300-410 IPv6 Tunneling Techniques — Timed 10 Questions

Question 1

A network engineer is troubleshooting an IPv6 connectivity issue between two sites connected via a 6to4 tunnel. The tunnel is configured on both routers and shows as up/up, but the engineer cannot ping the IPv6 address of the remote tunnel endpoint. The engineer checks the routing table and sees no route to the remote IPv6 prefix. What is the most likely cause of this problem?

Accepted Answer

The tunnel source interface is configured with a private IPv4 address, causing the 6to4 prefix to be invalid.. For a 6to4 tunnel, the IPv6 address on the tunnel interface must be derived from the tunnel source's public IPv4 address using the 2002:IPv4-address::/48 prefix format. If the tunnel source interface has a private IPv4 address (e.g., 10.0.0.1), the resulting 6to4 prefix (2002:0a00:0001::/48) is non-routable over the public Internet because private addresses are not globally unique. This causes the remote router to have no route to the invalid prefix, breaking connectivity even though the tunnel interface is up/up.

Answer

The tunnel mode is incorrectly set to ipv6ip instead of 6to4.

Answer

The tunnel destination is misconfigured with the remote router's IPv6 address instead of its IPv4 address.

Answer

The IPv6 address on the tunnel interface is not in the 2002::/16 range.

Question 2

An engineer is troubleshooting an ISATAP tunnel between a Windows host and a Cisco router. The host can ping the router's IPv6 address configured on the tunnel interface, but cannot reach any other IPv6 networks beyond the router. The router has a default route pointing to an upstream IPv6 router. What is the most likely cause?

Accepted Answer

The router is not configured as an ISATAP router; it only has the tunnel interface but lacks the 'ipv6 isatap' command.. The correct answer is A. For ISATAP to function, the router must be explicitly configured as an ISATAP router using the 'ipv6 isatap' command under the tunnel interface. Without this command, the router will not advertise the ISATAP prefix or respond to Router Solicitations from the host, so the host can only communicate with the router's own tunnel IPv6 address but cannot learn a default route or reach other IPv6 networks.

Answer

The host's ISATAP interface has an incorrect IPv4 address for the router's tunnel source.

Answer

The router's tunnel interface is missing the 'ipv6 enable' command.

Answer

The upstream router does not have a route back to the ISATAP prefix.

Question 3

A network engineer is troubleshooting a manual IPv6-in-IPv4 tunnel between two Cisco routers. The tunnel is up, and both routers can ping each other's tunnel IPv6 addresses. However, traffic from a host behind Router A to a host behind Router B fails. The engineer notices that Router A has a route to the remote IPv6 prefix via the tunnel, but Router B does not have a route to the local IPv6 prefix. What is the most likely cause?

Accepted Answer

Router B is missing a static route pointing the local IPv6 prefix to the tunnel interface.. The tunnel is up and both routers can ping each other's tunnel IPv6 addresses, confirming that the tunnel itself is operational. However, traffic from a host behind Router A to a host behind Router B fails because Router B lacks a route back to the local IPv6 prefix (the network behind Router A). For bidirectional communication, both routers must have a route to the remote IPv6 prefix pointing to the tunnel interface. Since Router B is missing this static route, it cannot forward return traffic into the tunnel, causing the failure.

Answer

The tunnel mode is set to 'ipv6ip 6to4' instead of 'ipv6ip'.

Answer

The tunnel source on Router B is misconfigured with the wrong IPv4 address.

Answer

The IPv6 access-list on Router B is blocking incoming traffic from the local prefix.

Question 4

An engineer is troubleshooting a GRE IPv6 tunnel between two sites. The tunnel is up, and the engineer can ping the remote tunnel endpoint IPv6 address. However, OSPFv3 neighbors over the tunnel fail to form. The engineer verifies that OSPFv3 is configured on both tunnel interfaces with the same area and that the network type is broadcast. What is the most likely cause?

Accepted Answer

The tunnel MTU is set to 1500, but the GRE encapsulation adds 24 bytes, causing OSPFv3 packets to be fragmented.. The GRE tunnel MTU of 1500 bytes does not account for the 24-byte GRE/IPv6 encapsulation overhead (20-byte IPv6 header + 4-byte GRE header). OSPFv3 packets, which can be up to 1500 bytes, become fragmented when encapsulated, but fragmentation is often disabled or handled poorly in tunnel interfaces, preventing OSPFv3 neighbor formation. This is the most likely cause because the tunnel is up and the endpoint is reachable, but the OSPFv3 packets are being dropped or corrupted due to fragmentation.

Answer

The OSPFv3 network type is set to point-to-point instead of broadcast.

Answer

The tunnel interface is missing the 'ipv6 ospf 1 area 0' command.

Answer

The tunnel keepalive is misconfigured, causing the tunnel to flap.

Question 5

A network engineer is troubleshooting an IPv6 connectivity problem across an IPv4 MPLS network using 6PE. The 6PE routers have MP-BGP sessions to exchange IPv6 prefixes, and the tunnel between them is up. However, a customer edge router behind one 6PE router cannot reach an IPv6 prefix behind the other 6PE router. The engineer checks the 6PE router's BGP table and sees the prefix, but the routing table shows the next-hop as unreachable. What is the most likely cause?

Accepted Answer

The MPLS LDP session between the 6PE routers or between the 6PE and P routers is down, so no label exists for the BGP next-hop.. In 6PE, the BGP next-hop for an IPv6 prefix is the IPv4 address of the remote 6PE router. The 6PE router must have a label-switched path (LSP) to that IPv4 next-hop, which requires a working MPLS LDP session to distribute a label for that IPv4 address. If the LDP session is down, no label exists for the BGP next-hop, making it unreachable in the routing table even though the BGP table contains the prefix.

Answer

The 6PE router is missing the 'ipv6 unicast-routing' command.

Answer

The tunnel interface is not in the VRF of the customer.

Answer

The remote 6PE router is not advertising the IPv6 prefix via BGP.

Question 6

An engineer is troubleshooting a DMVPN phase 2 deployment with IPv6 over mGRE tunnels. The spoke routers can ping the hub's tunnel IPv6 address, but cannot reach IPv6 networks behind other spokes. The engineer verifies that NHRP is configured and that the hub has a route to the spoke's internal networks. What is the most likely cause?

Accepted Answer

The spoke routers are missing a static route for the remote spoke's internal network pointing to the mGRE tunnel interface.. In a DMVPN Phase 2 deployment, spoke routers must have a route to remote spoke networks pointing to the mGRE tunnel interface. Without this static route, the spoke will not know to send traffic for the remote spoke's internal network over the tunnel, even though NHRP resolves the next-hop. The hub has a route to the spoke's internal networks, but that does not enable direct spoke-to-spoke communication without proper routing on the spokes themselves.

Answer

The NHRP authentication key is mismatched between the spokes.

Answer

The tunnel key is not configured on the mGRE interface.

Answer

The hub is not configured with 'ip nhrp redirect' and the spokes with 'ip nhrp shortcut'.

Question 7

A network engineer is troubleshooting an IPv6 over IPv4 tunnel using Teredo on a Windows host. The host can access some IPv6 resources on the internet but cannot reach a specific internal IPv6 server. The engineer suspects the Teredo relay is misconfigured. What is the most likely issue?

Accepted Answer

The Teredo relay is not in the same IPv4 network as the host, or the relay does not have a route to the internal IPv6 server.. Teredo relays are responsible for forwarding traffic between the Teredo IPv6 tunnel and the native IPv6 network. If the relay is not on the same IPv4 subnet as the host or lacks a route to the internal IPv6 server, the host can reach public IPv6 resources (via other relays) but fails to reach the internal server. This matches the symptom of partial connectivity.

Answer

The host's firewall is blocking Teredo traffic on UDP port 3544.

Answer

The internal server is not configured with an IPv6 address.

Answer

The Teredo client on the host is using an incorrect server.

Question 8

An engineer is troubleshooting an IPv6 manual tunnel between two routers that are not directly connected (the tunnel endpoints are separated by an IPv4 network). The tunnel is up, but the engineer notices that the tunnel interface flaps every few minutes. The show interfaces tunnel output shows input errors and CRC errors. What is the most likely cause?

Accepted Answer

The IPv4 path between the tunnel endpoints has a lower MTU than the tunnel interface MTU plus 20 bytes (IP header), causing fragmentation and packet loss.. The tunnel interface shows input errors and CRC errors, which are classic signs of fragmentation and reassembly issues. When the IPv4 path between tunnel endpoints has a lower MTU than the tunnel interface MTU plus 20 bytes (the IPv4 header), packets exceeding the path MTU are fragmented. Fragmentation increases the risk of packet loss and CRC errors, causing the tunnel to flap as the interface resets or routing reconverges.

Answer

The tunnel keepalive is set too low, causing the tunnel to go down when a keepalive is lost.

Answer

The tunnel source interface is a loopback that is not reachable from the remote router.

Answer

The tunnel is using GRE encapsulation, but the remote router is configured for ipv6ip.

Question 9

A network engineer is troubleshooting an IPv6 over IPv4 tunnel that is used to connect two remote sites. The tunnel is configured with a tunnel source that is a loopback interface. The tunnel is up, but the engineer cannot ping the remote tunnel endpoint IPv6 address. The engineer checks the routing table and sees a route to the remote loopback's IPv4 address via a default route. What is the most likely cause?

Accepted Answer

The remote router does not have a route to the loopback network used as the tunnel source; it only has a default route that may not cover that prefix.. The tunnel is up, but the engineer cannot ping the remote tunnel endpoint IPv6 address because the remote router lacks a route back to the loopback network used as the tunnel source. The remote router only has a default route, which may not cover the specific prefix of the local loopback, causing return traffic to be dropped. For IPv6 over IPv4 tunnels, the tunnel source and destination must be reachable via unicast routing; a missing or insufficient route (like a default that doesn't match) breaks bidirectional communication.

Answer

The tunnel destination is configured with the loopback address of the remote router, but the remote router's tunnel source is a different interface.

Answer

The tunnel interface is missing the 'tunnel mode ipv6ip' command.

Answer

The IPv6 address on the tunnel interface is not in the same subnet as the remote tunnel IPv6 address.

Question 10

A network engineer runs the following command on Router R1:

R1# show ipv6 tunnel brief

Tunnel2: IPv6/IP, intf id 0/0/2, 6to4, mtu 1280
  Source: 192.168.1.1 (GigabitEthernet0/0)
  Destination: 192.168.2.1
  Tunnel transport: IPv4

Based on this output, which statement is correct?

Accepted Answer

This tunnel is actually a manually configured IPv6/IP tunnel, not a 6to4 tunnel.. The output shows a manually configured IPv6/IP tunnel because it specifies both a source and destination IPv4 address. In a true 6to4 tunnel, the destination is automatically derived from the 6to4 prefix (2002::/16) and the destination IPv4 address, not statically configured. The presence of a static destination address indicates this is a manually configured tunnel, not a 6to4 tunnel.

Answer

This is a correctly configured 6to4 tunnel.

Answer

The tunnel is an ISATAP tunnel.

Answer

The tunnel is in an up/up state and passing traffic.