300-410 IPv6 Tunneling Techniques — 20 Questions

Question 1

A network engineer is troubleshooting an IPv6 connectivity issue between two sites connected via a 6to4 tunnel. The tunnel is configured on both routers and shows as up/up, but the engineer cannot ping the IPv6 address of the remote tunnel endpoint. The engineer checks the routing table and sees no route to the remote IPv6 prefix. What is the most likely cause of this problem?

Accepted Answer

The tunnel source interface is configured with a private IPv4 address, causing the 6to4 prefix to be invalid.. For a 6to4 tunnel, the IPv6 address on the tunnel interface must be derived from the tunnel source's public IPv4 address using the 2002:IPv4-address::/48 prefix format. If the tunnel source interface has a private IPv4 address (e.g., 10.0.0.1), the resulting 6to4 prefix (2002:0a00:0001::/48) is non-routable over the public Internet because private addresses are not globally unique. This causes the remote router to have no route to the invalid prefix, breaking connectivity even though the tunnel interface is up/up.

Answer

The tunnel mode is incorrectly set to ipv6ip instead of 6to4.

Answer

The tunnel destination is misconfigured with the remote router's IPv6 address instead of its IPv4 address.

Answer

The IPv6 address on the tunnel interface is not in the 2002::/16 range.

Question 2

An engineer is troubleshooting an ISATAP tunnel between a Windows host and a Cisco router. The host can ping the router's IPv6 address configured on the tunnel interface, but cannot reach any other IPv6 networks beyond the router. The router has a default route pointing to an upstream IPv6 router. What is the most likely cause?

Accepted Answer

The router is not configured as an ISATAP router; it only has the tunnel interface but lacks the 'ipv6 isatap' command.. The correct answer is A. For ISATAP to function, the router must be explicitly configured as an ISATAP router using the 'ipv6 isatap' command under the tunnel interface. Without this command, the router will not advertise the ISATAP prefix or respond to Router Solicitations from the host, so the host can only communicate with the router's own tunnel IPv6 address but cannot learn a default route or reach other IPv6 networks.

Answer

The host's ISATAP interface has an incorrect IPv4 address for the router's tunnel source.

Answer

The router's tunnel interface is missing the 'ipv6 enable' command.

Answer

The upstream router does not have a route back to the ISATAP prefix.

Question 3

A network engineer is troubleshooting a manual IPv6-in-IPv4 tunnel between two Cisco routers. The tunnel is up, and both routers can ping each other's tunnel IPv6 addresses. However, traffic from a host behind Router A to a host behind Router B fails. The engineer notices that Router A has a route to the remote IPv6 prefix via the tunnel, but Router B does not have a route to the local IPv6 prefix. What is the most likely cause?

Accepted Answer

Router B is missing a static route pointing the local IPv6 prefix to the tunnel interface.. The tunnel is up and both routers can ping each other's tunnel IPv6 addresses, confirming that the tunnel itself is operational. However, traffic from a host behind Router A to a host behind Router B fails because Router B lacks a route back to the local IPv6 prefix (the network behind Router A). For bidirectional communication, both routers must have a route to the remote IPv6 prefix pointing to the tunnel interface. Since Router B is missing this static route, it cannot forward return traffic into the tunnel, causing the failure.

Answer

The tunnel mode is set to 'ipv6ip 6to4' instead of 'ipv6ip'.

Answer

The tunnel source on Router B is misconfigured with the wrong IPv4 address.

Answer

The IPv6 access-list on Router B is blocking incoming traffic from the local prefix.

Question 4

An engineer is troubleshooting a GRE IPv6 tunnel between two sites. The tunnel is up, and the engineer can ping the remote tunnel endpoint IPv6 address. However, OSPFv3 neighbors over the tunnel fail to form. The engineer verifies that OSPFv3 is configured on both tunnel interfaces with the same area and that the network type is broadcast. What is the most likely cause?

Accepted Answer

The tunnel MTU is set to 1500, but the GRE encapsulation adds 24 bytes, causing OSPFv3 packets to be fragmented.. The GRE tunnel MTU of 1500 bytes does not account for the 24-byte GRE/IPv6 encapsulation overhead (20-byte IPv6 header + 4-byte GRE header). OSPFv3 packets, which can be up to 1500 bytes, become fragmented when encapsulated, but fragmentation is often disabled or handled poorly in tunnel interfaces, preventing OSPFv3 neighbor formation. This is the most likely cause because the tunnel is up and the endpoint is reachable, but the OSPFv3 packets are being dropped or corrupted due to fragmentation.

Answer

The OSPFv3 network type is set to point-to-point instead of broadcast.

Answer

The tunnel interface is missing the 'ipv6 ospf 1 area 0' command.

Answer

The tunnel keepalive is misconfigured, causing the tunnel to flap.

Question 5

A network engineer is troubleshooting an IPv6 connectivity problem across an IPv4 MPLS network using 6PE. The 6PE routers have MP-BGP sessions to exchange IPv6 prefixes, and the tunnel between them is up. However, a customer edge router behind one 6PE router cannot reach an IPv6 prefix behind the other 6PE router. The engineer checks the 6PE router's BGP table and sees the prefix, but the routing table shows the next-hop as unreachable. What is the most likely cause?

Accepted Answer

The MPLS LDP session between the 6PE routers or between the 6PE and P routers is down, so no label exists for the BGP next-hop.. In 6PE, the BGP next-hop for an IPv6 prefix is the IPv4 address of the remote 6PE router. The 6PE router must have a label-switched path (LSP) to that IPv4 next-hop, which requires a working MPLS LDP session to distribute a label for that IPv4 address. If the LDP session is down, no label exists for the BGP next-hop, making it unreachable in the routing table even though the BGP table contains the prefix.

Answer

The 6PE router is missing the 'ipv6 unicast-routing' command.

Answer

The tunnel interface is not in the VRF of the customer.

Answer

The remote 6PE router is not advertising the IPv6 prefix via BGP.

Question 6

An engineer is troubleshooting a DMVPN phase 2 deployment with IPv6 over mGRE tunnels. The spoke routers can ping the hub's tunnel IPv6 address, but cannot reach IPv6 networks behind other spokes. The engineer verifies that NHRP is configured and that the hub has a route to the spoke's internal networks. What is the most likely cause?

Accepted Answer

The spoke routers are missing a static route for the remote spoke's internal network pointing to the mGRE tunnel interface.. In a DMVPN Phase 2 deployment, spoke routers must have a route to remote spoke networks pointing to the mGRE tunnel interface. Without this static route, the spoke will not know to send traffic for the remote spoke's internal network over the tunnel, even though NHRP resolves the next-hop. The hub has a route to the spoke's internal networks, but that does not enable direct spoke-to-spoke communication without proper routing on the spokes themselves.

Answer

The NHRP authentication key is mismatched between the spokes.

Answer

The tunnel key is not configured on the mGRE interface.

Answer

The hub is not configured with 'ip nhrp redirect' and the spokes with 'ip nhrp shortcut'.

Question 7

A network engineer is troubleshooting an IPv6 over IPv4 tunnel using Teredo on a Windows host. The host can access some IPv6 resources on the internet but cannot reach a specific internal IPv6 server. The engineer suspects the Teredo relay is misconfigured. What is the most likely issue?

Accepted Answer

The Teredo relay is not in the same IPv4 network as the host, or the relay does not have a route to the internal IPv6 server.. Teredo relays are responsible for forwarding traffic between the Teredo IPv6 tunnel and the native IPv6 network. If the relay is not on the same IPv4 subnet as the host or lacks a route to the internal IPv6 server, the host can reach public IPv6 resources (via other relays) but fails to reach the internal server. This matches the symptom of partial connectivity.

Answer

The host's firewall is blocking Teredo traffic on UDP port 3544.

Answer

The internal server is not configured with an IPv6 address.

Answer

The Teredo client on the host is using an incorrect server.

Question 8

An engineer is troubleshooting an IPv6 manual tunnel between two routers that are not directly connected (the tunnel endpoints are separated by an IPv4 network). The tunnel is up, but the engineer notices that the tunnel interface flaps every few minutes. The show interfaces tunnel output shows input errors and CRC errors. What is the most likely cause?

Accepted Answer

The IPv4 path between the tunnel endpoints has a lower MTU than the tunnel interface MTU plus 20 bytes (IP header), causing fragmentation and packet loss.. The tunnel interface shows input errors and CRC errors, which are classic signs of fragmentation and reassembly issues. When the IPv4 path between tunnel endpoints has a lower MTU than the tunnel interface MTU plus 20 bytes (the IPv4 header), packets exceeding the path MTU are fragmented. Fragmentation increases the risk of packet loss and CRC errors, causing the tunnel to flap as the interface resets or routing reconverges.

Answer

The tunnel keepalive is set too low, causing the tunnel to go down when a keepalive is lost.

Answer

The tunnel source interface is a loopback that is not reachable from the remote router.

Answer

The tunnel is using GRE encapsulation, but the remote router is configured for ipv6ip.

Question 9

A network engineer is troubleshooting an IPv6 over IPv4 tunnel that is used to connect two remote sites. The tunnel is configured with a tunnel source that is a loopback interface. The tunnel is up, but the engineer cannot ping the remote tunnel endpoint IPv6 address. The engineer checks the routing table and sees a route to the remote loopback's IPv4 address via a default route. What is the most likely cause?

Accepted Answer

The remote router does not have a route to the loopback network used as the tunnel source; it only has a default route that may not cover that prefix.. The tunnel is up, but the engineer cannot ping the remote tunnel endpoint IPv6 address because the remote router lacks a route back to the loopback network used as the tunnel source. The remote router only has a default route, which may not cover the specific prefix of the local loopback, causing return traffic to be dropped. For IPv6 over IPv4 tunnels, the tunnel source and destination must be reachable via unicast routing; a missing or insufficient route (like a default that doesn't match) breaks bidirectional communication.

Answer

The tunnel destination is configured with the loopback address of the remote router, but the remote router's tunnel source is a different interface.

Answer

The tunnel interface is missing the 'tunnel mode ipv6ip' command.

Answer

The IPv6 address on the tunnel interface is not in the same subnet as the remote tunnel IPv6 address.

Question 10

A network engineer runs the following command on Router R1:

R1# show ipv6 tunnel brief

Tunnel2: IPv6/IP, intf id 0/0/2, 6to4, mtu 1280
  Source: 192.168.1.1 (GigabitEthernet0/0)
  Destination: 192.168.2.1
  Tunnel transport: IPv4

Based on this output, which statement is correct?

Accepted Answer

This tunnel is actually a manually configured IPv6/IP tunnel, not a 6to4 tunnel.. The output shows a manually configured IPv6/IP tunnel because it specifies both a source and destination IPv4 address. In a true 6to4 tunnel, the destination is automatically derived from the 6to4 prefix (2002::/16) and the destination IPv4 address, not statically configured. The presence of a static destination address indicates this is a manually configured tunnel, not a 6to4 tunnel.

Answer

This is a correctly configured 6to4 tunnel.

Answer

The tunnel is an ISATAP tunnel.

Answer

The tunnel is in an up/up state and passing traffic.

Question 11

A network engineer runs the following command on Router R1:

R1# show ipv6 interface tunnel 0

Tunnel0 is up, line protocol is up
  IPv6 is enabled, link-local address is FE80::A8BB:CCFF:FE00:1
  No global unicast address is configured
  Joined group address(es):
    FF02::1
    FF02::2
    FF02::1:FF00:1
  MTU is 1480 bytes
  ICMP error messages limited to one every 100 milliseconds
  ICMP redirects are enabled
  ICMP unreachables are sent
  ND DAD is enabled, number of DAD attempts: 1
  ND reachable time is 30000 milliseconds
  ND advertised reachable time is 0 milliseconds
  ND advertised retransmit interval is 0 milliseconds
  ND router advertisements are sent every 200 seconds
  ND router advertisements live for 1800 seconds
  Hosts use stateless autoconfiguration for addresses.

Based on this output, what is a likely problem?

Accepted Answer

The tunnel is not configured with a global IPv6 address, which may prevent routing of IPv6 traffic.. The output shows that the tunnel interface has no global unicast address configured, only a link-local address. Without a global IPv6 address, the router cannot route IPv6 traffic beyond the local link, as global reachability requires a globally routable address. This is a common misconfiguration in IPv6 tunneling scenarios where the tunnel source and destination are set but the interface itself lacks a global IPv6 address.

Answer

The tunnel interface is down.

Answer

The MTU is too small for IPv6.

Answer

IPv6 is not enabled on the tunnel.

Question 12

A network engineer runs the following command on Router R1:

R1# show ipv6 route | include Tunnel

O   2001:DB8:1::/48 [110/2]
     via FE80::1, Tunnel0
O   2001:DB8:2::/48 [110/3]
     via FE80::2, Tunnel1

Based on this output, which statement is correct?

Accepted Answer

OSPFv3 is running over the tunnel interfaces and these routes are reachable.. The output shows OSPF routes (indicated by 'O') learned over tunnel interfaces. Since the routes are IPv6 (2001:DB8::/48) and OSPFv3 is the IPv6-capable version of OSPF, the correct interpretation is that OSPFv3 is running over the tunnels. The 'via FE80::1, Tunnel0' confirms the next hop is a link-local address reachable through the tunnel, meaning the routes are reachable via OSPFv3 over those tunnels.

Answer

The routes are learned via EIGRP.

Answer

The tunnels are using IPv4 as the transport.

Answer

Tunnel0 has a higher metric than Tunnel1.

Question 13

A network engineer runs the following command on Router R1:

R1# show ipv6 mld interface tunnel 0

Tunnel0 is up, line protocol is up
  Internet address is FE80::1
  MLD is enabled on interface
  Current MLD version is 2
  MLD query interval is 125 seconds
  MLD querier timeout is 255 seconds
  MLD max query response time is 10 seconds
  Last member query response interval is 1 second
  MLD activity: 0 joins, 0 leaves
  MLD querying router is FE80::1 (this system)

Based on this output, what can be concluded?

Accepted Answer

There are no multicast listeners on this tunnel interface.. The output shows 'MLD activity: 0 joins, 0 leaves', indicating that no multicast listeners have joined any multicast group on this tunnel interface. Since MLD (Multicast Listener Discovery) is used to track group membership, zero joins means there are no active listeners. Therefore, option C is correct.

Answer

MLD is disabled on this interface.

Answer

This router is not the MLD querier.

Answer

MLD version 1 is in use.

Question 14

A network engineer runs the following command on Router R1:

R1# show ipv6 ospf neighbor

Neighbor ID     Pri   State           Dead Time   Address         Interface
192.168.1.2       1   FULL/DR        00:00:32     FE80::2         Tunnel0
192.168.1.3       1   FULL/BDR       00:00:35     FE80::3         Tunnel0

Based on this output, which statement is correct?

Accepted Answer

OSPFv3 adjacencies are fully established over the tunnel.. The output shows two OSPFv3 neighbors in the FULL state, which indicates that the adjacency process has completed successfully and the routers are exchanging link-state advertisements. The presence of the FULL state for both neighbors confirms that OSPFv3 adjacencies are fully established over the Tunnel0 interface, making option C correct.

Answer

OSPFv3 is not running on this router.

Answer

The router with Neighbor ID 192.168.1.3 is the Designated Router.

Answer

The tunnel is using IPv4 transport.

Question 15

A network engineer runs the following command on Router R1:

R1# show ipv6 bgp summary

BGP router identifier 192.168.1.1, local AS number 65001
BGP table version is 10, main routing table version 10
5 network entries using 720 bytes of memory
5 path entries using 400 bytes of memory
3/2 BGP path/bestpath attribute entries using 456 bytes of memory
1 BGP AS-PATH entries using 24 bytes of memory
0 BGP route-map cache entries using 0 bytes of memory
0 BGP filter-list cache entries using 0 bytes of memory
BGP using 1600 total bytes of memory
BGP activity 10/5 prefixes, 10/5 paths, scan interval 60 secs

Neighbor        V           AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd
2001:DB8::2     4        65002   100     99       10    0    0 00:45:12        3

Based on this output, which statement is correct?

Accepted Answer

BGP is peering over IPv6 and 3 prefixes are learned from the neighbor.. The output shows that the neighbor 2001:DB8::2 (IPv6 address) is in state '3' under 'State/PfxRcd', which indicates the BGP session is established and 3 IPv6 prefixes have been received from that neighbor. The 'Up/Down' time of 00:45:12 confirms the session is active, and the 'MsgRcvd/MsgSent' counters show bidirectional communication. Therefore, BGP is peering over IPv6 and has learned 3 prefixes from the neighbor, making option C correct.

Answer

BGP is not configured for IPv6.

Answer

The BGP session is down.

Answer

The router is in AS 65002.

Question 16

A network engineer runs the following command on Router R1:

R1# show ipv6 eigrp neighbors

IPv6-EIGRP neighbors for process 100
H   Address                 Interface       Hold Uptime   SRTT   RTO  Q  Seq
                                            (sec)         (ms)       Cnt Num
0   FE80::A8BB:CCFF:FE00:2  Tunnel0          13 00:23:45   10   200  0  12
1   FE80::A8BB:CCFF:FE00:3  Tunnel1          12 00:22:10   15   200  0  15

Based on this output, which statement is correct?

Accepted Answer

EIGRP for IPv6 adjacencies are established over the tunnels.. The output shows two IPv6 EIGRP neighbors with link-local addresses (FE80::/10) on interfaces Tunnel0 and Tunnel1, and the adjacency is established and exchanging routes (Seq Num increasing). This confirms that EIGRP for IPv6 adjacencies are formed over these tunnel interfaces, making option C correct.

Answer

EIGRP is not configured for IPv6.

Answer

The neighbors are using global unicast addresses.

Answer

The tunnels are using GRE encapsulation.

Question 17

A network engineer runs the following command on Router R1:

R1# show ipv6 mtu

IPv6 MTU per interface:

Interface    MTU
Tunnel0      1476
Tunnel1      1476
GigabitEthernet0/0  1500

Based on this output, what is the most likely reason for the reduced MTU on the tunnel interfaces?

Accepted Answer

The tunnels are using GRE encapsulation, which adds 24 bytes of overhead.. The output shows an MTU of 1476 on the tunnel interfaces, which is exactly 24 bytes less than the 1500-byte MTU of the physical GigabitEthernet0/0 interface. GRE encapsulation adds a 4-byte outer IP header and a 4-byte GRE header (total 24 bytes with the inner IP header), reducing the payload MTU. This is the default behavior when a tunnel is configured without a manual MTU override, making option B correct.

Answer

The tunnels are configured with a manual MTU.

Answer

The tunnels are using IPsec, which adds more overhead.

Answer

The tunnels are 6to4 tunnels, which do not reduce MTU.

Question 18

A network engineer runs the following command on Router R1:

R1# show ipv6 traffic | include tunnel

0 tunnel packets received
  0 tunnel packets sent
  0 tunnel packets dropped

Based on this output, what can be concluded?

Accepted Answer

The tunnel is not carrying any IPv6 traffic.. The 'show ipv6 traffic | include tunnel' command filters the output to show only lines containing 'tunnel'. The counters for packets received, sent, and dropped are all zero, which indicates that no IPv6 packets have been encapsulated or decapsulated by any tunnel interface. This means the tunnel is not carrying any IPv6 traffic, making option B correct.

Answer

The tunnel is passing traffic normally.

Answer

The tunnel is dropping all packets.

Answer

The tunnel is using IPsec encryption.

Question 19

Examine the following partial configuration on Router R1:
```
interface Tunnel0
 ipv6 address 2001:DB8:1::1/64
 tunnel source GigabitEthernet0/0
 tunnel destination 2001:DB8:2::2
 tunnel mode ipv6ip
```
What is the effect of this configuration?

Accepted Answer

The tunnel will not come up because the tunnel destination is an IPv6 address instead of an IPv4 address.. The tunnel mode ipv6ip requires an IPv4 address as the tunnel destination because it encapsulates IPv6 packets inside IPv4 packets for transport over an IPv4 network. In this configuration, the tunnel destination is set to an IPv6 address (2001:DB8:2::2), which is invalid for this tunnel mode, preventing the tunnel interface from coming up.

Answer

The tunnel will successfully encapsulate IPv6 packets in IPv4 and forward them.

Answer

The tunnel will use IPv6 as the transport protocol, encapsulating IPv4 packets.

Answer

The configuration is correct for a 6to4 tunnel.

Question 20

Consider this configuration on Router R2:
```
interface Tunnel0
 ipv6 address 2001:DB8:3::1/64
 tunnel source GigabitEthernet0/0
 tunnel mode gre ipv6
 tunnel destination 2001:DB8:4::2
```
Which statement is true?

Accepted Answer

This tunnel will encapsulate packets using GRE over an IPv6 transport.. The configuration shows a tunnel with `tunnel mode gre ipv6`, which explicitly sets the tunnel to use GRE encapsulation over an IPv6 transport. The tunnel source and destination are IPv6 addresses, and GRE can carry multiple protocols (including IPv4, IPv6, and others) over the IPv6 transport. Therefore, option C is correct because the tunnel encapsulates packets using GRE over an IPv6 transport.

Answer

This tunnel can only carry IPv6 traffic.

Answer

The tunnel source and destination must be IPv4 addresses.

Answer

The tunnel mode should be 'ipv6ip' for IPv6 transport.