300-410 Questions and Answers

1. R1 received DHCP packet and its interface was configured with the DHCP helper address. But we are not sure if R1 forward DHCP packet to R2 or not. 2. If we connect PC directly to R2 then this problem will not appear -> DHCP Server function was configured on R2.

From these facts, the most likely problem is related to Option 82. Maybe R2 ignored DHCP request packets because it was receiving these packets with the giant field set to 0.0.0.0.

By default Cisco IOS devices reject packets with zero “giaddr” and by default Cisco Catalyst switches use “giaddr” of zero when configured for DHCP snooping! Reference: https://blog.ine.com/2009/07/22/understanding-dhcp-option-82

If we can run the “debug ip dhcp server packet” on R2, we may see these messages:

*Feb 22 23:54:57.759: IP: s=0.0.0.0 (FastEthernet0/1), d=255.255.255.255, len 34 4, input feature, MCI Check(64), rtype 0, forus FALSE, sendself FALSE, mtu 0, fw dchk FALSE *Feb 22 23:54:57.759: IP: s=0.0.0.0 (FastEthernet0/1), d=255.255.255.255, len 34 4, rcvd 2 *Feb 22 23:54:57.759: IP: s=0.0.0.0 (FastEthernet0/1), d=255.255.255.255, len 34 4, stop process pak for forus packet

*Feb 22 23:54:57.759: DHCPD: inconsistent relay information. *Feb 22 23:54:57.759: DHCPD: relay information option exists, but giaddr is zero

We are receiving the DHCP packet from R1, source 0.0.0.0, and destination 255.255.255.255 broadcast, but if you notice from the debug output, R2, our DHCP Server, is complaining that the relay information is inconsistent. Option 82, Information Option, is contained in the packet but the GIADDR is zero. The GIADDR stands for Gateway IP Address, which is the IP Address of the relaying agent. The Option 82, Information Option, would then contain the receiving port and hostname of the Relaying Agent by default.

R2 sees the Option 82 information, signalling that the DHCP packet might have been relayed, BUT there is no relaying IP Address. This is the behavior of DHCP Snooping when enabling it on a switch, and since the switchport does not contain an IP Address, since it’s Layer 2, no GIADDR will be added.

Instead, just the Option 82 Information is added and this is the problem we have, but there are options:

1. You could trust all on R2 the DHCP Server, which will cause the server to not be so suspicious: – ip dhcp relay information trust-all – ip dhcp relay information trusted 2. Disable theaddition of Option 82 information on SW: – no ip dhcp snooping information option 3. Trust the port that is receiving the DHCP Discover: – ip dhcp snooping trust

Any of these options will fix our predicament.

https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_conn_dmvpn/configuration/15-mt/sec-conn-dmvpn-15-mt-book/sec-conn-dmvpn-dmvpn.html

After redistribution, R3 learns about network 10.1.1.0/24 via two paths:+ Internal BGP (IBGP): advertised from R4 with AD of 200 (and metric of 0)+ OSPF: advertised from R1 with AD of 110 (O E2) (and metric of 20)Therefore R3 will choose the path with the lower AD via OSPF

But this is a looped path which is received from R3 -> R2 -> R1 -> R3. So when the advertised route from R4 is expired, the looped path is also expired soon and R3 willreinstall the main path from R4. This is the cause of intermittent connectivity.In order to solve this issue, we can lower the AD of iBGP to a value which is lower than 110 so that it is preferred over OSPF-advertised route.

https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/snmp/configuration/xe-3se/3850/snmp-xe-3se-3850-book/nm-snmp-snmpv3.html

https://www.cisco.com/c/en/us/support/docs/ip/ip-routed-protocols/47121-pbr-cmds-ce.html

The IPv6 Router Advertisement Guard feature provides support for allowing the network administrator to block or reject unwanted or rogue router advertisement guard messages that arrive at the network device platform. Router Advertisements are used by devices to announce themselves on the link. The IPv6 Router Advertisement Guard feature analyzes these router advertisements and filters out router advertisements that are sent by unauthorized devices.

Certain switch platforms can already implement some level of rogue RA filtering by the administrator configuring Access Control Lists (ACLs) that block RA ICMP messages that might be inbound on “user” ports.

https://www.cisco.com/c/en/us/support/docs/wireless/4400-series-wireless-lan-controllers/109597-csr-chained-certificates-wlc-00.html#anc12

EIGRP does not have process ID as it uses Autonomous System (AS) numbers only.

This is not an authentication problem or we would see this error from the debug:

EIGRP: Ethernet0/0: ignored packet from 10.1.1.3, opcode = 1 (missing authentication or key-chain missing)

If the AS numbers between two routers are different then the neighbor relationship cannot be formed.

MPLS Layer-3 VPNs provide IP connectivity among CE sites* MPLS VPNs enable full-mesh, hub-andspoke, and hybrid IP connectivity* CE sites connect to the MPLS network via IP peering across PE-CE links* MPLS Layer-3 VPNs are implemented via VRFs on PE edge nodes* VRFs providing customer routing and forwarding segmentation* BGP used for signaling customer VPN (VPNv4) routes between PE nodes* To ensure traffic separation, customer traffic is encapsulated in an additional VPN label when forwarded in MPLS network* Key applications are layer-3 business VPN services, enterprise network segmentation, and segmented layer-3 Data Center access

To turn off terminal monitor, use “terminal no monitor” in the enable mode

router eigrp 1

!

address-family ipv4 vrf CLIENT1

network 172.16.0.0 0.0.0.255

no auto-summary

autonomous-system 1

exit-address-family

A Multiprotocol Label Switching(MPLS) Layer 3 Virtual Private Network (VPN) consists of a set

of sites that are interconnected by means of an MPLS provider core network. At each customer

site, one or more customer edge (CE) routers attach to one or more provider edge (PE) routers.

https://www.cisco.com/c/en/us/td/docs/cloud-systems-management/network-automation-and management/dnacenter/tech_notes/b_dnac_sda_lan_automation_deployment.html

In the debug output, we see that the Authorization (not Authentication) failed so we need to

correct the authorization. In order to enable authorization, we must use the global command

“aaa authorization console” first.

Graphical user interface, application Description automatically generated

Follow these guidelines when configuring the switch as an SSH server or SSH client:

+ An RSA key pair generated by a SSHv1 server can be used by an SSHv2 server, and the reverse.+ If the SSH server is running on a stack master and the stack master fails, the new stack master uses the RSA key pair generated by the previous stack master

+ If you get CLI error messages after entering the crypto key generate rsa global configuration command, an RSA key pair has not been generated. Reconfigure thehostname and domain, and then enter the crypto key generate rsa command.+ When generating the RSA key pair, the message No host name specified might appear. If it does, you must configure a hostname by using the hostname globalconfiguration command.+ When generating the RSA key pair, the message No domain specified might appear. If it does, you must configure an IP domain name by using the ip domain-nameglobal configuration command.+ When configuring the local authentication and authorization authentication method, make sure that AAA is disabled on the console.

Explanation

Once again, Cisco changed the IOS configuration commands required for OSPFv3 configuration. The new OSPFv3 configuration uses the “ospfv3” keyword instead of the earlier “ipv6 router ospf” routing process command and “ipv6 ospf” interface commands.

The Open Shortest Path First version 3 (OSPFv3) address families feature enables both IPv4 and IPv6 unicast traffic to be supported. With this feature, users may

have two processes per interface, but only one process per address family (AF).

https://www.cisco.com/c/en/us/support/docs/ip/open-shortest-path-first-ospf/13684-12.html

In fact in this question both answer A and answer C are correct but we believe answer A is the

better choice as it only allows PC-2 to telnet to terminal server. All other hosts are refused to

telnet to terminal server via sequence 20.

Desired Min TX Interval: This is the minimum interval, in microseconds, that the local system would like to use when transmitting BFD Control packets, less any jitterapplied. The value zero is reserved.

Required Min Echo RX Interval: This is the minimum interval, in microseconds, between received BFD Echo packets that this system is capable of supporting, less anyjitter applied by the sender. If this value is zero, the transmitting system does not support the receipt of BFD Echo packets.

https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2960x/software/15-0_2_EX/security/configuration_guide/b_sec_152ex_2960-x_cg/b_sec_152ex_2960-x_cg_chapter_01001.html

After redistribution, R3 learns about network 10.1.1.0/24 via two paths:

+ Internal BGP (IBGP): advertised from R4 with AD of 200 (and metric of 0)

+ OSPF: advertised from R1 with AD of 110 (O E2) (and metric of 20)

Therefore R3 will choose the path with the lower AD via OSPF

But this is a looped path which is received from R3 -> R2 -> R1 -> R3. So when the advertised route

from R4 is expired, the looped path is also expired soon and R3 will reinstall the main path from R4.

This is the cause of intermittent connectivity.

We can solve this problem by denying the 10.1.1.0/24 prefix from being redistributed into OSPF on

R1. So R3 will not learn this prefix from R1.

Or another solution is to place an OSPF distribute-list inbound on R3 to block the 10.1.1.0/24 prefix

from being advertised back to R3.

Excessive time lag between Cisco DNA Center and device: The time difference between Cisco DNA Center and the device IP Address has drifted too far apart. CiscoDNA Center cannot process the device data accurately if the time difference is more than 3 minutes.

https://community.cisco.com/t5/networking-documents/stateful-dhcpv6-relay-configuration-example/ta-p/3149338

The Destination Guard feature helps in minimizing denial-of-service (DoS) attacks. It performs address resolutions only for those addresses that are active on the link,and requires the FHS binding table to be populated with the help of the IPv6 snooping feature.The feature enables the filtering of IPv6 traffic based on the destinationaddress, and blocks the NDP resolution for destination addresses that are not found in the binding table. By default, the policy drops traffic coming for an unknowndestination.

+ allows an LSR to remove the label before forwarding the packet: penultimate hop popping

+ accepts unlabeled packets and imposes labels: label edge router

+ group of packets that are forwarded in the same manner: forwarding equivalence class

+ receives labeled packets and swaps labels: label switch router

Explanation

A label edge router (LER, also known as edge LSR) is a router that operates at the edge of an MPLS network and acts as the entry and exit points for the network. LERspush an MPLS label onto an incoming packet and pop it off an outgoing packet.

A forwarding equivalence class (FEC) is a term

There is an implicit deny all at the end of any route-map so all other traffic that does not match 172.20.5.0/24 would be dropped. Therefore we have to add a permitsequence at the end of the route-map to allow other traffic.

The default value of Local Preference is 100 and higher value is preferred so we have to set the local preference of AS100 lower than that of AS200.

Explanation

From the last line of the output, we notice that the result was “Invalid AUTHEN packet”. Therefore something went wrong with the username or password.

When R2 & R5 are route reflectors (RRs), routes from R4 & R8 are advertised to R5 and R5

advertises to R2. But R2 would drop them as R2 is also a RR. Therefore some routes are

missing on R1 to advertise to eBGP peers.

Good reference:

https://www.ciscolive.com/c/dam/r/ciscolive/emea/docs/2015/pdf/TECRST-2310.pdf

Route reflectors (RR) must be fully iBGP meshed so we cannot configure RR on both R1 and

R5.

We should choose routers at the center of the topology RRs, in this case R4 & R5.

https://www.cisco.com/c/en/us/td/docs/switches/datacenter/sw/5_x/nx-os/mpls/configuration/guide/mpls_cg/mp_mpls_overview.pdf

Disable-connected-check enables a directly connected eBGP neighbor to peer using a loopback address without adjusting the default TTL of 1. In disable connected check the router does not decrease the TTL of an IP packet that is destined to itself so it only counts or considers as one hop between the two loopbacks of the routers.

Required Min RX Interval: This is the minimum interval, in microseconds, between received BFD Control packets that this system is capable of supporting.

If we modify the weight, increase local preference or use AS path prepending then we can only

make MPLS B prefer over MPLS A. But when MPLS B is down then MPLS A will be used which

does not meet the requirement of this question. Only with AS path filtering we can deny prefixes

from certain AS and make sure branch B never uses MPLS A to reach HQ.

Let’s see how the “logging synchronous” command affect the typing command:

Without this command, a message may pop up and you may not know what you typed if that

message is too long. When trying to erase (backspace) your command, you realize you are

erasing the message instead.

With this command enabled, when a message pops up you will be put to a new line with your

typing command which is very

By default, the priority is 1 on all routers so we can set the OSPF priority of the hub to a value which is greater than 1 to make sure it would become the DR.

A DHCP server that receives a DHCPDISCOVER message may respond with a DHCPOFFER message on UDP port 68 (BootP client).

…

In the event that the DHCP server is not on the local subnet, the DHCP server will send the DHCPOFFER, as a unicast packet, on UDP port 67, back to the DHCP/BootPRelay Agent from which the DHCPDISCOVER came.

From the exhibit we see there are two flow monitors: the first one “FLOW-MONITOR-1” has been configured correctly but the second one “v4_r1” was left empty andinterface E0/0.1 is using it. So the remote server does not receive any NetFlow data.

If you configure the redistribution of OSPF into BGP without keywords, only OSPF intra-area

and inter-area routes are redistributed into BGP, by default. You can use the internal keyword

along with the redistribute command under router bgp to redistribute OSPF intra- and inter-area

routes.

Use the external keyword along with the redistribute command under router bgp to redistribute

OSPF external routes into BGP.

-> In order to redistribute all OSPF routes into BGP, we must use both internal and external

keywords. The full command would be (suppose we are using OSPF 1):

redistribute ospf 1 match internal external

Note: The configuration shows match internal external 1 external 2. This is normal because

OSPF automatically appends “external 1 external 2” in the configuration. In other words,

keyword external = external 1 external 2. External 1 = O E1 and External 2 = O E2.

To ACL should be permit tcp 101 10.1.1.1 0.0.0.0

Diagram Description automatically generated

The MPLS LDP Inbound Label Binding Filtering feature can be used to control the amount of

memory used to store Label Distribution Protocol (LDP) label bindings advertised by other

devices. For example, in a simple Multiprotocol Label Switching (MPLS) Virtual Private Network

(VPN) environment, the VPN provider edge (PE) devices might require label switched paths

(LSPs) only to their peer PE devices (that is, they do not need LSPs to core devices). Inbound

label binding filtering enables a PE device to accept labels only from other PE devices.

When doing mutual redistribution at multiple points (between OSPF and EIGRP on R1 & R2), we may create routing loops so we should use route-map to prevent redistributed routes from redistributing again into the original domain.

In the below example, the route-map “SET-TAG” is used to prevent any routes that have been redistributed into EIGRP from redistributed again into OSPF domain by tagging these routes with tag 1:

If a router is configured to get the time from a Network Time Protocol (NTP) server, the times in the router’s log entries may be different from the time on the systemclock if the [localtime] option is not in the service timestamps log command. To solve this issue, add the [localtime] option to the service timestamps log command. Thetimes should now be synchronized between the system clock and the log message timestamps.

https://community.cisco.com/t5/other-network-architecture/out-of-band-router-access/td-p/333295

The “transport output none” command prevents any protocol connection made from R1.

Therefore our SSH connection to 192.168.12.2 was refused. In order to fix this problem we can

configure “transport output ssh” under “line console 0” of R1.

Note: The parameter “-l” specifies the username to log in as on the remote machine.

When you configure an EIGRP summary route, all networks that fall within the range of your

summary are suppressed and no longer advertised on the interface. Only the summary route is

advertised. But if we want to advertise a network that has been suppressed along with the

summary route then we can use leak-map feature. The below commands will fix the

configuration in this question:

R1(config)#access-list 1 permit 10.1.1.0 0.0.0.3

R1(config)#route-map Leak-Route permit 10 // this command will also remove the “route_map

Leak-Route deny 10” command.

R1(config-route-map)#match ip address 1

The AD of static route is manually configured to 130 which is higher than the AD of OSPF router which is 110.

Restrictions for IPv6 RA Guard

The IPv6 RA Guard feature does not offer protection in environments where IPv6 traffic is tunneled.

This feature is supported only in hardware when the ternary content addressable memory (TCAM) is programmed.

This feature can be configured on a switch port interface in the ingress direction.

This feature supports host mode and router mode.

This feature is supported only in the ingress direction; it is not supported in the egress direction.

This feature is not supported on EtherChannel and EtherChannel port members.

This feature is not supported on trunk ports with merge mode.

This feature is supported on auxiliary VLANs and private VLANs (PVLANs). In the case of PVLANs, primary VLAN features are inherited and merged with port features.

Packets dropped by the IPv6 RA Guard feature can be spanned.

By default BGP advertises all prefixes to external BGP neighbors. This means that if you are

multi-homed (connected to two or more ISPs) then you might become a transit AS. For example,

ISP 2 in AS 200 can send traffic to your router in AS 100 to reach ISP 3 in AS 300 because you

advertised prefixes in ISP 3 to ISP 2.

This is what will be seen in the BGP routing table of ISP1:

LDP multicasts hello messages to a well-known UDP port (646) in order to discover neighbors. Once the discovery is accomplished, a TCP connection (port 646) is established and the LDP session begins. LDP keepalives ensure the health of the session. Thanks to the LDP session, LDP messages create the label mappings required for a FEC. Withdraw messages are used when FECs need to be torn down.

The ―logging console‖ is a default and hidden command.

Graphical user interface, chart Description automatically generated

The ―summary-address‖ is only used to create aggregate addresses for OSPF at an autonomous system boundary. It means this command should only be used on the ASBR when you are trying to summarize externally redistributed routes from another protocol domain or you have a NSSA area. But a requirement to create a summarized route is:

―The ASBR compares the summary route’s range of addresses with all routes redistributed into OSPF on that ASBR to find any subordinate subnets (subnets that sit inside the summary route range). If at least one subordinate subnet exists, the ASBR advertises the summary route.‖

From the exhibit, we learned:

+ VRF customer_a was exported with Route target (RT) of 1:1 so at the remote site it must be

imported with the same RT 1:1.

+ VRF customer_a was imported with Route target (RT) of 1:1 so at the remote site it must be

exported with the same RT 1:1.

Therefore at the remote site we must configure the command “route-target both 1:1” (which is

equivalent to two commands “route-target import 1:1” & “route-target export 1:1”.

The reason for the loop is that R2 is forwarding the packets destined to 10.1.1.1 to R4, instead of R1. This is because in the redistribute OSPF statement, BW metric has a higher value and delay has a value of 1. So, R2 chooses R4 over R1 for 10.1.1.0/24 subnet causing a loop. Now, R5 learns 10.1.1.0/24 from R3 and advertises the same route to R4, that R4 redistributes back in EIGRP. If R3 sets a tag of 1 while redistributing EIGRP in OSPF, and R4 denies all the OSPF routes with tag 1 while redistributing, it will not advertise 10.1.1.0/24 back into EIGRP. Hence, the loop will be broken.

Label Switch Router 1. Reads labels and forwards the packet based on the based on the label.

2. Performs PHP

Label Edge Router: 1 Assigns labels and unlabeled packets.

2. Handles traffic between multiple VPNs

From the output we can see there are 2 NHRP Peers. The first one with the NBMA Address of

172.18.16.2 and the “Attribute” (Attrb) of Static (S) so we can deduce it is the Hub device.

Therefore the second one must be the remaining Spoke device with the attribute of Dynamic

(D).

--> S - Static, D - Dynamic, I - Incomplete

N - NATed, L - Local, X - No Socket

# Ent --> Number of NHRP entries with same NBMA peer

NHS Status: E --> Expecting Replies, R --> Responding, W --> Waiting

UpDn Time --> Up or Down Time for a Tunnel

========================================================================

==

Interface: Tunnel1, IPv4 NHRP Details

Type:Spoke, NHRP Peers:2,

# Ent Peer NBMA Addr Peer Tunnel Add State UpDn Tm Attrb

----- --------------- --------------- ----- -------- -----

1 44.44.44.4 192.168.100.254 UP 00:03:40 S

1 12.12.12.2 192.168.100.2 UP 00:03:20 D

https://www.cisco.com/c/en/us/support/docs/ip/border-gateway-protocol-bgp/25160-bgp-maximum-prefix.html#b

Upload Software Images for Devices in Install Mode

The Image Repository page might show a software image as being in Install Mode. When a device is in Install Mode, Cisco DNA Center is unable to upload its software image directly from the device. When a device is in install mode, you must first manually upload the software image to the Cisco DNA Center repository before marking the image as golden, as shown in the following steps.

Command Default

Accounting port: 1813

Authentication port: 1812

Accounting: enabled

Authentication: enabled

Retransmission count: 1

Idle-time: 0

Server monitoring: disabled

Timeout: 5 seconds

Test username: test

Test password: test

LDP multicasts hello messages to a well-known UDP port (646) in order to discover neighbors. Once the discovery is accomplished, a TCP connection (port 646) is established and the LDP session begins. LDP keepalives ensure the health of the session. Thanks to the LDP session, LDP messages create the label mappings required for a FEC. Withdraw messages are used when FECs need to be torn down.

HTTP and HTTPs run on TCP port 80 and 443, respectively and we have to remember them.

Syslog runs on UDP port 514 while NTP runs on UDP port 123 so if we remember them we can find out the matching answers easily. But maybe there is some typos in this question as 2001:d88:800:200c::c/126 only ranges from 2001:d88:800:200c:0:0:0:c to 2001:d88:800:200c:0:0:0:f (4 hosts in total). It does not cover host 2001:0D88:0800:200c::1f. Same for 2001:D88:800:200c::e/126, which also ranges from 2001:d88:800:200c:0:0:0:c to 2001:d88:800:200c:0:0:0:f and does not cover host 2001:0D88:0800:200c::1c.

Label Switch Router 1. Reads labels and forwards the packet based on the based on the label.

2. Performs PHP

Label Edge Router: 1 Assigns labels and unlabeled packets.

2. Handles traffic between multiple VPNs

DHCPACK

The server-to-client communication with configuration parameters, including committed network address.

DHCPINFORM

The client-to-server communication, asking for only local configuration parameters that the client already has externally configured as an address.

DHCPNAK

The server-to-client communication, refusing the request for configuration parameter.

DHCPDECLINE

The client-to-server communication, indicating that the network address is already in use

A label edge router (LER, also known as edge LSR) is a router that operates at the edge of an MPLS network and acts as the entry and exit points for the network. LERs push an MPLS label onto an incoming packet and pop it off an outgoing packet.

By default, Catalyst switches add a simple uptime timestamp to logging messages. This is a cumulative counter that shows the hours, minutes, and seconds since the switch has been booted up

The ―imp-null‖ (implicit null) tag instructs the upstream router to pop the tag entry off the tag stack before forwarding the packet.

Note: pop means ―remove the top MPLS label‖

Unlike legacy network technologies such as ISDN, Frame Relay, and ATM that defined separate data and control channels, IP carries all packets within a single pipe. Thus, IP network devices such as routers and switches must be able to distinguish between data plane, control plane, and management plane packets to treat each packet appropriately.From an IP traffic plane perspective, packets may be divided into four distinct, logical groups:1. Data plane packets – End-station, user-generated packets that are always forwarded by network devices to other end-station devices. From the perspective of the network device, data plane packets always have a transit destination IP address and can be handled by normal, destination IP address-based forwarding processes.2. Control plane packets – Network device generated or received packets that are used for the creation and operation of the network itself. From the perspective of the network device, control plane packets always have a receive destination IP address and are handled by the CPU in the network device route processor. Examples include protocols such as ARP, BGP, OSPF, and other protocols that glue the network together.3. Management plane packets – Network device generated or received packets, or management station generated or received packets that are used to manage the network. From the perspective of the network device, management plane packets always have a receive destination IP address and are handled by the CPU in the network device route processor. Examples include protocols such as Telnet,Secure Shell (SSH), TFTP, SNMP, FTP, NTP, and other protocols used to manage the device and/or network.4. Services plane packets – A special case of data plane packets, services plane packets are also user-generated packets that are also forwarded by network devices to other end-station devices, but that require high-touch handling by the network device (above and beyond normal, destination IP address-based forwarding) to forward the packet. Examples of high-touch handling include such functions as GRE encapsulation, QoS, MPLS VPNs, and SSL/IPsec encryption/decryption, etc. From the perspective of the network device, services plane packets may have a transit destination IP address, or may have a receive destination IP address (for example, in the case of a VPN tunnel endpoint).

From the output we can see there are 2 NHRP Peers. The first one with the NBMA Address of

172.18.16.2 and the “Attribute” (Attrb) of Static (S) so we can deduce it is the Hub device.

Therefore the second one must be the remaining Spoke device with the attribute of Dynamic

(D).

--> S - Static, D - Dynamic, I - Incomplete

N - NATed, L - Local, X - No Socket

# Ent --> Number of NHRP entries with same NBMA peer

NHS Status: E --> Expecting Replies, R --> Responding, W --> Waiting

UpDn Time --> Up or Down Time for a Tunnel

========================================================================

==

Interface: Tunnel1, IPv4 NHRP Details

Type:Spoke, NHRP Peers:2,

# Ent Peer NBMA Addr Peer Tunnel Add State UpDn Tm Attrb

----- --------------- --------------- ----- -------- -----

1 44.44.44.4 192.168.100.254 UP 00:03:40 S

1 12.12.12.2 192.168.100.2 UP 00:03:20 D

By default, Catalyst switches add a simple uptime timestamp to logging messages. This is a cumulative counter that shows the hours, minutes, and seconds since the switch has been booted up

https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipv6_fhsec/configuration/xe-3s/ip6f-xe-3s-book/ip6-ra-guard.html#GUID-589AF00C-7499-439F-AD23-51005D61CAB7

The IPv6 RA Guard feature does not offer protection in environments where IPv6 traffic is tunneled.

When you configure an EIGRP summary route, all networks that fall within the range of your

summary are suppressed and no longer advertised on the interface. Only the summary route is

advertised. But if we want to advertise a network that has been suppressed along with the

summary route then we can use leak-map feature. The below commands will fix the

configuration in this question:

R1(config)#access-list 1 permit 10.1.1.0 0.0.0.3

R1(config)#route-map Leak-Route permit 10 // this command will also remove the “route_map

Leak-Route deny 10” command.

R1(config-route-map)#match ip address 1

We tested this config in GNS3 (except the LAN interface) but R1 loopback0 was advertised normally on R2 and R2 could reach this loopback0.

Note: Although the configured loopback address is 4.4.4.4/24 but by default OSPF will advertise this route to loopback0 as 4.4.4.4/32 (most specific route to that loopback). In order to override this, we have to change the network type to point-to-point. After this OSPF will advertise the address to loopback as 4.4.4.0/24.

the ACL 101 matches all HTTP pakects while the ACL 102 matches TCP packets destined

to Intranet webserver. These packets will be sent to HQ router.

If a match command refers to several objects in one command, either of them should match

(the logical OR algorithm is applied). For example, in the match ip address 101 102 command, a

route is permitted if it is permitted by access list 101 or access list 102.

https://www.cisco.com/c/en/us/support/docs/ip/enhanced-interior-gateway-routing-protocol-eigrp/8606-redist.html

Explanation

In the “crypto isakmp key … address ” command, the address must be of the IP address of the other

end (which is 200.1.1.3 in this case) so Option A and Option B are correct. The difference between

these two options are in the hash SHA or MD5 method but both of them can be used although SHA is

better than MD5 so we choose Option A the best answer.

Note: Cisco no longer recommends using 3DES, MD5 and DH groups 1, 2 and 5.

CIR (Committed Information Rate) is the minimum guaranteed traffic delivered in the network.

PIR (Peak Information Rate) is the top bandwidth point of allowed traffic in a non busy times without any guarantee.

+ Policing: is used to control the rate of traffic flowing across an interface. During a bandwidth exceed (crossed the maximum configured rate), the excess traffic is generally dropped or remarked. The result of traffic policing is an output rate that appears as a saw-tooth with crests and troughs. Traffic policing can be applied to inbound and outbound interfaces. Unlike traffic shaping, QoS policing avoids delays due to queuing. Policing is configured in bytes.

+ Shaping: retains excess packets in a queue and then schedules the excess for later transmission over increments of time. When traffic reaches the maximum configured rate, additional packets are queued instead of being dropped to proceed later. Traffic shaping is applicable only on outbound interfaces as buffering and queuing happens only on outbound interfaces. Shaping is configured in bits per second.

Therefore in this case we can only policing, not shaping as traffic shaping is applicable only on outbound interfaces as buffering and queuing happens only on outbound interfaces. Moreover, BGP traffic is not important so we can drop the excess packets without any problems.

And we only policing the PIR traffic so that the route processor is not overwhelmed by BGP calculation.

Note: The “set-prec-transmit” is the same as “transmit” command except it sets the IP Precedence level as well. The “set-clp-transmit” sets the ATM Cell Loss Priority (CLP) bit from 0 to 1 on the ATM cell and transmits the packet.

ON BR1

ON BR2

To use the DMPVN – Traffic Segmentation Within DMVPN feature you must configure Multiprotocol

Label Switching (MPLS) by using the mpls ip command.

When assigning an interface to a VRF, the IP address will be removed so we have to reassign the IP

address to that interface.

Solution:

Use cu-red under interfaces facing SW1 & SW3:

On R1:

interface Ethernet0/0

ip vrf forwarding cu-red

ip address 192.168.1.254 255.255.255.0

Check reachability to SW1:

R1#ping vrf cu-red 192.168.1.1

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 192.168.2.1, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/1 ms

On R2:

interface Ethernet0/0

ip vrf forwarding cu-red

ip address 192.168.2.254 255.255.255.0

Check reachability to SW3:

R2#ping vrf cu-red 192.168.2.1

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 192.168.1.1, timeout is 2 seconds:

!!!!!

Use vrf cu-green for SW2 & SW4:

On R1:

interface Ethernet0/1

ip vrf forwarding cu-green

ip address 192.168.20.254 255.255.255.0

Test reachability to SW2:

R1#ping vrf cu-green 192.168.20.1

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 192.168.22.1, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/1 ms

On R2:

interface Ethernet0/1

ip vrf forwarding cu-green

ip address 192.168.22.254 255.255.255.0

Test reachability to SW4:

R2#ping vrf cu-green 192.168.22.1

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 192.168.20.1, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/1 ms

On R1:

interface Ethernet0/2.100

mpls ip

!

interface Ethernet0/2.200

mpls ip

!

Configure BGP:

router bgp 65000

neighbor 10.10.10.2 remote-as 65000

neighbor 10.10.20.2 remote-as 65000

!

address-family vpnv4

neighbor 10.10.10.2 activate

neighbor 10.10.20.2 activate

exit-address-family

!

address-family ipv4 vrf cu-green

redistribute connected

exit-address-family

!

address-family ipv4 vrf cu-red

redistribute connected

exit-address-family

!

R1(config)#ip vrf cu-red

R1(config-vrf)#route-target both 65000:100

!

R1(config)#ip vrf cu-green

R1(config-vrf)#route-target both 65000:200

On R2:

interface Ethernet0/2.100

mpls ip

!

interface Ethernet0/2.200

mpls ip

!

router bgp 65000

neighbor 10.10.10.1 remote-as 65000

neighbor 10.10.20.1 remote-as 65000

!

address-family vpnv4

neighbor 10.10.10.1 activate

neighbor 10.10.20.1 activate

exit-address-family

!

address-family ipv4 vrf cu-green

redistribute connected

exit-address-family

!

address-family ipv4 vrf cu-red

redistribute connected

exit-address-family

R2(config)#ip vrf cu-red

R2(config-vrf)#route-target both 65000:100

!

R2(config)#ip vrf cu-green

R2(config-vrf)#route-target both 65000:200

Verification:

From SW1 to SW3:

SW1#ping 192.168.1.1

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 192.168.1.1, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/1 ms

But can’t Reach SW2 or SW4 in VRF cu-green:

SW1#ping 192.168.22.1

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 192.168.22.1, timeout is 2 seconds:

U.U.U

Success rate is 0 percent (0/5)

SW1#ping 192.168.20.1

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 192.168.20.1, timeout is 2 seconds:

U.U.U

Success rate is 0 percent (0/5)

Same Test for SW2:

From SW2 to SW4:

SW2#ping 192.168.20.1

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 192.168.20.1, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/1 ms

But can’t Reach SW3 or SW1 in VRF cu-red:

SW2#ping 192.168.1.1

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 192.168.1.1, timeout is 2 seconds:

U.U.U

Success rate is 0 percent (0/5)

SW2#ping 192.168.2.1

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 192.168.2.1, timeout is 2 seconds:

U.U.U

Success rate is 0 percent (0/5)

Both R1 & R2 has separate tables for VRFs cu-red and cu-green.

In EIGRP (Enhanced Interior Gateway Routing Protocol), a stub router is one that is connected to one or more neighbors and should not be a transit router1. The EIGRP stub routing feature improves network stability, reduces resource utilization, and simplifies the stub router’s configuration1.

The network engineer wants to configure an EIGRP stub router that advertises only connected and summary routes. This can be achieved with the configuration provided in Option B:

router eigrp 100

eigrp stub summary

This configuration ensures that the EIGRP stub router advertises only connected and summary routes12. The summary keyword after the eigrp stub command indicates that the router should advertise only auto-summarized or statically configured summary routes12.

Solution:

A screen shot of a computer AI-generated content may be incorrect.

A screen shot of a computer AI-generated content may be incorrect.

R-West#

service sequence-numbers

service timestamps log datetime msec

snmp-server enable traps ospf

archieve

log config

logging enable

hidekeys

notify syslog

exit

snmp-server enable traps ospf lsa

snmp-server enable traps ospf cisco-specific lsa

wr

====================

end

wr

https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipv6_fhsec/configuration/xe-3s/ip6f-xe-3s-book/ip6-src-guard.html

SOLUTION:-

R4

Int range et0/0 – 1

Ip ospf authentication message-digest

Ip ospf message-digest-key 1 md5 CCNP

Router ospf 1

Redistribute connected subnets route-map to-ospf metric-type 1

Copy run start

R5

Int range et0/0 – 1

Ip ospf authentication message-digest

Ip ospf message-digest-key 1 md5 CCNP

Interface eth 0/1

Ip ospf cost 10

Copy run start

VERIFICATION:-

A black screen with white text AI-generated content may be incorrect.