Inspect LFIB label-switched paths rather than assuming P routers must hold customer routes addresses a different situation, such as a core P router forwards labeled traffic without customer VPN IP routes. MPLS core forwarding can rely on transport labels without customer VRF awareness. In this question the relevant situation is customer router pings PE interface but its private prefixes never reach remote sites; the alternative changes another control and would not establish that local PE VRF RIB learns CE prefixes and remote VRF RIB receives corresponding routes. The specific remedy here concerns verify PE-CE address-family routing session and VRF membership of relevant interface.

Choose compatible OSPF network type and appropriate neighbor/DR design for hub-and-spoke addresses a different situation, such as a DMVPN mGRE overlay is configured with OSPF broadcast behavior and unforeseen DR election. OSPF adjacency and DR election assumptions depend on underlying multipoint reachability. In this question the relevant situation is customer router pings PE interface but its private prefixes never reach remote sites; the alternative changes another control and would not establish that local PE VRF RIB learns CE prefixes and remote VRF RIB receives corresponding routes. The specific remedy here concerns verify PE-CE address-family routing session and VRF membership of relevant interface.

Assign separate tunnel/NHRP identifiers and IPsec profiles for independent overlays addresses a different situation, such as two customer overlays share one router but must not cross-register NHRP peers. Overlay segmentation requires distinct control and crypto identifiers where services differ. In this question the relevant situation is customer router pings PE interface but its private prefixes never reach remote sites; the alternative changes another control and would not establish that local PE VRF RIB learns CE prefixes and remote VRF RIB receives corresponding routes. The specific remedy here concerns verify PE-CE address-family routing session and VRF membership of relevant interface.

Device health aggregates several operational measurements beyond a single interface state is a real technical distinction, but it supports the different operation to use Catalyst Center device health context and correlated telemetry for the affected node when assurance dashboard reports a branch device unhealthy despite interface counters appearing normal. It does not explain the selected intervention in this case, namely to correct DHCP DNS server options and renew a client lease. The controlling principle is instead that dHCP DNS option supplies resolver addresses separately from routing or IP lease.

Management traffic needs a valid two-way route in its own routing context and authorized VTY access is a real technical distinction, but it supports the different operation to test VRF-specific management route, source interface, and VTY admission instead of changing data-plane routes when a core router's SSH management interface must be accessible only from a dedicated out-of-band VRF. It does not explain the selected intervention in this case, namely to correct DHCP DNS server options and renew a client lease. The controlling principle is instead that dHCP DNS option supplies resolver addresses separately from routing or IP lease.

SNMPv3 keys can be localized to authoritative engine identifier is a real technical distinction, but it supports the different operation to reconcile local SNMPv3 engine ID, USM credentials and user localization at collector when sNMPv3 collector loses access after router replacement with a new engine identifier. It does not explain the selected intervention in this case, namely to correct DHCP DNS server options and renew a client lease. The controlling principle is instead that dHCP DNS option supplies resolver addresses separately from routing or IP lease.

Spoofed neighbor advertisements redirect IPv6 traffic toward a hostile MAC is a symptom of a different control gap that calls for enable supported IPv6 ND inspection and maintain reliable binding data. ND inspection helps detect neighbor identity spoofing using binding information. The proposed safeguard in this question instead deals with a source-based ACL near the origin blocks both intended and harmless applications; the alternative is not the most specific justification for place the standard ACL near intended destination or use an extended ACL with precise service scope.

CoPP service policy hard-drops all BGP packets and neighbors never establish is a symptom of a different control gap that calls for use supported police action with safe rate and appropriate conform/exceed behavior. A policer meters excess control-plane traffic while admitting traffic within the configured envelope. The proposed safeguard in this question instead deals with a source-based ACL near the origin blocks both intended and harmless applications; the alternative is not the most specific justification for place the standard ACL near intended destination or use an extended ACL with precise service scope.

Both central AAA servers are unreachable and no approved local break-glass account works is a symptom of a different control gap that calls for configure protected local fallback method for server-unavailable events and verify access restrictions. Resilient management authentication needs a constrained emergency path that does not weaken normal checks. The proposed safeguard in this question instead deals with a source-based ACL near the origin blocks both intended and harmless applications; the alternative is not the most specific justification for place the standard ACL near intended destination or use an extended ACL with precise service scope.

Routing protocol adjacencies and RIB updates must be scoped to the intended VRF is a real technical distinction, but it supports the different operation to enable a supported VRF-aware routing process or address family on the correct tenant interfaces when a partner VLAN should exchange OSPF routes only inside VRF PARTNER. It does not explain the selected intervention in this case, namely to configure appropriate eBGP multihop and matching update-source with reachable loopbacks. The controlling principle is instead that default eBGP neighbor reachability assumes directly connected peer unless multihop is configured.

A longer matching prefix wins over a less-specific route even if the latter protocol normally has a lower distance is a real technical distinction, but it supports the different operation to test both destinations by longest-prefix route lookup instead of changing global routing distances when a more-specific static /25 should steer only part of a subnet while a dynamic /24 covers the rest. It does not explain the selected intervention in this case, namely to configure appropriate eBGP multihop and matching update-source with reachable loopbacks. The controlling principle is instead that default eBGP neighbor reachability assumes directly connected peer unless multihop is configured.

OSPF inter-area summarization is performed by ABRs rather than ordinary internal routers is a real technical distinction, but it supports the different operation to configure OSPF inter-area range at the area border router for the area being summarized when a campus wants a group of area 10 subnets summarized toward backbone area 0. It does not explain the selected intervention in this case, namely to configure appropriate eBGP multihop and matching update-source with reachable loopbacks. The controlling principle is instead that default eBGP neighbor reachability assumes directly connected peer unless multihop is configured.

Verify supported 4-byte AS syntax and exact remote ASN on both peers addresses a different situation, such as an edge connects to a partner using a four-byte ASN not representable in old two-byte conventions. BGP four-octet AS support allows larger AS numbers with proper capability negotiation. In this question the relevant situation is the route exists in BGP and OSPF databases but the installed next hop appears to ignore local BGP preference; the alternative changes another control and would not establish that bGP best-path markers and the final RIB entry explain the differing decisions. The specific remedy here concerns check best candidate validity and administrative distance for the identical prefix in the routing table.

Select E1 external metric type where internal cost to ASBR must influence path selection addresses a different situation, such as remote sites should account for internal cost when selecting between two OSPF ASBRs. OSPF E1 total cost includes internal path cost while E2 normally compares external cost first. In this question the relevant situation is the route exists in BGP and OSPF databases but the installed next hop appears to ignore local BGP preference; the alternative changes another control and would not establish that bGP best-path markers and the final RIB entry explain the differing decisions. The specific remedy here concerns check best candidate validity and administrative distance for the identical prefix in the routing table.

Set appropriate ABR no-summary totally-stubby behavior with consistent stub configuration addresses a different situation, such as a small area should minimize both inter-area summaries and external routes. Totally stubby configuration suppresses most Type-3 summaries in addition to external LSAs. In this question the relevant situation is the route exists in BGP and OSPF databases but the installed next hop appears to ignore local BGP preference; the alternative changes another control and would not establish that bGP best-path markers and the final RIB entry explain the differing decisions. The specific remedy here concerns check best candidate validity and administrative distance for the identical prefix in the routing table.

Separate routing-protocol control traffic into classes with sufficient protected rate limits addresses a different situation, such as internet edge faces a flood of packets addressed to its CPU but must keep BGP alive. CoPP classifies punted control traffic and protects route processor without indiscriminate blocking. In this question the relevant situation is a switch-facing router receives packets claiming a source subnet reachable only via WAN; the alternative changes another control and would not establish that forged WAN-source access packets are dropped without blocking true access-client sources. The specific remedy here concerns use source validation at access ingress based on legitimate return path topology.

Enable supported IPv6 ND inspection and maintain reliable binding data addresses a different situation, such as access switch needs to validate neighbor advertisements against trusted device bindings. ND inspection helps detect neighbor identity spoofing using binding information. In this question the relevant situation is a switch-facing router receives packets claiming a source subnet reachable only via WAN; the alternative changes another control and would not establish that forged WAN-source access packets are dropped without blocking true access-client sources. The specific remedy here concerns use source validation at access ingress based on legitimate return path topology.

Use supported police action with safe rate and appropriate conform/exceed behavior addresses a different situation, such as security design wants to rate-limit permitted routing hellos rather than drop every packet. A policer meters excess control-plane traffic while admitting traffic within the configured envelope. In this question the relevant situation is a switch-facing router receives packets claiming a source subnet reachable only via WAN; the alternative changes another control and would not establish that forged WAN-source access packets are dropped without blocking true access-client sources. The specific remedy here concerns use source validation at access ingress based on legitimate return path topology.

Trace the external route source metric-type tag and route-map before changing intra-domain link cost addresses a different situation, such as two redistributors both inject a prefix but their external route selection is unexplained. External route attributes are introduced at redistribution and can differ from internal link metrics. In this question the relevant situation is a single edge router should prefer a backup peer locally without changing other AS routers; the alternative changes another control and would not establish that multiple iBGP routers select the intended egress consistent with local preference. The specific remedy here concerns set local preference for AS-wide exit preference rather than relying only on Cisco-local weight.

Validate a virtual link through a suitable nonstub transit area and both ABR router IDs addresses a different situation, such as a nonbackbone area has no direct adjacency to area 0 and needs an interim compliant backbone connection. An OSPF virtual link logically extends the backbone through a valid transit area. In this question the relevant situation is a single edge router should prefer a backup peer locally without changing other AS routers; the alternative changes another control and would not establish that multiple iBGP routers select the intended egress consistent with local preference. The specific remedy here concerns set local preference for AS-wide exit preference rather than relying only on Cisco-local weight.

Correct prefix-list ge/le range semantics and test representative boundary prefixes addresses a different situation, such as advertising aggregates requires allowing /16 through /24 descendants while excluding /25 and longer specifics. Prefix-list length qualifiers constrain prefix-length ranges relative to the listed network. In this question the relevant situation is a single edge router should prefer a backup peer locally without changing other AS routers; the alternative changes another control and would not establish that multiple iBGP routers select the intended egress consistent with local preference. The specific remedy here concerns set local preference for AS-wide exit preference rather than relying only on Cisco-local weight.

Dynamic multipoint registration must track actual public transport identity is a real technical distinction, but it supports the different operation to update tunnel source and ensure NHRP advertises the new valid NBMA mapping when a spoke migrates from wired ISP to LTE with a new public source interface. It does not explain the selected intervention in this case, namely to evaluate IGP-LDP synchronization or equivalent convergence safeguard. The controlling principle is instead that labeled traffic can fail when IP routing converges before LDP transport label readiness.

OSPF adjacency and DR election assumptions depend on underlying multipoint reachability is a real technical distinction, but it supports the different operation to choose compatible OSPF network type and appropriate neighbor/DR design for hub-and-spoke when a DMVPN mGRE overlay is configured with OSPF broadcast behavior and unforeseen DR election. It does not explain the selected intervention in this case, namely to evaluate IGP-LDP synchronization or equivalent convergence safeguard. The controlling principle is instead that labeled traffic can fail when IP routing converges before LDP transport label readiness.

Dynamic routing next-hop handling affects whether a spoke can resolve a remote NBMA address is a real technical distinction, but it supports the different operation to verify protocol next-hop preservation or redirection settings appropriate to deployed DMVPN phase when spoke routes learned across hub use hub next-hop, preventing expected direct shortcut. It does not explain the selected intervention in this case, namely to evaluate IGP-LDP synchronization or equivalent convergence safeguard. The controlling principle is instead that labeled traffic can fail when IP routing converges before LDP transport label readiness.

An abandoned SSH VTY session persists indefinitely and consumes all available login lines is a symptom of a different control gap that calls for configure appropriate VTY exec-timeout and verify graceful session cleanup. Idle session controls reduce unauthorized reuse and resource exhaustion in management plane. The proposed safeguard in this question instead deals with router debug output lacks reliable timestamps and cannot be aligned with remote events; the alternative is not the most specific justification for enable suitable log/debug timestamps and synchronize NTP before reproduction.

Router has an IP SLA object but its ICMP probe never runs because schedule not enabled is a symptom of a different control gap that calls for configure probe parameters and schedule the IP SLA operation. IP SLA operations require configuration and scheduling to generate live measurements. The proposed safeguard in this question instead deals with router debug output lacks reliable timestamps and cannot be aligned with remote events; the alternative is not the most specific justification for enable suitable log/debug timestamps and synchronize NTP before reproduction.

IP SLA counts every latency spike as a total timeout because thresholds were confused is a symptom of a different control gap that calls for set a realistic latency threshold separately from operation timeout. IP SLA threshold can flag degraded performance even when responses arrive before timeout. The proposed safeguard in this question instead deals with router debug output lacks reliable timestamps and cannot be aligned with remote events; the alternative is not the most specific justification for enable suitable log/debug timestamps and synchronize NTP before reproduction.

Correct ACL/class-map identification for OSPF protocol traffic to CPU addresses a different situation, such as oSPF sessions drop when new CoPP ACL treats protocol 89 as ordinary untrusted UDP/TCP. OSPF is IP protocol 89 and must be classified accurately in control plane policy. In this question the relevant situation is user authenticates via TACACS+ and still receives privileged EXEC commands outside assigned role; the alternative changes another control and would not establish that tACACS authorization logs permit show commands and deny forbidden configuration operations. The specific remedy here concerns configure and test per-command or exec authorization in the intended AAA policy.

Place the standard ACL near intended destination or use an extended ACL with precise service scope addresses a different situation, such as a legacy standard ACL filters only source IP and must not block another destination inadvertently. Standard ACL cannot match destination or transport protocol and placement affects collateral impact. In this question the relevant situation is user authenticates via TACACS+ and still receives privileged EXEC commands outside assigned role; the alternative changes another control and would not establish that tACACS authorization logs permit show commands and deny forbidden configuration operations. The specific remedy here concerns configure and test per-command or exec authorization in the intended AAA policy.

Scope authorization to approved identity/prefix and avoid assuming stable host privacy addresses addresses a different situation, such as an ACL permits one temporary IPv6 address of a staff host but breaks after SLAAC privacy address rotation. IPv6 temporary addresses can rotate independently of the network prefix. In this question the relevant situation is user authenticates via TACACS+ and still receives privileged EXEC commands outside assigned role; the alternative changes another control and would not establish that tACACS authorization logs permit show commands and deny forbidden configuration operations. The specific remedy here concerns configure and test per-command or exec authorization in the intended AAA policy.

Operators can still connect to VTY through Telnet after installing SSH keys is a symptom of a different control gap that calls for set VTY transport input ssh and confirm required SSH authentication prerequisites. VTY transport commands control which remote session protocols can enter management lines. The proposed safeguard in this question instead deals with discover packets reach server but OFFERs stop once every address is allocated; the alternative is not the most specific justification for check active leases, exclusions, mask and pool capacity before altering routing.

SSH clients receive negotiation failure although TCP 22 reaches router is a symptom of a different control gap that calls for configure supported hostname/domain and cryptographic SSH key with approved SSH version. SSH server requires usable cryptographic host keys and compatible protocol negotiation. The proposed safeguard in this question instead deals with discover packets reach server but OFFERs stop once every address is allocated; the alternative is not the most specific justification for check active leases, exclusions, mask and pool capacity before altering routing.

IP SLA runs only once because a finite start time/duration was configured inadvertently is a symptom of a different control gap that calls for verify operation frequency and lifetime schedule for continuing monitoring. IP SLA scheduling controls when and for how long measurements occur. The proposed safeguard in this question instead deals with discover packets reach server but OFFERs stop once every address is allocated; the alternative is not the most specific justification for check active leases, exclusions, mask and pool capacity before altering routing.