300-420 Question 24
Select 3An enterprise network requires a stable and secure BGP routing design to connect its on-premises data center to multiple cloud providers. The network must handle route flapping, prevent unauthorized route advertisements, and scale as new cloud regions are added. Which of the following design choices should be implemented to meet these requirements?
- A
Implement BGP route dampening to mitigate the effects of route flapping.
- B
Use prefix filtering to limit the routes advertised and received from BGP peers.
- C
Configure BGP communities to tag and group routes for easier policy enforcement.
- D
Disable BGP authentication to simplify connections with cloud providers.
- E
Enable route reflectors in the on-premises network to reduce the number of BGP sessions.
Show answer and explanation
Correct answers: A, B, C
Explanation
To create a stable, secure, and scalable BGP routing design, route dampening addresses route flapping, prefix filtering prevents unauthorized route exchanges, and BGP communities provide a scalable mechanism for policy enforcement. Disabling BGP authentication is insecure and not recommended, and while route reflectors are helpful in iBGP designs, they are not directly relevant to the challenges described in the scenario.
- A. Correct.
Implementing BGP route dampening helps stabilize the network by suppressing routes that frequently flap, which reduces unnecessary updates and improves stability.
- B. Correct.
Using prefix filtering ensures that only authorized routes are advertised and received, enhancing the security and control of the BGP environment.
- C. Correct.
Configuring BGP communities allows for grouping and tagging of routes, which simplifies routing policy enforcement and scaling as new cloud regions are added.
- D. Incorrect.
Disabling BGP authentication reduces security by making the network vulnerable to unauthorized BGP sessions, which is not a best practice in secure BGP design.
- E. Incorrect.
Route reflectors are used to optimize iBGP designs within an autonomous system, but they do not directly address the requirements for route flapping, unauthorized routes, or scalability across multiple cloud providers.