Which option is best suited to maintain Layer 3 separation in a multitenant data center design?

VXLAN is a Layer 2 overlay encapsulation technology used to extend L2 segments across an L3 fabric and does not inherently provide Layer 3 routing separation between tenants.

VRF creates logically isolated routing instances, each with its own routing table, forwarding table, and IP address space, ensuring that tenant traffic is completely separated at Layer 3. In a multitenant data center, VRFs are applied per tenant on routers or Layer 3 switches, preventing any cross-tenant routing without explicit route leaking, which is the standard mechanism for L3 multitenancy.

VDC (Virtual Device Context) is a Cisco Nexus-specific feature that partitions a physical switch into multiple logical devices but operates at the device virtualization level, not specifically at the Layer 3 routing separation level for multitenancy.

VLAN provides Layer 2 broadcast domain segmentation only and does not offer Layer 3 routing separation; tenants on separate VLANs can still share the same routing table without additional VRF configuration.