350-501 Implementing and Operating Cisco Service Provider Network Core Technologies (350-501 SPCOR) Questions and Answers

 The issue described involves packets being dropped when sent from the application server to the access site. Since OSPF and BGP peerings are confirmed to be operational, the problem likely lies within the route advertisement. Allowing 172.16.20.1 in the BGP advertisement on R3 by adjusting the route-map will likely resolve the issue, ensuring that traffic destined for 172.16.20.1 is not being inadvertently filtered or blocked.

The issue is occurring in OSPF stub area 100 where the Ethernet link is down between routers RX and RY due to a cut fiber, leading to dropped traffic from CE site A to the hub site. Changing the OSPF area 100 type to stub on RZ can resolve these issues. In a stub area, OSPF routers use a default route to forward traffic to destinations outside the area, reducing the size of their routing tables. This would allow traffic from CE site A to be routed through RZ when the direct link between RX and RY is down.

The keyword ‘none’ is essential in management plane security using TACACS to ensure that authentication can still succeed when the TACACS+ server is unreachable. This fallback mechanism allows network resources to remain accessible even if the TACACS+ server fails or becomes unreachable.  References : Implementing and Operating Cisco Service Provider Network Core Technologies (SPCOR) - Management Plane Security section.

The configuration shown in the exhibit is used to disable IP directed-broadcasts on a specific interface of a network device. This is typically done to mitigate smurf attacks, which involve sending a large amount of ICMP echo (ping) traffic to IP broadcast addresses, all having a spoofed source address of the victim’s IP. By disabling IP directed-broadcasts, the network device will not forward packets that are sent to broadcast addresses, thus mitigating this type of DDoS attack.  References : Implementing and Operating Cisco Service Provider Network Core Technologies (SPCOR) - Module on Security in the Service Provider Network

NetFlow provides traceback information by analyzing network traffic. To configure NetFlow for traceback, you need to set up a classification ACL (Access Control List) to identify which type of traffic will be analyzed. This allows NetFlow to focus on specific traffic flows and report relevant information. The classification ACL can be based on various criteria such as source/destination IP addresses, port numbers, or protocols. By defining the classification ACL, you ensure that only the relevant traffic is considered for NetFlow analysis.

 In the given scenario, to ensure that area 15 traffic from R5 to R1 prefers the route through R4, a multiarea adjacency should be implemented on the link between R2 and R4. The cost can be manipulated to make this path preferred. Multiarea adjacency allows OSPF routers to form adjacencies with routers in other areas, enabling more direct routing of traffic. By adjusting the cost of this adjacency, traffic can be directed preferentially through specific paths.

In Cisco Unified MPLS, BGP (Border Gateway Protocol) is used to transport labels along with network layer reachability information. RFC 3107 defines BGP/MPLS IP Virtual Private Networks (VPNs) and allows BGP to carry MPLS labels, enhancing scalability and flexibility in MPLS networks.

References

1 : Cisco. “Implementing and Operating Cisco Service Provider Network Core Technologies (SPCOR).” Link

Network Services Orchestrator (NSO) uses the YANG (Yet Another Next Generation) modeling language to provide a standardized way to automate network devices. YANG provides a powerful schema to model configuration and state data for network elements, which NSO leverages for service automation and orchestration.

Remember that SSM is an extension of IP multicast where datagram traffic is forwarded only from explicitly joined multicast sources to receivers. It creates source-specific multicast distribution trees without shared trees.

In the context of Cisco’s Implementing and Operating Service Provider Network Core Technologies, the UCS Series is typically where OpenStack components would be hosted. OpenStack is a cloud operating system that controls large pools of compute, storage, and networking resources throughout a data center, all managed through a dashboard that gives administrators control while empowering their users to provision resources through a web interface.

 To align with customer contract SLAs and allow 10% of interface capacity on router R3 for traffic from CE1 towards the FTP server, the network engineer must apply a policy map to R1 to reserve the remaining 10% of interface bandwidth (Option C). Additionally, applying a policy map to R3 to reserve 10% of interface bandwidth (Option D) ensures adherence to the customer’s contract SLAs while utilizing the allocated bandwidth capacity.  References : Implementing and Operating Cisco Service Provider Network Core Technologies (SPCOR) - Quality of Service section.

In this scenario, gRPC dial-out mode is being used for telemetry. The receiver with IP address 192.168.1.1 will be assigned one of the subscriptions and will manage the ASR. To configure this, the router needs to use the  protocol tcp  command. This ensures that telemetry data is streamed out over a TCP connection to the specified receiver.  Other options (A, B, and D) are not relevant for this specific use case.

The correct configuration for deploying VRF on ASBR router R1 to have connectivity over an MPLS VPN inter-AS Option AB network is found in option C. This involves configuring the interface with the commands shown, including setting the interface ethernet, applying IP VRF forwarding, and enabling MPLS BGP forwarding. These steps ensure that the interface is properly configured for VRF and can support MPLS VPN inter-AS communications effectively.  References  :=  Implementing and Operating Cisco Service Provider Network Core Technologies

Option D is the correct answer because, in the context of Auto-RP, sparse-dense mode allows the router to forward Auto-RP messages. Auto-RP uses dense mode multicast groups (224.0.1.39 and 224.0.1.40) to advertise RP mapping information, so enabling sparse-dense mode on the interface ensures that it can process both types of multicast traffic.  References : Implementing and Operating Cisco Service Provider Network Core Technologies (SPCOR) official course materials, which can be found  here .

 To complete the implementation of the route map “ciscotest” for filtering routes to a BGP peer, the engineer must attach the route map to the BGP neighbor statement in the inbound direction.  This will apply the specified filtering criteria to routes received from the BGP neighbor, thereby limiting access to restricted areas within the network as intended by the client.  References  := The Implementing and Operating Cisco Service Provider Network Core Technologies (SPCOR) course materials discuss the configuration of route maps and their application to BGP neighbors for route filtering purposes

The full separation model for Internet access and MPLS L3VPN services is chosen to enable EGP (Exterior Gateway Protocol) and IGP (Interior Gateway Protocol) to operate independently. In this model, the internet access and MPLS L3VPN services are fully separated, ensuring that the two networks do not interfere with each other’s operation. This separation enhances network security, performance, and manageability.  References : Implementing and Operating Cisco Service Provider Network Core Technologies source documents or study guide

The core component of MDT that describes the data streamed to a collector is the encoder. In the context of Microsoft Deployment Toolkit (MDT), the encoder is not explicitly mentioned; however, the concept aligns with the process of creating and capturing images of operating systems, which involves encoding or compiling the necessary data into a deployable image.

To enable LDP session protection for LDP neighbors within each VRF, the engineer should configure LDP session protection within the individual VRFs. This ensures that LDP sessions are protected at the VRF level, providing security and stability for MPLS-based services. By enabling LDP session protection within each VRF, the router will take appropriate actions to protect LDP sessions against misbehaving neighbors or potential attacks.  References :  Implementing and Operating Cisco Service Provider Network Core Technologies (SPCOR) v1.0

Here is the solution:

The  Forward Error Correction (FEC)  field within the OTN (Optical Transport Network) signal structure is responsible for error correction. When data arrives at the receiver, the FEC field helps correct any errors that may have occurred during transmission. It enhances the reliability of optical communication by detecting and rectifying errors.

After a router reload, BGP sessions may fail to re-establish due to incorrect source interface configurations for BGP sessions. Since EBGP multihop has been configured, it’s essential that the BGP session uses the correct source interface for establishing the connection. By configuring the neighbor update-source command with the loopback interface on R2, the BGP session will use the stable loopback address rather than the physical interface, which can change state.  This ensures that the BGP session remains stable and is not affected by interface states.  References : BGP Troubleshooting Cheat Sheet With Examples - Catchpoint 2 , BGP session stuck in Idle state after NSRP failover - Juniper Networks 3 , BGP Session is Disconnected - Network Playbook

The configuration shown in the exhibit enables IP flow information collection on the interface gigabitethernet0/1. This setup is used for network traffic analysis, and when applied, it provides data that includes the source interface of the traffic for traceback analysis. This is useful for identifying the origin of traffic, which can be critical in situations such as security incidents or network troubleshooting.

R1

key chain AUTH_ISIS

key 2

key-string C1sco!

exit

int range et0/0 , et1/0

isis authen key-chain AUTH_ISIS

ip isis

isis metric 15

Copy run start

R2

key chain AUTH_ISIS

key 2

key-string C1sco!

exit

int range et0/0 , et1/0

isis authen key-chain AUTH_ISIS

ip isis

isis metric 20

Copy run start

R3

key chain AUTH_ISIS

key 2

key-string C1sco!

exit

int range et0/0 , et1/0

isis authen key-chain AUTH_ISIS

ip isis

isis metric 25

Copy run start

https://www.cisco.com/c/en/us/td/docs/routers/asr9000/software/asr9k-r6-5/ip-addresses/configuration/guide/b-ip-addresses-cg-asr9000-65x/m-implementing-lpts-asr9000-crs.html

In this scenario, when edge routers at different regional sites are connected over a global carrier backbone, MP-eBGP must be run between routers to exchange customer VPNv4 routes. This is essential for enabling communication between customer sites located in different regions while utilizing a global carrier backbone service.  References : Implementing and Operating Cisco Service Provider Network Core Technologies source documents or study guide

To configure multi-topology IS-IS for IPv6, the router must be configured with the  ipv6 router isis  command under the interface configuration mode. This command enables IS-IS for IPv6 on the interface. The  ipv6 router isis  command is used to enable IS-IS for IPv6 on an interface. The  multi-topology  keyword specifies that the interface will participate in multiple topologies. The  level-1  and  level-2  keywords specify the IS-IS levels for which the interface will participate.  In this case, we want the interface to participate in both Level 1 and Level 2 topologies, so we use both keywords. 

Option B : Internet routing through global routing on a PE router means that the PE router performs global routing for internet traffic. This allows the PE router to handle both L3VPN traffic and internet traffic.

Option D : Leaking internet routes from the global table into the L3VPN VRF allows the L3VPN customers to access the internet via the same MPLS backbone. The PE router imports internet routes into the L3VPN VRF, enabling internet access for VPN customers.

When implementing traffic shaping on a network, the goal is to control the rate of traffic being sent into the network to avoid congestion. This is done by buffering excess packets and then scheduling them to be sent out at a steady rate.

Option A is correct because traffic shaping requires a queue with sufficient memory to buffer excess packets.  When the traffic rate exceeds the configured maximum rate (shaping rate), the excess packets are temporarily stored in the queue until they can be sent out, ensuring a smooth flow of traffic without overwhelming the network 1 .

Option B is also correct as traffic shaping involves configuring token values in bytes. Tokens are used to represent permission to send a certain amount of data. The token bucket is filled with tokens at a steady rate, and packets can only be sent if there are enough tokens in the bucket.  The token values determine the size of the bucket and the rate at which it is refilled, which in turn controls the rate of traffic 1 .

Option C is incorrect because packet remarking for excess traffic is not a component of traffic shaping.  Packet remarking is typically used in conjunction with policing, where packets that exceed the rate limit can be remarked to a lower priority for downstream handling 1 .

Option D is incorrect in the context of traffic shaping.  While a scheduling function is used to handle the packets that are delayed due to buffering, the scheduling itself is not part of the shaping mechanism but rather a function of the queuing system that works alongside shaping 1 .

Option E is incorrect as it pertains to traffic policing, not shaping.  In traffic policing, packets that exceed a certain threshold are discarded or remarked, whereas shaping delays excess packets by buffering them 1 .

The REST API command shown in the exhibit is a POST request to a specific URL, indicating that it is used to submit data to be processed to a specified resource. In this case, the resource is an XML file named “Descriptions.xml”. POST requests are used when submitting data to be processed by the resource identified by the URI. The nature of the process conducted on the submitted data depends on that particular URI.  References : Implementing and Operating Cisco Service Provider Network Core Technologies (SPCOR) - REST API section.

https://www.cisco.com/c/en/us/support/docs/mpls-vpns/multiprotocol-label-switching-mpls/23986-mpls-vpns-config-example.html

https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/mp_l3_vpns/configuration/15- mt/mp-l3-vpns-15-mt-book/mp-bgp-mpls-vpns.html

The issue of Router 1 failing to establish an OSPF peering with Router 2, and the increase in CPU and memory usage can be attributed to a mismatch in MTU (Maximum Transmission Unit) sizes. In OSPF, for a successful adjacency to be formed, the MTU size on the interfaces that are trying to form this adjacency must match. In this case, changing the MTU to 1524 on Router 1 will make it compatible with Router 2, allowing OSPF peering to be established and customer traffic to pass through successfully.

TI-LFA, or Topology Independent Loop-Free Alternate, is a fast-reroute mechanism that provides protection against link or node failures in a network. It guarantees a loop-free alternate path for all areas configured in OSPF, ensuring traffic can be quickly rerouted in case of a failure. This characteristic is crucial for maintaining network stability and avoiding traffic loops, which can lead to packet loss and network congestion.

the configuration should ensure that VRF ABC and XYZ have route targets that allow them to import routes from VRF CENTRAL, but not from each other.  This can be achieved by careful manipulation of route targets and import/export policies within the VRF configurations 4 5 6 .

The weight parameter in BGP (Border Gateway Protocol) is a Cisco-specific attribute that is local to the router on which it is configured. It is used to prefer one path over another when multiple paths to the same destination are available. The weight is not advertised to other routers, making it a local parameter.

Using verbose knob in above command will list all the hops as below: R1#traceroute mpls multipath ipv4 10.1.5.5 255.255.255.255 verbose https://www.cisco.com/c/en/us/support/docs/multiprotocol-label-switching-mpls/multiprotocol-label-switching-mpls/200097-MPLS-LSP-Multipath-Trace.html

When implementing LDP NSF on your network, enabling NSF for the link-state routing protocol in use on the network is essential to ensure continuous forwarding of packets during a failure scenario. Additionally, enabling NSF for BGP ensures that BGP sessions are not dropped during a switchover, maintaining network stability and uptime.

R1

R2

The configuration in  Option A  is used to implement URPF in loose mode on the  GigabitEthernet0/1  interface.

Loose mode allows the router to check for any route back to the source, not necessarily the best route.

By enabling URPF, the router ensures that incoming packets have a valid return path in the routing table.

This helps prevent IP spoofing and limits malicious traffic on the network.

LDP session protection capability is a feature that maintains LDP bindings when a link fails, using LDP Targeted Hellos to protect LDP sessions. Without the specific exhibit, it’s not possible to determine which router has LDP session protection enabled but session hold up is not active.

The correct configuration for enabling BGP FlowSpec client function and installation of policies on all local interfaces is  flowspec address-family ipv4 install interface-all local . This command configures the router to accept FlowSpec policies from a BGP peer and apply them to all local interfaces. The  flowspec  keyword enables the BGP FlowSpec client function,  address-family ipv4  specifies the address family, and  install interface-all local  ensures that the policies are installed on all local interfaces.  References  := Implementing and Operating Cisco Service Provider Network Core Technologies course.

The SPT threshold set to infinity causes multicast traffic to permanently stay on the shared tree and not switch to the source tree. In multicast routing, the Shortest Path Tree (SPT) threshold determines when a router should switch from receiving multicast traffic on the shared tree to receiving it on a source tree.  Setting the SPT threshold to infinity means that the router will always receive multicast traffic on the shared tree

: In the context of telemetry for data analytics, a destination (such as a collector or monitoring system) initiates a session to a router. This session allows the router to send telemetry data to the destination for analysis.

 The BFD (Bidirectional Forwarding Detection) interval configuration on an interface is automatically disconnected when the BFD-configured subinterface is removed. This is because BFD sessions are tied to the specific subinterface, and removing it will terminate the BFD session associated with that subinterface.

https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/fnetflow/configuration/xe-3s/fnf-xe-3s-book/fnf-ipfix-expor t.html#d27853e197a1635

To direct traffic from R3 to R4 via R1, the weight attribute on R3 can be set higher for the route through R1 compared to other routes. Weight is a Cisco-specific BGP attribute that determines the preferred path when multiple routes to the same destination exist. It is local to the router on which it is configured and not advertised to other BGP peers.

References  :=

Implementing and Operating Cisco Service Provider Network Core Technologies (SPCOR) course materials.

MPLS traffic-engineering tunnels can be configured with dynamic paths or explicitly defined paths across the core network. Tunnel links inherit IGP (Interior Gateway Protocol) metrics by default unless overridden by configurations that specify explicit paths or other criteria for path selection. Dynamic path tunnels use IGP metrics and other parameters like bandwidth availability for automatic path calculation.  References : Implementing and Operating Cisco Service Provider Network Core Technologies source documents or study guide

 MPLS TE tunnels are designed to optimize the flow of network traffic by mapping it onto specific paths based on resource requirements. Two key characteristics of MPLS TE tunnels are:

RSVP for Bandwidth Reservation : MPLS TE tunnels use the Resource Reservation Protocol (RSVP) to reserve the necessary bandwidth for the tunnel, ensuring that the required resources are available for the data that will flow through it 1 2 .

Unidirectional Flow : These tunnels are unidirectional, meaning they are established from a source to a destination and do not inherently support traffic in the reverse direction.  This is because each MPLS TE tunnel is associated with a label-switched path (LSP) that is specifically set up for traffic flowing in one direction

The Adjacency-SID sub-TLV extension is advertised within TLV-22 (Extended IS Reachability) to label a specific link in a segment routing domain. This allows for the identification and utilization of specific paths or links within the network, facilitating more efficient routing and traffic management.  References  :=  Implementing and Operating Cisco Service Provider Network Core Technologies

The configuration shown indicates that R1 has been configured to support Label Distribution Protocol (LDP) graceful restart. This means that R1 will maintain the forwarding state during an LDP restart, allowing it to continue forwarding packets along known routes while it re-establishes LDP neighbors/peers. This ensures minimal disruption to traffic flow during such events.  References : Implementing and Operating Cisco Service Provider Network Core Technologies source documents or study guide

The BGPsec framework is designed to secure the AS path information in BGP updates. It uses digital signatures to validate the AS path and prevent unauthorized route manipulation. Here are the key points related to BGPsec:

Securing AS Path :

BGPsec ensures the integrity of the AS path by allowing routers to sign BGP updates using their private keys.

When a router originates a BGP route, it signs the AS path information with its private key.

Other routers can verify the signature using the corresponding public key.

This prevents malicious AS path modifications and ensures the authenticity of the advertised route.

Private Keys and Router Key Pair :

BGPsec relies on cryptographic keys for signing and verifying BGP updates.

Each router has a router key pair consisting of a private key and a corresponding public key.

The private key is kept confidential and is used for signing route updates.

The public key is distributed to other routers for verification.

Expiration Time :

Unlike regular BGP updates, BGPsec does not assign an expiration time (TTL) to route advertisements.

The absence of an expiration time ensures that the signed AS path remains valid until explicitly withdrawn.

In summary, BGPsec enhances BGP security by securing the AS path using digital signatures and private keys.  It does not rely on IPsec tunnels for security 1 .

To collect the required traffic statistics, the network engineer must configure the router to capture specific data points. The configurations in Option A and Option D align with these requirements. Option A involves configuring the router to collect IPv4 protocol, source address, destination address, application name, interface output, IPv4 source-prefix, IPv4 destination-prefix, counter bytes, flow direction, and transport tcp-flags. Option D involves setting the cache-period timer active to 20 seconds, which aligns with the CPU limit of processing samples that are a maximum of 20 seconds long.

References  := Implementing and Operating Cisco Service Provider Network Core Technologies (SPCOR) v1.0

SOLUTION:-

R1

Config t

router isis 1

net 49.0001.0010.0001.0101.00

area-password C1sc0!

int et0/0

ip router isis 1

isis authen mode text level-2

isis circuit-type level-2

isis tag 1

int et1/0

ip router isis 1

isis authen mode text level-2

isis circuit-type level-2

isis tag 1

R2

router isis 2

net 49.0001.0010.0002.0202.00

area-password C1sc0!

int et0/0

ip router isis 2

isis authen mode text level-2

isis circuit-type level-2

isis tag 2

int et1/0

ip router isis 2

isis authen mode text level-1

isis circuit-type level-1

isis tag 2

R3

router isis 3

net 49.0001.0010.0003.0303.00

area-password C1sc0!

int et0/0

ip router isis 3

isis authen mode text level-1

isis circuit-type level-1

isis tag 3

int et1/0

ip router isis 3

isis authen mode text level-2

isis circuit-type level-2

isis tag 3

R1 Verification: -

R1

Config t

Ipv6 unicast-routing

Router isis 1

Metric-style wide

Address-family ipv6 unicast

Multi-topology

Int loop0

Ip router isis 1

Ipv6 router isis 1

Isis tag 1

Int et0/0

Ipv6 router isis 1

Int et1/0

Ipv6 router isis 1

R2

Config t

Ipv6 unicast-routing

Router isis 2

Metric-style wide

Address-family ipv6 unicast

Multi-topology

Int loop0

Ip router isis 2

Ipv6 router isis 2

Isis tag 2

Int et0/0

Ipv6 router isis 2

Int et1/0

Ipv6 router isis 2

R3

Config t

Ipv6 unicast-routing

Router isis 3

Metric-style wide

Address-family ipv6 unicast

Multi-topology

Int loop0

Ip router isis 3

Ipv6 router isis 3

Isis tag 3

Int et0/0

Ipv6 router isis 3

Int et1/0

Ipv6 router isis 3

R1 Ipv6 Verification: -

L

R1

Copy run start

R2

Copy run start

R3

Copy run start

The exhibit shows a snippet of configuration for a router using OSPF (Open Shortest Path First) protocol along with segment-routing MPLS (Multiprotocol Label Switching) and segment-routing forwarding MPLS.

In the context of Cisco Service Provider Network Core Technologies, segment routing is designed to be highly scalable, flexible, and allows for simplified traffic engineering and management across network domains.

Once the initial setup is done (as shown in the exhibit), segment routing can operate without any additional configuration. The segment-routing MPLS and segment-routing forwarding MPLS commands are sufficient for the operation of segment routing.

 BGPsec enhances BGP by adding a layer of security for the AS path attribute. When BGPsec is implemented, updates from eBGP peers include a BGPsec attribute sequence with a public key hash and digital signature. This ensures the authenticity and integrity of the AS path, preventing unauthorized AS numbers from being inserted.  References : = Implementing and Operating Cisco Service Provider Network Core Technologies course materials. 

 The Time to Live (TTL) security mechanism is a lightweight security feature that can protect against CPU and memory resource exhaustion due to a denial-of-service (DoS) attack. It works by setting a limit on the number of hops (TTL value) that BGP packets can traverse. By configuring  neighbor 10.163.83.55 ttl-security hops 2 , ISP A ensures that BGP packets received from ISP C must have a TTL value of at least 254 when they reach R1, as BGP packets decrement the TTL by 1 with each hop. This effectively prevents spoofing attacks from outside the directly connected network because any packets spoofed from further away would have a TTL that drops below the threshold before reaching R1.

To implement Bidirectional Forwarding Detection (BFD) in an IS-IS environment, the first task is to configure BFD in an interface configuration mode. This involves setting up BFD parameters on the interfaces where IS-IS is running to enable quick failure detection.

The configuration snippet shows a BGP router with AS number 65001. It has a neighbor at IP address 10.10.10.1 with remote AS number 4282, and there is an outbound distribute-list applied to this neighbor relationship (distribute-list 1 out).

The distribute list refers to access list 1, which permits any route with an AS path that starts with the local ASN (permit ^$). This means that only  local routes  will be advertised to the neighbor at IP address 10.10.10.1; routes from other Autonomous Systems (ASNs) will not be advertised because they would have an AS path starting with another ASN.

Model-driven telemetry (MDT) utilizes YANG models to enable the subscription to specific data items that are streamed from network devices. This allows applications to receive near real-time updates without the need for traditional polling methods.  MDT with YANG provides a more efficient and scalable way to monitor network devices by pushing updates to subscribers, which can specify the exact data they require 2 .

 NSO, or Network Services Orchestrator, provides full lifecycle management of devices and services in a network. It is designed to automate the service lifecycle from design and creation through deployment and decommissioning, without the need for manual intervention. This includes configuration, activation, updating, and ultimately, removal of services.

The configuration snippet is for model-driven telemetry on Cisco IOS XR, which involves creating a sensor-group named “cisco” and specifying a YANG model path for telemetry data collection. This configuration is used to stream telemetry data from the router, aligning with option D.  References : = Implementing and Operating Cisco Service Provider Network Core Technologies course materials

 In OSPF, for two routers to form an adjacency, they must have matching MTU sizes on their connecting interfaces. If the MTUs are mismatched, OSPF adjacency will be stuck in the EXSTART/EXCHANGE state because OSPF hello packets will not be exchanged between the routers. In this case, both routers R1 and R2 are stuck in EXCHANGE/EXSTART state due to mismatched MTU sizes as indicated in the exhibit.  References : Implementing and Operating Cisco Service Provider Network Core Technologies (SPCOR) -  Cisco

When implementing LDP NSF (Nonstop Forwarding) on the network, an engineer must perform the following tasks:

Implement direct connections for LDP peers : This ensures that LDP sessions can be reestablished quickly after a switchover.

Enable NSF for the link-state routing protocol in use on the network : This allows the routing protocol to maintain its state during a switchover, ensuring seamless operation.

For example, if OSPF is the link-state routing protocol, enabling NSF for OSPF ensures that OSPF adjacencies are maintained during a switchover

 To establish MPLS LDP sessions between two routers, both routers must be configured to support MPLS on the interfaces that connect them. The configuration shown for R2 includes enabling MPLS label protocol LDP and configuring interfaces Ethernet1/0 and Ethernet1/1. However, to complete the MPLS LDP session setup, R2 also needs to have MPLS enabled on the interface toward R1. This is done by entering the interface configuration mode for the relevant interface and using the  mpls ip  command. This command enables MPLS forwarding for IP packets on the interface, which is necessary for LDP to advertise and map labels to the IP routes.

References  := The answer is based on the concepts covered in the Implementing and Operating Cisco Service Provider Network Core Technologies (SPCOR) course,

In IS-IS, to advertise only the network prefixes associated with passive interfaces, the command  advertise passive-only  under the address family configuration mode is used. This ensures that only the prefixes of passive interfaces are advertised to other IS-IS routers in the network. The passive interface command is used to prevent IS-IS from forming adjacencies over that interface, while still allowing the network prefix of the interface to be included in the IS-IS link-state database.

In a multicampus network that supports video streaming, the engineer should configure the network to use  IGMPv3 . IGMPv3 is the version of IGMP that supports  Source-Specific Multicast (SSM) . SSM allows the receiver to specify the source of the multicast stream, which is particularly useful for video streaming applications.  By using SSM, the network can efficiently deliver the video content from the specified source to the receivers without unnecessary traffic from other sources.  References  := Implementing and Operating Cisco Service Provider Network Core Technologies (SPCOR) v1.0 1 .

 The correct route policy to satisfy the requirements is Option C. This option likely contains the necessary commands to:

Accept only customer-assigned prefixes, which can be specified using an access list or prefix list.

Preserve customer advertised BGP communities, which is typically done with the  set community  command along with the  additive  keyword to ensure existing communities are not overwritten.

Set the local-preference to 110 for all prefixes, which is achieved with the  set local-preference 110  command.

Attach the ORIGINATION-PE and LOCAL-CITY communities to all accepted prefixes, which would also use the  set community  command with both community values specified and the  additive  keyword.

 The error message “%CLNS-4-AUTH_FAIL: ISIS: LAN LIIH authentication failed” indicates that there is an authentication failure in the IS-IS routing protocol between routers R1 and R2. In the exhibit, it can be observed that R2 has a state of “UP” for its IS-IS neighbor relationship, while R1 is in “INIT” state. This discrepancy in states indicates an issue with the establishment of the neighbor relationship, which can be attributed to an authentication failure at both Level 1 and Level 2 PDUs as indicated by option B.

 The JSON script in the exhibit configures BGP with a neighbor at IP address 192.168.1.2 that resides in AS (Autonomous System) 65514. In the script,  < bgpPeerP addr= " 192.168.1.2 " >  specifies the neighbor’s IP address, and  < bgpAsP asn= " 65514 " / >  indicates the AS number of the neighbor.

 The  show isis neighbors  command is used to display the Intermediate System to Intermediate System (IS-IS) neighbors that the router has discovered. This command is essential for troubleshooting and verifying the IS-IS network’s topology and ensuring that the router has formed the correct adjacencies with its neighbors.

References  := For more detailed information and study materials, you can refer to the official Cisco course page for “Implementing and Operating Cisco Service Provider Network Core Technologies”  here  and the on-demand e-learning resources  here .

Flexible NetFlow improves on traditional NetFlow by providing more flexibility and efficiency in collecting and analyzing network flow data. In this specific configuration, the “mode random one-out-of-100” command is used, which means that only one out of every 100 packets is sampled. This leads to reduced CPU and memory utilization (Option A) because fewer packets are being processed. Additionally, because fewer packets are being analyzed (only one out of every 100), the number of packets to be analyzed is significantly reduced (Option D), leading to further efficiencies.

References  :=

Implementing and Operating Cisco Service Provider Network Core Technologies

On-Demand E-Learning

 In a gRPC dial-in configuration, the encoding is specified by the client initiating the connection. This setup allows for connection multiplexing, which means multiple gRPC calls can be made concurrently over a single connection, improving efficiency. Two-way streaming is also facilitated, allowing both the client and server to send a sequence of messages to each other, providing a full-duplex communication channel.

Cisco IOS XE Software is an open and flexible operating system optimized for a variety of network infrastructures. One of its key enhancements over Cisco IOS Software is the support for symmetric multiprocessing (SMP). This allows the operating system to efficiently utilize multiple CPU cores, improving performance and scalability for network services.

In MPLS Layer 3 VPNs, shared services such as Internet access can be provided through the use of a shared services VRF (Virtual Routing and Forwarding). The customer VRF uses route targets to import routes from the shared services VRF, which contains the routes to the Internet. This allows the customer sites to access the Internet without compromising the isolation of their private networks.  References : The concept of shared services VRF and the use of route targets for importing and exporting routes are common practices in MPLS VPN implementations.

In this scenario, CE1 and CE2 need connectivity to the internet through the ISP connected to PE3. The most straightforward approach is to configure CE1 and CE2 with a  static default route  pointing to PE3 as the next-hop for internet-bound traffic. This ensures that any traffic destined for the internet will be routed directly to PE3, which is directly connected to the internet.  Other options (A, B, and D) involve more complex configurations and are not necessary for this specific task.  References : Implementing and Operating Cisco Service Provider Network Core Technologies source documents or study guide

Here is the solution:

To achieve this, router 2 should use a route map to filter the routes being redistributed from BGP into OSPF. Specifically, the route map should match the internal route from Lo 2 (which is the loopback interface on router 2) and allow only that route to be redistributed. The other options do not achieve this specific requirement.  References : Implementing and Operating Cisco Service Provider Network Core Technologies (SPCOR) source book.

R1

Router bgp 65515

No bgp default ipv4-unicast

Neig 2.2.2.2 remote-as 65516

Nei 2.2.2.2 update-soc loopback0

Nei 2.2.2.2 ebgp-multihop 2

Neig 2.2.2.2 pass C1sc0!

Nei 2000:cc13:cc13:2::1 remote-as 65516

Nei 2000:cc13:cc13:2::1 update-so loopback0

Nei 2000:cc13:cc13:2::1 pass C1sc0!

Nei 2000:cc13:cc13:2::1 ebgp-multihop 2

Address-family ipv4

Neig 2.2.2.2 activate

Address-family ipv6

Nei 2000:cc13:cc13:2::1 activate

Ip route 2.2.2.2 255.255.255.255 192.168.1.2

Ipv6 route 2000:cc13:cc13:2::1/128 2000:cc13:cc13:cc13::2

R2

Router bgp 65516

No bgp default ipv4-unicast

Neig 1.1.1.1 remote-as 65515

Nei 1.1.1.1 update-soc loopback0

Nei 1.1.1.1 pass C1sc0!

Nei 1.1.1.1 ebgp-multihop 2

Nei 2000:cc13:cc13:1::1 remote-as 65515

Nei 2000:cc13:cc13:1::1 update-so loopback0

Nei 2000:cc13:cc13:1::1 pass C1sc0!

Nei 2000:cc13:cc13:1::1 ebgp-multihop 2

Address-family ipv4

Neig 1.1.1.1 activate

Address-family ipv6

Nei 2000:cc13:cc13:1::1 activate

Ip route 1.1.1.1 255.255.255.255 192.168.1.1

Ipv6 route 2000:cc13:cc13:1::1/128 2000:cc13:cc13:cc13::1

The IPv4 address family configuration under neighbor configuration-mode must be removed. The exhibit shows the configuration of a BGP neighborship between an ASBR and a directly connected BGP speaker. The ASBR is running Cisco IOS XR. The neighbor is configured with the IPv4 address family, which is not supported on Cisco IOS XR.  To establish the BGP neighborship, the IPv4 address family configuration must be removed.

https://www.cisco.com/c/en/us/td/docs/routers/xr12000/software/xr12k_r41/routing/configuration/guide/routing_cg41xr12k_chapter1.html

To redirect traffic from ASN 64501 to 10.0.0.0/8 via the primary link North_A instead of the slow backup link North_B, setting a higher local preference between North_A and South_A is required. Local preference is a BGP attribute that helps in selecting the exit point from an AS (Autonomous System). By increasing local preference for routes received on North_A, traffic will be directed through this path as it becomes more preferred.  References  :=  Cisco Implementing and Operating Cisco Service Provider Network Core Technologies (SPCOR)

The correct command to authenticate the OSPF neighbor between PE-A and PE-B using MD5 is found in Option A. In this option, the command  ip ospf message-digest-key 1 md5 44578611  is used to configure OSPF MD5 authentication on an interface with the key ID as 1 and key string as 44578611. The second command  ip ospf authentication key-chain 44578611  is used to enable OSPF authentication on an interface and associate it with a specific key chain.  References  :=  Cisco - Implementing and Operating Cisco Service Provider Network Core Technologies

The correct configuration to reduce LDP LIB size and advertise label bindings for the /32 loopback IP space only is to use an IP prefix-list that specifies the /32 prefix length and then configure MPLS LDP to allocate labels for these prefixes. The  ip prefix-list LOOPBACKS seq 5 permit 0.0.0.0/0 le 32  command creates a prefix-list named LOOPBACKS that allows any IP address with a prefix length less than or equal to 32. The  mpls ldp label allocate global prefix-list LOOPBACKS  command then instructs the router to allocate labels for all prefixes permitted by the LOOPBACKS prefix-list, which in this case, would be all /32 prefixes.  References : The explanation is based on the concepts covered in the SPCOR course, specifically the sections on MPLS LDP configuration and optimization. For more detailed information, refer to the official Cisco SPCOR course materials and documentation available at  Cisco’s official training page .

The issue described indicates that the preferred BGP path for traffic destined to 192.168.1.1/32 is not being used. By applying a route-map with a higher Local Preference (LP) on R1 for the prefix 192.168.1.1/32, the BGP path attributes can be manipulated to prefer the path through R2. Local Preference is a BGP attribute that determines the preferred exit path out of an AS. A higher Local Preference value is preferred over a lower one. Therefore, configuring the route-map  High-LP  with a higher Local Preference on R1’s BGP peering with R2 will influence the BGP path selection process, ensuring that traffic for 192.168.1.1/32 prefers the path R3-R2-R1 as expected.

The configuration shown indicates that Router 1 is set up with a route-map named “ddos” that matches traffic tagged with “tag 1”. The traffic matching this tag is then set to have a next-hop IP of 192.0.2.1 and a local preference of 150. The community is also set to “no export”, which means this route will not be advertised to external BGP peers. Since there’s no explicit deny statement in the configuration, only traffic with tag 1 and local preference of 150 will be dropped by Router 1 as per the BGP routing policy.  References : Implementing and Operating Cisco Service Provider Network Core Technologies course materials. 

A. Reconnect Timeout field : Specifies the time within which the LDP session should be reestablished after a failure.

C. Graceful restart capability in OPEN message : Indicates that the router supports LDP graceful restart and is capable of maintaining its MPLS forwarding state across a control plane failure.

D. Recovery Time field : Specifies the time that the router will maintain the MPLS forwarding state while it attempts to reestablish LDP sessions.

YANG (Yet Another Next Generation) is a data modeling language used primarily for the configuration and state data of network elements. It is closely associated with the NETCONF (Network Configuration Protocol) for which it models configuration data. YANG provides schemas that define how data is structured and transported by NETCONF operations. It also shapes the state data of network elements, allowing for a standardized format for representing the operational state of devices.  References : YANG is defined in RFCs such as RFC 6020 and RFC 7950, which outline its role in NETCONF operations and its capabilities in modeling both configuration and state data.

During the traceback phase of the six-phase approach to service provider security, the action that occurs is tracing the attack flows from the attacked sections of the network toward the network edges. This phase entails identifying the source of the attack by analyzing the path that the attack traffic has taken through the network.

Cisco MPLS TE tunnels can be established using IS-IS and OSPF as the routing protocols. These protocols allow the creation of traffic-engineered paths within the MPLS network.

 The configuration in Option D is correct for implementing BGP selective prefix suppression according to the requirements. The “aggregate-address” command is used to configure the advertisement of the summarized route 10.16.0.0/21, and the “suppress-map” option allows for selective suppression of specific prefixes, in this case, 10.16.6.0/24.  References : Implementing and Operating Cisco Service Provider Network Core Technologies (SPCOR) -  Cisco SPCOR Training & Certification

Configure an IP domain name : An IP domain name is essential for generating RSA keys needed for SSH. The RSA keys are part of the crypto key configuration, which is necessary to enable SSH on the router. This step ensures that users are authenticated via the SSH protocol when accessing the network remotely.

Configure crypto keys : The crypto keys are crucial for secure communication. The engineer should generate RSA keys using the configured IP domain name. These keys will be used for encryption and authentication during SSH sessions.

The other options (B, D, and E) are not directly related to completing the SSH configuration for secure remote access. Therefore, the correct answers are A and C.

The command  PE-A(config-pmap-c)#set dscp ef  is used to apply DSCP marking to the traffic matched by the class-map. DSCP marking is a part of QoS policy to prioritize traffic. The ‘ef’ (Expedited Forwarding) value is commonly used for voice traffic to ensure it receives high priority and low delay through the network.

In the context of regular expressions, the caret (^) is used to indicate the start of a string. This is a fundamental concept in pattern matching using regular expressions, where ^ matches the position at the beginning of the string.

Stateful (It has 1: N translation, It uses address overloading, It conservers IPv4 addresses)

Stateless (It is limited on the number of endpoints, It mandates IPv4-translatable IPv6 address allocation)

 A Multi-Layer control plane, like Cisco’s nLight technology, provides an integrated approach that allows for the automatic provisioning, monitoring, and management of traffic across different network layers, from Layer 0 (optical) to Layer 3 (IP).  This integration increases network agility and flexibility while improving network utilization, leading to significant cost savings and more efficient network resiliency solutions 2 .

To avoid advertising the same routes back to their sources when using RIP as the routing protocol between multiple PEs and CEs, the network engineer should  define VRFs (Virtual Routing and Forwarding)  on each device. VRFs allow for traffic separation by creating separate routing tables for different VPNs or customers. By using VRFs, each CE-PE link can be associated with a specific VRF, ensuring that routes are not inadvertently advertised back to their sources. Other options (A, B, and D) are not directly related to this specific requirement.  References : Implementing and Operating Cisco Service Provider Network Core Technologies source documents or study guide.

The configuration in the exhibit shows a route policy named “ciscotest”. According to this policy, if the destination is in acl10, then the traffic will pass without any changes. However, if the destination is not in acl10 (else condition), then the local preference will be set to 300 before it passes through. This means option C is correct as it states that if traffic matches acl10, it’s allowed without any change to its local-preference; otherwise (if not matching acl10), its local-preference is set to 300.

The  mpls ldp graceful-restart  command is applied in the global configuration mode in IOS XE Software.  This command enables MPLS LDP Graceful Restart, which assists a neighboring router with MPLS LDP Stateful Switchover/Nonstop Forwarding (SSO/NSF) Support and Graceful Restart to recover gracefully from an interruption in service without losing its MPLS forwarding state 1 .

The neighbor relationship is down because R2 is operating as a Level 1 router and the two routers are in different areas. In the IS-IS (Intermediate System to Intermediate System) protocol, Level 1 routers exchange routing information with other Level 1 routers in the same area, while Level 2 routers exchange information between areas. Since R1 is configured as a level-2 router and R2 as a level-1 router, they cannot form a neighbor relationship if they are not in the same area.  References : Implementing and Operating Cisco Service Provider Network Core Technologies source documents or study guide

The REST API script in the exhibit is used to configure a VRF (Virtual Routing and Forwarding) instance. In the script,  < fvTenant name= " customer " >  defines a tenant named “customer”, and  < fvCtx name= " customervrf " / >  creates a VRF named “customervrf” within that tenant. A VRF allows multiple instances of a routing table to co-exist within the same router at the same time, enabling network paths to be segmented without requiring multiple routers.  References : Implementing and Operating Cisco Service Provider Network Core Technologies source documents or study guide.

 The control plane protocol used between Cisco SD-WAN routers and vSmart controllers is the Overlay Management Protocol (OMP). OMP is a proprietary protocol of Cisco SD-WAN that facilitates the exchange of routing, policy, and management information across the network.  It operates within the secure environment provided by the Datagram Transport Layer Security (DTLS) or Transport Layer Security (TLS) control connection, ensuring that the communication between the routers and controllers is encrypted and authenticated 1 .

References  := Cisco 300-415: Cisco SD-WAN vSmart-WAN Edge Router Control Plane Protocol

 The configuration in the exhibit shows that R1 is configured with “mpls ldp graceful-restart”, which enables LDP Graceful Restart on the router. This means that R1 can support a graceful restart operation on the peer, even if graceful restart is disabled on the peer. This feature allows LDP to recover from failures without affecting the forwarding plane, ensuring network stability and minimal packet loss during failovers.

 In the context of Implementing and Operating Cisco Service Provider Network Core Technologies, LDP-IGP Synchronization is configured to ensure that the IGP and LDP convergences are synchronized. Option C is correct because it shows the configuration where router ISIS 1 is being configured with MPLS LDP sync, but not on a specific interface, ensuring that LDP is operational on all interfaces where IS-IS is enabled before routes are advertised.  References  :=  Cisco