-multihop 3 address-family l2vpn evpn disable-peer-as-check send-community route-map NH-UNCH out rewrite-evpn-rt-asn 

## leaf-1 and leaf-2 pretty similar except router-ID and peer IP

router bgp 65001 log-neighbor-changes address-family ipv4 unicast redistribute direct route-map TAG-UL neighbor 10.1.1.0 remote-as 65000 address-family ipv4 unicast neighbor 10.255.255.1 remote-as 65000 update-source loopback0 disable-connected-check ebgp-multihop 3 address-family l2vpn evpn disable-peer-as-check send-community send-community extended rewrite-evpn-rt-asn ! evpn vni 10010 l2 rd auto route-target import auto route-target export auto 

## I have two server connected to leaf in 10010 VNI and spine BGP can see them in routing table

spine-1# show bgp l2vpn evpn BGP routing table information for VRF default, address family L2VPN EVPN BGP table version is 475, Local Router ID is 10.255.255.1 Status: s-suppressed, x-deleted, S-stale, d-dampened, h-history, *-valid, >-best Path type: i-internal, e-external, c-confed, l-local, a-aggregate, r-redist, I-i njected Origin codes: i - IGP, e - EGP, ? - incomplete, | - multipath, & - backup, 2 - b est2 Network Next Hop Metric LocPrf Weight Path Route Distinguisher: 10.255.1.1:32777 *>e[2]:[0]:[0]:[48]:[5254.0014.e6b8]:[0]:[0.0.0.0]/216 10.254.1.1 0 65001 i *>e[3]:[0]:[32]:[10.254.1.1]/88 10.254.1.1 0 65001 i Route Distinguisher: 10.255.2.1:32777 *>e[2]:[0]:[0]:[48]:[5254.0019.9dcb]:[0]:[0.0.0.0]/216 10.254.2.1 0 65002 i *>e[3]:[0]:[32]:[10.254.2.1]/88 10.254.2.1 0 65002 i 

## i am getting BGP update error on leaf saying RT policy reject and its not installing routers in FIB

leaf-1# show bgp l2vpn evpn BGP routing table information for VRF default, address family L2VPN EVPN BGP table version is 175, Local Router ID is 10.255.1.1 Status: s-suppressed, x-deleted, S-stale, d-dampened, h-history, *-valid, >-best Path type: i-internal, e-external, c-confed, l-local, a-aggregate, r-redist, I-i njected Origin codes: i - IGP, e - EGP, ? - incomplete, | - multipath, & - backup, 2 - b est2 Network Next Hop Metric LocPrf Weight Path Route Distinguisher: 10.255.1.1:32777 (L2VNI 10010) *>l[2]:[0]:[0]:[48]:[5254.0014.e6b8]:[0]:[0.0.0.0]/216 10.254.1.1 100 32768 i *>l[3]:[0]:[32]:[10.254.1.1]/88 10.254.1.1 100 32768 i 

## BGP error on leaf-1 (10.255.255.1 is spine Loopback)

2020 Aug 7 13:52:29.759596 bgp: [14564] (default) UPD: [L2VPN EVPN] 10.255.255.1 Inbound import RT check action deny 2020 Aug 7 13:52:29.759906 bgp: [14564] (default) UPD: Received ESI 0000.0000.0000.0000.0000 for route type 2 from peer 10.255.255.1 2020 Aug 7 13:52:29.759957 bgp: [14564] (default) UPD: [L2VPN EVPN] Received rd 10.255.2.1:32777 prefix [2]:[0]:[0]:[48]:[5254.0019.9dcb]:[0]:[0.0.0.0]/112 from peer 10.255.255.1, origin 0, next hop 10.254.2.1, localpref 0, med 0 2020 Aug 7 13:52:29.759987 bgp: [14564] (default) UPD: [L2VPN EVPN] Dropping prefix [2]:[0]:[0]:[48]:[5254.0019.9dcb]:[0]:[0.0.0.0]/112 from peer 10.255.255.1, due to attribute policy rejected