Cisco 300-410 - Implementing Cisco Enterprise Advanced Routing and Services (300-410 ENARSI)

https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_conn_dmvpn/configuration/15-mt/sec-conn-dmvpn-15-mt-book/sec-conn-dmvpn-dmvpn.html

If you configure the redistribution of OSPF into BGP without keywords, only OSPF intra-area

and inter-area routes are redistributed into BGP, by default. You can use the internal keyword

along with the redistribute command under router bgp to redistribute OSPF intra- and inter-area

routes.

Use the external keyword along with the redistribute command under router bgp to redistribute

OSPF external routes into BGP.

- > In order to redistribute all OSPF routes into BGP, we must use both internal and external

keywords. The full command would be (suppose we are using OSPF 1):

redistribute ospf 1 match internal external

Note: The configuration shows match internal external 1 external 2. This is normal because

OSPF automatically appends “external 1 external 2” in the configuration. In other words,

keyword external = external 1 external 2. External 1 = O E1 and External 2 = O E2.

https://community.cisco.com/t5/networking-documents/how-to-configure-pbr/ta-p/3122774

By default, the priority is 1 on all routers so we can set the OSPF priority of the hub to a value which is greater than 1 to make sure it would become the DR.

https://www.cisco.com/c/en/us/support/docs/wireless/4400-series-wireless-lan-controllers/109597-csr-chained-certificates-wlc-00.html#anc12

According to this question, uRPF is running in strict mode because packets are dropped even

when that route exists in the routing table. Maybe packets are dropped because the receiving

interface is different from the interface the local router uses to send packets to that destination.

The ip verify unicast source reachable-via rx command enables Unicast RPF in strict mode.

To enable loose mode, administrators can use the any option (ip verify unicast source

reachable-via any). In loose mode, it doesn’t matter if we use this interface to reach the source

or not.

The allow-default option allows the use of the default

route in the source verification process.

Overview of the IPv6 First-Hop Security Binding Table

A database table of IPv6 neighbors connected to the device is created from information sources such as NDP snooping. This database, or binding table, is used by variousIPv6 guard features to validate the link-layer address (LLA), the IPv4 or IPv6 address, and the prefix binding of the neighbors to prevent spoofing and redirect attacks.

IPv6 First-Hop Security Binding Table Recovery MechanismThe IPv6 first-hop security binding table recovery mechanism enables the binding table to recover in the event of a device reboot.

Disable-connected-check enables a directly connected eBGP neighbor to peer using a loopback address without adjusting the default TTL of 1. In disable connected check the router does not decrease the TTL of an IP packet that is destined to itself so it only counts or considers as one hop between the two loopbacks of the routers.

From the output of the “show ip eigrp topology …” command, we notice network 192.168.13.0/24 was learned via two routes:+ From 192.168.23.3 (R3) with FD = 1075200 and AD = 281600+ From 192.168.12.1 (R1) with FD = 2611200 and AD = 281600

From the output of the “show ip route …” command, we learned that the best (and chosen) path is via 192.168.23.3 (R3).

To use both paths (called unequal cost load balancing) with EIGRP, the second path via R1 must satisfy the feasibility condition. The feasibility condition states that, theAdvertised Distance (AD) of a route must be lower than the feasible distance of the current successor route.

In this case, the second path satisfies the feasible condition as its AD (281600) is smaller than the FD (1075200) of the best path. Therefore we can configure loadbalancing with “variance” command.

In other words, EIGRP will install all paths with metric < variance * best_metric into the local routing table, provided that it meets the feasibility condition to preventrouting loop. Therefore we can calculate the variance > metric / best_metric = 2611200 / 1075200 =2.4.

So with a variance greater than 2 (and must be an integer), we can load balance traffic to network 192.168.13.0/24.

The Destination Guard feature helps in minimizing denial-of-service (DoS) attacks. It performs address resolutions only for those addresses that are active on the link,and requires the FHS binding table to be populated with the help of the IPv6 snooping feature.The feature enables the filtering of IPv6 traffic based on the destinationaddress, and blocks the NDP resolution for destination addresses that are not found in the binding table. By default, the policy drops traffic coming for an unknowndestination.

Unmonitored: Unmonitored devices are devices for which Assurance did not receive any

telemetry data during the specified time range.