352-001 · Question #473
Refer to the exhibit. Your company wants to sell its marketing research data to its strategic partners. All strategic partners currently have a Multipoint GRE VPN setup to your hub remote access route
The correct answer is C. Redistribute and tag only internal routes from the strategic partner's OSPF to your internal OSPF. Redistributing only the specific required routes between OSPF processes with route tagging ensures partners access only the data center application while preventing redistribution feedback loops.
Question
Refer to the exhibit. Your company wants to sell its marketing research data to its strategic partners. All strategic partners currently have a Multipoint GRE VPN setup to your hub remote access routers, and are running a separate OSPF process over the Multipoint GRE VPN with you. Your internal IGP is also OSPF, and the internal application used to access the marketing research data is located within your company's data center. Which solution ensures the strategic partners are provided with only the access they need, and that both organization's routing designs are not negatively affected?
Exhibit
Options
- ARedistribute and tag only internal routes from the strategic partner's OSPF to your internal OSPF
- BRedistribute and tag all routes from the strategic partner's OSPF to your internal OSPF and send
- CRedistribute and tag only internal routes from the strategic partner's OSPF to your internal OSPF
- DRedistribute and tag all routes from the strategic partner's OSPF to your internal OSPF and send
How the community answered
(54 responses)- A7% (4)
- B31% (17)
- C44% (24)
- D17% (9)
Why each option
Redistributing only the specific required routes between OSPF processes with route tagging ensures partners access only the data center application while preventing redistribution feedback loops.
Redistributing only internal routes without proper tagging and filtering creates redistribution feedback loops between the two OSPF processes because redistributed routes can cycle back into their source process, destabilizing routing.
Redistributing all routes from the strategic partner's OSPF process exposes unnecessary internal routing topology to the partners, violating the principle of providing only the access they require.
Redistributing only the internal data center application routes from the strategic partner OSPF process into the internal OSPF process limits partner access to exactly what is needed, satisfying the least-privilege access requirement. Applying route tags to redistributed routes allows the receiving OSPF process to identify and suppress re-advertisement of those routes back into the originating process, preventing feedback loops that would otherwise destabilize both organizations' routing domains.
Redistributing all routes into the internal OSPF and propagating all routes back to partners introduces excessive routing information and risks negatively affecting both organizations' routing designs by flooding unnecessary prefixes.
Concept tested: OSPF inter-process redistribution with route tagging
Source: https://www.cisco.com/c/en/us/support/docs/ip/open-shortest-path-first-ospf/18722-redistribution.html
Topics
Community Discussion
No community discussion yet for this question.
