hardMultiple ChoiceObjective-mapped
300-410 Practice Question: An engineer configures IPv6 uRPF loose mode on an…
An engineer configures IPv6 uRPF loose mode on an interface that connects to a DMVPN spoke. The spoke router uses NHRP to register with the hub and establishes a tunnel. Traffic from the spoke to destinations behind the hub is dropped. Which is the most likely explanation?
⚠ Common exam trap
Cisco often tests the distinction between uRPF loose and strict modes, and the trap here is that candidates assume loose mode only checks the RIB for any route, but they forget that NHRP-learned addresses are not installed in the global routing table, causing the drop.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The spoke's tunnel IPv6 address is not in the global routing table because it is only known via NHRP, causing uRPF loose mode to drop packets sourced from that address.
In IPv6 uRPF loose mode, the router checks that the source address of an incoming packet is present in the routing table (any route, not necessarily via the incoming interface). On a DMVPN spoke, the tunnel IPv6 address is typically learned only via NHRP and is not installed in the global IPv6 routing table. Therefore, when the spoke sends traffic sourced from its tunnel address, uRPF loose mode drops the packet because the source address is not found in the routing table.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The spoke's tunnel IPv6 address is not in the global routing table because it is only known via NHRP, causing uRPF loose mode to drop packets sourced from that address.
Why this is correct
Correct. uRPF loose mode requires that the source address be present in the routing table (any interface). If the address is only in NHRP cache, not in the routing table, packets are dropped.
- ✗
The hub has uRPF strict mode configured, which breaks the DMVPN tunnel because of asymmetric routing.
Why it's wrong here
Incorrect. The question specifies uRPF loose mode on the spoke interface, not strict mode on the hub.
- ✗
The spoke's NHRP registration packets are filtered by the uRPF check because they use multicast destination.
Why it's wrong here
Incorrect. NHRP uses unicast or multicast; uRPF checks source address, not destination.
- ✗
The tunnel interface has an IPv6 ACL that denies traffic from the spoke's tunnel address, overriding uRPF.
Why it's wrong here
Incorrect. There is no mention of an ACL; the issue is uRPF behavior.
Go deeper
Related to this question
Learn chapter
OSPF Route Summarization and Filtering
Key term
uRPF
Unicast Reverse Path Forwarding is a network security feature that verifies the source address of incoming packets to prevent IP spoofing attacks.
Key term
DMVPN Phase 2
DMVPN Phase 2 is an advanced Cisco routing technology that allows spoke routers to communicate directly with one another without sending traffic through a central hub, using dynamic routing protocols and multipoint GRE tunnels.
About these practice questions
This 300-410 question is part of Courseiva's 1,966-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.