A transit authority wants only utility-SCADA prefixes that already carry a specific route tag to enter the global routing table when redistributing from a SCADA VRF IGP. Which approach enforces that conditional redistribution?

The transit authority’s requirement is conditional redistribution: only utility-SCADA prefixes that already carry a specific route tag may enter the global routing table. A redistribute route-map that matches that tag (and denies everything else) is the standard ENARSI control plane tool. The map is applied on the redistribute statement into the global IGP/BGP process so untagged or differently tagged SCADA routes never become global candidates, preserving isolation intent while allowing the approved tagged set through.

Lowering administrative distance of every SCADA route changes preference among routes that are already eligible for the RIB; it does not filter which prefixes are redistributed and therefore cannot enforce tag-based selection. Split horizon on SCADA interfaces limits advertising a route back out the interface it was learned on; it is not a tag-aware redistribute gate between VRF and global. BFD detects forwarding-path liveliness for registered clients; it does not inspect route tags or drop untagged prefixes at a redistribution boundary.

Exam caveat: matching may use tag, ACL, or prefix-list depending on how tags were set earlier (for example set tag on redistribution into the SCADA IGP). Ensure the route-map has an explicit deny for non-matches if platform behavior would otherwise permit unmarked traffic. Tagging without a matching redistribute map achieves nothing by itself.

Operational check: before and after, show the SCADA RIB with tags (protocol-specific topology/database shows), then confirm only tagged prefixes appear in the global table after redistribution. Use show route-map and the redistribute line under show ip protocols (or VRF-aware equivalents) to prove the policy is attached. Test a deliberately untagged prefix and verify it stays out of global.