300-410 Cisco Implementing Cisco Enterprise Advanced Routing and Services (300-410 ENARSI) Free Practice Exam Questions (2026 Updated)

Restrictions for IPv6 RA Guard

The IPv6 RA Guard feature does not offer protection in environments where IPv6 traffic is tunneled.

This feature is supported only in hardware when the ternary content addressable memory (TCAM) is programmed.

This feature can be configured on a switch port interface in the ingress direction.

This feature supports host mode and router mode.

This feature is supported only in the ingress direction; it is not supported in the egress direction.

This feature is not supported on EtherChannel and EtherChannel port members.

This feature is not supported on trunk ports with merge mode.

This feature is supported on auxiliary VLANs and private VLANs (PVLANs). In the case of PVLANs, primary VLAN features are inherited and merged with port features.

Packets dropped by the IPv6 RA Guard feature can be spanned.

vty 0:

+ cisco

+ 0csic

vty 1:

+ no username

+ no password

The command “aaa authentication login default none” means no authentication is required when

access to the device via Console/VTY/AUX so if one interface does not specify another login

authentication method (via the “login authentication …” command), it will allow to access

without requiring username or password. In this case VTY 1 does not specify another

authentication login method so it will use the default method (which is “none” in this case).

The ―imp-null‖ (implicit null) tag instructs the upstream router to pop the tag entry off the tag stack before forwarding the packet.

Note: pop means ―remove the top MPLS label‖

Even PC2 cannot reach PC1 so there is something wrong with RIP redistribution in R2. Because

RIP has higher Administrative Distance (AD) value than OSPF and EIGRP so it will be looped

when doing mutual redistribution.

From the exhibit, we learned:

+ VRF customer_a was exported with Route target (RT) of 1:1 so at the remote site it must be

imported with the same RT 1:1.

+ VRF customer_a was imported with Route target (RT) of 1:1 so at the remote site it must be

exported with the same RT 1:1.

Therefore at the remote site we must configure the command “route-target both 1:1” (which is

equivalent to two commands “route-target import 1:1” & “route-target export 1:1”.

after bgp session are UP.I configured the CoPP to drop 10.3.3.3 bgp traffic (R3).

R3 bgp traffic that matched the ACL 100 is dropped and the state is in IDLE

--------------------------------------------

access-list 100 permit tcp host 10.3.3.3 any eq bgp

access-list 100 permit tcp host 10.3.3.3 eq bgp any

!

class-map match-all class-bgp

match access-group 100

!

policy-map policy-bgp

class class-bgp

drop

!

control-plane

service-policy input policy-bgp

!

The 10.3.3.3 neighbor goes to IDLE

The ―summary-address‖ is only used to create aggregate addresses for OSPF at an autonomous system boundary. It means this command should only be used on the ASBR when you are trying to summarize externally redistributed routes from another protocol domain or you have a NSSA area. But a requirement to create a summarized route is:

―The ASBR compares the summary route’s range of addresses with all routes redistributed into OSPF on that ASBR to find any subordinate subnets (subnets that sit inside the summary route range). If at least one subordinate subnet exists, the ASBR advertises the summary route.‖

By default BGP advertises all prefixes to external BGP neighbors. This means that if you are

multi-homed (connected to two or more ISPs) then you might become a transit AS. For example,

ISP 2 in AS 200 can send traffic to your router in AS 100 to reach ISP 3 in AS 300 because you

advertised prefixes in ISP 3 to ISP 2.

This is what will be seen in the BGP routing table of ISP1:

When you configure an EIGRP summary route, all networks that fall within the range of your

summary are suppressed and no longer advertised on the interface. Only the summary route is

advertised. But if we want to advertise a network that has been suppressed along with the

summary route then we can use leak-map feature. The below commands will fix the

configuration in this question:

R1(config)#access-list 1 permit 10.1.1.0 0.0.0.3

R1(config)#route-map Leak-Route permit 10 // this command will also remove the “route_map

Leak-Route deny 10” command.

R1(config-route-map)#match ip address 1

The reason for the loop is that R2 is forwarding the packets destined to 10.1.1.1 to R4, instead of R1. This is because in the redistribute OSPF statement, BW metric has a higher value and delay has a value of 1. So, R2 chooses R4 over R1 for 10.1.1.0/24 subnet causing a loop. Now, R5 learns 10.1.1.0/24 from R3 and advertises the same route to R4, that R4 redistributes back in EIGRP. If R3 sets a tag of 1 while redistributing EIGRP in OSPF, and R4 denies all the OSPF routes with tag 1 while redistributing, it will not advertise 10.1.1.0/24 back into EIGRP. Hence, the loop will be broken.

*When using DMVPN with IPSec, it is unnecessary to use tunnel mode. Because DMVPN uses GRE which means that a new IP header is already added by GRE. The GRE encapsulation happens on the tunnel interface before the encryption process takes place.

https://www.cisco.com/c/en/us/td/docs/routers/xr12000/software/xr12k_r3-9/system_management/command/reference/yr39xr12k_chapter4.html#wp1784026936

By default, syslog and debug messages are stamped by UTC, regardless of the time zone that device configured. You should append localtime key word to " service timestamp {log | debug} datetime msec " global command to change that behavior.

https://community.cisco.com/t5/networking-documents/router-log-timestamp-entries-are-different-from-the-system-clock/ta-p/3132258

https://www.cisco.com/E-Learning/bulk/public/tac/cim/cib/using_cisco_ios_software/cmdrefs/service_timestamps.htm