Chapter 5 Routing policeis and firewall filters

Question 1

Import and export policies

Answer 1

Import are from external to internal
export are from internal to external

Question 2

Policies for link-state protocols

Answer 2

Import policies should not be used with link-state protocol as all the routers in a link-state area should have the same LSDB

Question 3

Policies configuration

Answer 3

Policies are configured separately and then applied to the desired protocol, more policies can be applied with an order on the same protocol

Question 4

Protocol with no matching policies

Answer 4

When a route is not matching any policy it will get the default behaviour, each dynamic routing protocol has its default behaviour (Like RIP discards the route) but it can also be configured by the admin

Question 5

Policy matching criteria

Answer 5

Route-filters (based on the prefix)
Protocol
Prefix-lists
Attributes (Area, community, preference, AS Path)

Question 6

Policy actions

Answer 6

Accept
Reject
Next-policy
Modify

Question 7

Default policy behaviours

Answer 7

Import | Export
BGP: accept all valid routes accept and advertise all
active routes
OSPF: accept all routes reject all routes
IS-IS: accept all routes reject all
RIP: Accept all valid RIP routes from reject all
configured neighbors

Question 8

Route filters match-types

Answer 8

exact -> exact sm and prefix
orlonger -> exact + subsubnets
longer -> just subsubnets
upto -> up to a certain sm
prefix-length-range -> from sm min to sm max

Question 9

Change the order of terms in policies

Answer 9

insert <term1> before <term2></term2></term1>

Question 10

Firewall filters

Answer 10

Equivalent to ACL are configured with multiple terms and then need to be applied to interfaces in input or output

Question 11

Firewall filters actions

Answer 11

Terminating:
- accept
- deny -> let the user know it’s been denied by a firewall
- discard
Flow-contorl
- next-term -> skip the term
Non terminating
- syslog/log → pass the info to the RE that stores it/keeps less detail
stored in the linecards memory
- count → counts the number of packet, you need to specify a
counter name
- policer → policying the traffic (control the mac packets that can go
through)
- forwarding-class → QoS
- loss-priority → QoS

Question 12

Firewall filters on RE

Answer 12

To apply a firewall filter on the RE it needs to be applied to the internal switch/interface fxp01