You are configuring source-based routing in a VSX Gateway deployment with both External and Internal Virtual Routers. Which of the following functions can't be configured for the Virtual Systems?

Question

Options

• ARemote Access VPNs
• BAnti-spoofing measures
• CIntranet VPNs
• DNetwork Address Translation
• EVirtual System clustering

• A
  16% (5)
• B
  71% (22)
• C
  3% (1)
• D
  3% (1)
• E
  6% (2)

Explanation

Anti-spoofing cannot be configured on Virtual Systems in this scenario because it relies on a unified routing table to validate whether incoming packets arrive on the correct interface for their source address - but when source-based routing splits routing decisions across separate External and Internal Virtual Routers, the Virtual System no longer has the single, coherent routing view required to enforce anti-spoofing rules accurately.

The distractors are all features that can be configured on Virtual Systems: Remote Access VPNs (A) and Intranet VPNs (C) are both fully supported VPN modes within VSX Virtual Systems; NAT (D) is a core security function available at the VS layer; and Virtual System clustering (E) is supported through ClusterXL, allowing VSX gateways to operate in HA or load-sharing cluster configurations.

Memory tip: "Anti-Spoofing needs a Single Source of truth for routing." When routing is split between Virtual Routers (the whole point of source-based routing in VSX), the VS loses that single routing context - so anti-spoofing breaks down and is therefore unsupported in this topology.

No community discussion yet for this question.