Interview Questions for CCNP level Interview.

cyberjunkie

Hi,

Please share your interview experience and questions you faced recently(Cisco).

After 2 years I am looking for a change so It will be very helpful if I can get a idea of what kind of questions I expect. It will help me in my interview preparation .

down77

It varies from company to company but here are a set of was asked to candidates applying for an open Network Engineer II position:

1. You have two links between R1 and R2. One link connects over frame relay via OSPF Area 0. The other link is a dedicated PPP link that rides over area 45. The PPP link will primarily be the backup of the Frame Relay circuit between R1 and R2. How would you configure this network to keep OSPF operational over the PPP link when the Frame Relay circuit is down?


2. A client has asked for your expertise in building a new network. They have chosen to use EIGRP since it provides more granularities in its metric calculation. In order to get the maximum benefit of EIGRP a CCNP that works for the client suggests using Bandwidth, Delay and Load metrics within the IGP. As the Consultant, you want to ensure that bandwidth is always the major factor in metric calculation. How would you configure EIGRP to ensure that all three metrics are used and bandwidth is three times more significant than delay or load?

3. You have arrived at Company "X" to provide top-notch network consulting on an issue they currently have. Company "X" has 3 separate satellite sites, all of which need eBGP connectivity. Since Company "X" owns BGP as <#> you don’t want to apply for 3 additional AS numbers so you decide to use local AS numbers of 65001 64512 and 65010. All AS’s will connect back to AS <#> before entering the public BGP cloud. What would your solution be to prevent the locally significant AS numbers from leaking out into the rest of the BGP cloud?

AlexMR

I dont know the answers to 2 and 3. I am checking now, but I am sure the question 2 cant be answer with the material of the official course for the CCNP or the official self study guide. I know I read something about that but it was on Routing TCP/IP I think.

Could question 2 be more like CCIE level questions? Or at least beyond the CCNP level?

keenon

Be ready to look at a config output, a network diagram and to do some basic troubleshooting. I have drawn out complete networks and explained whys and hows of it.

Just depends some just want to know if they just like you and not what you know

networker050184

Question 2 is a CCNP level question. Think K values. Question 3 would seem to be a little more above the CCNP level. I can't remember if the BGP coverage went into those details, but its a fairly simple configuration.

AlexMR

networker050184 wrote: »

Question 2 is a CCNP level question. Think K values. Question 3 would seem to be a little more above the CCNP level. I can't remember if the BGP coverage went into those details, but its a fairly simple configuration.

I know it's K values, but I really dont know how I could make the router prefer bandwidth...oh wait, I might have gone thinking about it the wrong way. I am thinking about the actual speed of the link, not the one you configure...if that's what he wants...well thinking about it, it's the only possibility because you simply cant channge the formula, can you? .

networker050184

AlexMR wrote: »

I know it's K values, but I really dont know how I could make the router prefer bandwidth...oh wait, I might have gone thinking about it the wrong way. I am thinking about the actual speed of the link, not the one you configure...if that's what he wants...well thinking about it, it's the only possibility because you simply cant channge the formula, can you? .

You can change the weight of the values.

Cisco IOS IP Routing: EIGRP Command Reference - I through R [Support] - Cisco Systems

Forsaken_GA

Question 3 is basically asking you if you know what a confederation is when it comes to BGP. It's not really a CCNP question, but it's a perfectly reasonable CCIP question, so still at the professional level

Edit: Or if it's not setup as a confederation, I suppose you could just use the remove-private-as neighbor command on the router(s) that is/are configured with the public AS # in it's neighbor statements to it's public EBGP peers. I don't see why you would use private AS numbers for satellite sites though. Since all of these satellite sites would have to be back hauled over a private circuit to reach the public AS router before they could communicate to the public internet though, I'd just have them run the public AS number and use iBGP connections instead of EBGP

Edit #2: Actually, I guess that would depend on the number of routers involved. If it's a large network, the satellite sites running ebgp back into the central site to avoid a large number of iBGP sessions makes sense, though I think I'd rather deploy a route reflector than use private as numbers

chrisone

You definetly want to brush up on IPSEC tunnels, EIGRP, OSPF, Port Security, HSRP, MPLS, Some BGP.

I dont think BGP will be heavily drilled but to be honest with you it all depends on the Job Description, at the place where i am when i saw the job add i noticed eigrp, ospf, IPSEC tunnels, were a main concern to them. SO i brushed up on those specific and in the interview they asked me the stages of an IPSEC tunnel and some EIGRP questions. I had 3 interviews with them before i landed the job. They liked that i had a lot of experience implementing MPLS and some level of security. Just pay attention to the job description in the Ad and be on top of everything they list out, that will be your best bet.

mattsthe2

For the BGP question i agree that confederations is the way to go, although couldn't you get that working with Route Reflectors also?

Or is RR only local relevant within the local AS?

Paul Boz

God I would completely fail a Cisco technical interview now.

mattsthe2

Paul Boz wrote: »

God I would completely fail a Cisco technical interview now.

Ha ha know the feeling Paul.
Theres nothing like being put on the spot to give you warm fuzzy feelings (not).

I'm curious to the answers to the questions though.

b1tbuck3t

cyberjunkie wrote: »

Hi,

Please share your interview experience and questions you faced recently(Cisco).

After 2 years I am looking for a change so It will be very helpful if I can get a idea of what kind of questions I expect. It will help me in my interview preparation .

I like to ask questions that do not come from certification exams but indicate experience.

One of my favorite Enterprise experience questions is "You have two routers configured as HSRP neighbors, both are showing as Active. What does this mean and how would you troubleshoot it.

Easy question for anyone that has had to support/troubleshoot HSRP in an enterprise enviroment.

mattsthe2

b1tbuck3t wrote: »

I like to ask questions that do not come from certification exams but indicate experience.

One of my favorite Enterprise experience questions is "You have two routers configured as HSRP neighbors, both are showing as Active. What does this mean and how would you troubleshoot it.

Easy question for anyone that has had to support/troubleshoot HSRP in an enterprise enviroment.

Hmm i dont see that even being possible, unless the state changes are occurring frequently, making it look like they both are active. Assuming the configuration is correct this must be a layer 2 issue, id check the STP topology for the VLAN that the hsrp segment resides.

unless this is a trick question and its active for two different segments, HSRP load balancing. You know half the hosts peer to group 1 and the other half peer to group 2.

This posts sucks, lol.

b1tbuck3t

mattsthe2 wrote: »

Hmm i dont see that even being possible, unless the state changes are occurring frequently, making it look like they both are active. Assuming the configuration is correct this must be a layer 2 issue, id check the STP topology for the VLAN that the hsrp segment resides.

unless this is a trick question and its active for two different segments, HSRP load balancing. You know half the hosts peer to group 1 and the other half peer to group 2.

This posts sucks, lol.

You are mostly correct. It indicates a layer 2 (or layer 1 if the cable between the switches was unplugged) issue. The layer 2 keepalives are not making it between the neighbors therefore both neighbors think they are active.

I would then follow up with another simple question of how you would troubleshoot the layer 2 issue.

It's great to see people dig their own hole if they don't know what they are doing. For people that do have experience we quickly move on to other things. The whole point is to not ask a trick technical question but something that demonstrates experience and understanding.

Btw. I wouldn't ask about HSRP unless it is part of the job description or on the person's resume.

My second favorite thing is when someone who has only worked in small enviroments but has BGP (and every other protocol) on their resume.

In that case I would probably ask "You have a working BGP connection and you just added a new network statement to advertise a new netowrk prefix. What is the next thing you would do?" (This one is closer to textbook and only would expect a CCNP level person to be able to answer if they had the experience and BGP was on their resume)

Forsaken_GA

b1tbuck3t wrote: »

In that case I would probably ask "You have a working BGP connection and you just added a new network statement to advertise a new netowrk prefix. What is the next thing you would do?" (This one is closer to textbook and only would expect a CCNP level person to be able to answer if they had the experience and BGP was on their resume)

Check the looking glass of my peers to make sure it's propagating with the attributes I wanted set (ie, path prepended, med's, communitys, etc)

b1tbuck3t

Forsaken_GA wrote: »

Check the looking glass of my peers to make sure it's propagating with the attributes I wanted set (ie, path prepended, med's, communitys, etc)

ok. You check that but the network is not being propagated to the EBGP neighbor.

mattsthe2

b1tbuck3t wrote: »

You are mostly correct. It indicates a layer 2 (or layer 1 if the cable between the switches was unplugged) issue. The layer 2 keepalives are not making it between the neighbors therefore both neighbors think they are active.

I would then follow up with another simple question of how you would troubleshoot the layer 2 issue.

It's great to see people dig their own hole if they don't know what they are doing. For people that do have experience we quickly move on to other things. The whole point is to not ask a trick technical question but something that demonstrates experience and understanding.

Btw. I wouldn't ask about HSRP unless it is part of the job description or on the person's resume.

My second favorite thing is when someone who has only worked in small enviroments but has BGP (and every other protocol) on their resume.

In that case I would probably ask "You have a working BGP connection and you just added a new network statement to advertise a new netowrk prefix. What is the next thing you would do?" (This one is closer to textbook and only would expect a CCNP level person to be able to answer if they had the experience and BGP was on their resume)

Shoot i forgot about L1 - K.I.S.S

For the BGP question i guess i would do a show ip bgp sum
and see if that little carrot is there *>

Forsaken_GA

b1tbuck3t wrote: »

ok. You check that but the network is not being propagated to the EBGP neighbor.

Oh, I make sure I have a local route for the prefix I'm trying to announce. If I don't, then I nail up a static route to the next hop. If I'm announcing an aggregate, then I'd have my static route to null0 in place

But I'd do that *before* I originated it with a network statement hehe

The only time I should have to do anything after the network statement is if I've had to make changes to my access lists, route maps, or any of my filtering lists, etc, at which point I'd need to bounce my BGP sessions to make those active

b1tbuck3t

Forsaken_GA wrote: »

Oh, I make sure I have a local route for the prefix I'm trying to announce. If I don't, then I nail up a static route to the next hop. If I'm announcing an aggregate, then I'd have my static route to null0 in place

But I'd do that *before* I originated it with a network statement hehe

The only time I should have to do anything after the network statement is if I've had to make changes to my access lists, route maps, or any of my filtering lists, etc, at which point I'd need to bounce my BGP sessions to make those active

Troubleshooting When BGP Routes Are Not Advertised [IP Routing] - Cisco Systems

You still need to clear the BGP neighbor or soft reset the peer even if you only added a network statement for existing peers.

Your answers demonstrated good knowledge of BGP and you stated the key point which was if you make a change you need to bounce the peer/soft reset it.

To me these type of interview questions are always better then a trick question or a text book question. I am sure if I was interviewing you could have gone into detail on your BGP experience.

b1tbuck3t

b1tbuck3t wrote: »

Troubleshooting When BGP Routes Are Not Advertised [IP Routing] - Cisco Systems

You still need to clear the BGP neighbor or soft reset the peer even if you only added a network statement for existing peers.

Your answers demonstrated good knowledge of BGP and you stated the key point which was if you make a change you need to bounce the peer/soft reset it.

To me these type of interview questions are always better then a trick question or a text book question. I am sure if I was interviewing you could have gone into detail on your BGP experience.

Here is a basic CCNP level interview question but it still amazes me how many people answer it wrong:

You have two laptops, Laptop 1 and Laptop 2 connected to two different switches in two different vlans. Both switches connect to Router A.

Laptop 1 sends a packet to Laptop 2. Explain in detail how the packet goes from Laptop 1 to Laptop 2.

Forsaken_GA

b1tbuck3t wrote: »

Troubleshooting When BGP Routes Are Not Advertised [IP Routing] - Cisco Systems

You still need to clear the BGP neighbor or soft reset the peer even if you only added a network statement for existing peers.

I thought the session bounce was the answer you were fishing for, but I was answering what I'd do, not what I thought you'd want to hear hehe. I actually do work with BGP on a daily basis

And I'm not trying to pick a fight, but you're wrong.

Simply originating a new network with the network statement is not going to require a clearing of the session in order to propagate it under normal working conditions.

The following debug log shows from a router that a BGP session was not up (it was refused by the remote peer because I hadn't yet configured BGP). Then I brought the BGP session up. Then I originated a network. After I did that, I did a soft clear of the BGP session just to show what it would look like and to demonstrate that I did not in fact do a clear after the network statement was added on the originating router, it pushed the UPDATE message all by itself, and it appeared in the non-originating router's BGP table

---

Session Establishment

---

R4#
*Mar 10 02:55:56.031: BGP: 10.0.0.2 open active, local address 10.0.0.1
*Mar 10 02:55:56.075: BGP: 10.0.0.2 open failed: Connection refused by remote host, open active delayed 29045ms (35000ms max, 28% jitter)
R4#
*Mar 10 02:56:25.123: BGP: 10.0.0.2 open active, local address 10.0.0.1
*Mar 10 02:56:25.159: BGP: 10.0.0.2 went from Active to OpenSent
*Mar 10 02:56:25.159: BGP: 10.0.0.2 sending OPEN, version 4, my as: 1, holdtime 180 seconds
*Mar 10 02:56:25.159: BGP: 10.0.0.2 send message type 1, length (incl. header) 45
*Mar 10 02:56:25.223: BGP: 10.0.0.2 rcv message type 1, length (excl. header) 26
*Mar 10 02:56:25.223: BGP: 10.0.0.2 rcv OPEN, version 4, holdtime 180 seconds
*Mar 10 02:56:25.223: BGP: 10.0.0.2 rcv OPEN w/ OPTION parameter len: 16
*Mar 10 02:56:25.223: BGP: 10.0.0.2 rcvd OPEN w/ optional parameter type 2 (Capability) len 6
*Mar 10 02:56:25.223: BGP: 10.0.0.2 OPEN has CAPABILITY code: 1, length 4
*Mar 10 02:56:25.223: BGP: 10.0.0.2 OPEN has MP_EXT CAP for afi/safi: 1/1
*Mar 10 02:56:25.223: BGP: 10.0.0.2 rcvd OPEN w/ optional parameter type 2 (Capability) len 2
*Mar 10 02:56:25.223: BGP: 10.0.0.2 OPEN has CAPABILITY code: 128, length 0
*Mar 10 02:56:25.227: BGP: 10.
R4#0.0.2 OPEN has ROUTE-REFRESH capability(old) for all address-families
*Mar 10 02:56:25.227: BGP: 10.0.0.2 rcvd OPEN w/ optional parameter type 2 (Capability) len 2
*Mar 10 02:56:25.227: BGP: 10.0.0.2 OPEN has CAPABILITY code: 2, length 0
*Mar 10 02:56:25.227: BGP: 10.0.0.2 OPEN has ROUTE-REFRESH capability(new) for all address-families
BGP: 10.0.0.2 rcvd OPEN w/ remote AS 2
*Mar 10 02:56:25.227: BGP: 10.0.0.2 went from OpenSent to OpenConfirm
*Mar 10 02:56:25.227: BGP: 10.0.0.2 went from OpenConfirm to Established
*Mar 10 02:56:25.227: %BGP-5-ADJCHANGE: neighbor 10.0.0.2 Up
*Mar 10 02:56:25.231: BGP: Delaying initial update for up to 120 seconds


---Receiving UPDATE after network origination----

R4#
*Mar 10 02:56:55.459: BGP: compute bestpath for address family 0
*Mar 10 02:56:55.459: BGP(0): table version went from 1 to 1
*Mar 10 02:56:55.459: BGPNSF: notified IGPs about convergence
*Mar 10 02:56:55.463: BGPNSF: Listeners notified about convergence
R4#
*Mar 10 02:57:18.147: BGP(0): 10.0.0.2 rcvd UPDATE w/ attr: nexthop 10.0.0.2, origin i, metric 0, path 2
*Mar 10 02:57:18.147: BGP(0): 10.0.0.2 rcvd 192.168.12.0/24
*Mar 10 02:57:18.151: BGP(0): Revise route installing 1 of 1 routes for 192.168.12.0/24 -> 10.0.0.2(main) to main IP table
R4#sh ip bgp
BGP table version is 2, local router ID is 10.0.0.1
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
r RIB-failure, S Stale
Origin codes: i - IGP, e - EGP, ? - incomplete

Network Next Hop Metric LocPrf Weight Path
*> 192.168.12.0 10.0.0.2 0 0 2 i

---- Remote Peer clear soft of the session ----

R4#
*Mar 10 02:58:51.315: BGP: 10.0.0.2 rcv message type 5, length (excl. header) 4
*Mar 10 02:58:51.315: BGP: 10.0.0.2 rcv REFRESH_REQ for afi/sfai: 1/1
*Mar 10 02:58:51.315: BGP: 10.0.0.2 start outbound soft reconfig for afi/safi: 1/1
*Mar 10 02:58:51.331: BGP(0): 10.0.0.2 rcvd UPDATE w/ attr: nexthop 10.0.0.2, origin i, metric 0, path 2
*Mar 10 02:58:51.331: BGP(0): 10.0.0.2 rcvd 192.168.12.0/24...duplicate ignored

So yeah, simply originating a prefix through the network statement does not require you to bounce the BGP session. If you have to do some other work to your filters in preparation for being able to announce that prefix (especially if you're functioning as a transit AS), then yes, you'll have to bounce your sessions.

If you revised your question to 'You have a working BGP connection and you just added a new network statement to advertise a new netowrk prefix, but it's not propagating. What is the next thing you would do?' then I would have answered immediately to clear the BGP sessions.

tim100

down77 wrote: »

3. You have arrived at Company "X" to provide top-notch network consulting on an issue they currently have.

What happens if you solve the issue but don't provide "top-notch" consulting?

mattsthe2

b1tbuck3t wrote: »

Here is a basic CCNP level interview question but it still amazes me how many people answer it wrong:

You have two laptops, Laptop 1 and Laptop 2 connected to two different switches in two different vlans. Both switches connect to Router A.

Laptop 1 sends a packet to Laptop 2. Explain in detail how the packet goes from Laptop 1 to Laptop 2.

Ok so Laptop with its configured subnet mask and Default gateway will know the network its trying to communicate with is on a different network.
Laptop1 will arp for the mac of its D.G

D.G will responsd with its MAC for the segment facing Laptop 1.
Lap1 will then send the packet to the D.G
Sour MAC: Laptop1s mac
Sour IP: :Laptop1s IP
Dest Mac: Routers MAC
Dest IP: Laptop2

When the router receives the packet it will check its arp cache, as the VLAN will be a connected VLAN it will arp for Laptop 2 on the other vlan. Once it gets that the router will address the packet as follows:

Sour MAC:Routers MAC
Sour IP: Laptop 1
Destin MAC: Laptop 2
Destin IP: Laptop 2

This is a great question, the same really goes for if User A types in "www.techexams.net" what happens? Essentially the same thing except its going to through that twice, once to get the ip address of "www.techexams.net", through a iterative DNS query and then again to actually send the packet using the method above.

Please correct me if im wrong.

b1tbuck3t

mattsthe2 wrote: »

Ok so Laptop with its configured subnet mask and Default gateway will know the network its trying to communicate with is on a different network.
Laptop1 will arp for the mac of its D.G

D.G will responsd with its MAC for the segment facing Laptop 1.
Lap1 will then send the packet to the D.G
Sour MAC: Laptop1s mac
Sour IP: :Laptop1s IP
Dest Mac: Routers MAC
Dest IP: Laptop2

When the router receives the packet it will check its arp cache, as the VLAN will be a connected VLAN it will arp for Laptop 2 on the other vlan. Once it gets that the router will address the packet as follows:

Sour MAC:Routers MAC
Sour IP: Laptop 1
Destin MAC: Laptop 2
Destin IP: Laptop 2

This is a great question, the same really goes for if User A types in "www.techexams.net" what happens? Essentially the same thing except its going to through that twice, once to get the ip address of "www.techexams.net", through a iterative DNS query and then again to actually send the packet using the method above.

Please correct me if im wrong.

Absolutely perfect answer. I was hoping you would include the detail down to the arp requests.

Amazing get confused on the interview and claim Laptop A sends the frame address to the switch. If they answer that way I try to help them correct themselves by asking them to define transparent switching.

Here is a fun question. Still not a trick but does require experience and did actually happen to me.

An end user calls you up and says when they receive spreadsheets attached to an email message they are corrupted. The user is at a remote office connected by frame-relay over a T1 line. The email server is at a central site. No other users are reporting problems at the site and the user that is complaining can access all other network resources including email fine. They claim the problem is the network.

How would you troubleshoot this?

mattsthe2

b1tbuck3t wrote: »

Absolutely perfect answer. I was hoping you would include the detail down to the arp requests.

Amazing get confused on the interview and claim Laptop A sends the frame address to the switch. If they answer that way I try to help them correct themselves by asking them to define transparent switching.

Here is a fun question. Still not a trick but does require experience and did actually happen to me.

An end user calls you up and says when they receive spreadsheets attached to an email message they are corrupted. The user is at a remote office connected by frame-relay over a T1 line. The email server is at a central site. No other users are reporting problems at the site and the user that is complaining can access all other network resources including email fine. They claim the problem is the network.

How would you troubleshoot this?

Hmm to be honest im not sure on this one.
Check interface stats for errors?

I'm dying to know. Please post the answer.

mattsthe2

b1tbuck3t wrote: »

Absolutely perfect answer. I was hoping you would include the detail down to the arp requests.

Amazing get confused on the interview and claim Laptop A sends the frame address to the switch. If they answer that way I try to help them correct themselves by asking them to define transparent switching.

Here is a fun question. Still not a trick but does require experience and did actually happen to me.

An end user calls you up and says when they receive spreadsheets attached to an email message they are corrupted. The user is at a remote office connected by frame-relay over a T1 line. The email server is at a central site. No other users are reporting problems at the site and the user that is complaining can access all other network resources including email fine. They claim the problem is the network.

How would you troubleshoot this?

To be honest i dont have a clue.
Im assuming the attachement has something to do with size of data and it being dropped maybe because its bursting above the CIR, but its really a guess.

Whats the answer Doc?

akhileshkumar

kkk its a nice things for me

pham0329

I'm not sure what a CCNP level interview is, but I'll share some of the questions I was asked recently for my interview

1. What is STP and why is it used?
2. Why would you want to influence the root bridge selection?
3. What is UDLD and why would you use it?
4. What is HSRP and why would you use it?
5. Under HSRP, what does the "track s0/0" command do?
6. Under HSRP, what does the preemption command do?
7. How would you inject a host route into EIGRP?
8. How would you inject a host route into BGP?
9. What command must you enter into BGP if you're using a loopback for neighbor relationship?
10. How would you filter inbound/outbound BGP updates?
11. What are soft refresh, and why would you want to use it?
12. In an ASA, what does "show xlate" do?
13. What are class-maps and policy-maps?
14. What is a route map and what is it used for?
15. How do you do PBR?
16. If you receive a call about a slow connection, what would you do?
17. How does trace route work?
18. Why would you want to summarize routes?

There were more questions but that's all I can remember.

Shanman

Does anybody have the answer to this question? I am also dying to know the anwser.

themagicone

b1tbuck3t wrote: »

Absolutely perfect answer. I was hoping you would include the detail down to the arp requests.

Amazing get confused on the interview and claim Laptop A sends the frame address to the switch. If they answer that way I try to help them correct themselves by asking them to define transparent switching.

Here is a fun question. Still not a trick but does require experience and did actually happen to me.

An end user calls you up and says when they receive spreadsheets attached to an email message they are corrupted. The user is at a remote office connected by frame-relay over a T1 line. The email server is at a central site. No other users are reporting problems at the site and the user that is complaining can access all other network resources including email fine. They claim the problem is the network.

How would you troubleshoot this?

First part is that no one else at that site is having issues. Just follow simple troubleshooting procedure. Did this problem just start happening? Is it just attachments from a specific person or everyone? Could be as simple as the sender saved it in a incompatibility version. May be open the email on your side and see what happens. Overall doesn't seem like a network issue.