A retail chain has 60 stores and two hubs, each with an MPLS interface using color mpls and a broadband interface using color biz-internet. Compliance requires that MPLS TLOCs never form data-plane tunnels to any other color, while broadband TLOCs may tunnel to any color they can reach. Which configuration meets this requirement with no additional policy?
Select an answer to reveal the explanation.
Short Explanation
Think of restrict as a “same color only” sign on a TLOC: put it on mpls and those tunnels can only land on other mpls TLOCs. You leave biz-internet alone, so broadband keeps its freedom to reach any color.
Full Explanation
The restrict option is a per-color tunnel-interface setting on a WAN Edge. A TLOC with restrict builds data-plane tunnels only to remote TLOCs of the same color; because a tunnel needs both ends, it also refuses tunnels offered by TLOCs of other colors. Applying restrict to mpls at every store and hub therefore keeps MPLS tunnels mpls-to-mpls without additional policy, while unrestricted biz-internet TLOCs can still form tunnels to any colors they can reach. Applying restrict to biz-internet instead constrains the wrong transport: MPLS remains free to form cross-color tunnels, violating compliance, and broadband loses flexibility it is allowed to keep. Applying restrict to both colors isolates MPLS but also removes broadband’s permitted cross-color tunnels, so it over-restricts. Setting a unique carrier on MPLS does not block cross-color tunnels; carrier determines whether private or public addresses are used between TLOCs of different carriers, not whether their colors may form a tunnel. Exam caveat: restrict must be configured on the mpls color at every store and hub to enforce the requirement throughout the fabric. As a practical check, run show sdwan bfd sessions on a store and confirm that MPLS sessions list only remote mpls colors.