Which technology, implemented on aggregation-edge nodes at the aggregation layer, provides per-tenant isolation at Layer 3, with separate dedicated per-tenant routing and forwarding tables on the insi

VLANs operate at Layer 2 and provide traffic segmentation only within the switching domain; they do not create separate per-tenant Layer 3 routing and forwarding tables.

VXLAN is a Layer 2 overlay encapsulation protocol used to extend Ethernet segments across Layer 3 boundaries and does not itself provide dedicated per-tenant Layer 3 routing table separation.

VRF-lite creates independent virtual routing and forwarding table instances on aggregation-edge nodes, giving each tenant its own dedicated Layer 3 routing domain on the inside interfaces of firewall contexts - this achieves per-tenant isolation at Layer 3 without requiring a full MPLS control plane, making it the correct technology for this aggregation-layer design.

VDC (Virtual Device Context) is a Cisco Nexus-specific feature that partitions one physical chassis into multiple logical devices, representing device-level virtualization rather than per-tenant Layer 3 routing isolation.