300-440 Question 190
Single answerA network engineer has configured a BGP dynamic neighbor feature on a router. The engineer notices that the router is establishing BGP sessions dynamically but is concerned about potential unauthorized neighbors forming connections. Which configuration should the engineer implement to restrict dynamic neighbors to only authorized peers?
- A
Use a BGP listen range to define an IP address range for dynamic neighbors.
- B
Configure an access list and apply it to the BGP dynamic neighbor session.
- C
Enable BGP authentication using MD5 for all dynamic neighbor sessions.
- D
Use the 'neighbor
remote-as ' command to statically define neighbors.
Show answer and explanation
Correct answer: A
Explanation
The BGP dynamic neighbor feature allows a router to establish BGP sessions with neighbors dynamically without predefining every peer. To restrict potential unauthorized neighbors, the 'bgp listen range' configuration is used to define a specific range of IP addresses for allowed dynamic neighbors. This ensures security while preserving the flexibility of the dynamic neighbor feature.
- A. Correct.
Using a BGP listen range allows you to restrict dynamic neighbors to a specific IP address range, ensuring that only authorized peers within the defined range can form BGP sessions. This is the best practice for securing dynamic neighbor configurations.
- B. Incorrect.
While an access list can be used to filter traffic, it is not directly tied to BGP dynamic neighbor configuration and does not inherently restrict unauthorized BGP neighbor formation.
- C. Incorrect.
Enabling MD5 authentication secures the BGP session itself but does not restrict the dynamic neighbor formation based on IP addresses. Unauthorized peers with the correct password could still connect.
- D. Incorrect.
Using the 'neighbor
remote-as ' command statically defines BGP neighbors. This bypasses the dynamic neighbor feature entirely and does not align with the dynamic neighbor functionality.