352-001 · Question #252
You have been asked to establish a design that will allow your company to migrate from a WAN service to a Layer 3 VPN service. In your design, you are keeping some WAN links between critical sites…
The correct answer is D. Manually turn off the backdoor link when the Layer 3 service is up. When retaining backup WAN links during an MPLS L3 VPN migration, manually disabling those links while the VPN is active is the definitive way to prevent them from carrying transit traffic.
Question
You have been asked to establish a design that will allow your company to migrate from a WAN service to a Layer 3 VPN service. In your design, you are keeping some WAN links between critical sites as a backup for this service. You plan to use OSPF as your IGP and BGP for the PE- CE protocol. When the Layer 3 VPN service is available, how will you prevent transit traffic over the backup links?
Options
- ARedistribute routes at the CE as external type 1.
- BRedistribute routes at the CE as external type 2.
- CUse conditional advertisement only when the Layer 3 service is down.
- DManually turn off the backdoor link when the Layer 3 service is up.
How the community answered
(30 responses)- A17% (5)
- B3% (1)
- C10% (3)
- D70% (21)
Why each option
When retaining backup WAN links during an MPLS L3 VPN migration, manually disabling those links while the VPN is active is the definitive way to prevent them from carrying transit traffic.
Redistributing routes as OSPF external type 1 changes how the external metric accumulates across the domain but does not prevent the backdoor link from forming adjacencies or attracting transit traffic when both paths are simultaneously active.
Redistributing as OSPF external type 2 applies a flat external metric that does not grow with internal path cost, but this metric adjustment still does not block the physical backdoor link from being used for transit.
BGP conditional advertisement controls whether prefixes are sent to peers based on the presence of other routes - it affects route advertisement policy, not which physical path transit traffic uses when OSPF and BGP paths are both present.
Administratively shutting down the backdoor WAN links when the Layer 3 VPN service is active prevents OSPF adjacencies from forming over them and ensures no traffic path can use those links. While operationally manual, this approach unambiguously eliminates the possibility of transit traffic on backup links without relying on complex metric tuning that could behave unexpectedly during failover transitions.
Concept tested: Preventing backup link transit traffic during L3 VPN migration
Source: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/mp_l3_vpns/configuration/xe-16/mp-l3-vpns-xe-16-book/mp-bgp-mpls-vpn.html
Topics
Community Discussion
No community discussion yet for this question.