350-401 WAN Technologies — Timed 10 Questions

Question 1

A network engineer is configuring a DMVPN Phase 3 deployment with EIGRP as the routing protocol. The hub router has multiple spoke routers behind a single physical interface. The engineer notices that spoke-to-spoke traffic is being forwarded through the hub instead of directly. The spoke routers have the correct NHRP and mGRE configuration. What is the most likely cause of this issue?

Accepted Answer

The hub router is configured with 'ip next-hop-self eigrp' under the tunnel interface.. In DMVPN Phase 3, spoke-to-spoke tunnels require NHRP redirect and routing protocol next-hop-self behavior to be disabled on the hub so that spokes learn the remote spoke's next-hop IP and install a direct NHRP shortcut. If the hub still sets next-hop-self in EIGRP updates, spokes will see the hub as the next hop and forward traffic through it.

Answer

The hub router is configured with 'no ip next-hop-self eigrp' under the tunnel interface.

Answer

The spoke routers have 'ip nhrp shortcut' configured but the hub does not have 'ip nhrp redirect'.

Answer

The spoke routers are using static NHRP mappings to the hub only, without dynamic NHRP registration.

Question 2

An enterprise is replacing its legacy Frame Relay WAN with MPLS L3VPN. The new MPLS provider assigns a single VRF to the customer. The customer's CE routers are running BGP with the provider's PE routers. The engineer notices that the CE routers can ping the PE loopback addresses but cannot reach remote CE loopbacks. The BGP sessions are established and routes are received. What is the most likely cause?

Accepted Answer

The PE router is not disabling BGP next-hop-self for the VRF, so the routes advertised to the CE have the remote CE's IP as the next-hop, which is not reachable from the local CE.. In MPLS L3VPN, the PE router must advertise the customer routes with the correct next-hop (usually the PE's own address) and the MPLS labels must be properly distributed. However, the most common issue when CE can ping PE but not remote CE is that the PE is not advertising the customer routes back to the remote CE because of BGP next-hop processing or route-target filtering.

Answer

The CE router is not configured with 'no bgp default ipv4-unicast'.

Answer

The PE router is not sending the customer routes to the remote CE because the next-hop is set to the local PE's loopback, which is reachable, but the remote PE is not advertising the routes due to route-target mismatch.

Answer

The CE router is not advertising its own loopback into BGP, so the remote CE does not have a route to it.

Question 3

A network engineer is troubleshooting a site-to-site IPsec VPN tunnel between two Cisco routers. The tunnel is established and IKEv2 Phase 1 is up, but no traffic passes. The engineer checks the crypto map and sees that the ACL is configured to permit traffic between the two LAN subnets. However, 'show crypto ipsec sa' shows that the number of packets encapsulated and decapsulated is zero. What is the most likely cause?

Accepted Answer

The IPsec transform set uses ESP with SHA-1, but the remote router expects AES-GCM.. When IKEv2 Phase 1 is up but Phase 2 (IPsec SA) is not established, the most common cause is a mismatch in the proxy identities (the interesting traffic ACL) or a mismatch in the IPsec transform set parameters. Since the ACL is configured correctly, the issue is likely a mismatch in the transform set or the IKEv2 proposal.

Answer

The crypto map is not applied to the correct interface.

Answer

The ACL on the crypto map is missing the 'permit ip' statement for the return traffic.

Answer

The tunnel interface is down due to a routing issue.

Question 4

An engineer is configuring a FlexVPN hub-and-spoke topology using IKEv2. The hub router is configured with a dynamic crypto map and a local pool for assigning IP addresses to spokes. The spokes are configured with a static crypto map and a tunnel interface with an IP address from the pool. The tunnel comes up, but the spoke cannot ping the hub's tunnel interface. The hub can ping the spoke's tunnel interface. What is the most likely cause?

Accepted Answer

The spoke is configured with a static IP address on the tunnel interface that is not in the hub's IP pool.. In FlexVPN, the hub assigns an IP address to the spoke from a pool. The spoke's tunnel interface should receive this IP address dynamically. If the spoke is configured with a static IP address that is not in the hub's pool, the hub will not route traffic back to the spoke correctly, or the spoke may have a mismatched subnet. The hub can ping the spoke because the spoke's tunnel IP is reachable, but the spoke cannot ping the hub because the spoke's routing table may not have a route to the hub's tunnel IP, or the hub's reverse route injection is not working.

Answer

The hub is missing the 'tunnel protection ipsec' command on the tunnel interface.

Answer

The spoke's crypto map is not using the correct pre-shared key.

Answer

The hub's IKEv2 profile is not configured with 'authentication remote rsa-sig'.

Question 5

A company is using a dual-homed MPLS L3VPN connection with two different ISPs. The CE router is running eBGP with both PE routers. The engineer wants to ensure that inbound traffic from the Internet to the company's web servers uses both links, but outbound traffic from the company should prefer ISP A. The company advertises the same /24 prefix to both ISPs. What BGP configuration should the engineer apply on the CE router?

Accepted Answer

Use AS path prepending on routes advertised to ISP B and set a higher local preference for routes learned from ISP A.. To influence inbound traffic, the engineer can use AS path prepending to make one path less preferred. For outbound traffic, local preference can be used to prefer one ISP. Since the company wants outbound traffic to prefer ISP A, they should set a higher local preference for routes learned from ISP A. For inbound traffic, they can prepend AS path to ISP B to make that path less attractive.

Answer

Set a lower MED for routes advertised to ISP A and a higher MED for routes advertised to ISP B.

Answer

Advertise a more specific prefix (e.g., /25) to ISP A and a less specific prefix (/24) to ISP B.

Answer

Configure the CE router to use BGP multipath with both ISPs.

Question 6

An engineer is deploying a new SD-WAN solution using Cisco vManage. The WAN edge routers are connected to two different transport networks: MPLS and Internet. The engineer wants to ensure that voice traffic is always sent over the MPLS link when available, and only fails over to the Internet link if the MPLS link goes down. The engineer has configured a policy to set the preferred color for voice traffic to 'mpls'. However, during a test, voice traffic is still using the Internet link even though the MPLS link is up. What is the most likely cause?

Accepted Answer

The policy is not attached to the correct VPN or site list.. In Cisco SD-WAN, policy is applied in a specific order: centralized data policy, centralized app-route policy, and then local policy. The preferred color is set in the centralized data policy, but if there is also a centralized app-route policy that does not consider the preferred color, or if the policy is not properly attached to the correct VPN or site, it may not take effect. Additionally, the policy must be applied to the correct direction (service-side vs. transport-side).

Answer

The voice traffic is using a different DSCP value than the one defined in the policy.

Answer

The MPLS link is not in the 'up' state in the vManage overlay.

Answer

The policy is configured as a local policy instead of a centralized policy.

Question 7

A network engineer is configuring a PPPoE client on a Cisco router for a DSL connection. The engineer configures the dialer interface with the correct PPPoE profile and authentication credentials. The PPPoE session establishes, but the router cannot ping the ISP's gateway IP address. The engineer checks the routing table and sees that a default route is present via the dialer interface. What is the most likely cause?

Accepted Answer

The dialer interface does not have an IP address negotiated via IPCP.. PPPoE sessions often require the use of PPPoE client configuration on the physical interface and the dialer interface. A common issue is that the physical interface (e.g., Ethernet) is not configured with the 'pppoe enable' command, or the dialer interface is not bound to the correct dialer pool. However, the session is established, so the PPPoE negotiation succeeded. The inability to ping the gateway is often due to a missing or incorrect 'ip route' or a firewall issue, but the most common cause is that the ISP requires the use of PPP IPCP to negotiate the IP address, and the router may not have an IP address assigned.

Answer

The physical interface is configured with 'no ip address'.

Answer

The default route is pointing to the wrong next-hop IP.

Answer

The ISP's gateway is not responding to ICMP.

Question 8

An engineer is troubleshooting a site-to-site VPN that uses IPsec with IKEv1. The tunnel is established, but traffic is intermittently dropped. The engineer checks the 'show crypto ipsec sa' output and sees that the number of packets that failed anti-replay check is increasing. What is the most likely cause of this issue?

Accepted Answer

The traffic is taking multiple paths, causing packets to arrive out of order.. Anti-replay is a security feature in IPsec that uses sequence numbers to prevent replay attacks. If packets arrive out of order (e.g., due to different paths or latency), the anti-replay window may drop them. This is common when there are multiple paths or when the IPsec SA is used for traffic that is load-balanced across different links.

Answer

The IPsec SA is using a weak encryption algorithm.

Answer

The IPsec SA is using ESP in tunnel mode with authentication only.

Answer

The IPsec SA lifetime is too short, causing frequent rekeying.

Question 9

A company is implementing a WAN optimization solution using Cisco WAAS. The engineer configures WAAS devices at the data center and remote branch. The WAAS devices are configured to use inline mode. However, the engineer notices that optimized traffic is not being intercepted. The WAAS devices are directly connected to the WAN router and the LAN switch. What is the most likely cause?

Accepted Answer

The WAN router is not configured with WCCP or PBR to redirect traffic to the WAAS device.. In inline mode, WAAS devices must be physically placed in the traffic path. The WAAS device must be configured with the correct WAN and LAN interfaces, and the WAN router must be configured to redirect traffic to the WAAS device using WCCP or Policy Based Routing (PBR). If the WAN router is not configured to redirect traffic, the WAAS device will not see the traffic.

Answer

The WAAS device is not configured with the correct WAN and LAN interfaces.

Answer

The WAAS device is not licensed for optimization.

Answer

The WAAS device is using a different subnet than the LAN and WAN.

Question 10

A network engineer runs the following command on Router R1:

R1# show ip route 10.1.1.0
Routing entry for 10.1.1.0/24
  Known via "bgp 65001", distance 200, metric 0
  Tag 65002, type external
  Last update from 192.168.1.2 00:00:15 ago
  Routing Descriptor Blocks:
  * 192.168.1.2, from 192.168.1.2, 00:00:15 ago
      Route metric is 0, traffic share count is 1
      AS Hops 1
      Route tag 65002
      MPLS label: 18

Based on this output, what can be concluded?

Accepted Answer

The route is learned via BGP and has an MPLS label assigned, indicating MPLS forwarding.. The output shows a BGP route with an MPLS label, indicating that MPLS VPN or MPLS forwarding is in use. The presence of the MPLS label (18) in the routing table is the key clue.

Answer

The route is learned via OSPF and tagged with an MPLS label.

Answer

The route is a directly connected interface with an MPLS label.

Answer

The route is a static route with an MPLS label.