An administrator must prevent a new VPC from exporting any of its prefixes to the datacenter while still receiving a default route. Where should the routing policy be applied?

Question

Options

• AOn the VPC default route advertiser
• BOn the VPC's Transit Gateway
• COn the providers' BGP peer template
• DOn the VPC Gateway Firewall

• A
  3% (1)
• B
  79% (27)
• C
  12% (4)
• D
  6% (2)

Explanation

In the advanced networking architecture of VMware Cloud Foundation (VCF) 9.0 and the evolution of NSX VPCs, the control of route propagation is managed through the relationship between the consumer (the VPC) and the provider (the Tier-0 or Tier-1 Gateway). When a VPC is created, it is logically connected to the provider's infrastructure via a Transit Gateway (or a Provider-side logical router acting as a transit point). To control the flow of routing information--specifically to prevent the data center's physical network from learning about internal VPC subnets (prefixes) while ensuring the VPC can still reach the outside world via a default route--the routing policy must be applied at the point of intersection. The Transit Gateway serves as this demarcation point. By applying a route filter or prefix list on the Transit Gateway, the administrator can explicitly deny the advertisement of internal VPC prefixes "upstream" to the provider's BGP process. Simultaneously, the provider can still inject or "advertise" a default route ($0.0.0.0/0$) "downstream" into the VPC. Applying the policy on the VPC Gateway Firewall (Option D) would impact the data plane (blocking traffic) but would not prevent the routing table from being populated. The BGP peer template (Option C) is too broad, as it would likely affect all VPCs connected to that provider, rather than just the "new VPC" in question. The default route advertiser (Option A) only controls the egress of the default route, not the suppression of internal prefixes. Therefore, the Transit Gateway is the verified location for granular route control in a multi-tenant VCF VPC environment.

No community discussion yet for this question.