hardMultiple ChoiceObjective-mapped
Troubleshoot IPv6 Source Guard Dropping OSPFv3 Due to Missing Link-Local Binding
A network engineer configures 'ipv6 snooping' globally on a switch and applies 'ipv6 verify source' on a port connected to a router running OSPFv3. The router's OSPFv3 neighborship with another router across the switch fails. The switch logs show that OSPFv3 packets are being dropped. The engineer checks the binding table and sees no entries for the router's link-local address. What is the most likely reason?
Quick Answer
The answer is that IPv6 Source Guard drops OSPFv3 packets because it does not learn link-local addresses via ND snooping, leaving the binding table empty for those addresses. IPv6 Snooping and Source Guard rely on Neighbor Discovery snooping to populate the binding table, but OSPFv3 communicates exclusively using link-local addresses, which are algorithmically derived from the interface MAC and are never advertised in Neighbor Advertisements. Since the switch never sees a valid ND message for the router’s link-local address, no binding entry is created, and Source Guard drops the traffic as unauthorized. On the Cisco CCNP ENARSI 300-410 exam, this scenario tests your understanding of the IPv6 First Hop Security feature set and its edge cases—specifically that link-local bindings are not automatically generated, causing routing protocol failures. A common trap is assuming ND snooping captures all IPv6 addresses, but OSPFv3’s use of link-local sources is a deliberate blind spot. Memory tip: “Link-local is local to the link, not learned by ND—so Source Guard sinks the OSPF.”
⚠ Common exam trap
Cisco often tests the misconception that IPv6 Source Guard blocks multicast traffic, when in fact it filters based on source address validity against the binding table, not the destination address type.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Source Guard does not learn link-local addresses via ND snooping, so OSPFv3 packets are dropped.
IPv6 Source Guard, enabled by 'ipv6 verify source', relies on the IPv6 binding table to permit traffic. The binding table is populated by IPv6 Neighbor Discovery (ND) snooping, which learns global unicast and link-local addresses from ND messages. However, OSPFv3 uses its own Hello and LSA packets sent to the multicast address FF02::5, which are not ND messages. Since the router's link-local address is not learned via ND snooping, no binding entry exists, and Source Guard drops the OSPFv3 packets, causing the neighborship to fail.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Source Guard does not learn link-local addresses via ND snooping, so OSPFv3 packets are dropped.
Why this is correct
Link-local addresses are not populated in the binding table by default.
- ✗
OSPFv3 uses multicast addresses that are blocked by Source Guard.
Why it's wrong here
Source Guard validates source address, not destination.
- ✗
The router must be configured as a static binding for its link-local address.
Why it's wrong here
Static binding is an option but not required; the issue is the lack of automatic learning.
- ✗
The switch must have 'ipv6 snooping' enabled on the VLAN, not globally.
Why it's wrong here
Global enables it for all VLANs.
Quick reference
Routing Protocol Comparison
| Protocol | Metric | Max Hops | Algorithm | Type |
|---|---|---|---|---|
| RIP v2 | Hop count | 15 | Bellman-Ford | Distance vector |
| OSPF | Cost (bandwidth) | Unlimited | Dijkstra (SPF) | Link state |
| EIGRP | Composite metric | Unlimited | DUAL | Hybrid |
| IS-IS | Cost | Unlimited | Dijkstra | Link state |
| BGP | Policy / attributes | Unlimited | Path vector | Path vector |
RIP's 15-hop limit makes it unsuitable for large networks. OSPF and EIGRP dominate modern enterprise deployments.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 300-410 question from scratch — 1,966 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on 300-410
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A network engineer is troubleshooting an issue where IPv6 traffic is being forwarded incorrectly on a switch. The switch is configured with IPv6 Source Guard on access ports. A legitimate host on port Fa0/1 with IPv6 address 2001:db8:1::10 is unable to send traffic to the default gateway. The engineer checks the IPv6 binding table and sees that the host's entry is missing. What is the most likely cause?
medium- ✓ A.The host is using a static IPv6 address, and ND snooping is not enabled on the VLAN, so the binding was never learned.
- B.The host's MAC address is not in the MAC address table for VLAN 1.
- C.The switch is running IPv6 First Hop Security in monitor mode, which logs violations but does not drop traffic.
- D.The default gateway router is not sending Router Advertisements, so the host cannot form a default route.
Why A: IPv6 Source Guard relies on the IPv6 binding table, which is populated by IPv6 Neighbor Discovery (ND) snooping. If the host uses a static IPv6 address and ND snooping is not enabled on the VLAN, the switch never learns the binding, so IPv6 Source Guard drops the traffic as unauthorized. Enabling ND snooping allows the switch to inspect Neighbor Solicitation and Advertisement messages to build the binding table dynamically.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.