350-401 Question 350
Single answerA network engineer has configured a route map to filter prefixes being redistributed from OSPF into BGP. Despite the configuration, unintended prefixes are still being advertised into BGP. The engineer reviews the configuration:
route-map FILTER-REDISTRIBUTE deny 10 match ip address prefix-list BLOCKED-PREFIXES ! route-map FILTER-REDISTRIBUTE permit 20 ! redistribute ospf 1 route-map FILTER-REDISTRIBUTE
What could be the issue causing the unintended prefixes to still be advertised?
- A
The BLOCKED-PREFIXES prefix list is empty.
- B
The 'permit 20' statement in the route map allows all prefixes not matched by the deny statement.
- C
The 'redistribute ospf 1' command should reference an access list, not a route map.
- D
The route map should explicitly deny all prefixes at the end with an additional deny statement.
Show answer and explanation
Correct answer: B
Explanation
The issue lies in the logic of the route map. In a route map, any prefixes that do not match a deny statement are passed to the next sequence in the route map. In this case, the 'permit 20' statement allows all prefixes not explicitly denied by 'deny 10'. Since there are no additional constraints or filtering actions in the 'permit 20' statement, unintended prefixes are being advertised into BGP. This demonstrates the importance of carefully designing route map logic to ensure only the desired prefixes are permitted.
- A. Incorrect.
If the BLOCKED-PREFIXES prefix list were empty, the 'deny 10' statement would not match any prefixes, but this would not explain why unintended prefixes are being advertised. The permit statement in sequence 20 still allows all unmatched prefixes.
- B. Correct.
The 'permit 20' statement in the route map allows any prefixes not explicitly denied by sequence 10. Since there is no filtering logic or further constraints in this permit statement, all other prefixes are permitted, causing unintended prefixes to be advertised.
- C. Incorrect.
The 'redistribute ospf 1' command is correctly referencing a route map. There is no requirement to reference an access list in this context.
- D. Incorrect.
The route map does not require an explicit deny statement at the end because, by default, any prefixes not matched by the route map are implicitly denied. The issue lies with the logic in the permit statement, not the lack of an additional deny statement.