Question

A network engineer has deployed VRF-lite on a Cisco IOS-XE router to separate GUEST and CORP traffic. Both VRFs must reach a shared DNS server located in a SHARED-SVCS VRF, but GUEST and CORP must remain isolated from each other. Using MP-BGP with route-target import/export on the router, which configuration approach correctly enables the shared services access while preserving isolation between GUEST and CORP?

Accepted Answer

Configure the SHARED-SVCS VRF to export its route-target and have both GUEST and CORP import it, while SHARED-SVCS imports the route-targets of both GUEST and CORP.

Answer

Configure GUEST and CORP to export the same route-target value so all three VRFs can exchange the DNS route.

Answer

Merge GUEST, CORP, and SHARED-SVCS into a single VRF and rely on ACLs to keep GUEST and CORP separated.

Answer

Configure GUEST to import CORP's route-target and CORP to import GUEST's route-target so both can reach the shared DNS server transitively.