CCNA Infrastructure Questions

An anycast distributed gateway configures the same gateway IP and MAC on every leaf switch, so each leaf can route traffic locally for its directly attached hosts. This avoids sending traffic to a centralized gateway and prevents suboptimal tromboning. It is the standard VXLAN EVPN design for optimal East-West forwarding.

For 802.1X with EAP-TLS, the WLC must act as a RADIUS client and forward EAP messages to an external RADIUS server. Configuring the server on the WLC and selecting it in the WLAN's security settings enables this. The WLC does not terminate EAP-TLS; it passes the authentication to the RADIUS server.

In BGP, the route is only installed into the IP routing table if the next-hop IP address is reachable via an existing IGP or static route. In an MPLS VPN, the PE advertises VPN routes to the remote PE with the next-hop set to the loopback address of the advertising PE. If that loopback is not in the IGP routing table of the receiving PE or the CE, the BGP route remains in the BGP table but is not installed, causing the CE to see no usable routes.

EIGRP supports unequal-cost load balancing through the variance command, allowing traffic to be distributed across multiple paths with different metrics. It also converges quickly using the feasible successor mechanism, making it suitable for this branch office scenario. OSPF and BGP do not natively support unequal-cost load balancing, and RIP has slow convergence.

To enable 802.1X authentication on a WLC, the WLAN must be configured with WPA2 Enterprise security, which uses 802.1X/EAP. The RADIUS server details, including IP address and shared secret, must be specified so the WLC can communicate with the authentication server. This configuration ensures that clients authenticate via the RADIUS server before gaining network access.

VTP server mode allows the switch to create, modify, and delete VLANs for the entire VTP domain. The switch can also receive and process VTP advertisements from other servers, but it will not overwrite the existing VLAN database unless its configuration revision number is higher. By default, a new switch has a revision number of 0, so it will not overwrite existing databases. This meets all requirements.

The Control Plane Node (CPN) runs the LISP map server and map resolver. It maintains the endpoint ID-to-RLOC mapping database and responds to map-requests from fabric edge nodes. When an edge node needs to locate an endpoint, it queries the CPN, which returns the RLOC of the edge node where the endpoint is attached.

The fabric border node connects the SD-Access fabric to external networks (traditional L3 networks, data centers, or other fabric sites). It performs route redistribution between the fabric's LISP/VXLAN domains and external routing protocols, and can enforce policy via SGT propagation. It preserves endpoint IP addresses by advertising fabric prefixes externally and importing external routes into the fabric.

VTP uses the highest revision number within the same domain and password to determine which database is most current. SW2 has a higher revision number, so SW1 will accept SW2's advertisement and overwrite its own VLAN database with SW2's, which is empty. This can wipe out all VLANs on SW1 and disrupt the network.

In Cisco SD-Access, the control plane node runs the LISP map-server and map-resolver functions. It maintains the endpoint-to-location mappings in its database. When an edge node needs to resolve an endpoint's location, it queries the control plane node, which returns the RLOC (routing locator) of the edge node where the endpoint is attached.

In VXLAN, BUM traffic can be replicated using multicast in the underlay. By mapping each VLAN to a unique multicast group address, VTEPs can efficiently forward BUM traffic only to interested VTEPs. Configuring PIM Sparse Mode in the underlay enables this multicast replication. This approach optimizes BUM traffic by avoiding unicast head-end replication and leverages the underlay multicast capabilities.

To enable VXLAN encapsulation, the `feature nv overlay` and `feature vn-segment-vlan-based` must be enabled, and an NVE interface must be configured with a source interface (usually a loopback) and a VNI mapped to the VLAN. The NVE interface is the VTEP, and without it, VXLAN encapsulation does not occur.

HSRP uses a virtual MAC address of 0000.0c07.acXX, where XX is the group number in hexadecimal. It also allows the virtual IP address to be the same as one of the physical interface addresses on the active router. This matches the requirements exactly, making HSRP the correct choice.

The crypto ACL, typically an extended access list, defines the interesting traffic that should be encrypted and sent through the VPN tunnel. It specifies the source and destination subnets, such as permit ip 10.1.1.0 0.0.0.255 10.2.2.0 0.0.0.255. This ACL is referenced by the crypto map.

The control plane node in a Cisco SD-Access fabric runs the LISP Map-Server and Map-Resolver functions. It maintains the mapping database of endpoint IP addresses to fabric edge nodes (RLOCs). When an edge node needs to reach an endpoint, it sends a Map-Request to the control plane node, which responds with the Map-Reply containing the RLOC of the edge node where the endpoint is located. This enables VXLAN encapsulation and forwarding.

EVPN provides a standards-based control plane for VXLAN, enabling automatic VTEP discovery, MAC address learning, and support for multihoming with all-active forwarding. EVPN uses BGP to distribute MAC and IP reachability information, and it supports Ethernet Segment (ES) multihoming, which allows a host to connect to multiple VTEPs with all links active. This matches the requirements for dynamic discovery and all-active multihoming.

For DHCP relay to work, the router must have a route to the DHCP server's IP address. If no route exists, the router cannot forward the relayed packets, and clients will not receive addresses. This is a common oversight when configuring relay agents in a new environment.

GLBP provides both sub-second failover and automatic load balancing across multiple gateways. It uses an Active Virtual Gateway (AVG) and up to four Active Virtual Forwarders (AVFs) to share traffic. Different hosts can be assigned different virtual MAC addresses, distributing the load. This meets the requirements for sub-second failover and load balancing across VLANs without manual per-VLAN group configuration.

This command configures AAA authentication for login to first use the RADIUS server group and then fall back to the local database if the RADIUS server is unreachable. The 'local' keyword ensures that local authentication is attempted as a backup, providing resilience.

gRPC is a high-performance RPC framework that uses HTTP/2 for transport, supports streaming, and is used for model-driven telemetry on Cisco IOS XE. It allows efficient, real-time streaming of telemetry data and supports bidirectional streaming. This makes it the best choice for retrieving interface statistics with streaming telemetry and HTTP/2 benefits.

For OSPF MD5 authentication to succeed, both routers must have the same key ID and password configured on their interfaces. The neighbor must have the identical message-digest-key command with the same key number and MD5 password. Without this matching configuration, authentication will fail, and the adjacency will not form.

This method list tells the router to try TACACS+ first, then fall back to the local user database if the server does not respond. The local keyword ensures that a locally configured username and password can be used during an outage. This meets the requirement for centralized authentication with a local fallback.

VXLAN encapsulates original Layer 2 frames within UDP packets, typically using UDP port 4789. This encapsulation allows Layer 2 connectivity to be extended over a routed Layer 3 underlay, which is essential for data center interconnect and overlay networks. The use of UDP provides a standard transport that can traverse IP networks.

MP-BGP EVPN is the control plane that distributes MAC and IP bindings via EVPN routes such as Type 2 and Type 5. It enables all leaf switches to learn remote MAC/IP addresses and provides optimal forwarding without relying on flood-and-learn. This matches the requirement for a scalable, efficient VXLAN EVPN fabric.

LLQ provides a strict priority queue for VoIP traffic, ensuring low latency and jitter. When combined with a policer, it can limit the amount of traffic that enters the priority queue, dropping excess VoIP packets during congestion. This meets the requirement to prioritize and drop excess VoIP traffic.

SVIs are logical Layer 3 interfaces associated with VLANs. Creating an SVI for each VLAN and enabling IP routing allows the multilayer switch to route traffic between VLANs internally. This is the standard method for inter-VLAN routing on a Catalyst switch, eliminating the need for an external router and providing high-performance routing.

Cisco SD-Access fabric supports IP mobility, which allows a client to roam across Layer 3 boundaries while keeping its IP address. The fabric control plane node (using LISP) tracks endpoint locations, and the edge nodes encapsulate traffic in VXLAN. When a client roams, the new edge node registers the client's new location, and the fabric forwards traffic to the correct edge, ensuring seamless roaming without IP address change.

This command configures AAA authentication for login using the default method list. It specifies that the TACACS+ group should be tried first, and if the server is unreachable, the local database is used as a fallback. This meets the requirement for fallback authentication. The 'group tacacs+' keyword refers to the TACACS+ servers defined with the 'tacacs server' command.

OSPF E2 routes advertise the external metric from the ASBR and intentionally discard the internal cost accumulated along the path, so two E2 routes with the same metric appear equal. However, Cisco IOS and many other implementations avoid a random choice by applying a tie-breaking rule: when the E2 metric and AD are identical, the router compares the OSPF interface cost (or the cost to the ASBR) and prefers the path with the lower cost. In the exhibit, the two E2 routes have equal external metrics, but the route via the interface with lower cost is installed, while the other is held as a candidate. Thus, the apparent equal-cost routes are not truly equal for forwarding because interface cost breaks the tie.