Cisco SPCOR / CCNP Service Provider Core 350-501 (350-501) — Questions 451–525

Segment Routing (SR) uses a centralized control plane (via PCE or BGP-LS) to allocate labels per prefix, unlike LDP which allocates labels per interface on a hop-by-hop basis. This reduces the number of labels in the control plane and simplifies label management, as SR-MPLS uses a single label stack entry per segment rather than per-interface labels.

In MPLS, the EXP (Experimental) bits, also known as the Traffic Class (TC) field per RFC 5462, are 3 bits in the MPLS label header used to carry Quality of Service (QoS) information between Label Switch Routers (LSRs). These bits allow LSRs to apply per-hop behaviors (PHBs) such as queuing and scheduling based on the packet's QoS class, enabling differentiated services across the MPLS network.

NSO (Network Services Orchestrator) uses YANG models and NETCONF for configuration management. Ansible, Cisco DNA Center, and Chef are other tools but NSO is specifically for service orchestration.

GPON uses Wavelength Division Multiplexing (WDM) with different wavelengths for downstream (1490nm) and upstream (1310nm) on the same fiber.

BFD (Bidirectional Forwarding Detection) provides sub-second failure detection and triggers SPF/PRC.

VRF-Lite (Virtual Routing and Forwarding) is the correct mechanism because it allows a single PE router to maintain multiple separate routing tables (VRFs), each dedicated to a different customer. This ensures that routing updates for one customer are isolated from another, preventing interference. VRF-Lite achieves this without MPLS, using only IP forwarding and per-VRF routing instances.

BGP uses multiple attributes in a specific order of precedence when selecting the best path. Weight (Cisco-proprietary) is checked first, before local preference. If the peer's route has a higher weight (e.g., 32768 for locally injected routes or a manually set value), it will be preferred over a route with a local preference of 200, even if the other route's local preference is only 150.

DSCP is a 6-bit field with 64 possible values. Per-hop behaviors (PHBs) like EF and AF are defined by DSCP values.

When BGP is configured with a neighbor using a directly connected interface address (e.g., 10.0.0.2) but the update-source is set to Loopback0, the BGP session will attempt to establish using the loopback IP as the source. If the loopback address is not reachable via the directly connected link (e.g., no IGP route for the loopback across the MPLS/VPN core), the BGP session will fail, preventing the CE router behind the VRF from reaching the remote CE. This mismatch between the neighbor address and the update-source is a common misconfiguration in MPLS L3VPN environments.

IOS XR runs each protocol as a separate process in protected memory, so a crash of one process does not affect others, improving stability.

The route-map uses `match community 100` to identify the BGP community value 100:100 (in Cisco's default format, the community is matched without the colon), and `set local-preference 200` modifies the local preference for that prefix to 200. This is the standard method to influence inbound BGP path selection by adjusting local preference based on community matching.

VRF (Virtual Routing and Forwarding) creates separate routing tables for each customer, ensuring isolation.

SRv6 (Segment Routing over IPv6) encapsulates packets with an IPv6 header containing a Segment Routing Header (SRH), which is a type of IPv6 extension header. For line-rate forwarding, the hardware must natively process IPv6 extension headers in the forwarding plane without punting to the CPU, as software processing would cause performance degradation. Option C is correct because this capability is the most critical for SRv6 at line rate.

6PE uses BGP multiprotocol extensions (MP-BGP) with an AFI of 2 (IPv6) and SAFI of 1 (unicast), and the next-hop is encoded as an IPv4 address using the 'next-hop' attribute.

A policy-map must be applied in the correct direction (input or output) for the marking to take effect. If a marking policy is applied to the wrong direction, the packets will not be processed by the policy, and DSCP values will remain unchanged. This is a common misconfiguration when the intended marking should occur on ingress but the policy is applied to egress, or vice versa.

IGMPv3 snooping on the PE router processes the receiver's IGMPv3 report. If the SSM range (232.0.0.0/8) is applied to group 239.1.1.1, the receiver must send an IGMPv3 (S,G) report to join a specific source. However, if the receiver sends a (*,G) report (which is allowed only in ASM mode), the IGMP snooping will not install the forwarding entry, causing multicast traffic to be dropped even though the MDT is established.

Anycast SIDs are shared among multiple routers in the same anycast group, allowing any of those routers to process traffic destined for that SID. This provides redundancy and fast convergence because if one router fails, traffic is automatically rerouted to another router in the group without requiring control-plane signaling changes.

The confederation AS_PATH (AS_CONFED_SEQUENCE and AS_CONFED_SET) is used to track the path within the confederation, and loop detection checks this attribute.

A 'must' expression in YANG provides a XPath condition that must evaluate to true for the data to be valid.

The observed drop rate being exactly half the configured police rate strongly suggests that the token-bucket algorithm is operating with a burst size that is too small. When the burst size is insufficient, the bucket empties quickly under sustained traffic, causing packets to be marked as exceeding the rate and dropped. The police command in Cisco IOS uses a single-rate two-color marker (RFC 2697) or a two-rate three-color marker (RFC 2698), and a small burst size leads to premature drops even when the average rate is below the configured police rate.

MPLS-TE Fast Reroute (FRR) provides sub-50 ms protection switching by pre-computing backup paths (bypass tunnels) for link and node failures, ensuring minimal traffic loss. Bidirectional Forwarding Detection (BFD) provides sub-second failure detection by sending rapid, lightweight hello packets independent of routing protocols, enabling faster convergence when combined with FRR.

Originator ID is used by route reflectors to prevent loops. If a router receives a route with its own router ID as originator, it discards it.

Applying a policy-map in the wrong direction (input vs output) is a common QoS misconfiguration because QoS actions like shaping, policing, and queuing are direction-specific. For example, shaping is typically applied on the egress interface to control outbound traffic, while policing can be applied inbound to rate-limit incoming traffic. Misapplying a policy-map (e.g., attaching a shaper to the input direction) will either be ignored by the router or cause unexpected behavior, leading to QoS failures.

SRv6 SIDs are 128-bit and structured as Locator:Function:Arguments. End.DT4 is a function that decapsulates the outer IPv6 header and forwards the inner IPv4 packet based on destination.

The route is present in the VRF BGP table on PE1 (valid), but no MPLS label is assigned for that prefix in the forwarding table. This indicates that PE1 has learned the route via MP-BGP but cannot install it into the MPLS forwarding table because the route target (RT) import policy on PE1 does not match the RT export policy on PE2. Without a matching RT, PE1 does not consider the VPNv4 route as belonging to the CUST VRF, so it cannot resolve the next hop or assign a label for forwarding.

The ESI (Ethernet Segment Identifier) and designated forwarder election ensure single active forwarding per segment. DF election is used for multi-homing.

EIGRP configuration requires entering the EIGRP process, advertising networks, and optionally disabling auto-summary.

MQC consists of class-map (classification), policy-map (define actions), and service-policy (apply). class-map uses match statements; policy-map can include bandwidth, priority, shape, etc.

(Strict) is correct because RSVP-TE explicit paths with the 'strict' keyword require each hop in the path to be directly adjacent (connected) to the previous hop. This enforces that the tunnel path follows exactly the predefined set of hops without any intermediate routers being inserted, which is the requirement in the question.

EVPN uses ESI-based multi-homing with BGP control plane, offering faster convergence and active-active load balancing compared to VPLS's active/standby model.

MPLS-TE Fast Reroute (FRR) with link protection pre-computes a backup tunnel that bypasses the protected link. When link B-C fails, the router at node B (the Point of Local Repair, or PLR) immediately switches traffic to this pre-established backup tunnel, ensuring sub-50ms failover without involving the head-end router.

The 'backup' option in the ios_config module instructs Ansible to save a copy of the running configuration to a local file before making any changes. If the playbook fails or produces an undesired state, the operator can restore the device to the previous configuration using that backup file. This provides a straightforward rollback mechanism for MPLS VPN deployments without requiring external version control or manual snapshots.

PCEP (Path Computation Element Protocol) is used for communication between a PCE (controller) and PCC (router) to compute and instantiate SR-TE policies.

OSPFv3 uses IPsec for authentication and does not include authentication fields in the OSPF header. It runs per-link instead of per-subnet.

NSO (Network Services Orchestrator) uses NETCONF as its primary protocol for configuration management because NETCONF provides a standardized, transaction-based mechanism for editing device configurations using YANG data models. This allows NSO to perform atomic, rollback-capable configuration changes across multiple network devices, which is essential for service orchestration.

RPKI validates origin AS, prefix-list filters prefixes, and route-maps can apply additional filters. BGP communities are used for tagging, not direct hijacking prevention. AS-path prepending is for path selection, not hijacking.

MPLS LDP requires CEF, enabling MPLS on interfaces, and setting the LDP router-id.

High CPU usage on a BGP-speaking router is often caused by processing a large number of BGP updates. Applying inbound route filtering using prefix lists (option C) reduces the number of routes the router must process and store, directly lowering CPU load without disrupting existing traffic flows. This is a non-disruptive, targeted mitigation that addresses the root cause of excessive route processing.

IS-IS TE extensions (RFC 5305) are required to carry MPLS Traffic Engineering information, such as link bandwidth, administrative groups, and TE metric, in Type-Length-Value (TLV) fields within IS-IS Link State PDUs. These extensions enable the IGP to flood TE attributes that MPLS TE uses for constraint-based path computation, such as with RSVP-TE or Segment Routing.

BGP best path selection follows a specific order: weight, local preference, locally originated, AS_PATH length, MED.

EVPN Route Type 2 is used to advertise MAC and IP addresses of hosts, enabling MAC learning and ARP suppression in EVPN-VXLAN fabrics. By distributing host MAC and IP bindings via BGP, it allows VTEPs to learn remote MAC addresses without data-plane flooding and to suppress ARP requests by responding locally when the IP-to-MAC mapping is known.

Disabling MPLS on PE-CE links (by not enabling MPLS on the interface) prevents the customer from seeing or injecting MPLS labels, thus preventing label spoofing. TTL propagation is used for traceroute but not a primary anti-spoofing measure.

BGP-LS uses a separate address family (AFI 16388 / SAFI 71) from VPNv4 (AFI 1 / SAFI 128) to carry link-state information. This separation allows BGP-LS to operate independently from VPNv4 routes, enabling the collection and distribution of IGP topology data without interfering with MPLS VPN signaling.

When a PE router receives a customer route from a CE router via MP-BGP, it must first make the route unique within the MPLS VPN context by adding a Route Distinguisher (RD). The RD prepended to the IPv4 prefix creates a VPNv4 address (per RFC 4364), which is the format required for advertisement to a route reflector. Without the RD, the route would not be distinguishable from other customers' overlapping IP prefixes in the BGP table.

A bypass tunnel is a single tunnel protecting a link, carrying traffic for all LSPs that traverse that link. Detour tunnels are per-LSP.

WRED (Weighted Random Early Detection) and tail drop are congestion avoidance mechanisms that manage queue fullness before congestion occurs.

MP-BGP (Option E) is used to exchange VPNv4 routes between Provider Edge (PE) routers, carrying both the route and its corresponding MPLS label. MPLS labels (Option C) are used to forward packets across the provider core via label-switched paths (LSPs), enabling the separation of customer traffic. Together, MP-BGP and MPLS labels form the foundation of Layer 3 MPLS VPN services.

IRB uses an Integrated Routing and Bridging interface (IRB interface) or BVI (Bridge Virtual Interface) to route between VLANs within the EVPN.

LDP uses downstream unsolicited mode by default, where a router advertises labels to all neighbors without being asked.

EVPN uses BGP EVPN address family (AFI 25, SAFI 70) to exchange MAC/VPN routes for L2 and L3 services.

The route reflector must include the originator ID attribute to prevent routing loops when reflecting VPNv4 routes between clients. The originator ID is set to the router ID of the originating IBGP speaker, and the route reflector ignores any route with an originator ID equal to its own router ID, thereby preventing loops in a client-to-client reflection scenario.

B is correct because PCEP with stateful delegation allows the SDN controller to compute and instantiate SR-TE tunnels dynamically, while the router delegates control to the controller for path updates. This approach ensures fast convergence by enabling the controller to react to network changes in real time and scales efficiently by centralizing path computation, avoiding per-router configuration overhead.

PCEP (Path Computation Element Protocol) is used between PCCs (e.g., routers) and a PCE (e.g., SR-PCE) for path computation requests and responses.

The 'match ip dscp ef' command in the class map checks the DSCP value already present in the incoming VoIP packets. If the source device (e.g., an IP phone) does not mark the packets with DSCP EF (46), the class map will not match, and the QoS policy will not apply the expected marking. The policy can only re-mark packets that are already matched by the class map.

In a classic MPLS network without Segment Routing, LDP (Label Distribution Protocol) is the standard protocol used to exchange label binding information. LDP assigns and distributes labels for each FEC (Forwarding Equivalence Class) based on the underlying IGP routing table, enabling label-switched paths (LSPs) without requiring RSVP or Segment Routing extensions.

If the RESTCONF request path includes a specific interface key (e.g., /restconf/data/ietf-interfaces:interfaces/interface=GigabitEthernet0/0/0), the API will return only that single interface's operational data, even if the engineer intended to retrieve all interfaces. RESTCONF uses URI-encoded keys to filter resources; omitting the key returns the entire list, while including a key narrows the response to that specific instance.

CoPP on IOS XR is used to classify and rate-limit control plane traffic such as routing protocols (BGP, OSPF, IS-IS) and management traffic (SSH, SNMP). Among the options, BGP updates are control plane traffic that can be rate-limited to protect the CPU.

MPLS adds a label stack (typically 4 bytes per label) between the Layer 2 header and the IP packet. This additional overhead reduces the maximum payload size that can be carried without exceeding the interface MTU, effectively lowering the payload MTU available for the IP packet.

Process separation provides fault isolation; a crash in one protocol process does not affect others, improving overall system stability.

A common mapping is to copy the three most significant bits of DSCP to EXP, which maps DSCP PHBs into corresponding EXP values.

BGP updates are sent to the control plane; without CoPP, a flood of BGP updates can overwhelm the router. CoPP classifies BGP traffic and rate-limits it to protect the control plane.

End.DT4 for IPv4 L3VPN, End.DT6 for IPv6 L3VPN, and End.DT2U for L2VPN are defined SRv6 behaviors.

After weight, local pref, and locally originated, BGP compares AS_PATH length (shorter is preferred).

BGP PIC relies on installing a backup path in the FIB. For core-facing failures, BGP Fast External Fallover and BGP PIC with backup paths are used; specifically, 'bgp additional-paths install' is needed to install backup paths.

IBGP requires either a full mesh of sessions or route reflectors to prevent routing loops. The BGP split-horizon rule states that routes learned from an iBGP peer are not advertised to another iBGP peer, so without a full mesh or route reflectors, reachability information cannot propagate within the AS. Route reflectors break this rule by allowing selected iBGP speakers to re-advertise routes, but they must be deployed with proper cluster and originator ID attributes to avoid loops.

Default SRGB is 16000-23999, but can be configured. The label range is global across SR domain.

The `route-target import 100:1` command under the VRF definition configures the local PE to accept VPNv4 routes that carry the specified route-target (100:1) from the remote PE. This import RT must match the export RT of the remote PE for the route to be installed into the VRF's routing table. The `rd 100:1` defines the route distinguisher, which is separate from the RT and ensures uniqueness of the VPNv4 prefix.

BGP Prefix Independent Convergence (PIC) enables fast failover by pre-installing backup paths into the forwarding table, so when a BGP next-hop becomes unreachable, traffic is immediately switched to the backup path without waiting for BGP reconvergence. This is critical in MPLS cores where slow BGP convergence after a link failure can cause prolonged traffic loss.

PRC is triggered when a prefix changes but the topology remains unchanged. It recalculates only the affected prefixes, not the entire SPF tree.

The LFIB (Label Forwarding Information Base) is the MPLS forwarding table that maps incoming labels to outgoing labels and interfaces.

PCEP is the protocol used between PCE and PCC for path computation and setup.