Pass the Cisco CCNP Service Provider 350-501 Questions and answers with CertsForce

The BGPsec framework is designed to secure the AS path information in BGP updates. It uses digital signatures to validate the AS path and prevent unauthorized route manipulation. Here are the key points related to BGPsec:

Securing AS Path:

BGPsec ensures the integrity of the AS path by allowing routers to sign BGP updates using their private keys.

When a router originates a BGP route, it signs the AS path information with its private key.

Other routers can verify the signature using the corresponding public key.

This prevents malicious AS path modifications and ensures the authenticity of the advertised route.

Private Keys and Router Key Pair:

BGPsec relies on cryptographic keys for signing and verifying BGP updates.

Each router has a router key pair consisting of a private key and a corresponding public key.

The private key is kept confidential and is used for signing route updates.

The public key is distributed to other routers for verification.

Expiration Time:

Unlike regular BGP updates, BGPsec does not assign an expiration time (TTL) to route advertisements.

The absence of an expiration time ensures that the signed AS path remains valid until explicitly withdrawn.

In summary, BGPsec enhances BGP security by securing the AS path using digital signatures and private keys. It does not rely on IPsec tunnels for security1.

References:

Cisco. (2021). Implementing and Operating Cisco Service Provider Network Core Technologies (SPCOR) v1.0. Cisco Learning Services.

Cisco. (2021). Implementing and Operating Cisco Service Provider Network Core Technologies (SPCOR) v1.1. Cisco Learning Network Store.

Cisco. (2021). BGPsec Overview. Link

The configuration creates a class map named WEB which is used to match HTTP traffic. This class map can then be referenced in a policy map to define specific actions for traffic that matches the criteria, such as applying QoS policies or traffic shaping.

References: This concept is covered in the Implementing and Operating Cisco Service Provider Network Core Technologies (SPCOR) course, where class maps and policy maps are discussed in the context of traffic classification and policy enforcement.

The correct command to authenticate the OSPF neighbor between PE-A and PE-B using MD5 is found in Option A. In this option, the command ip ospf message-digest-key 1 md5 44578611 is used to configure OSPF MD5 authentication on an interface with the key ID as 1 and key string as 44578611. The second command ip ospf authentication key-chain 44578611 is used to enable OSPF authentication on an interface and associate it with a specific key chain. References := Cisco - Implementing and Operating Cisco Service Provider Network Core Technologies