300-410 IPv6 Traffic Filtering and uRPF Practice Questions

Question 1

A network engineer is troubleshooting a connectivity issue between two routers R1 and R2 connected via GigabitEthernet0/0. The engineer notices that R1 can ping its own IPv6 address 2001:db8:1::1/64, but cannot ping R2's interface address 2001:db8:1::2/64. The output of 'show ipv6 interface GigabitEthernet0/0' on R1 indicates that IPv6 is enabled and the interface is up/up. The engineer checks the access list applied to the interface and sees an inbound IPv6 ACL that permits only ICMPv6 echo requests from a specific source. What is the most likely cause of the ping failure?

Accepted Answer

The ACL is applied inbound on R1 and does not permit ICMPv6 echo replies from R2.. The inbound ACL on R1 is blocking the ICMPv6 echo reply from R2, because the ACL only permits echo requests from a specific source, not replies. For a successful ping, both the echo request and echo reply must be permitted. The reply is sourced from R2's address, which is not matched by the permit statement.

Answer

The ACL is applied outbound on R1 and blocks the echo request.

Answer

IPv6 unicast-routing is not enabled on R1.

Answer

The ACL is missing a permit statement for IPv6 neighbor discovery (ND) messages.

Question 2

A network engineer is troubleshooting a BGP IPv6 peering issue between two routers, R1 and R2, connected via a point-to-point link. The engineer notices that the BGP session is flapping with error 'BGP Notification sent: 3/2 (Update malformed)'. The engineer checks the IPv6 ACL applied to the interface on R1 and sees an inbound ACL that permits only TCP port 179 from the neighbor's link-local address. The BGP peering uses the global unicast addresses of the interfaces. What is the most likely cause of the BGP session failure?

Accepted Answer

The ACL is blocking TCP packets from the neighbor's global unicast address because it only permits traffic from the link-local address.. The BGP session is flapping because the inbound ACL on R1 permits only TCP port 179 traffic sourced from the neighbor's link-local address, but the BGP peering is configured using global unicast addresses. Therefore, TCP packets from R2's global unicast address are dropped by the ACL, causing the BGP session to fail with a 'Notification sent: 3/2 (Update malformed)' error, as the TCP connection cannot be established or maintained.

Answer

The BGP update is malformed because the neighbor does not have the correct route-map applied.

Answer

The ACL is missing a permit statement for ICMPv6 neighbor discovery messages.

Answer

The BGP session is using link-local addresses, but the ACL permits global addresses.

Question 3

A network engineer is troubleshooting an IPv6 routing issue on a router that is receiving OSPFv3 routes from multiple neighbors. The engineer notices that some routes are missing from the routing table. The engineer checks the interface configuration and finds an inbound IPv6 ACL applied to the interface that permits only specific prefixes. The engineer also notices that the missing routes are from a neighbor that is sending routes with a prefix length of /48, while the ACL permits only /64 prefixes. What is the most likely cause of the missing routes?

Accepted Answer

The ACL is filtering the OSPFv3 routes based on prefix length, and the /48 routes are not permitted.. The inbound IPv6 ACL on the interface is filtering OSPFv3 routes based on prefix length. Since the ACL permits only /64 prefixes, any routes with a /48 prefix length are denied and not installed in the routing table. This is the most likely cause of the missing routes.

Answer

The OSPFv3 neighbor relationship is down due to a mismatched area ID.

Answer

The router has a route-map that is denying the /48 routes before they are installed.

Answer

The IPv6 ACL is applied outbound, blocking the routes from being sent.

Question 4

A network engineer is troubleshooting a connectivity issue where a host on VLAN 10 cannot reach a server on VLAN 20. Both VLANs are on the same switch, which is running IPv6. The engineer checks the switch and finds that uRPF (unicast Reverse Path Forwarding) is enabled in strict mode on the VLAN 20 interface. The host's IPv6 address is 2001:db8:10::100/64, and the server's address is 2001:db8:20::200/64. The switch has a default route pointing to a next-hop router. The host sends traffic to the server, but the switch drops the packets. What is the most likely cause?

Accepted Answer

The uRPF strict mode check fails because the switch does not have a specific route to the host's subnet pointing back to the VLAN 10 interface.. With uRPF strict mode enabled on the VLAN 20 interface, the switch checks that the source IP address of incoming packets (2001:db8:10::100) is reachable via the same interface on which the packet arrived. Since the switch only has a default route pointing to a next-hop router and no specific route for the 2001:db8:10::/64 subnet pointing back to the VLAN 10 interface, the FIB lookup for the source address fails the strict uRPF check, causing the switch to drop the packet.

Answer

The uRPF mode should be loose mode to allow traffic from any source as long as there is a route in the FIB.

Answer

The host's IPv6 address is not in the switch's neighbor cache.

Answer

The switch has an ACL that blocks traffic between VLANs.

Question 5

A network engineer is troubleshooting an IPv6 connectivity issue on a router that is receiving routes via EIGRP for IPv6. The engineer notices that some routes are not being installed in the routing table, even though the EIGRP neighbor relationship is established. The engineer checks the interface configuration and finds an inbound IPv6 ACL that permits only certain EIGRP packets. The ACL permits EIGRP hello packets and updates, but not EIGRP queries or replies. What is the most likely cause of the missing routes?

Accepted Answer

The ACL is blocking EIGRP query and reply packets, which are necessary for the EIGRP process to install routes.. EIGRP for IPv6 uses multicast address FF02::A for all EIGRP packets, including hello, update, query, and reply. The ACL permits only hello and update packets, blocking query and reply packets. EIGRP requires query and reply packets for the Diffusing Update Algorithm (DUAL) to converge and install routes; without them, the router cannot complete the route installation process, even though the neighbor relationship is established.

Answer

The EIGRP router ID is not configured.

Answer

The ACL is applied outbound, blocking the EIGRP updates from being sent.

Answer

The EIGRP for IPv6 is not enabled on the interface.

Question 6

A network engineer is troubleshooting a scenario where a router is dropping IPv6 packets that are destined for a server on a directly connected network. The engineer checks the interface and finds that uRPF is enabled in loose mode. The router has a default route pointing to an upstream router. The source address of the packets is 2001:db8:100::1, which is not in the routing table (the router has no route to that prefix). What is the most likely cause of the packet drops?

Accepted Answer

The uRPF loose mode check fails because there is no route to the source address in the routing table.. With uRPF loose mode enabled, the router checks whether a route to the source address exists in the routing table, but it does not verify that the incoming interface matches the reverse path. Since the source address 2001:db8:100::1 is not present in the routing table, the loose mode check fails and the packets are dropped. The presence of a default route does not help because uRPF requires an exact match for the source prefix, not a default route.

Answer

The uRPF loose mode check fails because the source address is not reachable via the same interface.

Answer

The router has an ACL that blocks traffic from that source.

Answer

The uRPF mode should be strict mode to allow the traffic.

Question 7

A network engineer is troubleshooting an IPv6 multicast issue on a router. The router is receiving multicast traffic from a source, but the traffic is not being forwarded to downstream receivers. The engineer checks the interface and finds an inbound IPv6 ACL that permits only certain multicast groups. The ACL permits the group address FF1E::1, but the source address is 2001:db8:1::1. The engineer also notices that uRPF is enabled on the interface in strict mode. The router has a route to the source's network via a different interface. What is the most likely cause of the multicast forwarding failure?

Accepted Answer

The uRPF strict mode check fails because the route to the source's network points out a different interface than the one on which the multicast packet was received.. The correct answer is A. With uRPF strict mode enabled, the router checks that the source address of the incoming packet is reachable via the same interface on which the packet was received. Since the route to 2001:db8:1::1 points out a different interface, the uRPF check fails and the packet is dropped before any multicast forwarding can occur. This explains why the multicast traffic is not forwarded to downstream receivers despite the ACL permitting the group address.

Answer

The ACL is blocking the multicast traffic because the source address is not permitted.

Answer

The multicast routing is not enabled globally.

Answer

The downstream receivers are not in the multicast group.

Question 8

A network engineer is troubleshooting an IPv6 connectivity issue on a router that is using a tunnel interface (IPv6 over IPv4). The engineer notices that traffic is not passing through the tunnel. The engineer checks the tunnel interface and finds an inbound IPv6 ACL that permits only certain IPv6 traffic. The engineer also sees that uRPF is enabled on the tunnel interface in strict mode. The tunnel source and destination are IPv4 addresses. The IPv6 traffic sourced from a network behind the tunnel is being dropped. What is the most likely cause?

Accepted Answer

The uRPF strict mode check fails because the router does not have a route to the source IPv6 network pointing to the tunnel interface.. The uRPF strict mode check requires that the source IPv6 address of incoming traffic on the tunnel interface must have a route in the routing table pointing back to that same interface. Since the IPv6 traffic is sourced from a network behind the tunnel, the router likely has a route to that source network via a different interface (e.g., the physical LAN interface) or no route at all, causing uRPF to drop the packets. This is the most likely cause because the tunnel interface is the inbound interface for the decapsulated IPv6 packets, and uRPF strict mode validates the source address against the Forwarding Information Base (FIB) entry pointing to the tunnel interface.

Answer

The ACL is blocking the IPv6 traffic because the tunnel interface does not support ACLs.

Answer

The tunnel is not configured with the correct IPv4 source and destination.

Answer

The uRPF mode should be loose mode to allow traffic from any source.

Question 9

A network engineer is troubleshooting an IPv6 routing issue where a router is not learning routes from an OSPFv3 neighbor. The engineer checks the interface and finds an inbound IPv6 ACL that permits only OSPFv3 packets with a specific area ID in the packet. The ACL is using the 'ospfv3' keyword to match packets. The engineer also notices that the OSPFv3 neighbor is in a different area. What is the most likely cause of the route learning failure?

Accepted Answer

The ACL is dropping OSPFv3 packets from the neighbor because they contain a different area ID than what the ACL permits.. The ACL uses the 'ospfv3' keyword to match OSPFv3 packets and permits only those with a specific area ID. Since the neighbor is in a different area, its OSPFv3 packets contain a different area ID in the OSPFv3 header, causing the ACL to deny them. This prevents the router from receiving Hello packets and establishing adjacency, so routes are not learned.

Answer

The OSPFv3 process is not configured with the correct router ID.

Answer

The interface is not enabled for OSPFv3.

Answer

The ACL is applied outbound, blocking the OSPFv3 packets from being sent.

Question 10

A network engineer runs the following command on Router R1:

R1# show ipv6 interface gigabitethernet 0/0
GigabitEthernet0/0 is up, line protocol is up
  IPv6 is enabled, link-local address is FE80::1
  Global unicast address(es):
    2001:DB8:1:1::1, subnet is 2001:DB8:1:1::/64
  Joined group address(es):
    FF02::1
    FF02::2
  ICMP redirects are enabled
  ICMP unreachables are enabled
  ND DAD is enabled, number of DAD attempts: 1
  ND reachable time is 30000 milliseconds
  ND advertised reachable time is 0 milliseconds
  ND advertised retransmit interval is 1000 milliseconds
  ND router advertisements are sent every 200 seconds
  ND router advertisements live for 1800 seconds
  Hosts use stateless autoconfig for addresses.
  IPv6 uRPF: strict mode (drop invalid packets)

Based on this output, what is the operational state of uRPF on this interface?

Accepted Answer

uRPF is enabled in strict mode. The output explicitly states 'IPv6 uRPF: strict mode (drop invalid packets)', which confirms that unicast Reverse Path Forwarding (uRPF) is enabled on the interface and operating in strict mode. In strict mode, the router verifies that the source address of an incoming packet matches a route in the FIB pointing back to the same interface; if not, the packet is dropped. This is a direct read of the operational state from the show command.

Answer

uRPF is disabled

Answer

uRPF is enabled in loose mode

Answer

uRPF is enabled but only for multicast

IPv6 Traffic Filtering and uRPF

300-410 IPv6 Traffic Filtering and uRPF — Practice Questions

In IPv6, what is the default action for an access-list entry that does not specify a protocol?

What is the default uRPF mode when 'ipv6 verify unicast source reachable-via' is configured without any keyword?

According to RFC 2460, what is the correct behavior when an IPv6 router receives a packet with a source address that is a multicast address?

Which TWO commands can be used to verify IPv6 unicast RPF operation on an interface? (Choose TWO.)

A network engineer is troubleshooting IPv6 traffic filtering on a Cisco router. Which TWO statements about IPv6 ACLs are true? (Choose TWO.)

Which THREE symptoms indicate that IPv6 unicast RPF is misconfigured or failing on an interface? (Choose THREE.)

All 300-410 Objectives