A small clinic has one router with only a private MPLS circuit and a neighboring warehouse router with MPLS plus internet. The clinic must use the warehouse internet for DIA without adding a circuit. Which TLOC-extension design lets the clinic borrow transport correctly?
Select an answer to reveal the explanation.
Short Explanation
One pipe can serve two routers. TLOC extension shares the neighbor's on-ramp until you get your own.
Full Explanation
The correct design works because TLOC-extension extends a transport bearer over a direct Layer-3 link in VPN 0, allowing a router without physical internet to instantiate an internet-colored TLOC via the neighbor underlay, which enables local DIA breakout while OMP and IPsec control connections continue over existing transports without adding a circuit. The service-VPN variant fails by concept because TLOCs and transport interfaces exist only in VPN 0, so placing the extension link in VPN 10 provides service-side reachability but cannot originate or extend transport colors or build the required IPsec tunnels for DIA. The extra-MPLS variant fails by concept because it extends the wrong color, giving the clinic another MPLS next hop it already possesses instead of the missing public internet bearer required for DIA, which improves resiliency but does not solve breakout. The reversed-direction variant fails by fact because it borrows in the wrong direction, expecting the warehouse to source internet through a clinic that has only private MPLS and therefore has no public transport to share, which prevents tunnel formation and NAT. Exam caveat: distinguish TLOC-extension in VPN 0 from service-side GRE forwarding or service NAT, which can steer packets but do not create local TLOCs on the borrowing router. Practical check: verify control local-properties and tunnel state show the borrowed internet TLOC up on the clinic, confirm the inter-router VPN 0 link addressing and peering, then test DIA from a clinic service VPN with traceroute and NAT counters.