Question 650
A customer VRF contains two prefixes that overlap with a provider loopback. Observed: Provider-wide BGP policy accidentally imports the provider loopback into a customer VRF. After the correction, which result would most convincingly show that this fault is resolved?
Explanation
Correct Answer
After tighten tenant VRF RT/prefix filters to reject infrastructure destinations, inspect whether customer route tables exclude core loopbacks while customer service remains intact. This closes the loop between the reported observation (Provider-wide BGP policy accidentally imports the provider loopback into a customer VRF) and the underlying issue (The import policy lacks explicit provider-infrastructure prefix exclusion).
Incorrect Answers
It confirms an unrelated service correction: The PE imported VPN routes using shared route targets instead of isolated tenant membership. The present case reports Provider-wide BGP policy accidentally imports the provider loopback into a customer VRF. Its completion test is Customer route tables exclude core loopbacks while customer service remains intact.
This result is useful in another case with evidence Customer multicast control signaling exists but payload delivery fails at a remote PE. It does not test recovery from provider-wide bgp policy accidentally imports the provider loopback into a customer vrf. Check instead whether customer route tables exclude core loopbacks while customer service remains intact.
That observation would verify a separate fault involving no authorized internet route leak or default path exists for the branch vrfs. Its symptom is Remote branches can reach each other but not the public Internet. For this case the actual issue is the import policy lacks explicit provider-infrastructure prefix exclusion, and the relevant success signal is Customer route tables exclude core loopbacks while customer service remains intact.