A wastewater plant edge PE must offer civic Internet exit for one VRF’s users. Which design choice correctly frames Internet in a VRF versus the global routing table?
Select an answer to reveal the explanation.
Short Explanation
Internet-in-VRF versus global-table exit is a deliberate architecture fork: keep the default inside a services VRF, or leak carefully to/from global. Neither is magic — pick based on isolation, ops ownership, and how much Internet state you want in the VRF. P routers are not your Internet PE.
Full Explanation
Operators choose whether civic Internet for a wastewater edge PE lives inside a VRF (often a shared Internet or services VRF with RT import) or is reached via the global routing table with controlled route leaking between VRF and global. Each model carries different isolation, default-route scope, and operational ownership trade-offs; the correct framing is to decide deliberately between them.
Always placing Internet only on P routers because PE VRF tables “cannot” forward toward an Internet edge is false and misplaces the Internet edge. Requiring every VRF to import the full Internet table so PHP can remove VPN labels incorrectly ties PHP to Internet table size. Using identical RTs on all VRFs so Internet and private prefixes share one forwarding plane collapses separation.
Exam caveat: Internet-in-VRF versus global-table exit is an architecture fork—exams test recognition of the choice, not a single universal mandate.
Operational check: document which model the wastewater edge uses, leak or import only what policy allows, verify default exit and traceroute paths, and keep private VRF tables free of unintended Internet state. For civic operations, record the chosen control and the rejected alternatives in the change record so future on-call engineers understand which failure modes were avoided for citizen-facing services.