Cisco ENARSI 300-410 flashcards
Cisco ENARSI 300-410 · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- EIGRP feasible successor
- A backup route whose reported distance from the neighbor is strictly less than the local feasible distance, guaranteeing a loop-free path that can be used without DUAL recomputation.
- EIGRP stuck-in-active
- A route remains Active when a neighbor does not answer the query within the active timer (default 3 minutes); the router then resets the neighbor relationship.
- OSPF virtual link
- A logical link through a transit area connecting a remote area to the backbone; both endpoints must be ABRs with an interface in the transit area, which cannot be stub or NSSA.
- OSPF type 7 LSA
- An NSSA external LSA flooded only inside the NSSA; the NSSA ABR translates it to a type 5 LSA for the rest of the domain.
- BGP local preference
- A well-known discretionary attribute used inside an AS to select the preferred exit; higher value wins, and it is compared before AS path length in best-path selection.
- BGP next-hop-self
- An iBGP command that rewrites the next hop of advertised routes to the advertising router's own address, used when the original next hop is unreachable inside the AS.
- Route redistribution tag
- A value set with 'set tag' in a route-map during redistribution and matched on the reverse boundary, preventing routes from looping back into their origin protocol.
- Policy-based routing
- A route-map applied to an interface with 'ip policy route-map' that forwards matching traffic to a specified next hop or interface, overriding the routing table.
- DMVPN phase 3 redirect
- The hub sends an NHRP redirect to a spoke that sends traffic through the hub, prompting the spoke to query the destination and build a direct tunnel.
- DMVPN phase 2 split horizon
- The hub tunnel must disable split horizon (for example 'no ip split-horizon eigrp') so routes learned from one spoke are advertised to other spokes.
- NHRP map multicast dynamic
- A hub mGRE command that registers spokes dynamically and forwards multicast/broadcast traffic to all registered spokes, enabling routing protocols over the tunnel.
- IPsec tunnel mode
- ESP or AH mode that encrypts the entire original IP packet and prepends a new IP header, used for gateway-to-gateway VPNs; transport mode keeps the original header.
- IKE phase 1 mismatch
- When encryption, hash, DH group, authentication, or pre-shared key differ between peers, the tunnel fails with 'no proposal chosen' during ISAKMP negotiation.
- GRE over IPsec
- GRE encapsulates multicast and non-IP traffic, then IPsec encrypts the GRE packet; used because IPsec alone cannot carry multicast routing protocols.
- MPLS VRF route target
- A BGP extended community attached to VPNv4 routes; the export target on one VRF must match the import target on another for prefixes to be imported.
- GET VPN key server
- The device that authenticates group members, distributes the group policy and keys, and manages rekeying; data traffic flows directly between members without a tunnel header.
- TACACS+ versus RADIUS
- TACACS+ uses TCP 49 and encrypts the full payload with separated AAA; RADIUS uses UDP 1812/1813 and encrypts only the password field.
- DHCP snooping trusted port
- A port allowed to send DHCP server messages such as OFFER and ACK; untrusted ports may only send client messages, and replies are dropped.
- Dynamic ARP Inspection
- A feature that validates ARP packets against the DHCP snooping binding table, dropping ARP from hosts whose IP-to-MAC mapping is not in the table.
- IP Source Guard
- A port feature that permits only source IP and MAC pairs present in the DHCP snooping binding table or configured as static bindings.
- Control-plane policing
- A policy-map applied to the control-plane that rate-limits traffic destined for the route processor, protecting it from denial-of-service floods.
- uRPF strict mode
- A check that drops a packet unless the source address is reachable through the same interface it arrived on, using the reverse path in the routing table.
- 802.1X authenticator
- The switch port that relays EAPoL messages between the supplicant and the RADIUS server and blocks traffic until authentication succeeds.
- DHCP relay agent option 82
- An optional field inserted by the relay agent carrying the circuit ID and remote ID, used by the server for address assignment and by snooping features.
- NAT order of operations
- Inside-to-outside: routing, then NAT, then encryption; outside-to-inside: decryption, then NAT, then routing. This order explains many NAT and IPsec failures.
- NAT overload
- Port address translation configured with 'ip nat inside source list <acl> interface <if> overload', mapping many inside addresses to one outside address using port numbers.
- Syslog severity levels
- Eight levels from 0 emergency to 7 debug; 'logging trap <level>' sends messages at that severity and lower-numbered, more severe levels to the server.
- HSRP virtual MAC
- 0000.0c07.acXX, where XX is the group number in hexadecimal; VRRP uses 0000.5e00.01XX and enables preemption by default.
- FHRP object tracking
- 'standby <group> track <object>' decrements the priority when the tracked object goes down, allowing the standby router to preempt and become active.
- NETCONF transport
- NETCONF runs over SSH on TCP port 830, encodes data in XML per YANG models, and supports get-config, edit-config, lock, and commit operations.
- RESTCONF methods
- RESTCONF maps YANG data to HTTP verbs over HTTPS: GET reads, POST creates, PUT and PATCH update, and DELETE removes data.
- EEM applet
- An Embedded Event Manager script with an event detector (syslog, timer, interface) and actions such as CLI commands, reload, or syslog generation.