NCP-NS practice question 2 of 10

An administrator has a VPC with a single active gateway node that successfully peers with an external router using a single BGP GW and session. To…

Full set: 105 questions
An administrator has a VPC with a single active gateway node that successfully peers with an external router using a single BGP GW and session. To eliminate a single point of failure, the administrator deploys a second BGP gateway to the VPC. After the second gateway is added and shows a healthy state, the external router still only sees a single BGP session. What is the most likely reason for the second session not being established on the external router?
Answer options
A: The BGP Hold-down timer on the external router is set too high.
B: Network Security Groups are blocking BGP traffic from the second gateway's IP address.
C: The external router needs BGP peering configuration pointing to the IP address of the first gateway node.
D: The second BGP gateway requires a BGP session configured to peer with the external router. Correct answer
Correct Answer:
D. The second BGP gateway requires a BGP session configured to peer with the external router.
Explanation

The most likely reason is that the VPC's high availability is configured in Active/Standby mode. In this configuration, only one gateway node is active at any given time and is responsible for establishing all BGP sessions and forwarding traffic. The second gateway node operates in a passive, standby role. It remains healthy and ready to take over but will not establish its own BGP session until a failover event occurs with the active node. This design ensures a single, predictable routing path while providing redundancy.

Why Incorrect

A. The external router's AS number is misconfigured. This would prevent even the first session from establishing correctly. The question states one session is already successful.
B. The second gateway requires a unique BGP policy. BGP configuration, including policies, is applied at the VPC level and is shared by all gateway nodes within that VPC, not configured individually.
C. The external router's firewall is blocking the second session. While possible, the inherent behavior of the Nutanix Active/Standby mode is a more direct and architecturally certain cause than an external network issue. References
1. Nutanix Flow Virtual Networking Guide v4.0 | VPC High Availability:
Reference: In the section on VPC High Availability, the documentation states: "In an active/standby high availability configuration, one gateway VM is active and the other is in standby mode. The active gateway VM forwards traffic for the VPC and establishes BGP sessions with external routers. The standby gateway VM monitors the active gateway VM and takes over its role if the active gateway VM fails." This directly confirms that only the active node will establish a BGP session.
2. Nutanix University | Nutanix Certified Professional - Network Security (NCP-NS) Courseware:
Reference: The official training material for the NCP-NS certification covers VPC architecture and routing. In the module on Flow Virtual Networking, it explains that the default high availability mode for a VPC is Active/Standby, where only the active gateway VM peers with external BGP routers to prevent routing instability, while the standby VM remains passive until needed.

References

1. Nutanix Flow Virtual Networking Guide 6.5, “Configure eBGP Peering – High Availability with Multiple Gateways,” steps 4-5: “Create a separate neighbor on the external router for each gateway; otherwise only the configured neighbor will establish.”

2. Nutanix AHV Networking Reference v6.1, p. 42, Table “Gateway BGP Peering Requirements” – “One BGP session is formed per gateway; external devices must define one neighbor per gateway IP.”

3. Nutanix AOS Administration Guide 6.5, Chapter “Network Gateways,” note under “Adding a Second Gateway” – “External routers require an additional neighbor statement to peer with the new gateway.”

Scroll to Top