nerdexam
Cisco

352-001 · Question #252

You have been asked to establish a design that will allow your company to migrate from a WAN service to a Layer 3 VPN service. In your design, you are keeping some WAN links between critical sites…

The correct answer is D. Manually turn off the backdoor link when the Layer 3 service is up. When retaining backup WAN links during an MPLS L3 VPN migration, manually disabling those links while the VPN is active is the definitive way to prevent them from carrying transit traffic.

Designing Network Infrastructure

Question

You have been asked to establish a design that will allow your company to migrate from a WAN service to a Layer 3 VPN service. In your design, you are keeping some WAN links between critical sites as a backup for this service. You plan to use OSPF as your IGP and BGP for the PE- CE protocol. When the Layer 3 VPN service is available, how will you prevent transit traffic over the backup links?

Options

  • ARedistribute routes at the CE as external type 1.
  • BRedistribute routes at the CE as external type 2.
  • CUse conditional advertisement only when the Layer 3 service is down.
  • DManually turn off the backdoor link when the Layer 3 service is up.

How the community answered

(30 responses)
  • A
    17% (5)
  • B
    3% (1)
  • C
    10% (3)
  • D
    70% (21)

Why each option

When retaining backup WAN links during an MPLS L3 VPN migration, manually disabling those links while the VPN is active is the definitive way to prevent them from carrying transit traffic.

ARedistribute routes at the CE as external type 1.

Redistributing routes as OSPF external type 1 changes how the external metric accumulates across the domain but does not prevent the backdoor link from forming adjacencies or attracting transit traffic when both paths are simultaneously active.

BRedistribute routes at the CE as external type 2.

Redistributing as OSPF external type 2 applies a flat external metric that does not grow with internal path cost, but this metric adjustment still does not block the physical backdoor link from being used for transit.

CUse conditional advertisement only when the Layer 3 service is down.

BGP conditional advertisement controls whether prefixes are sent to peers based on the presence of other routes - it affects route advertisement policy, not which physical path transit traffic uses when OSPF and BGP paths are both present.

DManually turn off the backdoor link when the Layer 3 service is up.Correct

Administratively shutting down the backdoor WAN links when the Layer 3 VPN service is active prevents OSPF adjacencies from forming over them and ensures no traffic path can use those links. While operationally manual, this approach unambiguously eliminates the possibility of transit traffic on backup links without relying on complex metric tuning that could behave unexpectedly during failover transitions.

Concept tested: Preventing backup link transit traffic during L3 VPN migration

Source: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/mp_l3_vpns/configuration/xe-16/mp-l3-vpns-xe-16-book/mp-bgp-mpls-vpn.html

Topics

#MPLS L3 VPN#BGP PE-CE#WAN migration#backdoor link prevention

Community Discussion

No community discussion yet for this question.

Full 352-001 Practice