hardMultiple ChoiceObjective-mapped
300-410 Practice Question: A network using IPv6 over IPv4 L2TPv3 tunnels is…
A network using IPv6 over IPv4 L2TPv3 tunnels is experiencing packet drops. Router R1 has the following relevant configuration: interface Tunnel0 ipv6 address 2001:DB8:1::1/64 tunnel source 192.0.2.1 tunnel destination 198.51.100.1 tunnel mode l2tpv3 ipv6. Router R2 shows: R2# show l2tp tunnel Tunnel id 1, 1 session Session id 1, state established. R2# show ipv6 interface Tunnel0 Tunnel0 is up, line protocol is up. What is the root cause?
⚠ Common exam trap
Cisco often tests the misconception that L2TPv3 tunnels automatically handle MTU issues, when in fact the default MTU on the tunnel interface must be manually adjusted to prevent IPv6 packet drops due to encapsulation overhead.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The MTU on the tunnel interface is too high, causing fragmentation of IPv6 packets.
In an L2TPv3 tunnel carrying IPv6 traffic, the tunnel interface MTU defaults to 1500 bytes, but the actual path MTU between the tunnel endpoints (192.0.2.1 and 198.51.100.1) is likely lower due to the added L2TPv3, UDP, and IP headers. This causes IPv6 packets larger than the effective path MTU to be dropped because IPv6 routers do not fragment packets; they rely on ICMPv6 Packet Too Big messages, which may be blocked or not processed, leading to packet loss.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The MTU on the tunnel interface is too high, causing fragmentation of IPv6 packets.
Why this is correct
L2TPv3 adds overhead, and if the tunnel MTU is not adjusted, packets may be fragmented or dropped.
- ✗
The tunnel mode should be l2tpv3 ipv4 instead of ipv6.
Why it's wrong here
The mode is correct for transporting IPv6 over L2TPv3.
- ✗
The session ID on R1 does not match R2's session ID.
Why it's wrong here
The session is established, so IDs match.
- ✗
IPv6 routing is not enabled on R2.
Why it's wrong here
The interface is up and IPv6 is enabled.
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 300-410 question from scratch — 1,966 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.