A request arrived on your MPLS-vpn-bgp group. Due to a security breach, your customer is experiencing DoS attacks coming from specific subnets (200.0.10.0/24, 200.0.12.0/24). You have checked all…

Question

Options

• AIt blocks all routes.
• BIt blocks the routes 200.0.12.0/24, 200.0.10.0/24 only.
• CIt blocks the routes 200.0.12.0/24, 200.0.13.0/24 only.
• DIt blocks the routes 200.0.10.0/24, 200.0.13.0/24 only.
• ENothing happens, no routes are blocked.

• A
  4% (1)
• B
  63% (17)
• C
  11% (3)
• D
  4% (1)
• E
  19% (5)

Explanation

Remember, for the wild card mask, 1s are I DON'T CARE, and 0s are I CARE. In the access-list we put an 0.0.0.0 255.255.254.255 network; of course 255 means "1111 1111. This means we don't care about any of the bits in the first, second & 4th octets. In fact, the number 0 (in 0.0.0.0) is just smallest numbers we can throw there and it is easy to type but we can use any number, it wouldn't matter, since I DON'T CARE about them except the third octet as the wild card mask is Now let's extract the 0 in the third octet in binary form (so easy, right?) 0 = 0000 0000 With the 254 in the wildcard mask, we only care about the last bit of the third octet because 254 is That means, if the third octet is in the form of xxxx xxx0 then it will match my access-list (x can be 0 or 1 because I DON'T CARE). Now let's write the third octet of 4 above subnets in binary form: So, only 10 & 12 satisfy my access list -> I will only block the routes to 200.0.12.0/24, 200.0.10.0/24 - > B is correct. Here is a simple configuration example explaining the question above. Connect to Routers R1 and BHK via FastEthernet 0/0 interface Loopback0 ip address 200.0.10.1 255.255.255.0 interface Loopback1 ip address 200.0.11.1 255.255.255.0 interface Loopback2 ip address 200.0.12.1 255.255.255.0 interface Loopback3 ip address 200.0.13.1 255.255.255.0 interface FastEthernet0/0 ip address 10.0.1.2 255.255.255.252 router bgp 65500 no synchronization bgp log-neighbor-changes network 10.0.1.0 mask 255.255.255.252 network 200.0.10.0 network 200.0.11.0 network 200.0.12.0 network 200.0.13.0 neighbor 10.0.1.1 remote-as 65525 router bgp 65525 no synchronization bgp log-neighbor-changes network 10.0.1.0 mask 255.255.255.252 neighbor 10.0.1.2 remote-as 65500 neighbor 10.0.1.2 route-map 1 in distribute-list list in access-list 1 deny 0.0.0.0 255.255.254.255 access-list 1 permit any Note: You may need to clear the BGP process on Router BHK after applying the route-map

No community discussion yet for this question.