352-001 · Question #379
Refer to the exhibit. Service Provider A has offered to help Service Provider B to provide local connectivity for a customer who has a business operation in North America and recently opened an office
The correct answer is C. back-to-back VRF. Back-to-back VRF (Inter-AS Option A) is the simplest and most secure way for two previously unconnected service providers to offer inter-AS MPLS VPN service. It requires no VPNv4 or label exchange between providers, minimizing trust requirements.
Question
Refer to the exhibit. Service Provider A has offered to help Service Provider B to provide local connectivity for a customer who has a business operation in North America and recently opened an office in Asia. The service to be offered for the customer is a Layer 3 MPLS VPN. Service Provider A and Service Provider B have never shared any business dealings or interconnected their networks. What is the most secure and easiest way for the two service providers to interconnect?
Exhibit
Options
- Acarrier supporting carrier
- BeBGP VPNv4 multihop between route reflectors
- Cback-to-back VRF
- DVPNv4 peering between ASBRs
How the community answered
(18 responses)- A11% (2)
- B6% (1)
- C61% (11)
- D22% (4)
Why each option
Back-to-back VRF (Inter-AS Option A) is the simplest and most secure way for two previously unconnected service providers to offer inter-AS MPLS VPN service. It requires no VPNv4 or label exchange between providers, minimizing trust requirements.
Carrier Supporting Carrier is used when a customer carrier runs its own MPLS network over the service provider backbone, which does not apply to two peer SPs jointly delivering a shared L3VPN service.
eBGP VPNv4 multihop between route reflectors (Inter-AS Option C) requires the exchange of labeled VPNv4 routes between distant RRs and demands a high degree of trust and complex configuration that is inappropriate when the two SPs have no prior relationship.
Back-to-back VRF (Inter-AS Option A) connects the two providers by placing the customer VPN in a dedicated VRF on each ASBR and interconnecting those VRFs via a routed interface with route redistribution. No MPLS labels or VPNv4 routes are exchanged across the SP boundary, which maximizes security by limiting the routing information each provider must expose to the other. Because the interconnect appears as a standard routed link, no pre-existing BGP VPNv4 trust relationship or shared label space is required.
VPNv4 peering between ASBRs (Inter-AS Option B) requires the ASBRs to maintain and redistribute all VPNv4 routes from the peer AS, exposing full customer routing information across the inter-AS link and increasing both complexity and security risk.
Concept tested: Inter-AS MPLS VPN Option A back-to-back VRF
Source: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/mp_l3_vpns/configuration/xe-16/mp-l3-vpns-xe-16-book/mp-interAS-mpls-vpn.html
Topics
Community Discussion
No community discussion yet for this question.
