Free Cisco 300-410 Practice Exam with Questions & Answers | Set: 9

In a Layer 3 VPN (Virtual Private Network) over an MPLS (Multiprotocol Label Switching) network, the attribute that allows different customers to connect with overlapping IP ranges is the Route Distinguisher (RD)123.

RD is a unique identifier that is prepended to each IP address in a customer’s VPN to create a unique VPNv4 address. This allows customers to use overlapping IP addresses without conflict123. The RD makes it possible for the same IP prefix to exist in different VPNs, which is crucial when customers have overlapping IP ranges123.

In a Hierarchical DMVPN deployment (often referred to as DMVPN Phase 3), regional hubs (like Hub West and Hub East) play a dual role. They function as a Hub for the branch routers in their local region and as a Spoke (Next Hop Client) to the Central Hub.

To support this hierarchical structure and the Phase 3 functionality shown in the topology, the following configurations are required on the regional hubs:

1. ip nhrp map multicast dynamic (Option A):

Role: Hub Role.

Explanation: Since Hub West and Hub East act as hubs for their respective branches (Branch A and Branch B), they must be able to forward multicast traffic (such as EIGRP or OSPF Hello packets) to their spokes. Because branches have dynamic IP addresses, the hub cannot use static maps; it must use the dynamic keyword to automatically map multicast traffic to the NBMA addresses of spokes as they register.

2. ip nhrp shortcut (Option B):

Role: Spoke/Client Role.

Explanation: This is the defining command for DMVPN Phase 3 on the client side. In this hierarchy, Hub West and Hub East are clients of the Central Hub. When the Central Hub sends an NHRP Redirect (which is already configured in the exhibit ' s snippet), the ip nhrp shortcut command allows the regional hubs to process that redirect and initiate a direct " shortcut " tunnel to other hubs or spokes, bypassing the Central Hub for the data plane.

Why other options are not the primary focus for the " Hierarchical/Phase 3 " template:

Option C, D, and E: These relate to basic NHRP registration (pointing to the NHS). While Hub West and Hub East do need to point to the Central Hub to function, the question specifically asks about the configuration for Hierarchical DMVPN . Options A and B are the specific enhancements that enable the Phase 3 " Hub-and-Spoke-and-Hub " traffic flow and shortcutting capabilities.

Option A configures uRPF loose mode to forward the packet. This mode allows the router to check if there is a route in the routing table that matches the source IP address of the incoming packet, regardless of the interface that is used to reach the source. This mode is suitable for networks that have asymmetric routing, where the incoming and outgoing interfaces for a packet may differ2.

Option B permits the 172.16.3.251 in the inbound ACL on interface gi0/3. This option does not resolve the issue, because it only allows the packet to pass the ACL check, but not the uRPF check. The packet will still be dropped by uRPF if there is no route to reach the source IP address via the same interface3.

Option C permits the 172.16.3.251 in the inbound ACL on interface gi0/3 to allow 172.16.3.251. This option is redundant and incorrect, because it repeats the same IP address twice in the ACL statement. It also does not resolve the issue for the same reason as Option B3.

Option D configures uRPF strict mode to forward the packet. This option does not resolve the issue, because it is the same mode that was already configured on the interface. Strict mode requires that the router has a route to reach the source IP address via the same interface where the packet was received. If this condition is not met, the packet will be dropped4.