Refer to the exhibit. An ISP provides shared VoIP Extranet services to a customer in VRF-100 with these settings:
✑ The VoIP services are hosted in the 198.19.100.0/24 space.
✑ The customer has been assigned the 198.18.1.0/29 IP address block.
✑ VRF-100 is assigned import and export route target 65010:100.
Which configuration must the engineer apply to PE-1 to provision VRF-100 and provide access to the shared services?
The correct configuration for provisioning VRF-100 and providing access to the shared services should include both import and export route targets as mentioned in the question. Option D specifically defines the required import and export route targets for VRF-100 and shared services: route-target export 65010:100, route-target export 65010:1999, route-target import 65010:100, and route-target import 65010:2999. This ensures that the routes are properly shared between the VRFs, allowing connectivity between the customer's prefixes and the shared VoIP extranet services.
[Option D] export and import opposite to PE3 vrf definition VRF-100 rd 172.17.255.1:100 ! address-family ipv4 route-target export 65010:100 route-target export 65010:1999 route-target import 65010:100 route-target import 65010:2999 exit-address-family
B also seems to be OK, vrf definition VRF-100 rd 172.17.255.1:100 address-family ipv4 export map VRF-100-EXPORT route-target import 65010:100 route-target import 65010:2999 exit-address-family route-map VRF-100-EXPORT permit 10 match ip address prefix-list VRF-100-ALLOWED-EXPORT set extcommunity rt 65010:100 65010:1999 route-map RF-100-EXPORT permit 20 set extcommunity rt 65010:100 ip prefix-list VRF-100-ALLOWED-EXPORT seq 5 permit 198.18.1.0/29 and it adds the shared community only on the 198.18.1.0/29 prefix:
B and D both will provide access but D will also provide access to other customer prefixes which are not in int the prefix range which are provided to the customer
And I would like to point out that the prefix list in Answer B: doesnt account for longer prefixes. ip prefix-list VRF-100-ALLOWED-EXPORT seq 5 permit 198.18.1.0/29 What if the customer published 198.18.1.4/30 into BGP? 198.18.1.1/32?. The prefix would not match and would NOT export RT 65010:1999 The prefix list is missing "ge 29" attribute to permit longer matches. ip prefix-list VRF-100-ALLOWED-EXPORT seq 5 permit 198.18.1.0/29 ge 29 for that reason I vote D and not B
import/export map does not work without route-target import/export. It just refines what gets imported from route-target. https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/mpls/command/mp-cr-book/mp-e1.html#wp2441555563 The import map command associates a route map with the specified VRF. You can use a route map to filter routes that are eligible for import into a VRF, based on the route target extended community attributes of the route. The route map might deny access to selected routes from a community that is on the import list. The import map command does not replace the need for a route-target import in the VRF configuration. You use the import map command to further filter prefixes that match a route-target import statement in that VRF.
While everything you said is correct, answer B doesn't use an import map. Your link shows that export map CAN be used by itself, so B still works.
I noticed that the import map in B does not account for longer prefixes. It should have had the ge 29 keyword like so: ip prefix-list VRF-100-ALLOWED-EXPORT seq 5 permit 198.18.1.0/29 ge 29. for that reason, I upvote D
Only the import-map does not work without route-target import
D. Acho que está correto.
B. vrf definition VRF-100 rd 172.17.255.1:100 ! address-family ipv4 export map VRF-100-EXPORT route-target import 65010:100 route-target import 65010:2999 exit-address-family ! route-map VRF-100-EXPORT permit 10 match ip address prefix-list VRF-100-ALLOWED-EXPORT set extcommunity rt 65010:100 65010:1999 route-map VRF-100-EXPORT permit 20 set extcommunity rt 65010:100 ! ip prefix-list VRF-100-ALLOWED-EXPORT seq 5 permit 198.18.1.0/29
D is CORRECT ccie_race explains it well, we need export and import opposite to PE3. Also question tells us: "VRF-100 is assigned import and export route target 65010:100." which is only configured on D
We have provide access to the shared services from the VRF100, not saying anything about specific access from 198.18.1.0/29, so should be D, not B.
Both B and D work. B is more complete, as it specifics the host network trying to reach shared services, as such... i will go with B.
Although it doesn't ask us explicitly to only send the 198.18.1.0/29 route to the VoIP Shared Services VRF, it makes sense to do it which we see in B. I have changed my choice to B from D. D will make the connectivity work but will also add other routes into the Shared Services VRF which would not be advised.
C. vrf definition VRF-100 rd 172.17.255.1:100 ! address-family ipv4 export map VRF-100-EXPORT route-target import 65010:100 route-target import 65010:1999 exit address-family ! route-map VRF-100-EXPORT permit 10 match ip address prefix-list VRF-100-ALLOWED-EXPORT set extcommunity rt 65010:100 65010:2999 route-map VRF-100-EXPORT permit 20 set extcommunity r 65010:100 ! ip prefix-list VRF-100-ALLOWED-EXPORT seq 5 permit 198.18.1.0/29 D. vrf definition VRF-100 rd 172.17.255.1:100 ! address-family ipv4 route-target export 65010:100 route-target export 65010:1999 route-target import 65010:100 route-target import 65010:2999 exit-address-family
A. vrf definition VRF-100 rd 172.17.255.1:100 ! address-family ipv4 export map VRF-100-EXPORT import map VRF-100-IMPORT exit-address-family ! route-map VRF-100-EXPORT permit 10 match ip address prefix-list VRF-100-ALLOWED-EXPORT set extcommunity rt 65010:100 65010:2999 route-map VRF-100-EXPORT permit 20 set extcommunity rt 65010:100 ! route-map VRF-100-IMPORT permit 10 match extcommunity VRF-100-RT SHARED-SERVICES ! ip extcommunity-list standard SHARED-SERVICES permit rt 65010:1999 ip extcommunity-list standard VRF-100-RT permit rt 65010:100 ip prefix-list VRF-100-ALLOWED-EXPORT seq 5 permit 198.18.1.0/29
I am stuck here: B - is correct according to the Export Maps configuration and just for 198.18.1.0/29. D - is correct according to the rt export and import policy. Any opinion ? :)
B is more accurate and takes into account the mentioned subnet 198.18.1.0/29