An enterprise runs IPv4 Internet peering, new IPv6 internal reachability, and MPLS VPNs to isolate finance and engineering across the backbone, needing separate policy and next-hop handling per traffic class. A single BGP session per peer is preferred. Which BGP address family design supports IPv4, IPv6 and VPN isolation?
Select an answer to reveal the explanation.
Short Explanation
One session, three different languages — that is the magic you are after. Multiprotocol BGP keeps each address family in its own policy lane while sharing the same peering.
Full Explanation
Multiprotocol BGP is correct because it negotiates multiple AFI/SAFI NLRI types over a single TCP session while keeping IPv4 unicast for Internet peering, IPv6 unicast for new internal reachability, and VPNv4 for MPLS VPN customer routes logically separate with independent policy, filtering, and next-hop handling, and VPNv4 adds route distinguishers to make overlapping finance and engineering prefixes unique plus route targets to control import and export for isolation. The design with IPv4 unicast plus VPNv4 and RDs fails by address family concept because without the IPv6 unicast family there is no native NLRI to advertise the new internal IPv6 reachability, forcing tunneling or translation that the scenario does not request. The design with IPv4 and IPv6 unicast only fails by VPN concept because standard unicast NLRIs lack RDs and RTs, so finance and engineering prefixes cannot be kept as separate VPN tables across the backbone and overlapping addresses would collide despite having correct global reachability. The design that carries all three families but applies one shared policy and next hop fails by policy concept because it defeats the stated need for separate treatment per traffic class, where Internet, IPv6 internal, and each VPN typically require different filters, communities, and resolvable MPLS next hops. An exam caveat is that the presence of correct families is not sufficient if the question also demands distinct policy and next-hop behavior, so look for per-AFI and per-SAFI configuration. As a practical check, verify BGP capabilities, advertised AFI/SAFI, VRF RD and RT assignments, and test reachability separately for Internet IPv4, internal IPv6, and each finance and engineering VPN to confirm isolation is maintained.