nerdexam
Cisco

352-001 · Question #23

An enterprise network manager has decided to dual-home two service providers for Internet connectivity. In order to provide optimal outbound routing, the full Internet routing table will be accepted f

The correct answer is C. Build a route filter that only allows networks with an empty AS path to be advertised to each of. An outbound BGP AS path filter matching only an empty AS path (regex ^$) permits the enterprise to advertise solely its own originated prefixes to each ISP, blocking transit of routes learned from the other provider.

Layer 3 Control Plane

Question

An enterprise network manager has decided to dual-home two service providers for Internet connectivity. In order to provide optimal outbound routing, the full Internet routing table will be accepted from each provider. The enterprise has obtained address space and an AS to use in connecting to the Internet. What is the simplest mechanism the network manager can use to prevent it from becoming a transit between the two service providers?

Options

  • ABuild a route filter that only allows the specific networks the enterprise owns to be advertised to
  • BBuild a traffic filter that only allows traffic originating from the specific networks the enterprise
  • CBuild a route filter that only allows networks with an empty AS path to be advertised to each of
  • DBuild a route filter that only allows networks which are tagged with the LOCAL community to be

How the community answered

(44 responses)
  • A
    16% (7)
  • B
    11% (5)
  • C
    68% (30)
  • D
    5% (2)

Why each option

An outbound BGP AS path filter matching only an empty AS path (regex `^$`) permits the enterprise to advertise solely its own originated prefixes to each ISP, blocking transit of routes learned from the other provider.

ABuild a route filter that only allows the specific networks the enterprise owns to be advertised to

Filtering by explicitly listed enterprise prefixes achieves the same result but requires updating a prefix list every time new address space is provisioned, which is operationally heavier than an AS path regex.

BBuild a traffic filter that only allows traffic originating from the specific networks the enterprise

A traffic ACL controls data-plane packet forwarding and has no effect on BGP route advertisement; it cannot stop the enterprise from re-advertising ISP routes to the other provider.

CBuild a route filter that only allows networks with an empty AS path to be advertised to each ofCorrect

Routes originated inside the enterprise carry an empty AS path, while routes received from either ISP contain those upstream AS numbers in the path attribute. Applying an outbound route filter that permits only empty AS paths to each provider automatically restricts advertisements to locally originated prefixes without requiring a manually maintained prefix list, making it the simplest and most scalable approach.

DBuild a route filter that only allows networks which are tagged with the LOCAL community to be

The NO_EXPORT (LOCAL) well-known community prevents routes from crossing AS boundaries when honored by peers, but relying on each ISP to honor it is not a reliable or self-controlled mechanism, and filtering inbound routes tagged with it does not address outbound advertisement of transit routes.

Concept tested: BGP AS path filter to prevent enterprise acting as transit AS

Source: https://www.cisco.com/c/en/us/support/docs/ip/border-gateway-protocol-bgp/13753-27.html

Topics

#BGP transit AS prevention#route filtering#AS path filtering#dual-homed ISP

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 352-001 Practice