nerdexam
Cisco

300-410 · Question #76

After some changes in the routing policy, it is noticed that the router in AS 45123 is being used as a transit AS router for several service provides. Which configuration ensures that the branch…

The correct answer is D. ip as-path access-list 1 permit ^$ neighbor bgp 45123 neighbor SP-Neighbors filter-list 1 out. To ensure the router advertises only its local networks and acts as a non-transit AS, an AS-path access-list matching an empty AS path (^$) must be applied outbound.

Layer 3 Technologies

Question

After some changes in the routing policy, it is noticed that the router in AS 45123 is being used as a transit AS router for several service provides. Which configuration ensures that the branch router in AS 45123 advertises only the local networks to all SP neighbors?

Options

  • Aip as-path access-list 1 permit ^45123 | neighbor bgp 45123 neighbor SP-Neighbors filter-list 1 out
  • Bip as-path access-list 1 permit .* neighbor bgp 45123 neighbor SP-Neighbors filter-list 1 out
  • Cip as-path access-list 1 permit ^45123$ neighbor bgp 45123 neighbor SP-Neighbors filter-list 1 out
  • Dip as-path access-list 1 permit ^$ neighbor bgp 45123 neighbor SP-Neighbors filter-list 1 out

How the community answered

(33 responses)
  • A
    6% (2)
  • B
    6% (2)
  • C
    3% (1)
  • D
    85% (28)

Why each option

To ensure the router advertises only its local networks and acts as a non-transit AS, an AS-path access-list matching an empty AS path (`^$`) must be applied outbound.

Aip as-path access-list 1 permit ^45123 | neighbor bgp 45123 neighbor SP-Neighbors filter-list 1 out

`^45123|` is an incomplete or malformed regex; if intended to match paths starting with 45123, it could permit routes that merely passed through AS 45123, not just locally originated ones.

Bip as-path access-list 1 permit .* neighbor bgp 45123 neighbor SP-Neighbors filter-list 1 out

`.*` matches any AS path, including those with multiple AS numbers, which would permit transit traffic and defeat the purpose of being a non-transit AS.

Cip as-path access-list 1 permit ^45123$ neighbor bgp 45123 neighbor SP-Neighbors filter-list 1 out

`^45123$` would match routes whose AS path consists solely of AS 45123, which is typically for routes received inbound from a peer after it prepends its AS, not for identifying locally originated routes for outbound filtering.

Dip as-path access-list 1 permit ^$ neighbor bgp 45123 neighbor SP-Neighbors filter-list 1 outCorrect

When a router advertises a locally originated network to an eBGP peer, the AS-path attribute, from the perspective of the `as-path access-list` evaluating outbound routes, is considered empty (`^$`) before the local AS is prepended. By permitting only an empty AS path, the router ensures that only routes originated within its own AS (45123) are advertised to SP neighbors, effectively preventing it from being a transit AS for routes learned from other ASes.

Concept tested: BGP AS-path filtering, non-transit AS

Source: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/iproute_bgp/configuration/xe-3s/asr1000/bgp-xe-3s-book/bgp-cfg-aspath-acl.html

Topics

#BGP#AS-Path Filtering#Routing Policy#eBGP

Community Discussion

No community discussion yet for this question.

Full 300-410 Practice