A fleet garage needs a temporary construction-trailer subnet restricted on one Edge without rewriting the district-wide centralized policy. Which mechanism fits?
Select an answer to reveal the explanation.
Short Explanation
The trailer is a one-site headache, not a reason to rewrite the whole city’s playbook. Drop a localized ACL on that Edge, keep centralized policy intact, and remove the exception when the trailer leaves. Surgical beats nuclear.
Full Explanation
Localized access lists provide on-box exceptions at a specific Edge without rewriting fabric-wide centralized policy. For a fleet garage construction-trailer subnet, a localized ACL on that Edge restricts the temporary network while district centralized policy remains intact for every other site. That surgical pattern matches how civic operations handle short-lived attachments without destabilizing city-wide intent.
Deleting centralized data policy for every site to allow the trailer is disproportionate and risks district-wide security and steering gaps. Moving the trailer subnet into VPN 0 so ACLs “no longer apply” pollutes transport with user addressing and breaks the underlay-versus-service model. Disabling OMP so the Edge falls back to a static default abandons overlay routing for an ACL-sized, temporary problem.
Exam caveat: temporary or site-unique constraints map to localized policy; do not burn centralized intent for one trailer or similar one-off networks.
Operational check: deploy the localized ACL on the garage Edge only, validate trailer restriction and unchanged behavior at peer sites, schedule removal when the trailer leaves, leave centralized policy untouched, and record the exception in the change ticket.