Quick hitter – answer to the 2^nd IPv6 addressing question!

• Link to the question
• Link to the brief topic introduction

The Answer

(Wendell’s note to self: internal question number 113.)

Answer(s): A, C

The Explanation

You need to know a couple of facts to answer this question:

• The packet that flows through multiple routers, from host A to server S1, needs to use routable IPv6 addresses.
• The source IPv6 address must be a unicast IPv6 address.
• Two ranges exist:
  • Unique local – begins FD
  • Global unicast – literally, has many prefixes, but most often begins with hex 2 or 3

Armed with these two facts, a quick scan shows two such IPv6 addresses, at answers A and C.

• Link to the question
• Link to the brief topic introduction

The Answer

(Wendell’s note to self: internal question number 112.)

Answer(s): B

The Explanation

You need to key facts to answer this question:

• OSPF Version 3 (OSPFv3) uses link local addresses as the next-hop address for the IPv6 routes it adds to the IPv6 routing table.
• Link local addresses begin with an initial four hex digits of FE80.

Armed with those two facts, you can scan the list looking for any link local addresses, find only one (in answer B), and answer the question.

Another Question!

I could go on to explain more about the incorrect answers, but instead, I think I’ll ask another, with the same exact answers. Same scenario even. The only difference is the part of the question highlighted in yellow below. Here’s the next one:

(Question 113:)

Host A, in a bank branch office in Atlanta, Ga., is able to send IPv6 packets back and forth with server S1 in Charlotte, NC. The routers use OSPFv3. Which of the following address(es) could be used as the source IPv6 address of the packet that flows from Host A to Host B?

A) 3456:1234:5678:9AB:1111:2222:3333:4444

B) FE80::200:FF:FE00:1111

C) FD00:DEAD:BEEF:CAFE:101:20:3:1111

D) FF02::1:FF00:1234

E) ::

F) FF02::5

(Note that unlike the real Cisco exams, this sample question does NOT identify the number of correct answers, just to add to the challenge level.)

More Practice Questions:

This question is like those you get if when you buy the ICND1 100-101 Official Cert Guide. This blog also lists various practice questions as well. For more questions on a large variety of topics:

• Look at the Questions tab in the www.ccentskills.com blog
• Look at the Questions tab in the www.ccnaskills.com blog
• Use the practice tests that come with the printed version of the book
• Get additional exam banks, even more than the print book, with the Premium Edition of the Book, available only from the publisher

The Question

(Wendell’s note to self: internal question number 112.)

Host A, in a bank branch office in Atlanta, Ga., is able to send IPv6 packets back and forth with server S1 in Charlotte, NC. The routers use OSPFv3. Which of the following address(es) could be used as the next-hop IPv6 address of the route, learned with OSPFv3, that router R1 uses to forward an IPv6 packet from host A to server S1?

A) 3456:1234:5678:9AB:1111:2222:3333:4444

B) FE80::200:FF:FE00:1111

C) FD00:DEAD:BEEF:CAFE:101:20:3:1111

D) FF02::1:FF00:1234

E) ::

F) FF02::5

(Note that unlike the real Cisco exams, this sample question does NOT identify the number of correct answers, just to add to the challenge level.)

Figure 1: Figure Used with IPv6 Addressing Question

Answers next post. Enjoy!

Related Posts

Introduction to this topic as it exists in the new CCENT and CCNA exams:

More Practice Questions:

This question is like those you get if when you buy the ICND1 100-101 Official Cert Guide. This blog also lists various practice questions as well. For more questions on a large variety of topics:

• Look at the Questions tab in the www.ccentskills.com blog
• Look at the Questions tab in the www.ccnaskills.com blog
• Use the practice tests that come with the printed version of the book
• Get additional exam banks, even more than the print book, with the Premium Edition of the Book, available only from the publisher

The Exam Topics: Old and New

First, to review the history of what was in the old exams versus the new. Cisco had a few IPv6 exam topics in the ICND2 half of CCNA in the old days, with only one of those specific to IPv6 addressing:

• Describe IPv6 addresses

Cisco moved that exam topic to the new ICND1, with lots of supporting detail. Cisco also added one more exam topic specific to addressing. The following list details those exam topics:

• Identify the appropriate IPv6 addressing scheme to satisfy addressing requirements in a LAN/WAN environment.
• Describe IPv6 addresses

• Global unicast
• Multicast
• Link local
• Unique local
• eui 64
• autoconfiguration

Cisco’s new exam topics starting in March 2013 put some IPv6 into ICND1, with IPv6 addressing clearly in ICND1. The exam topics include some that explicitly list “IPv6”, while others use “IP” to refer to all of IP (both IPv4 and IPv6). To show what’s in each side of CCNA, Figure 1 breaks down the topics that I’ve put in the new ICND1 Cert Guide and new ICND2 Cert Guide for IPv6:

Figure 1: IPv6 Topic Breakdown in the ICND1 and ICND2 Books

IPv6 Addressing Overview

IPv6 addresses are long – 128 bits, and up to 32 hex digits long, which is still pretty long. For anyone new to IPv6, the length can be a problem. However, once you understand the addressing, getting around the length of the numbers become manageable. Then, the biggest challenge with IPv6 addresses is figuring out what type of address each IPv6 address is, and the purpose of each address.

IPv6 includes several types of unicast addresses, several types of multicast addresses, and some other special addresses as well. Once you start studying IPv6, you will already know how to look at an IPv4 address and quickly find the IPv4 address class (A, B, C, D, or E), and know that classes A/B/C are unicast, with D as multicast. IPv6 has a completely different set of rules, no address classes, a little bit of math involved in figuring out if an address is a particular type, with different initial values identifying an address as a particular type.

For instance, IPv6 breaks down unicast addresses (addresses used by one interface) into several categories, including:

Global unicasts: used by hosts and routers for an interface to send packets anywhere. Compared to IPv4, these most closely act like public IPv4 addresses, because IANA assigns the address range, and the Enterprise engineer then uses the assigned prefix for all addresses inside the company.

Unique local: used like global unicasts, but more like private IPv4 addresses, in that the numbers are not registered with IANA beforehand. Instead, the Enterprise network engineer chooses a prefix, and then uses that prefix for all addresses inside the company.

Link local: used for packets that flow only over the local link (not forwarded by a router), usually by some overhead protocols. Hosts and routers have the ability to automatically choose their link local addresses.

For instance, Figure 2 shows a diagram of a small network, with global unicast IPv6 addresses listed. Just like with IPv4, a network diagram with IPv6 addresses listed implies that the addresses are some type of unicast IPv6 address. They could be global unicasts, unique locals, or even link locals, depending on the purpose of the figure.

Figure 2: Sample IPv6 Address Plan for a Small Network

For the exams, you need to be as comfortable with these IPv6 addresses as you are for IPv4. For instance, for ICND1, you need to be ready to look at these IPv6 values, and decide which type of IPv6 address is represented by each. The ICND2 exam can them pose troubleshooting scenarios that use these addresses, knowing when each type of address is used for overhead protocols and for packet forwarding.

More on IPv6 Addressing

Next post: a sample question on IPv6.

Link to the question
Link to the brief topic introduction

The Answer

(Wendell’s note to self: internal question number 111.)

Answer(s): D

The Explanation

This question basically requires you to be able to do the following: given the scenario as described in the question stem, what are the possible correct configuration options on both the router and switch? Then, which answers fit within the possible correct configuration?

Note that the new ICND1 Official Cert Guide shows a very similar example on page 441 with Example 16-2.

Figure 3: ROAS: One Router LAN Interface, >1 VLAN and Subnet

First, focus on router B1. To give the router a presence in VLAN 10, which is not the native VLAN, the router MUST use a subinterface of its G0/0 interface, and the router must have an IP address in the match subnet. Likewise, router B1 must use a subinterface to connect to VLAN 20, also not the native VLAN, with a different subinterface, and with an IP address in subnet 10.1.20.0/24.

Also, note that B1’s configuration does NOT have to use a subinterface number that matches the VLAN. EG, B1 does not have to use subinterface G0/0.10 to connect to VLAN 10 on this trunk. B1 could use interface G0/0.10, but the answer that says that B1 “must” use that subinterface is incorrect because of the “must”. The encapsulation dot1q subcommand must use the correct VLAN number.

As a result, of the three answers that mention router B1, only answer D is correct.

The two answers that mention SW1 are both incorrect, but for different reasons. First, the answer that mentions the encapsulation dot1q 20 subcommand: that subcommand is part of a valid router configuration for VLAN trunking, but not part of a switch configuration for VLAN trunking. The other answer lists two valid switch subcommands for VLAN trunking when dynamically forming VLAN trunks between two switches. However, routers do not dynamically negotiate trunking, so the switch must be statically configured to trunk (switchport mode trunk).

More Practice Questions:

This question is like those you get if when you buy the ICND1 100-101 Official Cert Guide. This blog also lists various practice questions as well. For more questions on a large variety of topics:

• Look at the Questions tab in the www.ccentskills.com blog
• Look at the Questions tab in the www.ccnaskills.com blog
• Use the practice tests that come with the printed version of the book
• Get additional exam banks, even more than the print book, with the Premium Edition of the Book, available only from the publisher

The Question

(Wendell’s note to self: internal question number 111.)

Router B1 can correctly route IPv4 packets between the two LAN subnets shown in the figure. The router can also route packets to/from other subnets to the left of router B1 (not shown in the figure). R1 uses ROAS. Switch SW1 uses VTP Transparent mode, 802.1Q trunking on the link connected to router B1, and the default native VLAN.

Consider the configuration options. Which of the following answers must be true about the configuration on B1 and SW1?

A) B1 must have an interface gigabitethernet 0/0.10 command, with a subcommand that adds an IPv4 address from subnet 10.1.10.0/24

B) SW1 must have an interface command creating a subinterface of Gigabit 0/1, with that subinterface having an encapsulation dot1q 20 interface subcommand

C) B1 must have an encapsulation dot1q command inside the configuration section for the physical interface (under the interface gigabitethernet 0/0 command)

D) B1 must have an interface command creating a subinterface of Gigabit 0/0, with that subinterface having an encapsulation dot1q 20 interface subcommand

E) SW1 can use either the switchport mode dynamic desirable or switchport mode dynamic auto subcommands on interface G0/1

(Note that unlike the real Cisco exams, this sample question does NOT identify the number of correct answers, just to add to the challenge level.)

Figure 1: ROAS: One Router LAN Interface, >1 VLAN and Subnet

Answers next post. Enjoy!

Related Posts

Introduction to this topic as it exists in the new CCENT and CCNA exams:

More Practice Questions:

This question is like those you get if when you buy the ICND1 100-101 Official Cert Guide. This blog also lists various practice questions as well. For more questions on a large variety of topics:

• Look at the Questions tab in the www.ccentskills.com blog
• Look at the Questions tab in the www.ccnaskills.com blog
• Use the practice tests that come with the printed version of the book
• Get additional exam banks, even more than the print book, with the Premium Edition of the Book, available only from the publisher

Today’s topic: ROAS. Cool acronym, and was in #CCNA in the old days (before the March 2013 changes), but it gets a little more focus in the new exams. Today’s post hits the highlights of Router on a Stick, now squarely in the ICND1 and CCENT part of the Cisco cert equation.

The Exam Topics: Old and New

Cisco reveals what’s on each certification exam through their published exam topics. Router on a Stick, or ROAS, was in the ICND2 half of the CCNA Routing and Switching breakdown, in the ICND2 half of the mix, as:

Configure, verify, and troubleshoot interVLAN routing

As worded, you could argue whether or not “interVLAN routing” included ROAS or not. It is in my books related to the old exams.

Cisco’s new exam topics starting in March 2013 clearly state that ROAS exists in the new ICND1 100-101 exam and CCNA 200-120 exam. Cisco lists about three times the detail in their exam topics for the new exams versus the old. (The new exam does not have three times the topics; Cisco just gives us more information about the details.) In this case, the new ICND1 100-101 exam topics lists:

Configure and verify interVLAN routing (Router on a stick)

• sub interfaces
• upstream routing
• encapsulation

Clearly, the new exam includes ROAS, and several specific features. It also exists in the CCNA exam topics.

Figure 1: ROAS Location in the ICND1 & ICND2 Topic Breakdown

ROAS Overview

ROAS refers to a router feature with which the router can connect to multiple LAN-based subnets using a single physical interface. A router with one LAN interface, connected to a LAN switch, acts to support the multiple subnets associated with the multiple VLANs defined by that LAN switch. The router must route packets between multiple subnets, over one physical interface. The router is “on a stick” because the drawing looks like a router with one link to the LAN switch, like a stick, as shown in Figure 2.

Figure 2: ROAS: One Router LAN Interface, >1 VLAN and Subnet

ROAS can be a challenge for several reasons. First, the router and switch must both use VLAN trunking, and it must be statically defined. The static definition means that the configuration on both the router and switch must match, and if not, problems can occur.

The router uses subinterfaces: logical interfaces that subdivide the router’s logic as applies to what happens on a physical interface. ROAS is the first feature that most people see in their Cisco journey that happens to use subinterfaces.

ROAS can also be a challenge because it combines both layer 2 and layer 3 concepts. ROAS exists to route IP packets (a layer 3 concept). However, the means to connect to these layer 3 subnets requires VLAN trunking (a layer 2 concept). That combination can cause a little heartburn.

More on ROAS

The new ICND1 Official Cert Guide gets into some depth on ROAS, for concepts, configuration, and verification. Note that the book also gets into layer 3 switch concepts and configuration as well.

Next post: a sample question that uses ROAS.

• Link to Question 104
• Link to Question 105
• Link to Answer Part 1

Literal Answer(s):

Question 104: C

Question 105: D

Figure Reference

The figure is just a repeat of the figure from the questions, for handy reference.

Figure 104: Network Used for Question 104 (and 105)

The rest of today’s post discusses the rest of the answers, other than the answers about port security. Those answers were frankly the most challenging to work through. This post has lots of short topics.

Question 104: Two Answers Break Both A’s and B’s Ping

Two of the incorrect answers in question 104 break PC2’s ping, which was one part of the question. However, both actions would also break PC1’s ping, which the question said that PC1’s ping worked.

One answer suggested that R1’s G0/0 interface mask be changed to /25, keeping the same 10.1.1.254 address. That would make R1 have a connected subnet of 10.1.1.128/25, range 10.1.1.129 – 10.1.1.254. R1’s connected route would no longer include PC2’s 10.1.1.2 IP address, do R1 could no longer forward packets to host PC2.

The problem? R1 no longer has a route to reach host PC1’s 10.1.1.1 address either. So this answer breaks both PC1’s and PC2’s ping, which isn’t allowed.

Question 104 – Correct Answer

The correct answer to 104 says “a speed mismatch on one link”. A couple of facts:

• A speed mismatch prevents Ethernet frames from crossing the link. Note that a duplex mismatch does not.
• The question suggests “one” link. You choose. Which link? The link from host PC2 to switch SW2.

Frankly, I think this question had stronger distractors (wrong answers) than correct answers. Break one Ethernet link – the link connected to host PC2 – and host PC1 still have a path to its default router.

Question 105 – Misconfig of R1’s G0/1 IP Address

This incorrect answer breaks PC2’s ping, but also breaks PC1’s ping.

The change is to make R1’s G0/1 mask /25, keeping the address at 10.1.2.254. Similar to one answer for question 104, that makes R1 have a connected route for 10.1.2.128/25, range 10.1.2.129 – 10.1.2.254. That address range does not include PC4’s IP address, so R1 would not have a route with which to forward packets to PC4’s 10.1.2.4 address. Both pings would fail.

Question 105 – Misconfig of R1’s Routing Protocol

This one’s like so many logic puzzles – painfully simple, once it hits you. Until then, maybe it’s not so obvious. I’m leaving it for questions. The answer is incorrect. Ask if you like…

Question 105 – Misconfig of PC2’s Mask

Finally, this is the one correct answer to question 105. Again, this one was a little more obvious than some of the distractor answers. Changing PC2’s mask to /25, keeping the address as 10.1.1.2, puts the default router in a different subnet than PC2. The default router should be in the same subnet.

Literal Answer(s):

Question 104: C

Question 105: D

Figure Reference

The figure is just a repeat of the figure from the questions, for handy reference.

Figure 104: Network Used for Question 104 (and 105)

The rest of today’s post discusses the nuances of why both answers about port security happen to be wrong in this case. And to understand port security, you have to understand both the MAC addresses used in each frame, and what port security examines in a frame.

General Discussion 1: The MAC Addresses Stay in the Local Subnet

One of the first facts needed to help answer this question is to have a firm knowledge of encapsulation. Packets in this example leave one subnet and go to a second subnet when the router routes the packet. As a result, the router discards the old data link header/trailer that had encapsulated the frame, and builds a new one. For instance, when PC2 pings PC4:

1. The frame leaves PC2 with source MAC PC2-MAC, destination MAC R1-G0/0-MAC
2. R2 discards the data link header/trailer
3. R2 builds a new Ethernet frame w/ source MAC R1-G0/1-MAC and destination MAC PC4-MAC

General Discussion 2: Port Security Acts on Incoming Frames, Based on Source MAC Address

Cisco happens to include a little port security in ICND1, and a little in ICND2, with the current breakdown in these exams. However, even the ICND1 coverage defines the basics about what port security considers when watching traffic on a switch port. Specifically, port security:

• Watches incoming frames only
• Bases its choice of whether the frame breaks a rule based on the source MAC address

Question 104’s Answer with Port Security

Now look at question 104’s answer that mentions port security. It asks about SW4, port F0/5. Assuming port security was enabled on that interface, what would the frames look like for the ping issued from PC1? And for PC2? And how are they different?

First, note that port security only considers the incoming frames, and those would be the frames sent by each ping command towards PC4.

Next, note that in the figure, the IP packets would have arrived at R1, and been routed into subnet 10.1.2.0/24. So, the source MAC at that point would be R1-G0/1-MAC, both for packets sent for PC1’s ping and packets sent for PC2’s ping.

In short, the only concepts port security can examine on SW4’s G0/2 interface – the source MAC of frames entering that interface – are identical for frames holding PC1’s packets and frames holding PC2’s packets. So port security can either cause both pings to fail, or allows both to fail, but it cannot be configured to make PC1’s ping work and PC2’s ping fail.

Question 105’s Port Security Answer

Question 105’s answer has similar, but not identical logic. The big difference is that it asks about an event in subnet 10.1.1.0/24, on the left side of the figure. So, PC1’s and PC2’s MAC addresses might be in play.

Question 105 has an answer that asks about SW2’s F0/5 interface. That interface connects to router R1, namely R1’s G0/0 interface. Looking at the figure, and thinking about the ICMP messages generated by the ping commands, the ICMP Echo Reply messages will enter the SW2 F05 interface. That is, when PC4 sends back the reply, R1 will forward them back to the left.

Next, note that in the figure, the IP packets would have arrived from PC4 to R1, and been routed into subnet 10.1.1.0/24 on the left. So, the source MAC at that point would be R1-G0/0-MAC, both for packets sent from PC4 to PC1 (for PC1’s ping), and for packets sent from PC4 to PC2 (for PC2’s ping.)

In short, port security cannot distinguish between these two frames, because they have the same source MAC address.  Again, port security can either cause both pings to fail, or allows both to fail, but it cannot be configured to make PC1’s ping work and PC2’s ping fail.

Next post, I’ll wrap up the discussion of the other answers.

The Scenario: Question 105

(This is indeed a repeat of question 104’s details…)

In this scenario, PC4 acts as a web server, with users sitting at PC1 and PC2. The figure shows IPv4 addressing information, and pseudo-MAC addresses (eg, PC1-MAC for PC1’s MAC address).  PC1 and PC2 will ping PC4’s IP address.

Figure 105: Network Used for Question 105

Question 105

(Again, same question as question 104, just with different answers.)

An engineer has the documentation shown in the figure. All switch interfaces sit in VLAN 1. The user at PC1 claims that when they issue a ping 10.1.2.4 command, it works. However, when the user at PC2 issues the same command, it fails, (shows multiple periods.) Which of the following answers lists a possible cause of the current conditions? Note that multiple correct answers may exist. Also, note that the information in the figure may be incorrect (as noted in an answer).

a)     Misconfiguration on R1’s G0/1 to use IP address/mask 10.1.2.254/25

b)     Port security on SW2’s F0/5 interface

c)     R1 misconfiguration of its IPv4 routing protocol

d)     Misconfiguration of PC2’s IP address/mask to 10.1.1.2/25