Exam 350-501 topic 1 question 30 discussion

C: (bgp.1) is displayed in the clients that receive policies from bgp flowspec https://www.cisco.com/c/en/us/support/docs/ip/border-gateway-protocol-bgp/215637-configure-bgp-ipv6-flowspec.html

The difference between learned via BGP and locally configured https://www.noction.com/blog/ddos-mitigation

Is append with flowspec and destination is configured, not for all traffic

A is the best answer. The policy is locally configured on the router and drops all traffic either destined to 10.6.5.0/24 network or HTTP and HTTPS traffic.

The bgp in the Actions row indicates that this flow is received via BGP, so this rules out answers A and B. D cannot be correct because the counters displayed on the output are not a "rate" but rather a total of previously matched traffic, so we cannot know if there is traffic currently on the interface that is matching this flow. C is correct because the rule is received via BGP and the action to be taken is to set a traffic rate of 0, meaning drop the traffic.

I cannot get past the word "all traffic" -> in a Network Engineer's language, when you say ALL Traffic for TCP Port 80 -> it means '''''''''Destination-IP = ANY "AND" TCP-Port = 80'''''''''' -> which is obviously not true because the policy has a specific Destination-IP written. Therefore, my vote goes for D which is also correct saying that it's learnt via BGP and has Active Traffic on it (as evidenced by the Matched/Dropped Packet count).

For a locally configured we see: RP/0/0/CPU0:P1#show flowspec ipv4 detail Fri Jul 12 02:05:45.266 UTC AFI: IPv4 Flow :Dest:88.88.88.88/32 Actions :Traffic-rate: 0 bps (policy.1.FLOWSPEC-PMAP.FLOWSPEC) For a BGP learnt wee see: PE1#show flowspec ipv4 detail AFI: IPv4 Flow :Dest:88.88.88.88/32 Actions :Traffic-rate: 0 bps (bgp.1) Statistics (packets/bytes) Matched : 0/0 Dropped : 0/0 Hence, answer is D. We are not dropping ALL traffic, only traffic for ports 80/443 to addresses 10.6.5.0/24

https://www.noction.com/blog/ddos-mitigation

Answer: A

"A" sound right according to this article: https://www.noction.com/blog/ddos-mitigation. nolbi published it on this thread before.

Option C is right. Cause it does not say it drops "ALL THE TRAFFIC", it says "it drops all the traffic "FOR" port TCP and UDP". Remember HTTP and HTTPS are TCP. Packets matched and dropped is just a counter, not necessarily means there is current active traffic passing by. So D is not right.

I think this is a trick question where you don't pick the apparent obvious answer, it needs more checking. The output shows what was learned from the BGP flowspec policy and in there it tells us what is configured in the policy to match, what actions and the match/drops for any active traffic: Policy is configured for: Dest:10.6.5.0/24 Destination ports 80 and 443 Actions: traffic-rate: 0 bps So traffic matching the above will be dropped We see there is active traffic from Matched 12 and Dropped 12 packets But the policy is NOT configured to drop ALL traffic (ie to any destination) for TCP ports 80 and 443, only traffic for destination 10.6.5.0/24 and ports 80 and 443. It would include TCP and UDP as the protocol has not been configured for specific protocol 6 (TCP) or 17 (UDP) C is not correct for what we see configured. I still think D is correct because indeed this policy is learned via BGP Flowsec and does have active traffic on it as shows by the Matched and Dropped counters. https://www.ciscolive.com/c/dam/r/ciscolive/emea/docs/2019/pdf/BRKSPG-3012.pdf

Match:12 Drop:12 The policy is learned via BGP --> "Actions:(bgp.1) FlowSpec and drops all traffic for TCP ports 80 and 443

Match:12 Drop:12 The policy is learned via BGP --> "Actions:(bgp.1) FlowSpec and drops all traffic for TCP ports 80 and 443

I go for D Why? Policy is learned via BGP Flowspec It has active traffic shown by the matches and drops The configuration does NOT drop ALL TCP ports 80 and 443 from what we see. It is only port 80 and 443 for destination 10.6.5.0/24, protocol number is missing for TCP/UDP. Anybody agree or disagree?

The correct answer is C. If it was locally configured, it would list the name of the policy-map tied to it. Showing (bgp.1) means that's configured on another node , and this one is the client. (just replicated this in GNS3)

I'd vote for D https://www.ciscolive.com/c/dam/r/ciscolive/emea/docs/2019/pdf/BRKSPG-3012.pdf page 93 has a config demo