IP Network Security in VPRN Deployments
What this domain tests
The security domain tests protection of the VPRN control plane and tenant separation. You need to know how RT import/export policy, BGP session protection, prefix limits, and uRPF/ACLs prevent one tenant or CE from affecting another.
Core rules
- The VRF is the primary isolation boundary. A route enters a VPRN only if its RT matches an import target and policy permits it.
- Protect PE-CE and PE-PE BGP with TCP-AO or MD5, and consider GTSM to drop spoofed BGP packets with invalid TTL.
- max-prefix limits on a BGP neighbor cap the damage from a CE advertising excessive routes.
- Route policies should reject default routes, bogus prefixes, and prefixes tagged with the wrong community unless explicitly required.
- uRPF on VPRN interfaces reduces spoofed source addresses; management access filters restrict SSH/SNMP to the VPRN or base router as intended.
- Do not leak routes between VPRNs without an explicit policy and documented business need.
Worked example
A CE in VPRN 100 begins advertising 0.0.0.0/0 and 50,000 prefixes. The PE has an import policy that accepts only 10.10.0.0/16 and more-specifics, plus a max-prefix of 100. The default route is rejected by policy, and once the limit is exceeded the session is shut down or logged, protecting the VPRN table and core.
Traps
A matching RT alone is not a security control; pair it with import policy. MD5/TCP-AO mismatch causes session failure that looks like a routing problem. Applying uRPF on asymmetric paths can drop legitimate traffic.