Refer to the exhibit. Transit traffic in this large enterprise campus network passes the eBGP core. Per security policy, traffic coming from AS 65444 destined for AS 65466 and vice-versa must pass…

Question

Exhibit

Options

• AApply an ACL on AS 65466 to drop the direct traffic between AS 65444 and AS 65466
• BApply AS-path prepending on AS 65466 and AS 65444
• CApply next-hop self on both BGP neighbors on AS 65400
• DApply the MED attribute on the BGP session for AS 65444

• A
  11% (4)
• B
  8% (3)
• C
  79% (30)
• D
  3% (1)

Explanation

Option C is correct because in a broadcast (multi-access) network, when AS 65400 advertises routes learned from AS 65466 to AS 65444, the BGP next-hop attribute still points directly to AS 65466's IP address (all routers share the same subnet). This allows AS 65444 to bypass AS 65400 entirely. Applying next-hop-self on AS 65400 forces it to rewrite the next-hop to its own IP before advertising to each neighbor, ensuring all transit traffic physically flows through AS 65400.

Why the distractors fail:

• A (ACL): Drops traffic entirely rather than rerouting it - this breaks connectivity, not fixes it.
• B (AS-path prepending): Makes a path appear longer/less preferred, but on a broadcast network the direct path still has the correct reachable next-hop, so prepending alone won't force traffic through AS 65400.
• D (MED): MED influences inbound path selection into your own AS from a directly connected neighbor - it has no effect on next-hop reachability across a shared broadcast segment.

Memory tip: Think "next-hop-self = traffic through ME." Whenever a transit AS sits on a shared broadcast segment and needs to stay in the forwarding path, next-hop-self is the mechanism - it replaces the originator's IP with the transit AS's own IP, making itself the mandatory waypoint.

No community discussion yet for this question.