Cisco 300-410: Advanced IPv4 and IPv6 Addressing — Study Guide

By Laurynas Brazys · 16 August 2026 · #cisco #300-410 #certification #exam-prep #study-guide

Part of the Cisco CCNP Enterprise 300-410 ENARSI — Study Guide. Practice with verified answers in the Cisco exam hub, or take timed practice tests on ExamRoll.io.

Overview

Advanced IPv4 and IPv6 addressing underpins stable routing, predictable forwarding, scalable aggregation, and secure first-hop behavior. This section explains how prefixes are selected, how addressing plans scale through summarization, how IPv6 addressing and Neighbor Discovery operate, what to consider for dual-stack and migration, and how to verify forwarding. It also highlights common failure modes and trade-offs so that design and operations can converge on reliable outcomes.

IPv4 route selection and scalable address planning

• Longest prefix match (LPM): Routers always prefer the most specific route. A /32 host route overrides a /24, which overrides a /16, irrespective of protocol. Design implication: ensure specific routes exist where traffic engineering demands precision; otherwise, summarization may hide reachability changes and cause suboptimal paths or black holes.
• Administrative distance (AD): When multiple sources provide the same prefix length, the route with the lowest AD wins (for example, connected < static < eBGP < IGP < iBGP by default). Design with intent:
  • Use floating statics (higher AD) as controlled fallbacks behind a primary dynamic route.
  • Avoid unintended overrides; a low-AD static can silently suppress an IGP-learned path.
• Static route design:
  • Next-hop vs outbound interface: ip route 192.0.2.0 255.255.255.0 198.51.100.1 performs recursive resolution and is resilient to L2 changes. ip route 192.0.2.0 255.255.255.0 GigabitEthernet0/0 may trigger per-packet ARP on multiaccess segments and can misforward if multiple next-hops exist.
  • Link failures: Track interface or IP SLA objects to withdraw static defaults during upstream outages.
  • Summarization protection: Install a discard route to null0 matching the summary to prevent loops when specifics are missing.
    • Example: ip route 10.16.0.0 255.255.0.0 Null0 250
• Variable-length subnet masks (VLSM): Allocate subnets sized to need. Benefits include higher utilization and fewer prefixes if coupled with hierarchy. Risks include fragmentation that impedes summarization.
• Route summarization:
  • Summarize at distribution or core boundaries to constrain failure domains and shrink control-plane state.
  • Boundaries must align on binary (nibble) boundaries to maintain aggregation as the network grows.
  • Trade-off: Summaries can hide more-specific withdrawals, leading to black holes. Counter via:
    • Leak critical specifics (e.g., for traffic-engineering) and monitor reachability.
    • Use accurate longest-match exceptions or conditional advertisement tied to reachability probes.
• Address-plan scalability and overlap:
  • Hierarchical allocation: reserve blocks per site/region/role. Prevent secondary and ad hoc addressing that breaks summarization.
  • Avoid overlap by maintaining a single source of truth for allocations and pre-reserving growth within each block.
  • DMZ/Guest/Services separation simplifies policy and reduces blast radius.

IPv6 address types and plan design

• Link-local (FE80::/10): Auto-configured, mandatory on every interface, used for ND and routing next-hops on a link. Not routable; may be the only functional address for underlay adjacencies. Operational note: When using a link-local next-hop in static routes, you must specify the outbound interface.
• Global unicast (2000::/3): Routable on the Internet; allocate hierarchically (for example, /48 per site, /64 per LAN). Favor nibble-aligned boundaries (/48, /56, /60, /64) to simplify ACLs and summarization.
• Multicast (FF00::/8): Used by ND (solicited-node multicast), routing protocols, and services. Ensure MLD and control-plane policing account for these groups in dense L2 domains.
• Anycast: Same address configured on multiple nodes; traffic is delivered to the nearest instance by routing. Commonly used for first-hop gateways and recursive DNS. Failure mode: Operationally indistinguishable from unicast—document locations and monitor reachability or you may troubleshoot the wrong node.
• Unique local (FC00::/7): Non-Internet-routable, internally unique. Useful for internal services and as stable identifiers when you expect provider renumbering. Use NPTv6 only if you must preserve host addressing across provider changes; understand that NPTv6 preserves prefix length but not end-to-end address transparency.
• Interface identifiers: Prefer stable, random IID methods (RFC 7217) over EUI-64 to reduce privacy exposure. For servers and infrastructure, use numbered IIDs to simplify OAM and ACLs.

IPv6 Neighbor Discovery, ICMPv6, and autoconfiguration

• ICMPv6 is control-plane critical:
  • Router Solicitation (RS) and Router Advertisement (RA) drive default gateway learning and on-link determination.
  • Neighbor Solicitation (NS) and Neighbor Advertisement (NA) replace ARP; reachability and DAD depend on them.
  • Redirects provide first-hop path optimization; consider disabling in secure segments.
• Duplicate Address Detection (DAD): Runs before an address becomes valid. Failure mode: VMs or misbehaving hosts may NAK valid addresses; log DAD failures and quarantine offenders via port-security or ND inspection.
• SLAAC vs DHCPv6:
  • SLAAC: Hosts form addresses from RAs; default gateway comes from RA. Advantages: no server dependency, simple ops. Limitations: limited central control; host DNS options require RA RDNSS or DHCPv6.
  • Stateless DHCPv6: Supplements SLAAC with parameters (DNS, domain), not addresses. RA flags: O=1, M=0.
  • Stateful DHCPv6: Server assigns addresses and options. RA flags: M=1 (O may be 0 or 1). Use where audit and reservations are required (servers, regulated devices).
• Relay-agent design:
  • Place DHCPv6 servers centrally; deploy relay on L3 gateways with ipv6 dhcp relay destination [interface].
  • Ensure relays follow the shortest path to servers and that infrastructure ACLs permit UDP 546/547 and ICMPv6.
  • Failure modes: Asymmetric routing prevents Reply from reaching relay; overlapping prefixes or RA storms cause address churn; ensure only intended routers emit RAs on access segments by controlling device roles.

IPv6 routing, first-hop security, dual-stack, and troubleshooting

• IPv6 static routes:
  • Default: ipv6 route ::/0 GigabitEthernet0/0 fe80::1 (link-local next-hop requires interface).
  • Recursive next-hop with global unicast: ipv6 route 2001:db8:10::/48 2001:db8:ffff::1
  • Track upstream reachability with object tracking to withdraw defaults when the provider path fails.
• Source-specific routing:
  • Classic RIBs are destination-based; implement source-aware forwarding with IPv6 PBR or VRF selection.
  • Example (IPv6 PBR):
    • ipv6 access-list SRC-SITEA permit ipv6 host 2001:db8:100::/64 any
    • route-map V6-SADR permit 10 match ipv6 address SRC-SITEA set ipv6 next-hop 2001:db8:1::1
    • interface GigabitEthernet0/1 ipv6 policy route-map V6-SADR
  • Note: Policy-based routing changes forwarding without altering the routing table. Carefully test failure handling; some set default next-hop variants forward even if the next-hop is unresolved.
• Dual-stack, translation, and migration trade-offs:
  • Dual-stack: Runs IPv4 and IPv6 natively. Pros: protocol parity, minimal translation complexity. Cons: doubles control-plane scale; security policies must cover both families.
  • Translation: NAT64/DNS64 enables IPv6-only clients to reach IPv4 servers. Pros: accelerates IPv6-only access layers. Cons: breaks literal IPv4, can impact applications using IP literals or ALGs.
  • Tunneling: Good for limited domains or when underlay lacks IPv6. Pros: rapid enablement. Cons: MTU/PMTUD complexity, operational opacity, additional encapsulation overhead.
  • Migration guidance: Prefer dual-stack in the core and distribution; consider IPv6-only access with NAT64 for new greenfield segments.
• IPv6 first-hop security:
  • RA Guard: Blocks unauthorized RAs on access ports; trust only uplinks to legitimate routers. Ensure the platform supports RA Guard with extension-header awareness to avoid bypass.
  • DHCPv6 Guard: Blocks server messages on untrusted ports; trust only uplinks to legitimate DHCPv6 servers or relays.
  • ND inspection: Learns and secures bindings for SLAAC and DHCPv6 addresses, helping prevent ND spoofing and neighbor cache exhaustion. Coordinate with port-security to avoid false positives during host churn.
• Addressing verification and route lookup troubleshooting:
  • Validate interface addressing and ND:
    • show ipv6 interface brief
    • show ipv6 neighbors
  • Verify RIB/FIB by VRF:
    • show ip route vrf NAME
    • show ipv6 route vrf NAME
    • show ip cef exact-route SRCIP DSTIP
    • show ipv6 cef exact-route SRCv6 DSTv6
  • Confirm RA/DHCPv6 state:
    • show ipv6 routers
    • show ipv6 dhcp interface
  • Packet tests with explicit source address:
    • ping ipv6 DESTINATION source INTERFACE
  • Common pitfalls:
    • Longest prefix overrides unexpected summaries; check for leaked /32 or /128 routes.
    • Static routes pointing to a down interface remain until tracking removes them.
    • In IPv6, failing to specify an interface with a link-local next-hop results in an unresolved route.
    • Misplaced RA Guard/DHCPv6 Guard policies can block legitimate control messages; mark infrastructure ports as trusted.

Practical Problem Scenario

Contoso Manufacturing is rolling out IPv6 across two campuses while maintaining IPv4 services. They require scalable addressing, secure first-hop behavior, dual uplinks per campus, and policy to steer traffic sourced from specific VLANs to preferred ISPs.

1. Allocate hierarchical IPv6 blocks

• Assign 2001:db8:100::/48 to Campus A and 2001:db8:200::/48 to Campus B. Subdivide each /48 into /56 per building and /64 per VLAN.
• Rationale: Nibble-aligned boundaries enable clean summarization at distribution and campus cores, simplifying ACLs and route advertisements.

2. Deploy dual-stack in the core and distribution

• Keep IPv4 and IPv6 on routed links; OSPFv3 for IPv6 and OSPFv2 for IPv4, advertising /48 summaries between campuses.
• Rationale: Native forwarding avoids tunnel overhead and eases troubleshooting while allowing gradual IPv6 enablement at the edge.

3. Use SLAAC with stateless DHCPv6 for user VLANs; stateful DHCPv6 for servers

• Enable RAs with O=1, M=0 on user VLAN SVI; run DHCPv6 for DNS and domain options. Use M=1 on server VLANs to assign addresses centrally with reservations.
• Rationale: Users need agility with minimal ops overhead; servers need deterministic addressing and auditability.

4. Secure the first hop

• Apply RA Guard and DHCPv6 Guard to all access ports; trust only uplinks to distribution switches. Enable ND inspection on access VLANs.
• Rationale: Blocks rogue RAs and DHCPv6 servers that can hijack default gateways or poison neighbor caches; ND inspection builds legitimate bindings for enforcement.

5. Configure resilient IPv6 default routing with link-local next-hops

• On each campus core, install two tracked defaults:
  • ipv6 route ::/0 GigabitEthernet0/0 fe80::ISP1 track 10
  • ipv6 route ::/0 GigabitEthernet0/1 fe80::ISP2 5
• Rationale: Link-local next-hops require interface specification and remain stable across provider renumbers. Tracking ensures rapid failover to the secondary with a slightly higher administrative distance or metric.

6. Implement source-specific egress steering using IPv6 PBR

• On user VLANs in Building A1, steer traffic to ISP1; in Building A2, steer to ISP2:
  • route-map V6-STEER-A1 permit 10 match ipv6 address prefix-list A1-SOURCES set ipv6 next-hop 2001:db8:ISP1::1
  • route-map V6-STEER-A2 permit 10 match ipv6 address prefix-list A2-SOURCES set ipv6 next-hop 2001:db8:ISP2::1
  • Apply policies to the corresponding SVI interfaces.
• Rationale: Standard RIBs make destination-based decisions; PBR selectively overrides forwarding without changing the global routing table. This achieves SADR-like outcomes for specific source blocks.

7. Summarize and protect with discard routes

• Advertise 2001:db8:100::/48 from Campus A and install ipv6 route 2001:db8:100::/48 Null0 250.
• Rationale: Summaries reduce control-plane churn; the discard route prevents loops if a more-specific is withdrawn unexpectedly.

8. Verification and ongoing operations

• Confirm RA and DHCPv6 behavior:
  • show ipv6 routers
  • show ipv6 dhcp interface
• Validate neighbor tables and bindings:
  • show ipv6 neighbors
  • ND inspection show commands per platform
• Test steering and reachability:
  • ping ipv6 2001:db8:: target with source set to A1 and A2 VLAN SVIs
  • show ipv6 cef exact-route SRCv6 DSTv6 to verify PBR decisions
• Rationale: Explicit-source testing proves default gateway learning and PBR path selection, while CEF lookups confirm the actual forwarding path at line rate. Continuous monitoring detects RA/DHCP anomalies early.

All domains · OSPF Design →

Practice these questions → · Timed practice on ExamRoll.io →