300-410 IPv6 First Hop Security — 40 Questions

Question 1

A network engineer is troubleshooting an IPv6 neighbor discovery issue on a switch running IOS-XE. Hosts on VLAN 100 are intermittently losing connectivity to the default gateway. The switch is configured with IPv6 First Hop Security features including RA Guard and DHCPv6 Guard. The engineer notices that the switch is dropping valid Router Advertisements from the legitimate router. What is the most likely cause of this issue?

Accepted Answer

The RA Guard policy is configured with 'device-role router' on the port connected to the legitimate router, but the router's MAC address is not in the allowed list.. RA Guard is configured to drop RAs from unauthorized routers. If the legitimate router's MAC address is not in the RA Guard policy's allowed list or the policy is misconfigured, valid RAs will be dropped, causing hosts to lose their default gateway.

Answer

DHCPv6 Guard is blocking DHCPv6 Advertise messages from the router, preventing hosts from obtaining IPv6 addresses.

Answer

IPv6 Source Guard is dropping packets from the router because the router's IPv6 address is not in the binding table.

Answer

The switch has IPv6 unicast-routing enabled, causing it to send its own RAs and override the legitimate router.

Question 2

An engineer is troubleshooting a network where IPv6 hosts cannot obtain IP addresses via DHCPv6. The switch is configured with DHCPv6 Guard to prevent rogue DHCP servers. The legitimate DHCPv6 server is connected to port GigabitEthernet1/0/1. The engineer sees that DHCPv6 Solicit messages from hosts reach the server, but the server's Advertise and Reply messages are not reaching the hosts. What is the most likely root cause?

Accepted Answer

The DHCPv6 Guard policy is applied globally, and the port connected to the DHCP server is not configured as a trusted port for DHCPv6 server messages.. DHCPv6 Guard on the switch port connected to the DHCP server will drop DHCPv6 server messages (Advertise, Reply) unless the port is configured as a trusted DHCPv6 server port. If the port is not trusted, the server's responses are dropped.

Answer

RA Guard is blocking the DHCPv6 server's Router Advertisements, causing hosts to not send Solicit messages.

Answer

IPv6 Source Guard is filtering the server's responses because the server's IPv6 address is not in the binding table.

Answer

The switch has DHCP snooping enabled for IPv4, which is interfering with IPv6 DHCPv6 operation.

Question 3

A network engineer is troubleshooting an issue where IPv6 traffic is being forwarded incorrectly on a switch. The switch is configured with IPv6 Source Guard on access ports. A legitimate host on port Fa0/1 with IPv6 address 2001:db8:1::10 is unable to send traffic to the default gateway. The engineer checks the IPv6 binding table and sees that the host's entry is missing. What is the most likely cause?

Accepted Answer

The host is using a static IPv6 address, and ND snooping is not enabled on the VLAN, so the binding was never learned.. IPv6 Source Guard requires a valid binding entry (learned via DHCPv6 snooping or ND snooping) to permit traffic. If the host is using a static IPv6 address, ND snooping must be enabled to learn the binding; otherwise, traffic is dropped.

Answer

The host's MAC address is not in the MAC address table for VLAN 1.

Answer

The switch is running IPv6 First Hop Security in monitor mode, which logs violations but does not drop traffic.

Answer

The default gateway router is not sending Router Advertisements, so the host cannot form a default route.

Question 4

An engineer is troubleshooting an IPv6 connectivity issue where hosts on VLAN 10 cannot reach the internet. The switch is configured with IPv6 First Hop Security features including RA Guard and DHCPv6 Guard. The legitimate router is connected to port Gi1/0/1. The engineer notices that the router is sending RAs, but hosts are not receiving them. The switch shows that RA Guard is dropping packets on port Gi1/0/1. What is the most likely misconfiguration?

Accepted Answer

The RA Guard policy is configured with 'device-role host' on port Gi1/0/1, which causes the switch to drop all RAs received on that port.. RA Guard drops RAs from devices that are not authorized as routers. If the legitimate router's MAC address is not included in the RA Guard policy's allowed list, or if the port is not configured with the correct device-role, the RAs will be dropped.

Answer

DHCPv6 Guard is configured on port Gi1/0/1, blocking the router's DHCPv6 server messages.

Answer

IPv6 Source Guard is enabled on the VLAN, and the router's IPv6 address is not in the binding table.

Answer

The switch has IPv6 unicast-routing enabled, and it is sending its own RAs, causing a conflict.

Question 5

A network engineer is troubleshooting an issue where IPv6 hosts are unable to perform Duplicate Address Detection (DAD) successfully. The switch is configured with IPv6 First Hop Security features including ND Inspection and ND Suppress. The engineer notices that Neighbor Solicitation messages for DAD are being dropped by the switch. What is the most likely cause?

Accepted Answer

ND Inspection is configured to drop Neighbor Solicitations with an unspecified source address (::) because it has no binding for that address.. ND Suppress is a feature that suppresses Neighbor Advertisements for addresses that are in the binding table. However, if ND Inspection is misconfigured, it may drop Neighbor Solicitations that are part of DAD because the source address is the unspecified address (::) and the switch may not have a binding for it.

Answer

RA Guard is configured to drop all multicast traffic, including Neighbor Solicitations.

Answer

DHCPv6 Guard is blocking the DAD messages because they are considered DHCPv6 traffic.

Answer

IPv6 Source Guard is dropping the DAD messages because the source address :: is not in the binding table.

Question 6

An engineer is troubleshooting a network where IPv6 hosts on VLAN 20 are unable to communicate with each other. The switch is configured with IPv6 First Hop Security features including Private VLAN (PVLAN) and IPv6 Source Guard. The hosts are in the same VLAN but cannot ping each other. What is the most likely cause?

Accepted Answer

The switch has Private VLAN configured on VLAN 20, and the hosts are on isolated ports, which prevents direct communication.. Private VLAN (PVLAN) isolates ports within the same VLAN, preventing communication between hosts unless they are in the same community or are promiscuous ports. If the switch has PVLAN configured, hosts on isolated ports cannot communicate directly.

Answer

IPv6 Source Guard is blocking inter-host traffic because the hosts' bindings are not in the binding table.

Answer

RA Guard is blocking Neighbor Advertisements between hosts.

Answer

DHCPv6 Guard is blocking DHCPv6 messages between hosts.

Question 7

A network engineer is troubleshooting an issue where IPv6 traffic from a host is being dropped by the switch. The switch has IPv6 Source Guard enabled. The host has a static IPv6 address 2001:db8:2::20. The engineer sees that the binding table does not contain an entry for this host. What should the engineer do to resolve the issue without disabling IPv6 Source Guard?

Accepted Answer

Enable IPv6 ND snooping on the VLAN to allow the switch to learn the host's binding from Neighbor Discovery messages.. For static IPv6 addresses, IPv6 Source Guard relies on ND snooping to learn the binding. If ND snooping is not enabled, the binding will not be created, and traffic will be dropped. The fix is to enable ND snooping on the VLAN.

Answer

Configure the host to use DHCPv6 to obtain an address so that the binding is learned via DHCPv6 snooping.

Answer

Add a static binding entry for the host in the IPv6 binding table using the 'ipv6 neighbor' command.

Answer

Disable IPv6 Source Guard on the port connected to the host.

Question 8

An engineer is troubleshooting an issue where a rogue IPv6 router is sending false Router Advertisements on the network, causing hosts to use a malicious default gateway. The switch is configured with IPv6 First Hop Security features. The engineer wants to prevent this attack while allowing the legitimate router to send RAs. What is the correct configuration approach?

Accepted Answer

Configure RA Guard with a policy that sets the legitimate router's port as 'device-role router' and all other ports as 'device-role host', and apply the policy globally.. RA Guard is designed to prevent rogue RAs by allowing only authorized routers to send RAs. The correct approach is to configure RA Guard with a policy that trusts the legitimate router's port and drops RAs from all other ports.

Answer

Enable DHCPv6 Guard on all ports to block any DHCPv6 server messages, which will also block RAs.

Answer

Use IPv6 Source Guard to filter traffic from the rogue router based on its IPv6 address.

Answer

Configure a static IPv6 neighbor entry for the legitimate router on the switch to override rogue RAs.

Question 9

A network engineer is troubleshooting an issue where IPv6 hosts are receiving multiple Router Advertisements from different routers, causing routing instability. The switch is configured with IPv6 First Hop Security features. The engineer wants to ensure that only the primary router's RAs are accepted by hosts. What is the most effective solution?

Accepted Answer

Configure RA Guard with a policy that includes the primary router's MAC address in the allowed list and apply it to all ports.. RA Guard can be used to allow only authorized routers to send RAs. By configuring an RA Guard policy that permits only the primary router's MAC address, RAs from other routers will be dropped, ensuring stability.

Answer

Enable DHCPv6 Guard to block DHCPv6 messages from the secondary router.

Answer

Use IPv6 Source Guard to filter traffic from the secondary router.

Answer

Configure the switch to act as a router and send its own RAs with a higher priority to override the secondary router.

Question 10

A network engineer runs the following command on Router R1:

R1# show ipv6 snooping policy
Interface                      Policy                      Role            State
Gi0/0/0                        GUARD_POLICY                device-guard    ACTIVE
Gi0/0/1                        GUARD_POLICY                device-guard    ACTIVE
Gi0/0/2                        (default)                   host            ACTIVE

Based on this output, which statement is correct?

Accepted Answer

Interface Gi0/0/2 is not protected by the custom guard policy and may be vulnerable to spoofing attacks.. The output shows that interface Gi0/0/2 is using the default policy with role 'host', while Gi0/0/0 and Gi0/0/1 are configured with a specific policy named GUARD_POLICY and role 'device-guard'. This indicates that Gi0/0/2 is not protected by the custom guard policy, which could allow rogue DHCPv6 or ND messages on that interface.

Answer

Interface Gi0/0/2 is protected by the GUARD_POLICY policy.

Answer

All interfaces are equally protected by the same policy.

Answer

The role 'host' means Gi0/0/2 is acting as a device-guard.

Question 11

A network engineer runs the following command on Router R1:

R1# show ipv6 nd raguard policy
Interface                      Policy                      Role            State
Gi0/0/0                        RA_GUARD                    router          ACTIVE
Gi0/0/1                        RA_GUARD                    host            ACTIVE
Gi0/0/2                        (default)                   host            ACTIVE

Based on this output, which statement is correct?

Accepted Answer

Interface Gi0/0/0 is allowed to send Router Advertisements.. The output shows that Gi0/0/0 is configured with role 'router' under the RA_GUARD policy, meaning it is trusted to send Router Advertisements. Gi0/0/1 and Gi0/0/2 have role 'host', meaning they are not allowed to send RAs. The default policy on Gi0/0/2 still blocks RAs from that interface.

Answer

Interface Gi0/0/1 is allowed to send Router Advertisements.

Answer

Interface Gi0/0/2 is allowed to send Router Advertisements.

Answer

All interfaces are blocked from sending Router Advertisements.

Question 12

A network engineer runs the following command on Router R1:

R1# show ipv6 dhcp guard policy
Interface                      Policy                      Role            State
Gi0/0/0                        DHCP_GUARD                  server          ACTIVE
Gi0/0/1                        DHCP_GUARD                  client          ACTIVE
Gi0/0/2                        (default)                   client          ACTIVE

Based on this output, which statement is correct?

Accepted Answer

Interface Gi0/0/0 is trusted to send DHCPv6 replies.. The output shows Gi0/0/0 is configured as a DHCP server (trusted to send DHCP replies), while Gi0/0/1 and Gi0/0/2 are clients (not trusted to send DHCP replies). This is typical for DHCP guard to prevent rogue DHCP servers.

Answer

Interface Gi0/0/1 is trusted to send DHCPv6 replies.

Answer

Interface Gi0/0/2 is trusted to send DHCPv6 replies.

Answer

All interfaces are blocked from sending DHCPv6 replies.

Question 13

A network engineer runs the following command on Router R1:

R1# show ipv6 source-guard policy
Interface                      Policy                      Role            State
Gi0/0/0                        SRC_GUARD                   host            ACTIVE
Gi0/0/1                        SRC_GUARD                   host            ACTIVE
Gi0/0/2                        (default)                   host            ACTIVE

Based on this output, which statement is correct?

Accepted Answer

Source guard is enabled on all interfaces, preventing IPv6 address spoofing.. All interfaces are using the SRC_GUARD policy or default with role 'host', meaning source address validation is enforced on all interfaces. This prevents hosts from spoofing IPv6 addresses.

Answer

Only Gi0/0/0 and Gi0/0/1 have source guard enabled.

Answer

Source guard is disabled on Gi0/0/2 because it uses the default policy.

Answer

Role 'host' means the interface is a router port.

Question 14

A network engineer runs the following command on Router R1:

R1# show ipv6 neighbors
IPv6 Address                              Age Link-layer Addr State Interface
2001:DB8:1::1                              0   aaaa.bbbb.cccc  REACH  Gi0/0/0
2001:DB8:1::2                             10   aaaa.bbbb.cccd  STALE  Gi0/0/0
2001:DB8:1::3                              -   aaaa.bbbb.ccce  DELAY  Gi0/0/1
FE80::1                                    0   aaaa.bbbb.cccf  REACH  Gi0/0/0

Based on this output, which statement is correct?

Accepted Answer

The neighbor 2001:DB8:1::3 is in DELAY state, meaning a Neighbor Solicitation will be sent soon.. The neighbor table shows IPv6 neighbors with different states. The entry for 2001:DB8:1::3 has no age (indicated by '-') and is in DELAY state, which means it is waiting for a Neighbor Solicitation to be sent. This could indicate a potential issue with neighbor reachability or a spoofing attempt if the MAC address is unexpected.

Answer

All neighbors are in a stable state.

Answer

The neighbor 2001:DB8:1::2 is unreachable.

Answer

The link-local address FE80::1 is not valid.

Question 15

A network engineer runs the following command on Router R1:

R1# show ipv6 dhcp binding
Client: FE80::1
  DUID: 0003000100AABBCCDDEE
  Username: unknown
  IA NA: IA ID 0x00010001, T1 302400, T2 483840
    Address: 2001:DB8:1::100/128
      Preferred lifetime 604800, valid lifetime 2592000
      Expires at Sep 15 2024 12:00 PM (2592000 seconds)

Based on this output, which statement is correct?

Accepted Answer

The client has been assigned an IPv6 address via DHCPv6.. The output shows a DHCPv6 binding for a client with link-local address FE80::1, DUID, and an assigned IPv6 address 2001:DB8:1::100/128 with valid lifetime. This indicates that DHCPv6 is functioning and the client has a valid lease.

Answer

The client is using SLAAC instead of DHCPv6.

Answer

The client's lease has expired.

Answer

The client is not authorized.

Question 16

A network engineer runs the following command on Router R1:

R1# show ipv6 dhcp interface Gi0/0/0
Gi0/0/0 is in server mode
  Uses prefix 2001:DB8:1::/64
  Rapid-Commit is disabled
  Preference value: 0
  Information refresh option: 86400
  DNS server: 2001:DB8::1
  Domain name: example.com
  Active clients: 5
  Pool: DHCP_POOL

Based on this output, which statement is correct?

Accepted Answer

The router is acting as a DHCPv6 server on Gi0/0/0 and has 5 active clients.. The interface is configured as a DHCPv6 server with a prefix, DNS server, and domain name. It has 5 active clients. This means the router is providing DHCPv6 services on that interface.

Answer

The router is acting as a DHCPv6 client on Gi0/0/0.

Answer

Rapid-Commit is enabled.

Answer

The interface is using SLAAC for address assignment.

Question 17

A network engineer runs the following command on Router R1:

R1# show ipv6 traffic
IPv6 statistics:
  Rcvd: 1000 total, 800 unicast, 200 multicast
  Sent: 900 total, 700 unicast, 200 multicast
  Errors: 0
  Dropped: 0
  ND statistics:
    NS: 50 received, 40 sent
    NA: 30 received, 20 sent
    RS: 10 received, 5 sent
    RA: 2 received, 8 sent
    Redirect: 0 received, 0 sent

Based on this output, which statement is correct?

Accepted Answer

The router is receiving more Neighbor Solicitations than it is sending, which is expected.. The ND statistics show that Router Advertisements (RAs) are being sent (8 sent) and received (2 received). This is normal for a router that is advertising itself. The numbers are balanced and indicate proper ND operation.

Answer

The router is not sending any Router Advertisements.

Answer

There is a high number of errors in IPv6 traffic.

Answer

The router is dropping many packets.

Question 18

A network engineer runs the following command on Router R1:

R1# show ipv6 snooping binding
IPv6 Address                              MAC Address       VLAN Interface        State
2001:DB8:1::100                           aaaa.bbbb.cccc    10    Gi0/0/0          ACTIVE
2001:DB8:1::101                           aaaa.bbbb.cccd    10    Gi0/0/0          ACTIVE
2001:DB8:1::102                           aaaa.bbbb.ccce    10    Gi0/0/1          ACTIVE
2001:DB8:1::103                           aaaa.bbbb.cccf    10    Gi0/0/1          ACTIVE

Based on this output, which statement is correct?

Accepted Answer

All entries are in the ACTIVE state, meaning they are valid bindings.. The snooping binding table shows the IPv6 addresses and corresponding MAC addresses for devices on VLAN 10. All entries are ACTIVE, meaning they have been validated. This is used for source guard and other first-hop security features.

Answer

The binding for 2001:DB8:1::103 is invalid.

Answer

The table shows only IPv6 addresses from SLAAC.

Answer

There are no entries for VLAN 10.

Question 19

Interface GigabitEthernet0/1 is configured as shown:

interface GigabitEthernet0/1
 ipv6 address 2001:db8:1::1/64
 ipv6 nd raguard
 ipv6 nd prefix default no-autoconfig

What is the effect of this configuration?

Accepted Answer

The interface drops all incoming Router Advertisements from other routers.. The 'ipv6 nd raguard' command enables Router Advertisement guard on the interface, which filters RAs. The 'ipv6 nd prefix default no-autoconfig' suppresses the autonomous address configuration flag in RAs, preventing hosts from using SLAAC.

Answer

The interface sends RAs with the autonomous flag set to allow SLAAC.

Answer

The interface only allows RAs from a specific authorized router.

Answer

The interface drops all Neighbor Solicitations.

Question 20

Examine the following partial IPv6 DHCP guard configuration:

ipv6 dhcp guard policy DHCP_GUARD
 device-role server
 match server access-list SERVER_ACL
interface GigabitEthernet0/2
 ipv6 dhcp guard policy DHCP_GUARD

Which statement is true about this configuration?

Accepted Answer

The interface will allow DHCP server messages only from sources matching SERVER_ACL.. DHCP guard policy with device-role server allows DHCP server messages only if they match the access-list. The interface applies the policy to filter DHCP messages.

Answer

The interface will block all DHCP server messages.

Answer

The interface will allow all DHCP client messages.

Answer

The interface will drop all DHCP messages.