A manufacturer uses MPLS private color and internet public color on all WAN Edges. Compliance forbids any tunnel that would bridge private MPLS to internet transport via the fabric, but each color must still mesh fully with the same color. Which restrict-attribute design on colors enforces this tunnel separation?

The restrict keyword on a tunnel interface limits the TLOC to forming tunnels only with TLOCs of the same color. Marking the MPLS color as restricted means MPLS TLOCs build BFD tunnels only to other MPLS TLOCs, so no private-to-internet tunnel can form while the internet color, which is unrestricted but has no matching restricted partner, still meshes with other internet TLOCs. Leaving both colors unrestricted and relying on a data policy fails because the cross-color tunnels would still exist; the compliance rule forbids the tunnels themselves, and a policy only filters traffic inside them. Restricting MPLS on hubs only fails because branch MPLS TLOCs stay unrestricted, so branches can still build MPLS-to-internet tunnels to each other and the separation is incomplete. Using distinct private colors per site while keeping restrict fails because a restricted TLOC pairs only with the identical color, so sites with different color names would never mesh and the same-color full-mesh requirement is lost. Restrict controls which TLOC pairs form tunnels; it is not about path preference or encryption. In practice, confirm with show sdwan bfd sessions that MPLS TLOCs show only MPLS remotes and internet TLOCs show only internet remotes.