Question 620
A provider uses inter-AS VPN option A at a boundary. Observed: A customer subnet is absent on the far side while local sites exchange correctly. What operational check best guards against this problem returning?
Explanation
Correct Answer
This control asks for the same recovery evidence (The authorized VPN subnet is learned across the AS boundary without tenant mixing) and flags recurrence of the same failure (A customer subnet is absent on the far side while local sites exchange correctly). It targets the underlying issue, the inter-as per-vrf ebgp exchange is missing a route export or prefix permission, rather than a different service problem. The exact cadence must be agreed with operations.
Incorrect Answers
The proposed control is tied to the customer interface or routing family is associated with the wrong routing instance, typically observed when iPv6 routes leak into the global IPv6 table instead of the tenant's inet6 VRF. Here the target is the inter-as per-vrf ebgp exchange is missing a route export or prefix permission; monitor the authorized VPN subnet is learned across the AS boundary without tenant mixing.
It is valid for another service scenario but checks remote pe imports the route but forwarding fails on the core transit. This case instead needs a gate for a customer subnet is absent on the far side while local sites exchange correctly and evidence that the authorized VPN subnet is learned across the AS boundary without tenant mixing.
This gate monitors a different failure, an interprovider labeled packet cannot be forwarded through the upstream core. It would not detect the current problem: A customer subnet is absent on the far side while local sites exchange correctly. The appropriate check requires the authorized VPN subnet is learned across the AS boundary without tenant mixing.