Exam 350-501 topic 1 question 272 discussion

[Option D] export and import opposite to PE3 vrf definition VRF-100 rd 172.17.255.1:100 ! address-family ipv4 route-target export 65010:100 route-target export 65010:1999 route-target import 65010:100 route-target import 65010:2999 exit-address-family

B also seems to be OK, vrf definition VRF-100 rd 172.17.255.1:100 address-family ipv4 export map VRF-100-EXPORT route-target import 65010:100 route-target import 65010:2999 exit-address-family route-map VRF-100-EXPORT permit 10 match ip address prefix-list VRF-100-ALLOWED-EXPORT set extcommunity rt 65010:100 65010:1999 route-map RF-100-EXPORT permit 20 set extcommunity rt 65010:100 ip prefix-list VRF-100-ALLOWED-EXPORT seq 5 permit 198.18.1.0/29 and it adds the shared community only on the 198.18.1.0/29 prefix:

D is the most appropriate answer to address this need.

We have provide access to the shared services from the VRF100, not saying anything about specific access from 198.18.1.0/29, so should be D, not B.

D. Acho que está correto.

Both B and D work. B is more complete, as it specifics the host network trying to reach shared services, as such... i will go with B.

import/export map does not work without route-target import/export. It just refines what gets imported from route-target. https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/mpls/command/mp-cr-book/mp-e1.html#wp2441555563 The import map command associates a route map with the specified VRF. You can use a route map to filter routes that are eligible for import into a VRF, based on the route target extended community attributes of the route. The route map might deny access to selected routes from a community that is on the import list. The import map command does not replace the need for a route-target import in the VRF configuration. You use the import map command to further filter prefixes that match a route-target import statement in that VRF.

Although it doesn't ask us explicitly to only send the 198.18.1.0/29 route to the VoIP Shared Services VRF, it makes sense to do it which we see in B. I have changed my choice to B from D. D will make the connectivity work but will also add other routes into the Shared Services VRF which would not be advised.

C. vrf definition VRF-100 rd 172.17.255.1:100 ! address-family ipv4 export map VRF-100-EXPORT route-target import 65010:100 route-target import 65010:1999 exit address-family ! route-map VRF-100-EXPORT permit 10 match ip address prefix-list VRF-100-ALLOWED-EXPORT set extcommunity rt 65010:100 65010:2999 route-map VRF-100-EXPORT permit 20 set extcommunity r 65010:100 ! ip prefix-list VRF-100-ALLOWED-EXPORT seq 5 permit 198.18.1.0/29 D. vrf definition VRF-100 rd 172.17.255.1:100 ! address-family ipv4 route-target export 65010:100 route-target export 65010:1999 route-target import 65010:100 route-target import 65010:2999 exit-address-family

B. vrf definition VRF-100 rd 172.17.255.1:100 ! address-family ipv4 export map VRF-100-EXPORT route-target import 65010:100 route-target import 65010:2999 exit-address-family ! route-map VRF-100-EXPORT permit 10 match ip address prefix-list VRF-100-ALLOWED-EXPORT set extcommunity rt 65010:100 65010:1999 route-map VRF-100-EXPORT permit 20 set extcommunity rt 65010:100 ! ip prefix-list VRF-100-ALLOWED-EXPORT seq 5 permit 198.18.1.0/29

A. vrf definition VRF-100 rd 172.17.255.1:100 ! address-family ipv4 export map VRF-100-EXPORT import map VRF-100-IMPORT exit-address-family ! route-map VRF-100-EXPORT permit 10 match ip address prefix-list VRF-100-ALLOWED-EXPORT set extcommunity rt 65010:100 65010:2999 route-map VRF-100-EXPORT permit 20 set extcommunity rt 65010:100 ! route-map VRF-100-IMPORT permit 10 match extcommunity VRF-100-RT SHARED-SERVICES ! ip extcommunity-list standard SHARED-SERVICES permit rt 65010:1999 ip extcommunity-list standard VRF-100-RT permit rt 65010:100 ip prefix-list VRF-100-ALLOWED-EXPORT seq 5 permit 198.18.1.0/29

I am stuck here: B - is correct according to the Export Maps configuration and just for 198.18.1.0/29. D - is correct according to the rt export and import policy. Any opinion ? :)

B is more accurate and takes into account the mentioned subnet 198.18.1.0/29

D is CORRECT ccie_race explains it well, we need export and import opposite to PE3. Also question tells us: "VRF-100 is assigned import and export route target 65010:100." which is only configured on D

B and D both will provide access but D will also provide access to other customer prefixes which are not in int the prefix range which are provided to the customer