NSE 7 - Enterprise Firewall 7.6 Administrator Exam Materials - Question #50 Discussion

please explain why

Default BGP Behavior: When a BGP router advertises a route to a neighbor, it usually changes the next-hop attribute to its own IP address. This means if Hub A receives routes from Spoke 1 and Spoke 2 and then advertises them to Hub B, the next-hop will default to Hub A’s IP (10.255.255.1). Problem in the Shown Topology: Spokes (Spoke 1 and Spoke 2) are behind Hub A, and Spoke 3 and Spoke 4 are behind Hub B. If Hub A changes the next-hop when sending routes to Hub B, Hub B will think the next hop to reach Spoke 1 is Hub A. This breaks routing logic because in SD-WAN or VPN networks, spokes need to keep the original next-hop so traffic flows correctly through the tunnels. Solution with set attribute-unchanged next-hop: This command tells the BGP process not to modify the next-hop attribute when redistributing routes to its neighbor. As a result, Hub A advertises Spoke 1 and Spoke 2 routes to Hub B keeping the original next-hop (the spoke’s IP). This ensures Hub B knows that traffic to Spoke 1 should go directly through the correct tunnel, not via Hub A unnecessarily. Conclusion: In a Hub-and-Spoke architecture using BGP, preserving the original next-hop is critical for proper spoke-to-spoke communication without forcing traffic through the hub. That’s why the correct option is “set attribute-unchanged next-hop”.