hardMultiple ChoiceObjective-mapped
300-410 Practice Question: An engineer configures an IPv6 ACL to permit BGP…
An engineer configures an IPv6 ACL to permit BGP traffic (TCP port 179) between two routers and deny all other traffic. The ACL is applied inbound on the interface facing the BGP neighbor. BGP session establishes, but the routers cannot exchange IPv6 routes. Which is the most likely explanation?
⚠ Common exam trap
Cisco often tests the misconception that BGP traffic always uses destination port 179, but the trap is that BGP updates are sent from source port 179 to an ephemeral destination port, so an ACL permitting only destination port 179 will block route updates while still allowing the session to establish.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The ACL permits only TCP packets with destination port 179, but BGP updates are sent from source port 179 to an ephemeral destination port, so they are not matched and are dropped.
BGP updates are sent from TCP source port 179 to a high ephemeral destination port (above 1023). The ACL only permits TCP packets with destination port 179, which matches the initial BGP session establishment (where the neighbor sends SYN to destination port 179). However, once the session is up, BGP update messages are sourced from port 179 and destined to the ephemeral port of the peer. These updates have a destination port that is not 179, so they are not permitted by the ACL and are dropped, preventing route exchange.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The ACL permits only TCP packets with destination port 179, but BGP updates are sent from source port 179 to an ephemeral destination port, so they are not matched and are dropped.
Why this is correct
Correct. BGP uses source port 179 for outgoing updates; the destination port is ephemeral. The ACL must permit both directions or use 'tcp any any eq 179' for incoming updates, but for outgoing updates, the router needs to permit 'tcp any any' or specify the correct direction.
- ✗
The ACL must also permit ICMPv6 for PMTUD, but the BGP session establishes, so PMTUD is not needed.
Why it's wrong here
Incorrect. BGP can establish without PMTUD if the MTU is sufficient.
- ✗
The ACL is applied outbound, not inbound, causing the BGP updates to be filtered.
Why it's wrong here
Incorrect. The question states the ACL is applied inbound.
- ✗
The router has BGP authentication configured, which changes the TCP port number.
Why it's wrong here
Incorrect. Authentication does not change the port number.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every 300-410 question from scratch — 1,966 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.