2V0-41.24 Question 149
Select 2An organization is using NSX-T Data Center to segment its network traffic and has decided to implement VRF Lite for tenant isolation. During the configuration, the administrator creates two VRFs: VRF-A for Tenant A and VRF-B for Tenant B. Both tenants need to access shared network services located in a common subnet outside the VRFs. What must the administrator configure to ensure proper routing between the VRFs and the shared services network?
- A
Configure a centralized Tier-0 Gateway with separate routing instances for VRF-A and VRF-B.
- B
Enable route leaking between VRF-A and VRF-B, and between each VRF and the shared services subnet.
- C
Implement static routes in each VRF to point to the shared services network.
- D
Use a distributed firewall rule to allow traffic between VRF-A, VRF-B, and the shared services subnet.
- E
Advertise the shared services subnet through BGP to both VRF-A and VRF-B.
Show answer and explanation
Correct answers: B, C
Explanation
To ensure communication between VRFs and the shared services subnet, the administrator must configure route leaking and/or static routes. VRF Lite isolates routing domains, so explicit configurations are required to share routes between VRFs or to external networks. Route leaking allows selective route sharing, while static routes provide direct traffic forwarding. Other options, such as using a centralized Tier-0 Gateway or BGP advertisement, do not directly address the requirement for inter-VRF and external connectivity.
- A. Incorrect.
This option is incorrect because while a centralized Tier-0 Gateway can provide routing for VRFs, it does not inherently enable communication between VRFs or external subnets.
- B. Correct.
This option is correct because route leaking allows selective sharing of routes between VRFs and other networks, enabling communication between VRFs and the shared services subnet.
- C. Correct.
This option is correct because static routes can be used within each VRF to direct traffic to the shared services network, ensuring connectivity.
- D. Incorrect.
This option is incorrect because distributed firewall rules control traffic flow but do not handle routing between VRFs or external subnets.
- E. Incorrect.
This option is incorrect because simply advertising the shared services subnet through BGP does not establish connectivity between VRFs and the subnet without proper route configuration.