CCNP ENARSI v8 Final Test Online

Hint

The EIGRP command distance 66 172.16.55.1 0.0.0.0 90 changes the AD to 66 for all EIGRP routes learned from neighbor 172.16.55.1 that match the specific network prefix of ACL 90.

Hint

A BGP open message is used to establish a BGP adjacency. Both peer sides negotiate session capabilities before BGP peering is established.

Hint

For a BGP session to initiate, one address family for a neighbor must be activated. On Cisco routers the IPv4 address family is activated by default; however, it may cause confusion when working with other address families. The BGP router configuration command no bgp default ip4-unicast disables the automatic activation of the IPv4 AFI.

Hint

BGP weight is a Cisco-defined attribute and the first step in selecting the BGP best path. Weight is a 16-bit value (0 through 65,535) assigned locally on the router; it is not advertised to other routers

Hint

When you configure BGP multipathing, the additional paths need to match the following best-path BGP path attributes:

• Weight
• Local preference
• AS_Path length
• AS_Path content (although confederations can contain a different AS_CONFED_SEQ path)
• Origin
• MED
• Advertisement method (iBGP or eBGP) (If the prefix is learned from an iBGP advertisement, the IGP cost must match for iBGP and eBGP to be considered equal.)

Hint

The command show dmvpn [detail] provides the tunnel interface, tunnel role, tunnel state, and tunnel peers with uptime. When the DMVPN tunnel interfaceis administratively shut down, there are no entries associated to that tunnel interface. The tunnel states are, in order of establishment: – INTF: The line protocol of the DMVPN tunnel is down. – IKE: DMVPN tunnels configured with IPsec have not yet successfully established an Internet key exchange (IKE) session. – IPsec: An IKE session is established but an IPsec security association (SA) has not yet been established. – NHRP: The DMVPN spoke router has not yet successfully registered. – Up: The DMVPN spoke router has registered with the DMVPN hub and received an ACK (positive registration reply) from the hub.

Hint

Purge messages are sent to remove a cached NHRP entry. Purge messages notify routers of the loss of a route used by NHRP. Purges are typically sent by an NHS to NHCs (which it answered) to indicate that the mapping for an address/network that it answered is not valid anymore (for example, if the network is unreachable from the original station or has moved). Purge messages take the most direct path (spoke-to-spoke tunnel) if feasible. If a spoke-to-spoke tunnel is not established, purge messages are forwarded via the hub.

Hint

As a result of implementing EIGRP automatic summarization, router R3 uses a classful network addressing scheme to group networks together based on their classful network mask. 192.168.10.4/30 and 192.168.10.8/30 are shortened to 192.168.10.0/24 and 172.16.3.0/24 is summarized to 172.16.0.0/16. 192.168.1.0/24 is already using its classful mask and is not summarized.

Hint

If the no auto-summary command was issued disabling the autosummarization, all subnetworks will be advertised, without summarization.

Hint

To deny traffic from the 172.16.0.0/16 network, the access-list 95 deny 172.16.0.0 0.0.255.255 command is used. To permit all other traffic, the access-list 95 permit any statement is added.

Hint

The missing routes are the result of there not being an EIGRP adjacency between R1 and R2, R3, and R4.To establish adjacency, a router must send and receive hello packets over an interface to and from its neighbors. The interface Fa0/ of the router R1 is declared as passive, so R1 will not send hello packets over its interface Fa0/0.

Hint

To establish adjacency, both routers must be configured with the same AS number. The network 192.168.0.0 .0.0.255.255 command issued on R1 includes all networks from 192.168.0.0 to 192.168.255.255. Therefore, the network 192.168.1.0/24 is also included.

Hint

The two primary protocols used with IPsec are AH and ESP. AH is protocol number 51 and provides data authentication and integrity for IP packets that are exchanged between the peers. ESP, which is protocol number 50, performs packet encryption.

Hint

One method for conditional matching of routes in BGP is through extended ACLs. When extended ACLs are used for this purpose, the source fields match against the network portion of the route, and the destination fields match against the network mask. The network portion of the matching networks is 10.0.32.0 through 10.0.63.0. The network mask portion is /24 through /26.

Hint

In troubleshooting BGP, regular expressions (regex) can be used to parse through the large number of available ASNs. Regular expressions are based on query modifiers used to select the appropriate content. The regex pattern 100_ indicates to only include the lines that contain the exact phrase of 100. Some regex query modifiers are as follows:

• (underscore) – Matches a space
• ^ (caret) – Indicates the start of a string
• $ (dollar sign) – Indicates the end of a string
• . (period) – Matches a single character, including a space

Hint

OSPF uses six LSA types for IPv4 routing:

• Type 1, router: LSAs that advertise network prefixes within an area
• Type 2, network: LSAs that indicate the routers attached to broadcast segment within an area
• Type 3, summary: LSAs that advertises network prefixes that originate from a different area
• Type 4, ASBR summary: LSA used to locate the ASBR from a different area
• Type 5, AS external: LSA that advertises network prefixes that were redistributed in to OSPF
• Type 7, NSSA external: LSA for external network prefixes that were redistributed in a local NSSA area

Hint

The routers are unable to form an OSPFv3 adjacency because OSPFv3 has not been enabled on the interfaces with the ospfv3 1 ipv6 area 0 command.

Hint

The metrics for R2 routes are different from the metrics from R1 routes. This is because R1 is using EIGRP classic configuration mode that uses classic metrics, and R2 is using EIGRP named mode configuration that uses wide metrics by default. The EIGRP classic metric calculation uses 5 K values (K1 to K5) to calculate the metric, whereas the EIGRP wide metric calculation uses 6 K values (K1 to K6). The two metric styles will allow adjacency between the two routers, as long as K1 through K5 are the same, and K6 is not set. The wide metrics calculation addresses the issues of scalability with higher-capacity interfaces.

Hint

A variance of 11 is needed to load balance across the second route. The metric of the existing successor route is 25000. The metric of the second route is 264000. The first metric needs to be multiplied by 11, which is 275000, in order for the route to be put into the routing table.

Hint

A class map may contain one of two instructions: match-any or match-all . If you have multiple match commands in a single class map and match-any is used, it means the traffic must match one of the match commands to be classified as part of the traffic class. If you use match-all , the traffic must match all the match commands to be part of the traffic class. Considering the exhibit, it is not possible for a packet to be ICMP, BGP, and EIGRP at the same time. Therefore, the traffic would never match the CoPP-CLASS class map and would never be subject to the implicit default class.

Hint

The authentication for Telnet connections is defined by AAA method list AUTHEN. The AUTHEN list defines that the first authentication method is through an ACS server using the RADIUS protocol (or RADIUS server), the second authentication method is to use the local user database, and the third method is to use the enable password. In this scenario, however, because the administrator fails to pass the authentication by the first method, the authentication process stops and no other authentication methods are allowed.

Hint

The conclusions that can be drawn from the command output are: According to the aaa authentication login VTY_ACCESS group RADIUSMETHOD local command the first method to be used is the group of servers in the RADIUSMETHOD group. According to the aaa authentication login CONSOLE_ACCESS group RADIUSMETHOD local command, the first method to be used is the group of servers in the RADIUSMETHOD group, and the second method to be used if the servers are not available is the local username and password database. RADIUS server is using ports 1812 and 1813 for authentication and accounting, so the port numbers on the Cisco router should be the same, not the Cisco default ports (1645 and 1646). The router needs to be configured with the same pre-shared key for the RADIUS server, RADIUSPASSWORD . When a router sources packets, it uses the exit interface as the source of the packet. If the exit interface is not configured with the IP address that the AAA server is expecting, the client cannot use the AAA server and the services it provides. It is recommended that the IP address of a loopback interface be used for the source of packets and as the client IP address that is configured on the AAA server. Therefore, the router should be configured with the ip radius source-interface [ loopback ] [ number ].

Hint

OSPF router ID does not contribute to SPF algorithm calculations, nor does it facilitate the transition of the OSPF neighbor state to Full. Although the router ID is contained within OSPF messages when router adjacencies are being established, it has no bearing on the actual convergence process.

Hint

The permit statement with the incorrect IP address is the reason why the administrator is not able to access router R1. The correct statement should be permit 192.168.1.3. The snmp-server location and snmp-server enable traps commands are optional commands and have no relation to the access restriction to router R1. The rw keyword does not need to be included in this case because the administrator just wants to obtain information, not change any configuration.

Hint

NetFlow flows are unidirectional. One user connection exists as two flows. The flow in each direction must be captured. This is done by using both the ip flow ingress and ip flow egress command on the interface.

Hint

An unspecified address in the BGP table indicates that the local router is generating the prefix for the BGP table. The weight value 32,768 also indicates that the prefix is locally originated by the router.

Hint

Cisco routers review BGP attributes in the following ranked order when deciding which path is the best-path:

• – Prefer the highest weight .
• – Prefer the highest local preference .
• – Prefer the route originated by the local router.
• – Prefer the path with the shorter Accumulated Interior Gateway Protocol (AIGP) metric attribute.
• – Prefer the shortest AS_Path .
• – Prefer the lowest origin code.
• – Prefer the lowest multi-exit discriminator (MED).
• – Prefer an external path over an internal path.
• – Prefer the path through the closest IGP neighbor .
• – Prefer the oldest route for EBGP paths.
• – Prefer the path with the lowest neighbor BGP RID .
• – Prefer the path with the lowest neighbor IP address .

The first path attribute to be checked is the weight. In this case, no weight is listed because both routes are using the default value 0. The next path attribute to be checked is the local preference. A higher value is better. Therefore, setting the local preference to 200 will make the path through 3.3.3.3 the best-path.

Hint

Statically configuring the BGP router ID (RID) is a best practice to ensure RID stability. If the RID is not statically configured, the dynamic RID allocation logic uses the highest IP address of any active loopback interfaces. If there is not an active loopback interface, then the highest IP address of any active interfaces becomes the RID when the BGP process initializes.

Hint

The OSPFv2 process ID is local to each router and does not have to be common. Neither interface on the link connecting the two routers can be passive. Both must be participating in the OSPF area. The DR, BDR, and DROTHER status of the router has no bearing on the adjacency relationship.

Hint

The fact that RTRB can be pinged from RTRA indicates that there is connectivity between the two routers. However, the absence of OSPF routes from RTRA suggests that there is a configuration issue. One potential issue is that one or both routers are missing or have a misconfigured network statement for the OSPF process. OSPF relies on routers to advertise the networks they are connected to by including them in the OSPF domain through the use of network statements. If these statements are missing or misconfigured, the routers will not advertise their networks and OSPF routes will not be available. Another potential issue is that a distribute list is denying routes from being installed in the routing table. Distribute lists can be used to filter incoming and outgoing OSPF routes based on certain criteria such as prefix, access list, or prefix list. If a distribute list is configured to deny routes from being installed in the routing table, OSPF routes from RTRB may not be available on RTRA.

Hint

In EIGRPv6, a Null0 route with an administrative distance of 5 is added to the routing table as a loop-prevention mechanism. Only the /48 summary prefix is received from the neighbor router and any of the more specific /64 and /128 route entries are suppressed. In this instance a Null0 route is populated on the router for the local /48 summary route advertisement.

Hint

When troubleshooting OSPFv3 adjacency issues between two routers over an Ethernet link, the following issues could be the possible reasons for adjacency failure:

• Mismatched network types: OSPFv3 supports different network types such as broadcast, non-broadcast, point-to-point, and point-to-multipoint. Both routers should have the same OSPFv3 network type configured on the Ethernet interface for adjacency to form.
• Mismatched link-local addresses: OSPFv3 uses link-local addresses to establish an adjacency between two routers over an Ethernet link. If the link-local addresses on both routers are not configured correctly, the adjacency will not form.

Therefore, both mismatched network types and mismatched link-local addresses could be possible reasons for the OSPFv3 adjacency not forming over an Ethernet link. The other options listed in the question such as mismatched Area IDs, mismatched global OSPv3 PID and the PID configured on the Ethernet interface, mismatched global unicast addresses, and mismatched subnet masks are not relevant to this issue.

Hint

There is a mismatch between the timer intervals of R1 and R2. In OSPF the timers must match on two routers before they will become neighbors. The IPv6 addresses that are used by OSPFv3 are link-local, and are in the same subnet. The OSPFv3 process ID is locally significant, and does not have to match between routers. The default OSPF interface priority value is 1, and does not prevent neighbor relationships from forming.

Hint

ACLs are used to prevent SNMP messages from going beyond the required devices. The ACL_SNMP is permitting only the host IP of 172.16.10.10 to access the SNMP agent. The actual IP of the SNMP manager is 172.16.10.1. The SNMP agent is configured for read-write access for reading and setting variables. The community string of snmpenable2 is only affecting connectivity for trap messages.​

Hint

An OSPF virtual link is used to connect two areas through a non-backbone area. The virtual link is used to overcome the discontiguity of the OSPF domain caused by the non-backbone area. Therefore, it would be appropriate to use an OSPF virtual link in the following two situations:

• When connecting discontiguous areas: If there are two OSPF areas that are not physically connected to each other, a virtual link can be created to connect them. The virtual link passes through a non-backbone area to reach the destination area.
• When merging with another company and needing to connect the two backbone areas: If two companies merge, and each has its own OSPF backbone area, a virtual link can be created to connect the two backbone areas. This allows for a seamless integration of the two OSPF domains.

The other options listed in the question such as allowing corporate telecommuters to connect to corporate OSPF network resources, importing a non-OSPF routing protocol into an ABR or backbone OSPF router, and importing a non-OSPF routing protocol into an internal OSPF router are not relevant to the use case for OSPF virtual links.

Hint

Occasionally, an EIGRP query is delayed because of packet loss, slow neighbors, or a large hop count. EIGRP maintains an active timer, which has a default value of 3 minutes (180 seconds). According to the output, the active timer was set to 2 minutes (120 seconds). EIGRP then waits half of the active timer value that was set (60 seconds) for a reply. If the router does not receive a response within 60 seconds, the originating router sends a SIA query to EIGRP neighbors that did not respond.

Hint

The BGP maximum prefix feature restricts the number of routes that are received from a BGP peer.

Hint

The BGP (Border Gateway Protocol) maximum prefix feature is used to limit the number of BGP prefixes that a router will accept from a specific peer. The purpose of this feature is to prevent the router from being overwhelmed with too many prefixes, which could cause the router to run out of memory or processing resources. By setting a maximum prefix limit, the router can protect itself from receiving an excessive number of BGP routes, which can be particularly important in cases where a misconfiguration or a routing loop can cause an uncontrolled growth in the number of prefixes being advertised.

Hint

Default redistribution behavior is as follows:

• BGP only redistributes EBGP routes into IGP protocols.
• Routes redistributed into OSPF from BGP have a seed metric of 1.
• Routes redistributed into EIGRP have an AD of 170.
• Routes redistributed into OSPF have an AD of 110.
• The default BGP weight for redistributed routes is 32,768.

Hint

Data integrity ensures that data has not been modified or tampered with in transit or storage, and that it is accurate and consistent. This is typically achieved through the use of cryptographic techniques, such as digital signatures or hash functions. The following statements describe the elements of security that are ensured by data integrity:

• Data is accurate and has not been changed in transit. By ensuring that data has not been modified or tampered with, data integrity ensures that data is accurate and that it has not been changed in transit.
• Data can only be modified by authorized users. Data integrity also ensures that data can only be modified by authorized users, who have the necessary permissions to modify the data. This helps to prevent unauthorized changes to data and helps to maintain the accuracy and consistency of data.

Hint

Authentication is the process of verifying the identity of a sender or receiver of data, and ensuring that the data has not been tampered with in transit. IPsec provides authentication through the use of digital certificates or pre-shared keys, which allow the receiver to verify the identity of the sender.

Hint

In order for a computer to communicate outside its network, it must have a valid default gateway configured.This address cannot be the same as the IP address of the computer.

Hint

R3 will be elected DR for segment A because it has the highest router-ID of 192.168.1.5. R3 will be elected DR for segment B because it has the highest router-ID of 192.168.2.2. R5 will be elected BDR because it has the numerically highest router-ID of 172.16.1.4.

Hint

By default, Fast Ethernet, Gigabit, and 10 Gigabit Ethernet interfaces all have a cost of 1. Altering the default reference bandwidth alters the cost calculation, allowing each speed to be more accurately reflected in the cost.

Hint

There are three DMVPN phase models: Phase 1, Phase 2, and Phase 3. The first DMVPN implementation is Phase 1. Phase 1 only supports spoke-to-hub tunnels. Traffic between spokes must traverse the hub. Phases 2 and 3 support not only spoke-to-hub tunnels, but also direct spoke-to-spoke tunnels.

Hint

To establish adjacency, both routers must be configured with the same AS number. The network 192.168.0.0 .0.0.255.255 command issued on R1 includes all networks from 192.168.0.0 to 192.168.255.255. Therefore, the network 192.168.1.0/24 is also included.

Hint

When uRPF is configured on an interface, the uRPF mode should be chosen according to the type of routing. With symmetric routing, the same path is used for the source and the return traffic. With asymmetric routing, a different path ends up being used for return traffic. The ip verify unicast reachable-via rx command configures uRPF in strict mode. If strict mode is used when asymmetric routing occurs, the legitimate traffic is dropped. Where symmetric routing is guaranteed to occur, uRPF should be configured in strict mode.

Hint

The address has a prefix length of /64. Thus the first 64 bits represent the network portion, whereas the last 64 bits represent the host portion of the IPv6 address.

Hint

An EIGRP stub router does not advertise routes that it learns from other EIGRP peers. By default, EIGRP stubs advertise only connected and summary routes, but they can be configured only to receive routes or advertise any combination of redistributed routes, connected routes, or summary routes. The EIGRP stub router announces that it is a stub router within the EIGRP hello packet. If a route goes active, EIGRP does not send EIGRP queries to an EIGRP stub router.

Hint

Control Plane Policing (CoPP) varies based on IOS version and platform version. Therefore, there are general elements that apply to all versions. When configuring CoPP, the steps are as follows: Create ACLs to identify the traffic. Create class maps to define a traffic class. Create policy maps to define a service policy. Apply the service policy to the control plane.

Hint

When using the EIGRP Stub Routing feature, you need to configure the distribution and remote routers to use EIGRP, and to configure only the remote router as a stub. Only specified routes are propagated from the remote (stub) router. The router responds to queries for summaries, connected routes, redistributed static routes, external routes, and internal routes with the message “inaccessible.” A router that is configured as a stub will send a special peer information packet to all neighboring routers to report its status as a stub router. Without the stub feature, even after the routes that are sent from the distribution router to the remote router have been filtered or summarized, a problem might occur. If a route is lost somewhere in the corporate network, EIGRP could send a query to the distribution router, which in turn will send a query to the remote router even if routes are being summarized. If there is a problem communicating over the WAN link between the distribution router and the remote router, an EIGRP stuck in active (SIA) condition could occur and cause instability elsewhere in the network. The EIGRP Stub Routing feature allows a network administrator to prevent queries from being sent to the remote router.

Hint

The OSPFv2 process ID does not have to be the same on each router, and it is enabled globally, not separately on each interface. OSPFv3 (IPv6) uses link-local addresses to form an adjacency with a neighbor router, and requires the OSPF process to be enabled on the interface.

Hint

Link-local addresses are only unique on a given link, and the same address could exist out multiple interfaces. For that reason, any time a static route specifies a link-local address as the next hop, it must also specify the exit interface. This is called a fully specified static route.

Hint

The second entry in the table indicates that there is one feasible successor (“1 successors”) for network 192.168.1.8/30. The last entry in the table shows that network 192.168.10.8/30 is directly connected, so it is not reachable through network 192.168.11.1. The third entry indicates that the reported distances for network 192.168.1.0 are 28116 and 2170112, not 41024256. This same entry shows that neighbor 172.16.6.1 is a feasible successor for network 192.168.1.0. The first entry indicates that R1 has only one successor, not two to network 172.16.3.0/24.

Hint

Cisco IOS automatically modifies the Dead interval to four times the Hello interval.

Hint

Feasible successors are installed in the EIGRP routing table when the successor becomes unavailable. Feasible successors are backup routes that are have a metric higher than that of successors.

Hint

The DHCPDISCOVER message is sent by a DHCPv4 client and targets a broadcast IP along with the destination port 67. The DHCPv4 server or servers respond to the DHCPv4 clients by targeting port 68.

Hint

Authentication ensures that only authorized routers are eligible to become EIGRP neighbors. A precomputed password hash is encrypted by using a MD5 authentication and it is included with all EIGRP packets. The hash is computed using the key number and the key string. The receiving router decrypts the hash. If the passwords do not match for a packet, the routers will not become neighbors. In this scenario, the key number and the key string are the same on both routers. Therefore, they will become neighbors.