A manufacturing enterprise has corporate, guest and building-automation traffic across two campuses that must stay segmented end to end with isolated routing tables, controlled route leaking only at a shared firewall, and scalable expansion to a third campus. Which VRF design for segmentation across campuses best meets isolation and growth needs?
Select an answer to reveal the explanation.
Short Explanation
You've got traffic that can't mix, so you'll stretch your VRFs end-to-end with MP-BGP VPNv4 like color-coded shipping labels that stay on between campuses. Your firewall just opens one supervised door for the prefixes you approve, so growing to a third campus stays simple.
Full Explanation
End-to-end VRFs extended with MP-BGP VPNv4 preserve separate routing tables and labels across campus cores, scale cleanly to new campuses by adding PE attachments, and allow precise import-export or firewall-based leaking of only shared services, maintaining isolation with controlled connectivity. Independent VRF-Lite with mutual full redistribution fails by concept because without a VPN control plane, tags are lost at boundaries and full redistribution merges tables, defeating segmentation and creating scaling and loop risk. A single global table with VLANs and ACLs fails by concept because VLANs provide L2 separation only and a shared RIB allows address overlap conflicts and lateral reachability that ACLs alone cannot robustly contain at scale. Separate physical routers without exchange fails by concept because it provides isolation through overbuilt hardware sprawl, prevents any controlled sharing, and cannot scale or be managed as an enterprise design. For the exam, remember VRF-Lite is local while MP-BGP VRFs are transportable, and in practice verify route-target import-export policy and firewall leak prefixes before adding campuses.