What is MED (Multi-Exit Discriminator) and how can misconfiguration impact security or policy?

• A. MED sets the path length in the AS_PATH.
• B. MED is a security authentication protocol.
• C. MED indicates preferred ingress from an adjacent AS; misconfig can reveal topology or affect traffic flows.
• D. MED is used to validate ROAs.

Answer: (C)

Multi-Exit Discriminator is an optional BGP path attribute that neighboring networks use to indicate a preferred ingress point into your network when you have multiple exit points. It acts as a traffic engineering hint for inbound traffic: a peer evaluating routes for a prefix may prefer the route with a lower MED value, steering traffic into your AS via that particular edge.

It isn’t a security mechanism, and it isn’t used to authenticate routes or validate ROAs, nor does it relate to measuring or enforcing path length. Because MED values are hints and not guaranteed across all peers, their impact depends on how each neighbor treats them.

If MEDs are misconfigured, two main issues can arise. First, they can reveal topology: the advertised values imply which exit points you intend to use, giving observers clues about your network layout. Second, they can shift traffic flows in ways that undermine policy or performance—sending inbound traffic through a less desirable or less secure path, or causing suboptimal routing if peers misinterpret or ignore the MED values. In short, MED guides inbound traffic engineering, and misconfiguring it can expose topology and affect security-aware routing decisions.