350-501 · Question #607
Refer to the exhibit. The enterprise is running BGP between sites to provide connectivity to users across the company's geographic regions. A network engineer must update the configuration so that…
The correct answer is C. bgp bestpath prefix-validate allow-invalid. To enable the operations team to confirm the origin autonomous system of received BGP prefixes, RPKI Route Origin Validation must be configured, specifically using bgp bestpath prefix-validate allow-invalid to ensure validation occurs and invalid routes are still considered but…
Question
Refer to the exhibit. The enterprise is running BGP between sites to provide connectivity to users across the company's geographic regions. A network engineer must update the configuration so that the operations team can confirm that BGP prefixes that are received on each router originated from the correct autonomous system. Which configuration must the engineer apply?
Exhibit
Options
- Abgp bestpath prefix-validate disable
- Bbgp rpki server tcp 192.168.1.2 port 1029 refresh 500
- Cbgp bestpath prefix-validate allow-invalid
- Dbgp synchronization
How the community answered
(67 responses)- A10% (7)
- B3% (2)
- C84% (56)
- D3% (2)
Why each option
To enable the operations team to confirm the origin autonomous system of received BGP prefixes, RPKI Route Origin Validation must be configured, specifically using `bgp bestpath prefix-validate allow-invalid` to ensure validation occurs and invalid routes are still considered but marked.
The `bgp bestpath prefix-validate disable` command explicitly turns off RPKI prefix validation, which directly contradicts the requirement to confirm origin.
Configuring the RPKI cache server using `bgp rpki server` is a necessary prerequisite to obtain validation records, but it does not, by itself, enable the validation process during BGP best path selection to confirm prefix origin.
The `bgp bestpath prefix-validate allow-invalid` command enables RPKI Route Origin Validation (ROV), allowing the router to verify if received BGP prefixes are authorized to be originated by the advertised autonomous system. By setting `allow-invalid`, invalid routes are considered in the best path selection but their validation state is visible, thus enabling the operations team to confirm origin validity.
The `bgp synchronization` command is an outdated BGP feature related to IGP route synchronization and has no relevance to RPKI Route Origin Validation.
Concept tested: BGP RPKI Route Origin Validation
Source: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/iproute_bgp/configuration/xe-16/bgp-xe-16-book/bgp-rpki-rov.html
Topics
Community Discussion
No community discussion yet for this question.
