300-410 IPv6 Traffic Filtering and uRPF — 30 Questions

Question 1

A network engineer is troubleshooting a connectivity issue between two routers R1 and R2 connected via GigabitEthernet0/0. The engineer notices that R1 can ping its own IPv6 address 2001:db8:1::1/64, but cannot ping R2's interface address 2001:db8:1::2/64. The output of 'show ipv6 interface GigabitEthernet0/0' on R1 indicates that IPv6 is enabled and the interface is up/up. The engineer checks the access list applied to the interface and sees an inbound IPv6 ACL that permits only ICMPv6 echo requests from a specific source. What is the most likely cause of the ping failure?

Accepted Answer

The ACL is applied inbound on R1 and does not permit ICMPv6 echo replies from R2.. The inbound ACL on R1 is blocking the ICMPv6 echo reply from R2, because the ACL only permits echo requests from a specific source, not replies. For a successful ping, both the echo request and echo reply must be permitted. The reply is sourced from R2's address, which is not matched by the permit statement.

Answer

The ACL is applied outbound on R1 and blocks the echo request.

Answer

IPv6 unicast-routing is not enabled on R1.

Answer

The ACL is missing a permit statement for IPv6 neighbor discovery (ND) messages.

Question 2

A network engineer is troubleshooting a BGP IPv6 peering issue between two routers, R1 and R2, connected via a point-to-point link. The engineer notices that the BGP session is flapping with error 'BGP Notification sent: 3/2 (Update malformed)'. The engineer checks the IPv6 ACL applied to the interface on R1 and sees an inbound ACL that permits only TCP port 179 from the neighbor's link-local address. The BGP peering uses the global unicast addresses of the interfaces. What is the most likely cause of the BGP session failure?

Accepted Answer

The ACL is blocking TCP packets from the neighbor's global unicast address because it only permits traffic from the link-local address.. The BGP session is flapping because the inbound ACL on R1 permits only TCP port 179 traffic sourced from the neighbor's link-local address, but the BGP peering is configured using global unicast addresses. Therefore, TCP packets from R2's global unicast address are dropped by the ACL, causing the BGP session to fail with a 'Notification sent: 3/2 (Update malformed)' error, as the TCP connection cannot be established or maintained.

Answer

The BGP update is malformed because the neighbor does not have the correct route-map applied.

Answer

The ACL is missing a permit statement for ICMPv6 neighbor discovery messages.

Answer

The BGP session is using link-local addresses, but the ACL permits global addresses.

Question 3

A network engineer is troubleshooting an IPv6 routing issue on a router that is receiving OSPFv3 routes from multiple neighbors. The engineer notices that some routes are missing from the routing table. The engineer checks the interface configuration and finds an inbound IPv6 ACL applied to the interface that permits only specific prefixes. The engineer also notices that the missing routes are from a neighbor that is sending routes with a prefix length of /48, while the ACL permits only /64 prefixes. What is the most likely cause of the missing routes?

Accepted Answer

The ACL is filtering the OSPFv3 routes based on prefix length, and the /48 routes are not permitted.. The inbound IPv6 ACL on the interface is filtering OSPFv3 routes based on prefix length. Since the ACL permits only /64 prefixes, any routes with a /48 prefix length are denied and not installed in the routing table. This is the most likely cause of the missing routes.

Answer

The OSPFv3 neighbor relationship is down due to a mismatched area ID.

Answer

The router has a route-map that is denying the /48 routes before they are installed.

Answer

The IPv6 ACL is applied outbound, blocking the routes from being sent.

Question 4

A network engineer is troubleshooting a connectivity issue where a host on VLAN 10 cannot reach a server on VLAN 20. Both VLANs are on the same switch, which is running IPv6. The engineer checks the switch and finds that uRPF (unicast Reverse Path Forwarding) is enabled in strict mode on the VLAN 20 interface. The host's IPv6 address is 2001:db8:10::100/64, and the server's address is 2001:db8:20::200/64. The switch has a default route pointing to a next-hop router. The host sends traffic to the server, but the switch drops the packets. What is the most likely cause?

Accepted Answer

The uRPF strict mode check fails because the switch does not have a specific route to the host's subnet pointing back to the VLAN 10 interface.. With uRPF strict mode enabled on the VLAN 20 interface, the switch checks that the source IP address of incoming packets (2001:db8:10::100) is reachable via the same interface on which the packet arrived. Since the switch only has a default route pointing to a next-hop router and no specific route for the 2001:db8:10::/64 subnet pointing back to the VLAN 10 interface, the FIB lookup for the source address fails the strict uRPF check, causing the switch to drop the packet.

Answer

The uRPF mode should be loose mode to allow traffic from any source as long as there is a route in the FIB.

Answer

The host's IPv6 address is not in the switch's neighbor cache.

Answer

The switch has an ACL that blocks traffic between VLANs.

Question 5

A network engineer is troubleshooting an IPv6 connectivity issue on a router that is receiving routes via EIGRP for IPv6. The engineer notices that some routes are not being installed in the routing table, even though the EIGRP neighbor relationship is established. The engineer checks the interface configuration and finds an inbound IPv6 ACL that permits only certain EIGRP packets. The ACL permits EIGRP hello packets and updates, but not EIGRP queries or replies. What is the most likely cause of the missing routes?

Accepted Answer

The ACL is blocking EIGRP query and reply packets, which are necessary for the EIGRP process to install routes.. EIGRP for IPv6 uses multicast address FF02::A for all EIGRP packets, including hello, update, query, and reply. The ACL permits only hello and update packets, blocking query and reply packets. EIGRP requires query and reply packets for the Diffusing Update Algorithm (DUAL) to converge and install routes; without them, the router cannot complete the route installation process, even though the neighbor relationship is established.

Answer

The EIGRP router ID is not configured.

Answer

The ACL is applied outbound, blocking the EIGRP updates from being sent.

Answer

The EIGRP for IPv6 is not enabled on the interface.

Question 6

A network engineer is troubleshooting a scenario where a router is dropping IPv6 packets that are destined for a server on a directly connected network. The engineer checks the interface and finds that uRPF is enabled in loose mode. The router has a default route pointing to an upstream router. The source address of the packets is 2001:db8:100::1, which is not in the routing table (the router has no route to that prefix). What is the most likely cause of the packet drops?

Accepted Answer

The uRPF loose mode check fails because there is no route to the source address in the routing table.. With uRPF loose mode enabled, the router checks whether a route to the source address exists in the routing table, but it does not verify that the incoming interface matches the reverse path. Since the source address 2001:db8:100::1 is not present in the routing table, the loose mode check fails and the packets are dropped. The presence of a default route does not help because uRPF requires an exact match for the source prefix, not a default route.

Answer

The uRPF loose mode check fails because the source address is not reachable via the same interface.

Answer

The router has an ACL that blocks traffic from that source.

Answer

The uRPF mode should be strict mode to allow the traffic.

Question 7

A network engineer is troubleshooting an IPv6 multicast issue on a router. The router is receiving multicast traffic from a source, but the traffic is not being forwarded to downstream receivers. The engineer checks the interface and finds an inbound IPv6 ACL that permits only certain multicast groups. The ACL permits the group address FF1E::1, but the source address is 2001:db8:1::1. The engineer also notices that uRPF is enabled on the interface in strict mode. The router has a route to the source's network via a different interface. What is the most likely cause of the multicast forwarding failure?

Accepted Answer

The uRPF strict mode check fails because the route to the source's network points out a different interface than the one on which the multicast packet was received.. The correct answer is A. With uRPF strict mode enabled, the router checks that the source address of the incoming packet is reachable via the same interface on which the packet was received. Since the route to 2001:db8:1::1 points out a different interface, the uRPF check fails and the packet is dropped before any multicast forwarding can occur. This explains why the multicast traffic is not forwarded to downstream receivers despite the ACL permitting the group address.

Answer

The ACL is blocking the multicast traffic because the source address is not permitted.

Answer

The multicast routing is not enabled globally.

Answer

The downstream receivers are not in the multicast group.

Question 8

A network engineer is troubleshooting an IPv6 connectivity issue on a router that is using a tunnel interface (IPv6 over IPv4). The engineer notices that traffic is not passing through the tunnel. The engineer checks the tunnel interface and finds an inbound IPv6 ACL that permits only certain IPv6 traffic. The engineer also sees that uRPF is enabled on the tunnel interface in strict mode. The tunnel source and destination are IPv4 addresses. The IPv6 traffic sourced from a network behind the tunnel is being dropped. What is the most likely cause?

Accepted Answer

The uRPF strict mode check fails because the router does not have a route to the source IPv6 network pointing to the tunnel interface.. The uRPF strict mode check requires that the source IPv6 address of incoming traffic on the tunnel interface must have a route in the routing table pointing back to that same interface. Since the IPv6 traffic is sourced from a network behind the tunnel, the router likely has a route to that source network via a different interface (e.g., the physical LAN interface) or no route at all, causing uRPF to drop the packets. This is the most likely cause because the tunnel interface is the inbound interface for the decapsulated IPv6 packets, and uRPF strict mode validates the source address against the Forwarding Information Base (FIB) entry pointing to the tunnel interface.

Answer

The ACL is blocking the IPv6 traffic because the tunnel interface does not support ACLs.

Answer

The tunnel is not configured with the correct IPv4 source and destination.

Answer

The uRPF mode should be loose mode to allow traffic from any source.

Question 9

A network engineer is troubleshooting an IPv6 routing issue where a router is not learning routes from an OSPFv3 neighbor. The engineer checks the interface and finds an inbound IPv6 ACL that permits only OSPFv3 packets with a specific area ID in the packet. The ACL is using the 'ospfv3' keyword to match packets. The engineer also notices that the OSPFv3 neighbor is in a different area. What is the most likely cause of the route learning failure?

Accepted Answer

The ACL is dropping OSPFv3 packets from the neighbor because they contain a different area ID than what the ACL permits.. The ACL uses the 'ospfv3' keyword to match OSPFv3 packets and permits only those with a specific area ID. Since the neighbor is in a different area, its OSPFv3 packets contain a different area ID in the OSPFv3 header, causing the ACL to deny them. This prevents the router from receiving Hello packets and establishing adjacency, so routes are not learned.

Answer

The OSPFv3 process is not configured with the correct router ID.

Answer

The interface is not enabled for OSPFv3.

Answer

The ACL is applied outbound, blocking the OSPFv3 packets from being sent.

Question 10

A network engineer runs the following command on Router R1:

R1# show ipv6 interface gigabitethernet 0/0
GigabitEthernet0/0 is up, line protocol is up
  IPv6 is enabled, link-local address is FE80::1
  Global unicast address(es):
    2001:DB8:1:1::1, subnet is 2001:DB8:1:1::/64
  Joined group address(es):
    FF02::1
    FF02::2
  ICMP redirects are enabled
  ICMP unreachables are enabled
  ND DAD is enabled, number of DAD attempts: 1
  ND reachable time is 30000 milliseconds
  ND advertised reachable time is 0 milliseconds
  ND advertised retransmit interval is 1000 milliseconds
  ND router advertisements are sent every 200 seconds
  ND router advertisements live for 1800 seconds
  Hosts use stateless autoconfig for addresses.
  IPv6 uRPF: strict mode (drop invalid packets)

Based on this output, what is the operational state of uRPF on this interface?

Accepted Answer

uRPF is enabled in strict mode. The output explicitly states 'IPv6 uRPF: strict mode (drop invalid packets)', which confirms that unicast Reverse Path Forwarding (uRPF) is enabled on the interface and operating in strict mode. In strict mode, the router verifies that the source address of an incoming packet matches a route in the FIB pointing back to the same interface; if not, the packet is dropped. This is a direct read of the operational state from the show command.

Answer

uRPF is disabled

Answer

uRPF is enabled in loose mode

Answer

uRPF is enabled but only for multicast

Question 11

A network engineer runs the following command on Router R1:

R1# show ipv6 interface tunnel 0
Tunnel0 is up, line protocol is up
  IPv6 is enabled, link-local address is FE80::1
  Global unicast address(es):
    2001:DB8:2::1, subnet is 2001:DB8:2::/64
  Joined group address(es):
    FF02::1
    FF02::2
  ICMP redirects are enabled
  ICMP unreachables are enabled
  ND DAD is enabled, number of DAD attempts: 1
  ND reachable time is 30000 milliseconds
  IPv6 uRPF: loose mode (allow default route)

Based on this output, what is the uRPF configuration on this interface?

Accepted Answer

uRPF is enabled in loose mode. The output explicitly shows 'IPv6 uRPF: loose mode (allow default route)', which confirms that unicast Reverse Path Forwarding (uRPF) is enabled in loose mode. In loose mode, the router checks that the source address of an incoming packet has a matching entry in the routing table, but it does not require the incoming interface to match the best return path. This is distinct from strict mode, which requires both a routing table entry and that the incoming interface is the same as the outgoing interface for the return route.

Answer

uRPF is disabled

Answer

uRPF is enabled in strict mode

Answer

uRPF is enabled but only for IPv4

Question 12

A network engineer runs the following command on Router R1:

R1# show ipv6 access-list FILTER-IPv6
IPv6 access list FILTER-IPv6
    permit ipv6 2001:DB8:1::/48 any sequence 10
    deny ipv6 any any sequence 20

Based on this output, what is the effect of this access list when applied to an interface?

Accepted Answer

It permits only IPv6 traffic from 2001:DB8:1::/48 and denies everything else. The access list FILTER-IPv6 has two entries: a permit statement for source 2001:DB8:1::/48 to any destination (sequence 10), followed by an implicit deny all (sequence 20). When applied to an interface, only traffic matching the permit entry is allowed; all other IPv6 traffic is denied by the implicit deny rule at the end of the list. This results in permitting only traffic from the specified prefix and denying everything else.

Answer

It permits all IPv6 traffic

Answer

It denies all IPv6 traffic from 2001:DB8:1::/48

Answer

It permits all IPv6 traffic except from 2001:DB8:1::/48

Question 13

A network engineer runs the following command on Router R1:

R1# show ipv6 interface gigabitethernet 0/0 | include uRPF
  IPv6 uRPF: strict mode

Based on this output, which statement is true?

Accepted Answer

uRPF is enabled in strict mode. The command output explicitly shows 'IPv6 uRPF: strict mode', which confirms that unicast Reverse Path Forwarding (uRPF) is enabled and operating in strict mode. In strict mode, the router verifies that the source address of an incoming packet matches a route in the FIB and that the incoming interface is the same as the outgoing interface for that route. This prevents spoofed traffic from entering the network.

Answer

uRPF is disabled

Answer

uRPF is enabled in loose mode

Answer

uRPF is enabled but only for multicast

Question 14

A network engineer runs the following command on Router R1:

R1# show ipv6 interface gigabitethernet 0/0 | include uRPF
  IPv6 uRPF: loose mode

Based on this output, what is the operational state of uRPF on this interface?

Accepted Answer

uRPF is enabled in loose mode. The command 'show ipv6 interface gigabitethernet 0/0 | include uRPF' returns 'IPv6 uRPF: loose mode', which directly indicates that unicast Reverse Path Forwarding (uRPF) is enabled and operating in loose mode on this interface. Loose mode checks only that a source address exists in the routing table, without requiring that the incoming interface matches the best return path.

Answer

uRPF is disabled

Answer

uRPF is enabled in strict mode

Answer

uRPF is enabled but only for IPv4

Question 15

A network engineer runs the following command on Router R1:

R1# show ipv6 access-list DENY-REMOTE
IPv6 access list DENY-REMOTE
    deny ipv6 2001:DB8:2::/48 any sequence 10
    permit ipv6 any any sequence 20

Based on this output, what is the effect of this access list when applied to an interface?

Accepted Answer

It denies all IPv6 traffic from 2001:DB8:2::/48 and permits everything else. The access list DENY-REMOTE explicitly denies IPv6 traffic sourced from the prefix 2001:DB8:2::/48 (sequence 10) and then permits all other IPv6 traffic (sequence 20). When applied to an interface, this results in only traffic from that specific prefix being blocked, while all other IPv6 traffic is allowed. This matches option B.

Answer

It permits all IPv6 traffic

Answer

It permits only IPv6 traffic from 2001:DB8:2::/48

Answer

It denies all IPv6 traffic

Question 16

A network engineer runs the following command on Router R1:

R1# show ipv6 interface gigabitethernet 0/0 | include uRPF
  IPv6 uRPF: strict mode (allow default route)

Based on this output, what is the uRPF configuration on this interface?

Accepted Answer

uRPF is enabled in strict mode with allow-default. The command output explicitly shows 'IPv6 uRPF: strict mode (allow default route)', which confirms that uRPF is enabled in strict mode with the allow-default option. This configuration validates that the source address of incoming packets must have a matching route in the FIB pointing back to the same interface, and the allow-default keyword permits the use of a default route as a valid reverse path, which is necessary in scenarios where a default route is the only route to the source.

Answer

uRPF is disabled

Answer

uRPF is enabled in loose mode

Answer

uRPF is enabled but only for multicast

Question 17

A network engineer runs the following command on Router R1:

R1# show ipv6 interface gigabitethernet 0/0
GigabitEthernet0/0 is up, line protocol is up
  IPv6 is enabled, link-local address is FE80::1
  Global unicast address(es):
    2001:DB8:1:1::1, subnet is 2001:DB8:1:1::/64
  Joined group address(es):
    FF02::1
    FF02::2
  ICMP redirects are enabled
  ICMP unreachables are enabled
  ND DAD is enabled, number of DAD attempts: 1
  ND reachable time is 30000 milliseconds
  ND advertised reachable time is 0 milliseconds
  ND advertised retransmit interval is 1000 milliseconds
  ND router advertisements are sent every 200 seconds
  ND router advertisements live for 1800 seconds
  Hosts use stateless autoconfig for addresses.
  IPv6 uRPF: strict mode (drop invalid packets)
  Inbound access list: FILTER-IPv6

Based on this output, which two features are configured on this interface?

Accepted Answer

uRPF in strict mode and inbound IPv6 ACL. The output shows 'IPv6 uRPF: strict mode (drop invalid packets)' and 'Inbound access list: FILTER-IPv6', confirming that unicast Reverse Path Forwarding in strict mode and an inbound IPv6 ACL are both configured on the interface. Strict uRPF verifies that the source address of incoming packets has a matching route in the FIB pointing back to the same interface, dropping packets that fail this check. The inbound ACL filters traffic before any routing decision, as indicated by the 'Inbound access list' line.

Answer

uRPF in loose mode and outbound IPv6 ACL

Answer

uRPF disabled and inbound IPv6 ACL

Answer

uRPF in strict mode and outbound IPv6 ACL

Question 18

A network engineer runs the following command on Router R1:

R1# show ipv6 access-list PERMIT-ONLY
IPv6 access list PERMIT-ONLY
    permit ipv6 2001:DB8:3::/48 any sequence 10

Based on this output, what is the effect of this access list when applied to an interface?

Accepted Answer

It permits only IPv6 traffic from 2001:DB8:3::/48 and denies everything else. Option B is correct because an IPv6 access list, like its IPv4 counterpart, has an implicit deny all at the end. The single permit entry for source 2001:DB8:3::/48 allows only traffic from that prefix; all other IPv6 traffic is denied by the implicit deny ipv6 any any rule.

Answer

It permits all IPv6 traffic

Answer

It denies all IPv6 traffic from 2001:DB8:3::/48

Answer

It permits all IPv6 traffic except from 2001:DB8:3::/48

Question 19

Examine the following IPv6 ACL applied to an interface:

ipv6 access-list FILTER
 permit ipv6 any any fragments
 deny ipv6 any any

interface GigabitEthernet0/1
 ipv6 traffic-filter FILTER in

What is the effect of this configuration?

Accepted Answer

Only fragmented IPv6 packets are permitted; all other IPv6 traffic is denied.. Option B is correct because the ACL explicitly permits only fragmented IPv6 packets via the 'permit ipv6 any any fragments' statement, while the subsequent 'deny ipv6 any any' statement denies all other IPv6 traffic. Since ACLs are processed sequentially, the permit for fragments is evaluated first, allowing only fragmented packets; all non-fragmented packets are then denied by the second entry.

Answer

All IPv6 traffic is permitted because the permit statement matches any packet.

Answer

The ACL is invalid because 'fragments' cannot be used with 'any any'.

Answer

The interface command is missing the 'ipv6 enable' prerequisite.

Question 20

Consider the following configuration:

ipv6 access-list BLOCK-ICMP
 deny icmp any any echo-request
 deny icmp any any echo-reply
 permit ipv6 any any

interface GigabitEthernet0/2
 ipv6 traffic-filter BLOCK-ICMP in

Which statement is true?

Accepted Answer

The ACL blocks ICMP echo-request and echo-reply, but permits all other IPv6 traffic inbound.. Option A is correct because the IPv6 ACL explicitly denies ICMPv6 echo-request and echo-reply messages (types 128 and 129) while the final permit ipv6 any any statement allows all other IPv6 traffic. The ipv6 traffic-filter command applied inbound on GigabitEthernet0/2 filters traffic as it enters the interface, so only the specified ICMP types are blocked, and all other IPv6 traffic is permitted.

Answer

The ACL blocks all ICMPv6 traffic because the deny statements are too broad.

Answer

The ACL must be applied outbound to filter echo-request.

Answer

The ACL is missing the 'log' keyword to be effective.