300-410 VRF-Lite — 40 Questions

Question 1

A network engineer is troubleshooting a VRF-Lite setup where two customer VRFs (VRF_A and VRF_B) are configured on a router. The engineer notices that routes from VRF_A are appearing in the routing table of VRF_B, causing traffic misdirection. The router is running IOS-XE 17.3. What is the most likely cause of this issue?

Accepted Answer

The 'route-target import' and 'route-target export' commands are misconfigured, causing VRF_A routes to be imported into VRF_B.. The issue is caused by route leaking between VRFs, which can occur if VRF route import/export configurations are misapplied or if routes are accidentally redistributed between VRFs. In VRF-Lite, VRFs are isolated by default, and any cross-VRF route sharing must be explicitly configured.

Answer

The router has 'ip routing' disabled globally.

Answer

The 'ip vrf forwarding' command is missing on the interfaces.

Answer

The router is running OSPF with the same process ID in both VRFs.

Question 2

A network engineer is troubleshooting a VRF-Lite configuration on a Cisco router. The router has two VRFs (VRF_RED and VRF_BLUE) configured with OSPF as the routing protocol. The engineer notices that OSPF neighborships are not forming between routers in VRF_RED. The 'show ip ospf neighbor' command shows no neighbors. What is the most likely cause?

Accepted Answer

The OSPF process is not configured with the 'vrf VRF_RED' command.. OSPF neighborships in VRF-Lite require that the OSPF process is associated with the correct VRF and that interfaces are placed in the correct VRF. Missing VRF association in the OSPF process or incorrect interface VRF assignment are common issues.

Answer

The OSPF process ID is not unique across VRFs.

Answer

The interfaces in VRF_RED are missing the 'ip ospf network point-to-point' command.

Answer

The 'router-id' command is missing in the OSPF process.

Question 3

A network engineer is troubleshooting a VRF-Lite deployment where two routers are connected via a trunk link. Each router has two VRFs (VRF_A and VRF_B). The engineer configures subinterfaces on the trunk link, assigning each subinterface to a different VRF. However, traffic between the two routers for VRF_A is not working. The 'show vrf' command shows the VRFs are active. What is the most likely issue?

Accepted Answer

The subinterface on Router1 is configured with 'encapsulation dot1q 10', but the subinterface on Router2 is configured with 'encapsulation dot1q 20'.. In VRF-Lite with trunk links, subinterfaces must be associated with the correct VRF and VLAN. A common mistake is not matching the VLAN IDs on the subinterfaces of both routers, or missing the 'encapsulation dot1q' command.

Answer

The 'ip vrf forwarding VRF_A' command is missing on the main interface.

Answer

The 'no ip routing' command is configured globally.

Answer

The 'mtu' command is set differently on the two subinterfaces.

Question 4

A network engineer is troubleshooting a VRF-Lite scenario where a router is configured with two VRFs (VRF_X and VRF_Y). The engineer notices that routes from VRF_X are not being advertised to the neighbor router via eBGP. The BGP configuration includes 'neighbor 10.1.1.2 remote-as 65002' under the VRF_X BGP address-family. The 'show bgp vpnv4 unicast all neighbors' command shows the BGP session is established. What is the most likely cause?

Accepted Answer

The 'network' command for the prefix is configured under the global BGP configuration, not under the VRF address-family.. In VRF-Lite with BGP, routes must be explicitly injected into the VRF BGP table. Missing the 'network' command or redistribution under the VRF address-family is a common issue.

Answer

The BGP session is not using the correct update-source interface.

Answer

The 'maximum-paths' command is set to 1.

Answer

The 'bgp router-id' command is missing.

Question 5

A network engineer is troubleshooting a VRF-Lite setup where a router is configured with VRF_GREEN. The engineer pings the gateway IP of a host in VRF_GREEN from the router, but the ping fails. The 'show ip route vrf VRF_GREEN' command shows the connected network for the host's subnet. The 'show ip interface brief' shows the interface is up/up. What is the most likely cause?

Accepted Answer

The host's IP address is not in the same subnet as the router's interface IP in VRF_GREEN.. If the interface is up and the route is present, the issue might be with ARP resolution or the host's configuration. However, in VRF-Lite, the router might not be able to ping the gateway if the gateway IP is not in the same subnet as the interface IP, or if the host has a firewall blocking ICMP.

Answer

The host's default gateway is not set to the router's interface IP in VRF_GREEN.

Answer

The router's interface in VRF_GREEN has 'ip proxy-arp' disabled.

Answer

The 'ip routing' command is disabled in VRF_GREEN.

Question 6

A network engineer is troubleshooting a VRF-Lite configuration where a router is using RIP as the routing protocol in VRF_BLUE. The engineer notices that RIP routes are not being learned from a neighbor router. The 'show ip rip database vrf VRF_BLUE' shows no entries. The 'show ip vrf interfaces VRF_BLUE' shows the correct interface. What is the most likely cause?

Accepted Answer

The 'network' command is configured under the global RIP process, not under the VRF address-family.. RIP in VRF-Lite requires that the RIP process be associated with the VRF and that the network command is issued under the VRF context. Missing the 'address-family ipv4 vrf VRF_BLUE' configuration is a common oversight.

Answer

The 'version 2' command is missing under the VRF address-family.

Answer

The 'no auto-summary' command is missing.

Answer

The 'timers basic' command is set to a very low value.

Question 7

A network engineer is troubleshooting a VRF-Lite deployment where a router is configured with VRF_ORANGE. The engineer attempts to configure a static route in VRF_ORANGE using the command 'ip route vrf VRF_ORANGE 192.168.10.0 255.255.255.0 10.1.1.1', but the route does not appear in the routing table. The 'show ip route vrf VRF_ORANGE' does not show the static route. What is the most likely cause?

Accepted Answer

The next-hop IP address 10.1.1.1 is not reachable in VRF_ORANGE.. Static routes in VRF-Lite require that the next-hop IP address is reachable within the same VRF. If the next-hop is not in the VRF's routing table, the static route will not be installed.

Answer

The 'ip classless' command is disabled.

Answer

The static route is missing the 'permanent' keyword.

Answer

The router has 'no ip routing' configured.

Question 8

A network engineer is troubleshooting a VRF-Lite setup where two routers are connected via a serial link. Each router has VRF_SALES configured. The engineer configures EIGRP in VRF_SALES. The 'show ip eigrp vrf VRF_SALES neighbors' shows no neighbors. The 'show ip eigrp vrf VRF_SALES interfaces' shows the serial interface is passive. What is the most likely cause?

Accepted Answer

The 'passive-interface default' command is configured under the EIGRP process for VRF_SALES.. If an interface is marked as passive in EIGRP, it will not send or receive hello packets, preventing neighbor formation. This is a common misconfiguration.

Answer

The 'network' command for the serial interface's subnet is missing.

Answer

The 'autonomous-system' number is different on the two routers.

Answer

The 'metric weights' command is misconfigured.

Question 9

A network engineer is troubleshooting a VRF-Lite configuration on a Cisco router. The router has two VRFs (VRF_CUSTOMER_A and VRF_CUSTOMER_B). The engineer notices that traffic from VRF_CUSTOMER_A is being routed to the wrong next-hop, causing connectivity issues. The 'show ip route vrf VRF_CUSTOMER_A' shows a route to the destination via a next-hop that belongs to VRF_CUSTOMER_B. What is the most likely cause?

Accepted Answer

The 'route-target import' command in VRF_CUSTOMER_A is importing routes from VRF_CUSTOMER_B.. This issue is typically caused by route leaking between VRFs, which can happen if the route-target import/export commands are misconfigured or if there is a shared interface with incorrect VRF assignment.

Answer

The router has a default route that points to the next-hop in VRF_CUSTOMER_B.

Answer

The 'ip cef' command is disabled globally.

Answer

The 'ip vrf forwarding' command is applied to the same physical interface for both VRFs.

Question 10

A network engineer runs the following command on Router R1:

R1# show ip vrf interfaces
Interface   VRF          IP Address    Protocol
GigabitEthernet0/0   BLUE         10.1.1.1      up
GigabitEthernet0/1   BLUE         10.1.2.1      up
GigabitEthernet0/2   RED          192.168.1.1   up
Loopback0            BLUE         10.0.0.1      up
Loopback1            RED          192.168.0.1   up

Based on this output, which statement is correct?

Accepted Answer

GigabitEthernet0/2 is in VRF RED with IP address 192.168.1.1.. The 'show ip vrf interfaces' command displays all interfaces assigned to VRFs and their IP addresses. The output shows that GigabitEthernet0/0, GigabitEthernet0/1, and Loopback0 are in VRF BLUE, while GigabitEthernet0/2 and Loopback1 are in VRF RED. There are no interfaces in the global routing table shown here, but that is normal for VRF-Lite.

Answer

All interfaces are in the global routing table.

Answer

Loopback0 is in VRF RED.

Answer

GigabitEthernet0/1 has IP address 10.1.2.2.

Question 11

A network engineer runs the following command on Router R1:

R1# show ip route vrf BLUE

Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP
       a - application route
       + - replicated route, % - next hop override

Gateway of last resort is not set

10.0.0.0/8 is variably subnetted, 3 subnets, 2 masks
C        10.1.1.0/24 is directly connected, GigabitEthernet0/0
C        10.1.2.0/24 is directly connected, GigabitEthernet0/1
O        10.2.0.0/16 [110/20] via 10.1.1.2, 00:00:15, GigabitEthernet0/0

Based on this output, what is the problem?

Accepted Answer

The OSPF route was learned 15 seconds ago, indicating a recent flap.. The output shows the routing table for VRF BLUE. It has two connected routes and one OSPF route. The OSPF route (10.2.0.0/16) has been learned recently (00:00:15), which may indicate a flapping neighbor or recent convergence. However, the key observation is that the OSPF route's next hop is 10.1.1.2, which is reachable via GigabitEthernet0/0. The output is normal; no problem is evident. But if the question implies a problem, it might be that the OSPF route age is very recent, suggesting instability. However, the correct answer here is that the VRF routing table is correctly populated.

Answer

The OSPF route 10.2.0.0/16 has a next hop of 10.1.1.2, which is unreachable.

Answer

The VRF BLUE has no default route, which is a problem.

Answer

The connected routes are not in the routing table.

Question 12

A network engineer runs the following command on Router R1:

R1# show ip bgp vpnv4 vrf RED summary

BGP router identifier 192.168.0.1, local AS number 65001
BGP table version is 5, main routing table version 5
4 network entries using 576 bytes of memory
4 path entries using 320 bytes of memory
2/1 BGP path/bestpath attribute entries using 320 bytes of memory
0 BGP route-map cache entries using 0 bytes of memory
0 BGP filter-list cache entries using 0 bytes of memory
BGP using 1216 total bytes of memory
BGP activity 4/0 prefixes, 4/0 paths, scan interval 60 secs

Neighbor        V           AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd
10.1.1.2        4        65001      23      25        5    0    0 00:12:34        2
10.1.2.2        4        65002      18      20        5    0    0 00:10:15        1

Based on this output, which statement is correct?

Accepted Answer

Both BGP neighbors are in the Established state.. The 'show bgp vpnv4 vrf RED summary' command displays BGP neighbors for VRF RED. It shows two neighbors: 10.1.1.2 (AS 65001) and 10.1.2.2 (AS 65002). Both are in the Established state with prefixes received. The neighbor 10.1.1.2 has received 2 prefixes, and 10.1.2.2 has received 1 prefix.

Answer

Neighbor 10.1.2.2 is in the Idle state.

Answer

The local AS number is 65002.

Answer

Neighbor 10.1.1.2 is in AS 65002.

Question 13

A network engineer runs the following command on Router R1:

R1# show ip eigrp vrf RED neighbors

EIGRP-IPv4 Neighbors for AS(100) VRF RED
H   Address                 Interface              Hold Uptime   SRTT   RTO  Q  Seq
                                                   (sec)         (ms)       Cnt Num
0   192.168.1.2             Gi0/2                   13  00:15:30   12   200  0  45
1   192.168.2.2             Gi0/3                   12  00:14:20   15   200  0  32

Based on this output, what is the problem?

Accepted Answer

The EIGRP adjacency is functioning correctly.. The output shows two EIGRP neighbors for VRF RED. Both are in normal state with low SRTT and no Q count. There is no obvious problem. However, the hold times are 13 and 12 seconds, which are typical. The uptimes are similar. The output is healthy. But if the question implies a problem, it might be that the neighbors are not exchanging routes? But the Seq numbers are incrementing, indicating activity. Actually, no problem is evident. The correct answer should be that the EIGRP adjacency is functioning correctly.

Answer

The EIGRP neighbors are not exchanging routes because the Seq numbers are low.

Answer

Both neighbors are in the Init state.

Answer

The hold time of 13 seconds indicates a problem.

Question 14

A network engineer runs the following command on Router R1:

R1# show ip ospf neighbor vrf BLUE

Neighbor ID     Pri   State           Dead Time   Address         Interface
10.0.0.2          1   FULL/DR        00:00:32    10.1.1.2        GigabitEthernet0/0
10.0.0.3          1   2WAY/DROTHER   00:00:35    10.1.2.2        GigabitEthernet0/1

Based on this output, which statement is correct?

Accepted Answer

The OSPF adjacencies are functioning normally.. The output shows two OSPF neighbors for VRF BLUE. Neighbor 10.0.0.2 is in FULL state and is the DR on GigabitEthernet0/0. Neighbor 10.0.0.3 is in 2WAY state and is a DROTHER on GigabitEthernet0/1. The 2WAY state is normal for neighbors that are not DR/BDR on a multi-access network. No problem is evident.

Answer

Neighbor 10.0.0.3 is not forming a full adjacency because it is a DROTHER.

Answer

Neighbor 10.0.0.2 is the Backup Designated Router.

Answer

Both neighbors are in the FULL state.

Question 15

A network engineer runs the following command on Router R1:

R1# show route-map VRF_RED_MAP
route-map VRF_RED_MAP, permit, sequence 10
  Match clauses:
    ip address prefix-list RED_PREFIXES
  Set clauses:
    tag 100
  Policy routing matches: 0 packets, 0 bytes

Based on this output, what is the problem?

Accepted Answer

The route-map is not applied to any interface.. The route-map VRF_RED_MAP has a match clause for prefix-list RED_PREFIXES and a set clause to tag 100. The policy routing matches show 0 packets, meaning the route-map has never been used. This could indicate that the route-map is not applied to any interface or that no traffic matches the prefix-list.

Answer

The prefix-list RED_PREFIXES is empty.

Answer

The set clause is incorrect.

Answer

The route-map sequence is invalid.

Question 16

A network engineer runs the following command on Router R1:

R1# show ip vrf detail RED
VRF RED (VRF Id = 1); default RD <not set>
   Interfaces:
           GigabitEthernet0/2
           Loopback1
   Address family IPV4 (Table ID = 1):
      No Export VPN route-target communities
      No Import VPN route-target communities
      No import route-map
      No export route-map
      VRF label distribution protocol: not configured
   Address family IPV6 (Table ID = 0x1E000001):
      No Export VPN route-target communities
      No Import VPN route-target communities
      No import route-map
      No export route-map
      VRF label distribution protocol: not configured

Based on this output, which statement is correct?

Accepted Answer

The VRF RED includes two interfaces: GigabitEthernet0/2 and Loopback1.. The 'show ip vrf detail RED' command shows detailed VRF information. It lists interfaces GigabitEthernet0/2 and Loopback1. The RD is not set, which is common for VRF-Lite (no MPLS). There are no route-target communities, which is expected for VRF-Lite.

Answer

The VRF RED has a Route Distinguisher configured.

Answer

The VRF RED has an export route-map configured.

Answer

The VRF RED is configured for MPLS label distribution.

Question 17

A network engineer runs the following command on Router R1:

R1# show ip bgp vpnv4 vrf RED neighbors 10.1.1.2 advertised-routes

BGP table version is 5, local router ID is 192.168.0.1
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
              r RIB-failure, S Stale, m multipath, b backup-path, f RT-Filter,
              x best-external, a additional-path, c RIB-compressed,
              t secondary path, L long-lived-stale,
Origin codes: i - IGP, e - EGP, ? - incomplete

Network          Next Hop            Metric LocPrf Weight Path
*> 192.168.1.0/24   0.0.0.0                  0         32768 i
*> 192.168.2.0/24   0.0.0.0                  0         32768 i

Total number of prefixes 2

Based on this output, what is the problem?

Accepted Answer

The routes are being advertised correctly.. The output shows the routes advertised to BGP neighbor 10.1.1.2 for VRF RED. It advertises two networks: 192.168.1.0/24 and 192.168.2.0/24, both with next hop 0.0.0.0 (meaning self). This is normal. However, the next hop 0.0.0.0 might be problematic if the neighbor expects a valid next hop. But in BGP, 0.0.0.0 is used for locally originated routes. The problem could be that the routes are not being advertised with the correct next hop, but for VRF-Lite, this is typical. Actually, no problem is evident. The correct answer might be that the routes are being advertised correctly.

Answer

The routes are advertised with next hop 0.0.0.0, which will cause the neighbor to drop them.

Answer

The BGP table version is 5, indicating a problem.

Answer

The routes have weight 0, which is incorrect.

Question 18

A network engineer runs the following command on Router R1:

R1# show ip route vrf RED 192.168.1.0

Routing entry for 192.168.1.0/24
  Known via "connected", distance 0, metric 0 (connected, via interface)
  Routing Descriptor Blocks:
  * directly connected, via GigabitEthernet0/2
      Route metric is 0, traffic share count is 1

Based on this output, which statement is correct?

Accepted Answer

The route is directly connected via GigabitEthernet0/2.. The output shows the route for 192.168.1.0/24 in VRF RED is a connected route via GigabitEthernet0/2. This is normal.

Answer

The route is learned via OSPF.

Answer

The route is a static route.

Answer

The route has a metric of 1.

Question 19

Given the following partial configuration on router R1:
```
interface GigabitEthernet0/0
 ip vrf forwarding CUSTOMER_A
 ip address 192.168.1.1 255.255.255.0
```
What is the effect of this configuration?

Accepted Answer

The interface is placed into VRF CUSTOMER_A, and the IP address is assigned correctly.. The 'ip vrf forwarding' command associates the interface with a VRF. It removes the IP address if one was previously configured, requiring it to be re-applied. This ensures traffic on this interface is forwarded using the VRF's routing table.

Answer

The interface is placed into VRF CUSTOMER_A, but the IP address is ignored because it must be configured before the VRF command.

Answer

The VRF name is misspelled; it should be 'vrf forwarding CUSTOMER_A' under the interface.

Answer

The configuration will fail because VRF CUSTOMER_A must be created globally first.

Question 20

Consider this partial configuration:
```
ip vrf CUSTOMER_B
 rd 65000:1
 route-target export 65000:1
 route-target import 65000:1
```
What statement is true about this VRF configuration?

Accepted Answer

The VRF is correctly configured for VRF-Lite with a unique RD and optional route-targets.. In VRF-Lite, route-targets are not strictly required because there is no MP-BGP exchange. However, they are used for interoperability and to define import/export policies if needed. The RD is mandatory to create the VRF.

Answer

The VRF will not function because route-targets are mandatory for VRF-Lite.

Answer

The RD must match the route-target value exactly.

Answer

The VRF will only work if 'vrf forwarding' is applied to an interface.