CCNA Infrastructure Services Questions

NHRP redirect allows the hub to inform the originating spoke that a shorter path exists to the destination spoke, enabling direct spoke-to-spoke tunnels. When the hub receives a packet from one spoke destined to another, it sends an NHRP redirect message to the source spoke, which then initiates an NHRP resolution for the destination spoke's public address and builds a direct tunnel. This is a key feature of DMVPN Phase 3.

DHCPv6 Guard filters DHCPv6 server messages on untrusted ports, allowing only authorized servers to respond to client requests. Enabling it on the VLAN prevents rogue DHCPv6 servers from assigning addresses. Since IPv6 snooping is already enabled, adding DHCPv6 Guard provides the necessary protection against rogue servers, fulfilling the requirement.

The address-family vpnv4 unicast configuration under BGP enables the exchange of VPNv4 routes between PE routers. This address family carries the VPN label and route targets, allowing PEs to import and export routes into VRFs. Without activating this address family, BGP will not advertise VPNv4 prefixes, and customer routes will not be propagated across the MPLS core.

In MPLS L3VPN, the PE router maintains separate OSPF processes for each VRF. By not redistributing the customer's OSPF routes into the provider's global OSPF process, the customer's routes remain isolated. The PE redistributes them into MP-BGP for transport across the MPLS core. This separation prevents the customer's OSPF topology from mixing with the provider's IGP.

OSPFv3, like OSPFv2, requires that routers on the same link be in the same area to form an adjacency. Since R1 is in area 0 and R2 is in area 1, the hello packets will not be accepted, and the adjacency will not form. This is the most likely cause of the problem described.

The ip dhcp excluded-address command can be entered multiple times to exclude different ranges or individual addresses. To exclude the first 10 addresses and the last address, you need two commands: one for the range 192.168.100.1 to 192.168.100.10, and another for the single address 192.168.100.254. This correctly meets all requirements.

RSVP (Resource Reservation Protocol) is the signaling protocol used for MPLS Traffic Engineering. It reserves bandwidth along the path and distributes labels for the TE tunnel. RSVP-TE extends RSVP to support traffic engineering by adding objects for explicit routes, bandwidth, and label requests. It must be enabled on all interfaces that the TE tunnel traverses to ensure resource reservation and label distribution.

This command configures the default login authentication method list to first try TACACS+ and then fall back to the local database if the TACACS+ server is unreachable. The 'local' keyword ensures that local authentication is attempted only if the TACACS+ servers do not respond, providing redundancy and preventing lockout.

The router lisp command enters LISP configuration mode, where you can enable ITR functionality, define EID-to-RLOC database mappings, and configure map-resolvers. Without this global command, LISP processes are not activated, and the router cannot encapsulate or decapsulate LISP traffic. It is the foundational step for any LISP role.

The ip rsvp bandwidth command must be configured on each core interface that will participate in RSVP-TE. This command enables RSVP on the interface and allocates a percentage or absolute amount of bandwidth for TE reservations. Without it, RSVP messages are not sent or processed on that interface, and the TE tunnel cannot be signaled. Therefore, this is the required interface-level command to enable RSVP-TE on the core links.

The other-config-flag instructs hosts to use DHCPv6 to obtain other configuration parameters such as DNS, while addresses are still formed via SLAAC. The ipv6 dhcp server command binds the DHCPv6 pool to the interface. This combination meets the requirement of SLAAC for addresses and DHCPv6 for DNS.

RA Guard examines incoming Router Advertisement and Redirect messages on a port and can block or allow them based on a policy. By configuring RA Guard on host-facing ports to block RAs, only the legitimate router's RAs are accepted, preventing rogue RA attacks and restoring stable connectivity.

After creating an RA guard policy, you must attach it to the desired interface with the ipv6 nd raguard attach-policy command. This activates the policy on that interface, allowing it to filter rogue RAs. Without attaching the policy, the configuration exists but is not enforced on any port, leaving the network vulnerable.

This is correct. For the DHCP relay agent to forward requests to the server, the router must have a route to the DHCP server's IP address. The helper address itself only specifies the destination; the router must be able to reach that destination via its routing table. If the interface facing the server is down or lacks an IP address, or if there is no route to 10.1.1.100, the relayed packets will be dropped. This is a common oversight when configuring DHCP relay.

'ip nhrp redirect' on the hub allows the hub to send a redirect message to the spoke when it detects that traffic is being routed through the hub to another spoke. This enables the spoke to initiate an NHRP resolution for the destination spoke's NBMA address and establish a direct tunnel.

For spoke-to-spoke shortcut tunnels to form, the spoke must have a specific route to the destination network that points to the tunnel interface, not a default route. If a default route is used, the spoke will not attempt NHRP resolution for the specific destination and will continue sending traffic via the hub. The spoke needs a more specific route (e.g., a /24 for the remote spoke's LAN) to trigger the shortcut. This is a common oversight in DMVPN Phase 3 deployments.

The mpls ip command enables MPLS forwarding on an interface. On the core-facing interface of a PE router, this command is required to allow the interface to send and receive MPLS-labeled packets. Without it, the interface will not process MPLS labels, and traffic for the CUSTOMER VRF will not be forwarded correctly across the MPLS backbone.

The ip helper-address command configured on the router interface enables DHCP relay by forwarding UDP broadcasts (including DHCP DISCOVER) to the specified server IP address. This allows clients on a subnet without a local DHCP server to obtain addresses from a centralized server. It is the standard method for DHCP relay in Cisco IOS.

In an MPLS Layer 3 VPN, the PE router must have a VRF configured for each customer, and the customer-facing interface must be assigned to that VRF. This separates customer routing tables and allows the PE to advertise customer routes into MP-BGP with the appropriate route target. Without a VRF, the PE cannot distinguish customer traffic or apply the correct label stack, so VPN traffic would not be forwarded correctly.

The 'standby 10 preempt' command enables the router to take over as the active gateway if it has a higher priority than the current active router. Without preemption, a router that reboots and comes back online will not become active even if its priority is higher; it will remain in standby. This command ensures the intended active router assumes the role.

This configuration creates a DHCP pool named LAN, defines the subnet 10.10.10.0/24 from which addresses are allocated, and specifies the default gateway and DNS server for clients. The router interface address 10.10.10.1 is used as the gateway. This is the standard Cisco IOS DHCP server configuration for a directly connected subnet.

This command, configured on the interface, specifies a custom client identifier that the router includes in its DHCP requests. The service provider can use this identifier to assign a specific lease or apply policies. It must be applied to the interface acting as the DHCP client, and the identifier can be a string or hexadecimal value.

The address-family vpnv4 command under BGP configuration enables the exchange of VPNv4 prefixes between PE routers. It carries the route distinguisher and route target extended communities, which are essential for MPLS L3VPN. Without this address family activated on both PE routers, customer routes will not be propagated across the MPLS core, breaking connectivity between sites.

NHRP redirect on the hub and NHRP shortcut on the spokes enable Phase 3 DMVPN. The hub sends NHRP redirect messages to spokes when it receives traffic that could go directly between them, and spokes use NHRP shortcut to resolve the destination spoke's NBMA address and build a direct tunnel, reducing hub load and latency.

RSVP is the signaling protocol used by MPLS TE to reserve resources and establish label-switched paths. Even if the IGP advertises TE information, without RSVP enabled on the interfaces, the TE tunnel cannot signal the path and reserve bandwidth. Enabling RSVP on all interfaces along the intended path is essential for the tunnel to come up.

The crypto access list, configured with an extended access list and referenced in the crypto map, defines which traffic is encrypted and sent through the IPsec tunnel. Traffic permitted by the access list is encrypted, while denied traffic is sent unencrypted. This is the correct element for specifying the interesting traffic in an IPsec VPN configuration on Cisco routers.

The ip policy route-map command, configured under the interface, enables PBR for packets arriving on that interface. The route-map defines the match and set criteria that determine how packets are handled. This is the correct and standard method to apply PBR on Cisco IOS routers for policy routing of ingress traffic.

This command globally excludes the range 192.168.50.1 through 192.168.50.30 from any DHCP pool on the router. In this scenario, it ensures the server never offers those addresses, leaving them available for manual static configuration on access points and controllers while the remaining addresses in 192.168.50.0/24 are dynamically leased.

In DMVPN Phase 3, the hub uses NHRP redirect to notify a source spoke that traffic it sent through the hub could be sent directly. The redirect causes the source spoke to issue an NHRP resolution request for the destination spoke's NBMA address, after which it builds a direct tunnel. Without ip nhrp redirect on the hub, spokes keep forwarding through the hub even though they could shortcut.

To forward multicast traffic over a GRE tunnel, the tunnel interface must have IP PIM enabled. The ip pim sparse-mode command enables PIM on the interface, allowing it to participate in multicast routing. Without PIM on the tunnel interface, multicast packets will not be forwarded, even if the tunnel is up.

Multiprotocol BGP (MP-BGP) with the VPNv4 address family is used to distribute VPNv4 routes between PE routers in an MPLS L3VPN environment. It carries the route targets and route distinguishers as extended communities, enabling proper VPN membership and route separation. BGP is the only protocol that supports the necessary address family and attributes for VPNv4 route exchange, making it the correct choice.