A regional ISP peers with two upstreams and a customer AS 64500. Requirements are to accept only the customer aggregate, block private AS numbers inbound, and prevent your AS from becoming transit between upstreams. Which BGP route-filtering approach enforces prefix scope, AS-path sanity, and transit protection together?
Select an answer to reveal the explanation.
Short Explanation
You're guarding your borders and don't want stray routes or unwanted transit traffic sneaking through. Layered filtering lets you check the address list, the AS travel history, and the final decision in one clean pass.
Full Explanation
The prefix list plus AS-path filter plus route-map design succeeds because it layers three complementary controls matching the three requirements: the prefix list permits only the authorized customer aggregate from AS 64500 while denying deaggregates and unrelated prefixes, the AS-path filter uses regex to deny private ASNs 64512-65534 and confederation segments inbound to preserve AS-path sanity, and the route map orders match clauses and enforces actions including denying advertisement of one upstream-learned route to the other upstream to guarantee non-transit behavior. The customer aggregate prefix list with no-export approach covers prefix scope and attempts transit protection but fails AS-path sanity because community signaling depends on neighbor compliance and cannot inspect or reject a forged AS_PATH containing private ASNs. The AS-path filter for private ASNs with transit-deny route map covers sanity and non-transit advertisement but fails prefix scope because without an explicit prefix list it still accepts customer deaggregates, leaked internals, or hijacked more-specifics sharing an allowed AS. The customer prefix list plus private-AS filter with no transit control validates inbound acceptance but fails egress transit protection because inbound filtering does not constrain re-advertisement, so upstream routes can still propagate between upstreams and create unintended transit. Exam caveat: when the stem explicitly demands scope plus sanity plus transit, eliminate any design naming only two mechanisms as a classic incomplete-answer trap. Practically verify with show ip bgp received-routes and advertised-routes on both upstream sessions to confirm only the aggregate is accepted, no private-ASN paths remain, and no upstream-learned prefix is advertised to the other upstream.