300-410 ENARSI: Implementing Cisco Enterprise Advanced Routing and ServicesDemo

Cisco IOS disables AAA authorization on the console by default, so the RADIUS shell:priv-lvl=15 attribute does not apply to console sessions. Enabling aaa authorization console followed by authorization exec on the line con 0 allows the console to leverage RADIUS authorization. Option D includes both commands, enabling the console to respect the RADIUS privilege level.

BFD's two core benefits are subsecond (typically sub-50ms) failure detection between adjacent forwarding devices and the ability to detect forwarding-path failures directly, independent of and much faster than routing-protocol hello/dead timers. It is not universally supported by every routing protocol and has no relationship to UDLD.

Label Distribution Protocol (LDP) forms label-distribution peer sessions in an MPLS network. MD5 authentication verifies the integrity and origin of LDP peer communications, and a session cannot be established unless both peers use the matching authentication configuration. This prevents unauthorized routers from participating in LDP.

In DMVPN output, the NBMA (Non-Broadcast Multiple Access) address field shows the WAN/underlay IP address of each peer, while the tunnel address represents the overlay/tunnel interface IP. The 'D' designation indicates a dynamically discovered spoke. The WAN IP address of another spoke router is found in the NBMA Addr column, which shows 172.18.46.2 for the dynamic peer entry.

Policy-based routing uses configured policies, commonly based on packet attributes such as source, destination, protocol, or application, to select a next hop independently of the normal routing-table lookup. This permits traffic steering without changing the routing table.

Cisco IOS maps SSH rotary groups to consecutive ports starting from the specified port number. The command ip ssh port 2001 rotary 1 11 creates SSH access on ports 2001 through 2011 (11 consecutive ports for rotary groups 1–11). The VTY lines must use transport input ssh to permit SSH connections on all mapped ports.

A TACACS+ shared secret mismatch prevents the router from correctly decrypting the authentication packet, producing the invalid AUTHEN packet and incorrect expected-length error. Configuring the same password (shared key) on the TACACS+ server and router resolves the failure.

ip http authentication aaa changes HTTP login authentication from local credentials to AAA-based network credentials. ip http max-connections 3 permits three concurrent HTTP-server connections. The existing ACL already permits the 172.16.10.48/28 subnet, so no ACL change is required.

The VTY configuration includes no exec, which disables the EXEC process required for an inbound Telnet session after the connection opens. Applying exec under the R3 VTY lines re-enables inbound terminal access. transport input all already permits Telnet, and the line password with login is already configured. Cisco documents that Telnet users cannot log in when EXEC processing is disabled on a line.

SNMP ifIndex persistence retains IF-MIB interface index values across reloads, maintaining consistent interface identification and preventing monitoring graphs from associating traffic with changed interface OIDs. Global configuration applies this persistence to all applicable interfaces.

An OSPF neighbor that remains in ExStart cannot complete Database Description packet exchange. A mismatch between the interfaces’ MTU settings causes the router receiving a Database Description packet with an unacceptable advertised MTU to ignore it, so the adjacency does not progress. The interface MTUs must match.

The default-information originate command causes OSPF to originate and advertise a default external route. Without always, it does so when a default route is present in the routing table, which the configured static 0.0.0.0/0 route provides.

R1 exports NetFlow records as UDP packets to 10.66.66.66 on destination port 1090, but its UDP source port is 54186. The applied DDOS ACL denies UDP traffic in the 1024–65535 range, so it blocks those export packets on either route. A permit for UDP traffic to host 10.66.66.66 on port 1090 must be added before the deny entry on both R3 and R4, which cover the secondary and primary paths. Cisco documents that a flow exporter’s UDP transport setting identifies the destination system’s listening port, and extended ACLs can filter UDP ports. Cisco Flexible NetFlow output features Cisco IP Access List Overview

IPv6 RA Guard supports the device-role values host and router. Host mode blocks Router Advertisement and router redirect messages on a port, while router mode designates a port that faces a router.

Routes redistributed from an OSPF domain should be tagged at redistribution and filtered inbound by the same tag in the other domain. This prevents routes that originated in a domain from being installed after returning through another domain, so they cannot be redistributed back into their source domain and form a routing loop.

Independent IP SLA operations and track objects are required so that each default route is withdrawn according to reachability through its own ISP. ISP-specific static host routes for 8.8.8.8/32 ensure the ICMP probes are forwarded through the intended ISP rather than succeeding over the alternate default route. Cisco documents that IP SLA tracking changes the associated static route according to probe reachability and that separate SLA objects can be associated with individual routes.

When device tags are used to filter templates, the same tags must be applied to the target device. A tag mismatch causes Cisco DNA Center to report that the device cannot be selected because it is not compatible with the template.

EIGRP selects the route with the lowest composite metric, which by default includes the minimum configured bandwidth along the path and cumulative delay. Configuring Cape Town’s direct interface as 5 Mbps and its Tokyo-facing interface as 10 Mbps makes the route through Tokyo preferable. The EIGRP autonomous system shown is 222, so commands under EIGRP 100 do not affect the routing process.

service dhcp enables Cisco IOS DHCP service, including DHCP relay processing, on R1. ip dhcp relay information trust-all configures R2 to accept DHCP packets containing relay-agent information (Option 82) from all interfaces; otherwise, relay-agent information from an untrusted source can cause the DHCP packet to be discarded.

username Admin secret Cisco@123 stores the user credential as a nonreversible hashed secret instead of displaying the clear-text password in the configuration. service password-encryption enables encryption of clear-text passwords, including username passwords, in the configuration. A password 7 entry must be supplied with an already encrypted Type 7 value, not a clear-text password.

A prefix-list entry without ge or le matches only the exact prefix length, so permit 10.0.0.0/8 permits only the /8 aggregate. Configuring le 32 permits that aggregate and every more-specific prefix within 10.0.0.0/8; the later deny entry can continue to block all other routes. Cisco documents that le sets the maximum matched prefix length and that, when used alone, the range begins with the prefix length in the entry.

EIGRP stub routing restricts which routes a router advertises to neighbors. When R1 is configured as an EIGRP stub, it only advertises connected and summary routes, preventing it from propagating the static or redistributed default route learned from R2 to the branch network. Removing EIGRP stub configuration on R1 allows it to advertise all learned routes, including the default route, to the branch network. This enables branch users to reach the Internet through the HQ network.

A named AAA login authentication method list does not take effect on a line until that list is applied to the line. Configuring login authentication Console under the console line applies the existing aaa authentication login Console local list, causing console logins to use the local username database instead of the default TACACS+ list.