300-420 Exam Dumps - Designing Cisco Enterprise Networks (ENSLD) v1.1

Stateful NAT64 is the correct translation solution when IPv6-only corporate hosts need Internet connectivity to IPv4 resources using a limited IPv4 address pool. NAT64 translates IPv6 client addresses to IPv4 addresses and maintains state for each session, allowing many IPv6 hosts to share a smaller set of IPv4 addresses through port multiplexing. The design is restricted to the 172.16.168.0/22 subnet, which provides an IPv4 pool that can be used for stateful translation. Stateless NAT64 requires algorithmic one-to-one address mapping and normally needs enough IPv4 address space to represent IPv6 hosts deterministically; it is not suitable when many clients must share a restricted IPv4 block. NAT66 translates IPv6 to IPv6 and does not provide access to IPv4 Internet resources. In a production design, stateful NAT64 is often paired with DNS64 so IPv6-only clients can resolve IPv4-only destinations through synthesized AAAA records. Reference topics: stateful NAT64, DNS64, IPv6-to-IPv4 translation, address conservation, Internet access migration.

The branch router should advertise the local LAN with the EIGRP network command and make the LAN-facing interface passive. A passive interface allows the connected network to be included in EIGRP advertisements while suppressing EIGRP hello packets and neighbor formation on that interface. This is exactly what the engineer needs: remote EIGRP neighbors learn the LAN subnet, but unnecessary multicast EIGRP messages are not sent onto the user LAN where no EIGRP neighbors should exist. Replacing EIGRP with a static default route would not meet the requirement to advertise the local LAN through EIGRP. Redistributing connected routes can work, but it is less clean for a simple LAN interface and can introduce external-route behavior or policy complexity. Advertising the subnet as a stub network does not suppress multicast hellos on the LAN interface by itself. Cisco design best practice is to use passive interfaces on LAN-facing interfaces that should be advertised but should not form routing adjacencies. Reference topics: EIGRP passive interface, network statements, branch routing, unnecessary neighbor prevention, multicast control traffic.

OSPF requires all nonbackbone areas to connect logically to Area 0. In the original design, HQ is Area 0 and the existing branch is Area 1, which is valid because Area 1 has connectivity to the backbone. The newly acquired branch is assigned Area 2 but is temporarily connected through the existing branch instead of directly to HQ. That means Area 2 does not have a direct logical connection to Area 0, violating the OSPF backbone requirement. The proper OSPF design mechanism for this temporary topology is a virtual link. An OSPF virtual link is configured through a transit area to logically connect a disconnected area or ABR back to the backbone. Making the existing branch a stub area does not solve the lack of Area 0 connectivity. A sham link is used in MPLS VPN OSPF designs to prefer backdoor links or preserve intra-area behavior across the provider core, not for this generic backbone disconnection. Making Area 2 a stub area also does not establish backbone reachability. Therefore, a virtual link between the new branch and HQ is required.

Affinity is the Cisco SD-WAN feature used to minimize TLOC and control connections and reduce strain on vSmart controllers. Cisco documentation explains that establishing affinity between controllers and edge devices allows the operator to control overlay scaling by limiting which controllers an edge device can establish control connections with. In large deployments, unrestricted connections between every WAN Edge and every controller can create unnecessary state and operational load. Affinity lets the design distribute edge connections across controllers and data centers while still preserving redundancy through primary and backup controller relationships. Color identifies the transport type or behavior associated with a TLOC, but it does not reduce controller connection scale by itself. Control-direction and control-connections are not the feature names that provide the scaling function described in the question. A well-designed SD-WAN control plane uses affinity, controller groups, and redundancy planning to keep the overlay scalable and predictable. Reference topics: Cisco SD-WAN affinity, vSmart controller scale, TLOC connections, control-plane redundancy, overlay scaling.

GRE over IPsec is required when the backup connection is an Internet circuit, encryption is mandatory, and multicast applications must cross the tunnel. GRE provides the logical tunnel interface and can encapsulate multicast traffic and routing protocol packets. IPsec then encrypts the GRE packets across the public Internet, satisfying the security requirement. This combination is widely used in enterprise WAN designs where dynamic routing, multicast video, or other non-unicast traffic must be transported securely between sites. Direct IPsec encapsulation protects unicast IP traffic, but it does not natively provide a multicast-capable tunnel interface for routing and multicast services. GETVPN is designed for private WAN environments where the provider network can carry the routed addresses and where tunnel-less group encryption is desired; it is not the usual choice for Internet backup. DMVPN could also use GRE and IPsec, but for a simple backup connection between two sites, GRE over IPsec is the direct answer. Reference topics: GRE tunneling, IPsec encryption, multicast over VPN, Internet backup WAN design.

Redistributing OSPF process 1 into process 2 on both R1 and R4 provides the required backup routing behavior between the management network and the target routers. The design requirements are failure driven: if R1 fails, NMS traffic must use R4, and if the link between R5 and R6 fails, traffic to 10.6.6.6 must still route through R4. When separate OSPF processes or domains exist, controlled redistribution at both exit points allows reachability to be maintained through either redistribution point. Advertising a single address into OSPF with high cost on R1 does not solve both failure cases. Static routes with IP SLA on R2 and R3 would be more manual and less aligned with the dynamic OSPF design. Default-information originate would provide a default path but would not accurately advertise the specific internal reachability required for the NMS destinations. The redistribution design must also include route filtering or tagging in production to prevent feedback loops. Reference topics: OSPF redistribution, redundant redistribution points, management reachability, route control, failure-path design.

Wake-on-LAN across routed boundaries requires directed broadcast handling toward the client subnet and helper behavior to forward the magic packet correctly. A sleeping host normally does not maintain a normal IP session, so the WoL magic packet is commonly sent as a directed broadcast to the destination subnet. Cisco designs therefore enable IP directed broadcast on the routed interface or SVI for the client subnet where the sleeping endpoints reside, while controlling the feature carefully to avoid abuse. The ip forward-protocol behavior is also relevant because routers must forward the required UDP broadcast traffic rather than dropping it at the Layer 3 boundary. In addition, an IP helper address toward the WoL server or relay path may be needed on client-facing interfaces so the magic packet can be delivered from the management or server subnet to the client subnet. PortFast helps endpoints become reachable quickly at Layer 2, but it does not replace routed broadcast forwarding. Reference topics: Wake-on-LAN, directed broadcast, ip helper-address, UDP forwarding, PortFast, campus services.

The ORF filter should be applied so the route reflector or upstream peer suppresses the unwanted Branch A prefix before sending updates toward the resource-constrained branch. Cisco BGP outbound route filtering lets a receiving router advertise a prefix-list filter to its peer, causing that peer to apply the filter outbound. This is useful when a router has limited CPU or memory because unwanted prefixes are never sent across the session. In the described design, HQ must prevent Branch A prefixes from reaching R4, while Branch B has limited resources. The answer using the 10.10.10.0/24 prefix list on R2 aligns with filtering the Branch A prefix at the point where HQ can control route reflection or advertisement toward the constrained branch path. Applying the filter on the wrong router or using the wrong prefix would still allow unnecessary updates. ORF is preferred over simple inbound filtering when the goal is to reduce received route volume. Reference topics: BGP ORF, prefix-list signaling, route-reflector filtering, branch route scale, outbound update suppression.