350-501 · Question #590
Refer to the exhibit. Routers R1 and R2 are connected over the internet, with the connection passing over four different autonomous systems. The company must mitigate potential DDoS attacks and…
The correct answer is C. Configure neighbor 182.12.91.5 ttl-security hops 4 under the BGP configuration. The engineer must configure BGP TTL security on R1 to protect against DDoS attacks by verifying the Time-to-Live (TTL) of incoming BGP packets, as specified by RFC 5082.
Question
Refer to the exhibit. Routers R1 and R2 are connected over the internet, with the connection passing over four different autonomous systems. The company must mitigate potential DDoS attacks and protect the CPUs of the routers. A network engineer must secure all external connections on edge router R1 based on RFC 5082. R2 has already been secured. Which task should the engineer perform on R1 to achieve the goal?
Exhibit
Options
- AConfigure ip neighbor 182.12.91.5 bgp multihop-ttl 4 under the global configuration.
- BConfigure ip neighbor 182.12.91.5 ttl 4 under the global configuration.
- CConfigure neighbor 182.12.91.5 ttl-security hops 4 under the BGP configuration.
- DConfigure neighbor 182.12.91.5 bgp-ttl 4 under the BGP configuration.
How the community answered
(32 responses)- A13% (4)
- B3% (1)
- C78% (25)
- D6% (2)
Why each option
The engineer must configure BGP TTL security on R1 to protect against DDoS attacks by verifying the Time-to-Live (TTL) of incoming BGP packets, as specified by RFC 5082.
The 'bgp multihop-ttl' command is used for enabling multi-hop eBGP, allowing sessions to establish over more than one hop, but it does not implement the RFC 5082 TTL security mechanism.
The 'ip neighbor ttl' command is not a valid BGP configuration command for implementing BGP TTL security.
The 'neighbor <ip> ttl-security hops <value>' command implements BGP TTL security, which drops BGP packets that arrive with a TTL value lower than 255 minus the configured number of hops, effectively preventing forged packets from reaching the router CPU. This mechanism, defined in RFC 5082, secures eBGP peering sessions against CPU-resource exhaustion attacks.
The 'bgp-ttl' command is not a valid BGP configuration command for implementing BGP TTL security.
Concept tested: BGP TTL Security (RFC 5082)
Source: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/iproute_bgp/configuration/xe-16-10/irg-xe-16-10-book/bgp-ttl-security.html
Topics
Community Discussion
No community discussion yet for this question.