300-410 Practice Questions

The question describes a requirement to support both IPv4 and IPv6 traffic within a DMVPN setup, which is a dual-stack configuration. The standard and correct command for a multipoint GRE tunnel used in DMVPN is tunnel mode gre multipoint.

However, none of the provided options include the correct command. The options listed are all IPv6-over-IPv4 transition mechanisms, which are fundamentally different from mGRE. Given the flawed nature of the question, the most plausible intended answer is tunnel mode ipv6ip auto-tunnel. This choice is likely based on a conceptual association: DMVPN provides automatic spoke-to-spoke tunnels via NHRP, and "auto-tunnel" is the option that explicitly refers to an automatic tunneling mechanism. This mode automatically creates a tunnel for IPv6 packets over an IPv4 network.

A. Tunnel mode ipv6ip 6to4 is a specific public transition mechanism that uses the reserved 2002::/16 prefix and is not intended for private enterprise VPNs like DMVPN.

B. Tunnel mode ipv6ip isatap (Intra-Site Automatic Tunnel Addressing Protocol) is designed for providing IPv6 connectivity over an IPv4 network within a single site, not over a WAN.

D. Tunnel mode ipv6ip 6rd (Rapid Deployment) is a mechanism primarily for Internet Service Providers to rapidly deploy IPv6 services over their IPv4 infrastructure, not for enterprise DMVPN.

1. Cisco Systems

"IP Tunneling: Automatic IPv6 Tunneling Command Reference". This document describes the tunnel mode ipv6ip auto-tunnel command. It states

"To configure an automatic IPv6-in-IPv4 tunnel on a tunnel interface

use the tunnel mode ipv6ip auto-tunnel command... An automatic IPv6-in-IPv4 tunnel uses IPv4-compatible IPv6 addresses." This defines the function of the selected option

which is distinct from mGRE.

2. Cisco Systems

"IP Addressing: IPv6 Configuration Guide

Cisco IOS Release 15M&T - Implementing Tunneling for IPv6". This guide details various IPv6 tunneling mechanisms

clearly separating automatic tunnels like 6to4 and ISATAP from manually configured GRE tunnels

which form the basis of DMVPN. This separation highlights the technical inaccuracy of mixing these concepts in the question.

3. Cisco Systems

"DMVPN and GETVPN with dual-stack IPv4/IPv6 tunnels". This official feature guide specifies the correct configuration for dual-stack DMVPN. It explicitly shows the use of tunnel mode gre multipoint for an IPv4 transport and tunnel mode gre multipoint ipv6 for an IPv6 transport

confirming that none of the provided options are correct for an mGRE DMVPN tunnel.

4. IETF RFC 5214

"Intra-Site Automatic Tunnel Addressing Protocol (ISATAP)". Section 1 describes ISATAP as a mechanism "to provide automatic tunneling of IPv6 over IPv4 for deployment of IPv6 within a site." This confirms its unsuitability for a multi-site WAN scenario.

The tunnel interface is flapping due to a recursive routing problem. The router is learning the route to the tunnel destination IP address (192.168.1.2) via the EIGRP adjacency established over the tunnel itself. When the routing table prefers this path, the router attempts to send the GRE-encapsulated packets (destined for 192.168.1.2) out of the same tunnel interface. This creates a logical impossibility, causing the tunnel interface to go down. Once the tunnel fails, the EIGRP route is withdrawn, a valid underlay route is used, the tunnel comes back up, and the cycle repeats. The solution is to ensure the route to the tunnel destination is never learned through the tunnel itself.

B. Modifying the network command to be more specific is a best practice but does not prevent the recursive routing loop.

C. Advertising more networks from the remote side does not resolve the fundamental issue of how the local router reaches the tunnel destination.

D. Changing the tunnel's IP addressing scheme to /31 is valid for point-to-point links but is irrelevant to the recursive routing problem.

1. Cisco Systems

Inc. (2023). IP Tunneling Configuration Guide

Cisco IOS XE Gibraltar 16.12.x. IP Tunnels. In the section "Information About IP Tunnels

" subsection "Recursive Routing in a Tunnel

" it states: "A recursive route to the tunnel destination can cause the tunnel interface to flap. A tunnel interface may flap when the recursive route is intermittently lost from the routing table... To avoid recursive routing... use a different routing protocol to advertise the tunnel destination." This supports the principle of not learning the destination route through the tunnel.

2. Cisco Systems

Inc. (2014). Troubleshoot GRE Tunnel - Tech Note. Document ID: 118370. In the "Recursive Routing" section

it explains: "Recursive routing occurs when the routing table (routing information base [RIB]) has the tunnel interface as the outbound interface to reach the tunnel destination... In order to resolve this

the route to the tunnel destination must be learned via a different interface or a static route must be configured that points to the physical interface." This directly identifies the problem and solution.

The OSPF-4-FLOODWAR syslog message indicates that a router is receiving conflicting Link-State Advertisements (LSAs) for the same Link State ID. The symptom described—a switch receiving its own LSA and flushing it—is a classic sign of a duplicate OSPF Router ID within the OSPF domain. When two routers have the same Router ID, they both originate LSAs. This causes a continuous loop of flooding and flushing as each router invalidates the other's LSA. Since OSPF Router IDs are commonly determined by the highest IP address on a loopback or active physical interface, a duplicate IP address in the network is a frequent cause of duplicate Router IDs.

A. An area type mismatch (e.g., stub vs. non-stub) prevents an OSPF adjacency from forming but does not cause a flooding war.

B. A subnet mask mismatch on a link prevents the OSPF adjacency from reaching the FULL state, typically getting stuck in EXSTART/EXCHANGE.

C. Not using a port channel on parallel links is a valid design that creates multiple adjacencies; it does not inherently cause an LSA flooding conflict.

1. Cisco Systems

Inc. (2013). Troubleshoot OSPF-4-FLOODWAR Syslog Messages. Document ID: 116142. In the "Problem" section

it states

"This message is most commonly seen when you have duplicate router-ids on two different routers in the OSPF domain."

2. Moy

J. (1998). RFC 2328: OSPF Version 2. IETF. Section 13.4

"Receiving link state updates

" describes the procedure for handling received LSAs

including the case where a router receives an LSA that it originated. This mechanism is what leads to a "flooding war" when duplicate Router IDs exist.

3. Doyle

J.

& Carroll

J. (2005). Routing TCP/IP

Volume 1 (2nd ed.). Cisco Press. Chapter 8

"OSPF

" section "Troubleshooting OSPF

" details that duplicate router IDs are a significant cause of network instability

leading to constant LSA reflooding.

The Cisco DNA Center output clearly identifies a "Layer 2 Loop" on interface GigabitEthernet1/0/1 and explicitly provides a "Suggested Action" to "enable BPDU Guard on the port." BPDU Guard is a security feature that protects the Spanning Tree Protocol (STP) topology. It is designed for edge ports where end devices connect, which are typically configured with PortFast. If a PortFast-enabled port with BPDU Guard enabled receives a BPDU (which should never happen in a valid configuration), the feature immediately places the port into an err-disabled state. This action effectively shuts down the port and prevents a potential switching loop caused by an unauthorized switch being connected to an edge port.

A. no spanning-tree uplinkfast: UplinkFast is a legacy Cisco proprietary feature for fast convergence on access layer switches; disabling it does not address loops on edge ports.

B. spanning-tree loopguard default: Loop Guard prevents alternate or root ports from becoming designated ports due to a loss of BPDUs, a feature used between switches, not on edge ports.

C. spanning-tree backbonefast: BackboneFast is a legacy Cisco proprietary feature that accelerates convergence after an indirect link failure in the network core, which is irrelevant here.

---

1. Cisco Systems

"Configuring Spanning Tree Protocol

" Catalyst 9300 Series Switches

Cisco IOS XE Cupertino 17.9.x

LAN Switching Configuration Guide.

Section: "Port Fast

BPDU Guard

BPDU Filtering

Root Guard

and Loop Guard"

Content: "When you enable BPDU guard on the switch

spanning tree shuts down Port Fast-enabled interfaces that receive BPDUs instead of putting them into the blocking state. In a valid configuration

Port Fast-enabled interfaces do not receive BPDUs. Receiving a BPDU on a Port Fast-enabled interface means an invalid configuration..." This document confirms that BPDU Guard is the correct feature to use on PortFast-enabled ports to prevent loops from invalid connections.

2. Cisco Systems

"Spanning Tree PortFast

BPDU Guard

BPDU Filter

UplinkFast

BackboneFast

and Root Guard

" Cisco Community

Document ID: 10596.

Section: "BPDU Guard"

Content: "The BPDU guard feature was developed to protect the switched network from this situation. BPDU guard shuts down interfaces that are in a PortFast-operational state if any BPDU is received on them... BPDU guard puts the interface in the err-disabled state." This source directly validates the use of BPDU Guard for the scenario described.

3. Cisco Systems

"Configuring Optional STP Features

" Catalyst 9300 Series Switches

Cisco IOS XE Gibraltar 16.12.x

Layer 2 Configuration Guide.

Section: "Understanding How Loop Guard Works"

Content: "Loop guard is best used on blocking ports (alternate or root ports)... When the switch running loop guard on a port stops receiving BPDUs from its neighbor on that port

the port is moved into the STP loop-inconsistent blocking state." This explains why Loop Guard (Option B) is incorrect

as it serves a different purpose on different port types.

IPv6 RA Guard: This feature analyzes and validates Router Advertisement (RA) and Router Redirect packets to prevent rogue routers from misconfiguring the network.

IPv6 Snooping: This is the foundational feature that inspects neighbor discovery and DHCPv6 messages to build the binding table. Cisco documentation explicitly states that enabling Snooping is a prerequisite for features like IPv6 Source Guard to function. (Note: The option "populates... from data packets" is incorrect because snooping inspects control/signaling packets, not data packets).

IPv6 Source Guard: This feature works on untrusted Layer 2 ports and filters IPv6 data traffic by verifying the source address against the binding table created by snooping.

DHCP Guard: This feature restricts DHCP offers/replies to trusted ports, blocking unauthorized DHCP servers.

Cisco Systems, "IPv6 First Hop Security Configuration Guide, Cisco IOS XE 17.x". Chapter: Configuring IPv6 Snooping.

Quote: "IPv6 snooping is a prerequisite for IPv6 Source Guard and IPv6 Destination Guard."

Link: Cisco Content Hub - Configuring IPv6 Snooping

Cisco Systems, "IPv6 First Hop Security Configuration Guide". Chapter: Configuring IPv6 RA Guard.

Quote: "The IPv6 RA Guard feature validates the content of RA and router redirect messages..."

Link: Cisco Content Hub - Configuring IPv6 RA Guard

Cisco Systems, "Security Configuration Guide, Cisco IOS XE". Chapter: Configuring IPv6 Source Guard.

Quote: "IPv6 source guard is an interface feature between the populated binding table and data traffic filtering... It filters traffic on Layer 2 ports that are not trusted."

Cisco Systems, "IPv6 First Hop Security Configuration Guide". Chapter: Configuring IPv6 DHCP Guard.

Quote: "The IPv6 DHCP Guard feature blocks DHCP reply and advertisement messages that originate from unauthorized sources."

Penultimate Hop Popping (PHP): This mechanism allows the router immediately preceding the egress router (the penultimate LSR) to remove (pop) the top label. This ensures the egress router receives the packet without the outer MPLS label, saving it from performing a double lookup (label and IP).

Label Edge Router (LER): Also known as an ingress or egress router, an LER resides at the boundary of an MPLS domain. An ingress LER receives native (unlabeled) IP traffic, classifies it, and imposes (pushes) the appropriate MPLS label before forwarding it into the core.

Forwarding Equivalence Class (FEC): An FEC is a group of IP packets that are treated similarly by routers. For example, packets destined for the same IP prefix are mapped to the same FEC and traverse the same Label Switched Path (LSP).

Label Switch Router (LSR): These are core routers within the MPLS network. They receive incoming labeled packets, perform a lookup in the Label Forwarding Information Base (LFIB), swap the incoming label with an outgoing label, and forward the packet to the next hop.

Rosen, E., Viswanathan, A., & Callon, R. (2001). Multiprotocol Label Switching Architecture. RFC 3031. Internet Engineering Task Force (IETF).

Section 2.1: Defines Forwarding Equivalence Class (FEC) as a "group of IP packets which are forwarded in the same manner (e.g., over the same path, with the same forwarding treatment)."

Section 3.15: Discusses label distribution and the concept of popping the label at the penultimate hop (Penultimate Hop Popping).

Cisco Systems. (n.d.). MPLS Overview. Cisco IOS Multiprotocol Label Switching Configuration Guide.

Glossary/Key Concepts: Identifies Label Edge Routers (LERs) as devices that "operate at the edge of the access network and MPLS network... LERs support multiple ports connected to dissimilar networks... and impose labels."

LSR Definition: Defines an LSR as a high-speed router in the core that participates in MPLS label switching (swapping).

The route-map that sets weight 200 must be applied to inbound updates from 10.222.1.1 so the router can tag routes learned from that neighbor with the higher weight.

In the exhibit the route-map is attached in the outbound direction, therefore the weight is never added to the routes received from 10.222.1.1. Because those routes keep the default weight of 0, the best-path decision reverts to other attributes and a different neighbor is selected. Re-applying the route-map in the inbound direction (neighbor 10.222.1.1 route-map WEIGHT in) will make the router prefer that neighbor, sending traffic for AS 690 to 10.222.1.1.

A. Local preference is evaluated after weight; even a higher local-pref elsewhere cannot override a weight of 200 if it were actually applied.

B. Weight and local preference are independent attributes; matching their numeric values has no effect on path selection.

D. No other neighbor is configured with a higher weight; the problem is that 10.222.1.1’s weight is never applied, remaining at the default 0.

1. Cisco IOS IP Routing: BGP Command Reference

“set weight”

Usage Guidelines: “Valid only in route maps applied to inbound updates.” (Cisco Doc ID 16406

section ‘set weight’

para 3).

2. Cisco IOS XE 17 Routing Configuration Guide

“Configuring BGP Weight Attribute”

Step 2: “Apply the route map inbound… Weight is local to the router and set only on routes it receives.” (Configuration Guide

ch. “BGP Route Filtering”

p. 4).

3. Cisco “BGP Best Path Selection Algorithm” Technical White Paper

Step 1: “Prefer the path with the highest weight (local to router).” (white paper

rev 2

p. 2).

Multiprotocol Label Switching (MPLS) operates by inserting a "shim" header between the Layer 2 (Data Link) and Layer 3 (Network) headers of a packet. This header contains the MPLS label, which is used by MPLS-enabled routers to make forwarding decisions without needing to perform a complex lookup on the Layer 3 IP destination address. Because of its position between these two layers, MPLS is often referred to as a "Layer 2.5" technology. This placement allows MPLS to be protocol-agnostic at Layer 3, capable of carrying various payloads like IP, IPv6, or even Ethernet frames.

A. between Layer 5 and Layer 6: These are upper layers (Session and Presentation) that deal with application data representation and session management, not packet forwarding.

B. between Layer 1 and Layer 2: Layer 1 is the physical medium. MPLS operates on logical data units (frames/packets), not the raw bitstream.

C. between Layer 3 and Layer 4: Placing the label here would require processing the Layer 3 header first, defeating the primary purpose of MPLS, which is to avoid Layer 3 lookups.

1. IETF RFC 3031

"Multiprotocol Label Switching Architecture": Section 2.1

"The Label

" states

"In some applications

the label is carried in a small 'shim' which is located between the layer 2 and layer 3 headers." Section 3.1

"The Label Stack

" reiterates this: "The label stack...is carried in a 'shim' that appears between the data link layer and network layer headers."

2. Cisco Systems

"MPLS Basic Configuration Guide

Cisco IOS XE Gibraltar 16.12.x": In the "MPLS Overview" section

under the heading "MPLS Label

" the documentation states

"The label is imposed between the Layer 2 and Layer 3 headers."

3. Stallings

W. (2016). Data and Computer Communications (10th ed.). Pearson. Chapter 12

"Multiprotocol Label Switching

" Section 12.2

"MPLS Operation

" describes the MPLS header being inserted after the Layer 2 header and before the Layer 3 header. (Note: While a textbook

it is a peer-reviewed

standard academic text used in university curricula).

Implicit Null (Label 3): The "Implicit Null" label allows the egress Router to signal the Penultimate Hop to pop the top label (PHP). Although the label is removed before transmission, Label 3 is the reserved value defined in the RFCs to request this action.

Explicit Null (Label 0): This forces the Penultimate Hop to keep the packet encapsulated in an MPLS header (with Label 0) rather than popping it. This preserves the EXP bits (derived from IP Precedence/DSCP) so the egress router can perform QoS on the MPLS header before de-encapsulation.

Inbound Label Binding Filtering: By filtering which label bindings (mappings) are accepted from neighbors, a router prevents its memory (LIB) from being exhausted by unnecessary routes.

Entropy Label: Defined in RFC 6790, this label pushes flow information into the label stack, allowing transit routers to load-balance (hash) efficiently without needing to parse (DPI) the underlying IP headers.

RFC 3032, MPLS Label Stack Encoding, Section 2.1 "Reserved Values":

"3: Implicit Null Label... This label is an implicit label that implies that the label stack is popped." "0: IPv4 Explicit Null Label... The Explicit Null Label is a label that the egress LSR can advertise to the penultimate hop LSR... to keep the EXP bits."

RFC 6790, The Use of Entropy Labels in MPLS Forwarding, Abstract:

"Entropy labels... allow routers to load balance traffic... without needing to perform deep packet inspection (DPI)."

Cisco Systems, MPLS Label Distribution Protocol Configuration Guide, "Controlling the Advertising and Storage of LDP Label Bindings":

"You can configure the router to filter the label bindings that it accepts from its LDP neighbors... to conserve memory."

This configuration correctly configures BR1 and BR2 as DMVPN spokes.

1. NHRP (Goals 1 & 2): ip nhrp authentication ccnp123, ip nhrp network-id 100, and ip nhrp holdtime 300 (5 minutes) are set. The static ip nhrp map and ip nhrp nhs commands correctly point to the HUB's tunnel IP (192.168.1.254) and its public NBMA address (10.10.255.254).
2. Fragmentation (Goal 3): ip mtu 1400 and ip tcp mss 1360 are applied. ip fragmentation pre-encrypt ensures packets are fragmented before IPsec encapsulation, as required.
3. IPsec (Goal 4): tunnel protection ipsec profile DMVPN_PROFILE applies the preconfigured profile.
4. Base Config: tunnel source Ethernet0/1 uses the physical interface, and tunnel key 100 matches the "EIGRP ASN" requirement.

Cisco Systems. (2023). IPsec and DMVPN Configuration Guide, Cisco IOS XE 17.x. Sections: "Configuring NHRP on the Spoke," "Configuring IPsec," and "DMVPN: Tunnel-Specific IPsec."

Details: Confirms the use of ip nhrp map, ip nhrp nhs, ip nhrp network-id, ip nhrp authentication, and tunnel protection ipsec profile commands for spoke configuration.

Cisco Systems. (2023). Cisco IOS Interface and Hardware Component Command Reference.

Details: Documents the ip mtu command (Interface Commands section) to set the MTU size on an interface.

Details: Documents the ip tcp mss command (Interface Commands section) to set the maximum segment size for TCP connections.

Details: Documents the ip fragmentation pre-encrypt command (Interface Commands section), specifying its use "to enable prefragmentation for encrypted packets on a tunnel interface."

Cisco Systems. (2023). Cisco IOS IP Addressing Services Command Reference.

Details: Documents the ip nhrp holdtime command (NHRP Commands section), confirming its use to set the validity period for NHRP cache entries, with the value (300) specified in seconds.