Question 910
A policy requires restricted services in a management VRF to reach a shared NTP system but forbids broad connectivity to the production user VRF. Which first diagnostic check is most useful before changing the network?
Explanation
Correct Answer
This check collects evidence at the layer implicated by the symptom: VRF separation blocks required shared services unless an explicit controlled path exists. Examine the evidence before choosing the corrective change.
Incorrect Answers
This would be a reasonable check when a campus BGP peering to an ISP remains Idle because the local neighbor remote-AS setting is incorrect, but is less direct for the issue at hand: VRF separation blocks required shared services unless an explicit controlled path exists.
This would be a reasonable check when a device sends packets to a remote IPv6 network, but return traffic fails because the remote router lacks the source-prefix route, but is less direct for the issue at hand: VRF separation blocks required shared services unless an explicit controlled path exists.
This would be a reasonable check when a data center's OSPF router and campus peer have matching area IDs but fail adjacency because their hello/dead timers differ, but is less direct for the issue at hand: VRF separation blocks required shared services unless an explicit controlled path exists.