Interview Questions for CCNP level Interview.

Question 3 is basically asking you if you know what a confederation is when it comes to BGP. It's not really a CCNP question, but it's a perfectly reasonable CCIP question, so still at the professional level

Edit: Or if it's not setup as a confederation, I suppose you could just use the remove-private-as neighbor command on the router(s) that is/are configured with the public AS # in it's neighbor statements to it's public EBGP peers. I don't see why you would use private AS numbers for satellite sites though. Since all of these satellite sites would have to be back hauled over a private circuit to reach the public AS router before they could communicate to the public internet though, I'd just have them run the public AS number and use iBGP connections instead of EBGP

Edit #2: Actually, I guess that would depend on the number of routers involved. If it's a large network, the satellite sites running ebgp back into the central site to avoid a large number of iBGP sessions makes sense, though I think I'd rather deploy a route reflector than use private as numbers

chrisone

You definetly want to brush up on IPSEC tunnels, EIGRP, OSPF, Port Security, HSRP, MPLS, Some BGP.

I dont think BGP will be heavily drilled but to be honest with you it all depends on the Job Description, at the place where i am when i saw the job add i noticed eigrp, ospf, IPSEC tunnels, were a main concern to them. SO i brushed up on those specific and in the interview they asked me the stages of an IPSEC tunnel and some EIGRP questions. I had 3 interviews with them before i landed the job. They liked that i had a lot of experience implementing MPLS and some level of security. Just pay attention to the job description in the Ad and be on top of everything they list out, that will be your best bet.

For the BGP question i agree that confederations is the way to go, although couldn't you get that working with Route Reflectors also?

Or is RR only local relevant within the local AS?

Paul Boz

God I would completely fail a Cisco technical interview now.

Paul Boz wrote: »

God I would completely fail a Cisco technical interview now.

Ha ha know the feeling Paul.
Theres nothing like being put on the spot to give you warm fuzzy feelings (not).

I'm curious to the answers to the questions though.

cyberjunkie wrote: »

Hi,

Please share your interview experience and questions you faced recently(Cisco).

After 2 years I am looking for a change so It will be very helpful if I can get a idea of what kind of questions I expect. It will help me in my interview preparation .

I like to ask questions that do not come from certification exams but indicate experience.

One of my favorite Enterprise experience questions is "You have two routers configured as HSRP neighbors, both are showing as Active. What does this mean and how would you troubleshoot it.

Easy question for anyone that has had to support/troubleshoot HSRP in an enterprise enviroment.

b1tbuck3t wrote: »

I like to ask questions that do not come from certification exams but indicate experience.

One of my favorite Enterprise experience questions is "You have two routers configured as HSRP neighbors, both are showing as Active. What does this mean and how would you troubleshoot it.

Easy question for anyone that has had to support/troubleshoot HSRP in an enterprise enviroment.

Hmm i dont see that even being possible, unless the state changes are occurring frequently, making it look like they both are active. Assuming the configuration is correct this must be a layer 2 issue, id check the STP topology for the VLAN that the hsrp segment resides.

unless this is a trick question and its active for two different segments, HSRP load balancing. You know half the hosts peer to group 1 and the other half peer to group 2.

This posts sucks, lol.

mattsthe2 wrote: »

Hmm i dont see that even being possible, unless the state changes are occurring frequently, making it look like they both are active. Assuming the configuration is correct this must be a layer 2 issue, id check the STP topology for the VLAN that the hsrp segment resides.

unless this is a trick question and its active for two different segments, HSRP load balancing. You know half the hosts peer to group 1 and the other half peer to group 2.

This posts sucks, lol.

You are mostly correct. It indicates a layer 2 (or layer 1 if the cable between the switches was unplugged) issue. The layer 2 keepalives are not making it between the neighbors therefore both neighbors think they are active.

I would then follow up with another simple question of how you would troubleshoot the layer 2 issue.

It's great to see people dig their own hole if they don't know what they are doing. For people that do have experience we quickly move on to other things. The whole point is to not ask a trick technical question but something that demonstrates experience and understanding.

Btw. I wouldn't ask about HSRP unless it is part of the job description or on the person's resume.

My second favorite thing is when someone who has only worked in small enviroments but has BGP (and every other protocol) on their resume.

In that case I would probably ask "You have a working BGP connection and you just added a new network statement to advertise a new netowrk prefix. What is the next thing you would do?" (This one is closer to textbook and only would expect a CCNP level person to be able to answer if they had the experience and BGP was on their resume)

b1tbuck3t wrote: »

In that case I would probably ask "You have a working BGP connection and you just added a new network statement to advertise a new netowrk prefix. What is the next thing you would do?" (This one is closer to textbook and only would expect a CCNP level person to be able to answer if they had the experience and BGP was on their resume)

Check the looking glass of my peers to make sure it's propagating with the attributes I wanted set (ie, path prepended, med's, communitys, etc)

Forsaken_GA wrote: »

Check the looking glass of my peers to make sure it's propagating with the attributes I wanted set (ie, path prepended, med's, communitys, etc)

ok. You check that but the network is not being propagated to the EBGP neighbor.

b1tbuck3t wrote: »

You are mostly correct. It indicates a layer 2 (or layer 1 if the cable between the switches was unplugged) issue. The layer 2 keepalives are not making it between the neighbors therefore both neighbors think they are active.

I would then follow up with another simple question of how you would troubleshoot the layer 2 issue.

It's great to see people dig their own hole if they don't know what they are doing. For people that do have experience we quickly move on to other things. The whole point is to not ask a trick technical question but something that demonstrates experience and understanding.

Btw. I wouldn't ask about HSRP unless it is part of the job description or on the person's resume.

My second favorite thing is when someone who has only worked in small enviroments but has BGP (and every other protocol) on their resume.

In that case I would probably ask "You have a working BGP connection and you just added a new network statement to advertise a new netowrk prefix. What is the next thing you would do?" (This one is closer to textbook and only would expect a CCNP level person to be able to answer if they had the experience and BGP was on their resume)

Shoot i forgot about L1 - K.I.S.S

For the BGP question i guess i would do a show ip bgp sum
and see if that little carrot is there *>

b1tbuck3t wrote: »

ok. You check that but the network is not being propagated to the EBGP neighbor.

Oh, I make sure I have a local route for the prefix I'm trying to announce. If I don't, then I nail up a static route to the next hop. If I'm announcing an aggregate, then I'd have my static route to null0 in place

But I'd do that *before* I originated it with a network statement hehe

The only time I should have to do anything after the network statement is if I've had to make changes to my access lists, route maps, or any of my filtering lists, etc, at which point I'd need to bounce my BGP sessions to make those active

Forsaken_GA wrote: »

Oh, I make sure I have a local route for the prefix I'm trying to announce. If I don't, then I nail up a static route to the next hop. If I'm announcing an aggregate, then I'd have my static route to null0 in place

But I'd do that *before* I originated it with a network statement hehe

The only time I should have to do anything after the network statement is if I've had to make changes to my access lists, route maps, or any of my filtering lists, etc, at which point I'd need to bounce my BGP sessions to make those active

Troubleshooting When BGP Routes Are Not Advertised [IP Routing] - Cisco Systems

You still need to clear the BGP neighbor or soft reset the peer even if you only added a network statement for existing peers.

Your answers demonstrated good knowledge of BGP and you stated the key point which was if you make a change you need to bounce the peer/soft reset it.

To me these type of interview questions are always better then a trick question or a text book question. I am sure if I was interviewing you could have gone into detail on your BGP experience.

b1tbuck3t wrote: »

Troubleshooting When BGP Routes Are Not Advertised [IP Routing] - Cisco Systems

You still need to clear the BGP neighbor or soft reset the peer even if you only added a network statement for existing peers.

Your answers demonstrated good knowledge of BGP and you stated the key point which was if you make a change you need to bounce the peer/soft reset it.

To me these type of interview questions are always better then a trick question or a text book question. I am sure if I was interviewing you could have gone into detail on your BGP experience.

Here is a basic CCNP level interview question but it still amazes me how many people answer it wrong:

You have two laptops, Laptop 1 and Laptop 2 connected to two different switches in two different vlans. Both switches connect to Router A.

Laptop 1 sends a packet to Laptop 2. Explain in detail how the packet goes from Laptop 1 to Laptop 2.

b1tbuck3t wrote: »

Troubleshooting When BGP Routes Are Not Advertised [IP Routing] - Cisco Systems

You still need to clear the BGP neighbor or soft reset the peer even if you only added a network statement for existing peers.

I thought the session bounce was the answer you were fishing for, but I was answering what I'd do, not what I thought you'd want to hear hehe. I actually do work with BGP on a daily basis

And I'm not trying to pick a fight, but you're wrong.

Simply originating a new network with the network statement is not going to require a clearing of the session in order to propagate it under normal working conditions.

The following debug log shows from a router that a BGP session was not up (it was refused by the remote peer because I hadn't yet configured BGP). Then I brought the BGP session up. Then I originated a network. After I did that, I did a soft clear of the BGP session just to show what it would look like and to demonstrate that I did not in fact do a clear after the network statement was added on the originating router, it pushed the UPDATE message all by itself, and it appeared in the non-originating router's BGP table

Session Establishment

R4#
*Mar 10 02:55:56.031: BGP: 10.0.0.2 open active, local address 10.0.0.1
*Mar 10 02:55:56.075: BGP: 10.0.0.2 open failed: Connection refused by remote host, open active delayed 29045ms (35000ms max, 28% jitter)
R4#
*Mar 10 02:56:25.123: BGP: 10.0.0.2 open active, local address 10.0.0.1
*Mar 10 02:56:25.159: BGP: 10.0.0.2 went from Active to OpenSent
*Mar 10 02:56:25.159: BGP: 10.0.0.2 sending OPEN, version 4, my as: 1, holdtime 180 seconds
*Mar 10 02:56:25.159: BGP: 10.0.0.2 send message type 1, length (incl. header) 45
*Mar 10 02:56:25.223: BGP: 10.0.0.2 rcv message type 1, length (excl. header) 26
*Mar 10 02:56:25.223: BGP: 10.0.0.2 rcv OPEN, version 4, holdtime 180 seconds
*Mar 10 02:56:25.223: BGP: 10.0.0.2 rcv OPEN w/ OPTION parameter len: 16
*Mar 10 02:56:25.223: BGP: 10.0.0.2 rcvd OPEN w/ optional parameter type 2 (Capability) len 6
*Mar 10 02:56:25.223: BGP: 10.0.0.2 OPEN has CAPABILITY code: 1, length 4
*Mar 10 02:56:25.223: BGP: 10.0.0.2 OPEN has MP_EXT CAP for afi/safi: 1/1
*Mar 10 02:56:25.223: BGP: 10.0.0.2 rcvd OPEN w/ optional parameter type 2 (Capability) len 2
*Mar 10 02:56:25.223: BGP: 10.0.0.2 OPEN has CAPABILITY code: 128, length 0
*Mar 10 02:56:25.227: BGP: 10.
R4#0.0.2 OPEN has ROUTE-REFRESH capability(old) for all address-families
*Mar 10 02:56:25.227: BGP: 10.0.0.2 rcvd OPEN w/ optional parameter type 2 (Capability) len 2
*Mar 10 02:56:25.227: BGP: 10.0.0.2 OPEN has CAPABILITY code: 2, length 0
*Mar 10 02:56:25.227: BGP: 10.0.0.2 OPEN has ROUTE-REFRESH capability(new) for all address-families
BGP: 10.0.0.2 rcvd OPEN w/ remote AS 2
*Mar 10 02:56:25.227: BGP: 10.0.0.2 went from OpenSent to OpenConfirm
*Mar 10 02:56:25.227: BGP: 10.0.0.2 went from OpenConfirm to Established
*Mar 10 02:56:25.227: %BGP-5-ADJCHANGE: neighbor 10.0.0.2 Up
*Mar 10 02:56:25.231: BGP: Delaying initial update for up to 120 seconds

---Receiving UPDATE after network origination----

R4#
*Mar 10 02:56:55.459: BGP: compute bestpath for address family 0
*Mar 10 02:56:55.459: BGP(0): table version went from 1 to 1
*Mar 10 02:56:55.459: BGPNSF: notified IGPs about convergence
*Mar 10 02:56:55.463: BGPNSF: Listeners notified about convergence
R4#
*Mar 10 02:57:18.147: BGP(0): 10.0.0.2 rcvd UPDATE w/ attr: nexthop 10.0.0.2, origin i, metric 0, path 2
*Mar 10 02:57:18.147: BGP(0): 10.0.0.2 rcvd 192.168.12.0/24
*Mar 10 02:57:18.151: BGP(0): Revise route installing 1 of 1 routes for 192.168.12.0/24 -> 10.0.0.2(main) to main IP table
R4#sh ip bgp
BGP table version is 2, local router ID is 10.0.0.1
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
r RIB-failure, S Stale
Origin codes: i - IGP, e - EGP, ? - incomplete

Network Next Hop Metric LocPrf Weight Path
*> 192.168.12.0 10.0.0.2 0 0 2 i

---- Remote Peer clear soft of the session ----

R4#
*Mar 10 02:58:51.315: BGP: 10.0.0.2 rcv message type 5, length (excl. header) 4
*Mar 10 02:58:51.315: BGP: 10.0.0.2 rcv REFRESH_REQ for afi/sfai: 1/1
*Mar 10 02:58:51.315: BGP: 10.0.0.2 start outbound soft reconfig for afi/safi: 1/1
*Mar 10 02:58:51.331: BGP(0): 10.0.0.2 rcvd UPDATE w/ attr: nexthop 10.0.0.2, origin i, metric 0, path 2
*Mar 10 02:58:51.331: BGP(0): 10.0.0.2 rcvd 192.168.12.0/24...duplicate ignored

So yeah, simply originating a prefix through the network statement does not require you to bounce the BGP session. If you have to do some other work to your filters in preparation for being able to announce that prefix (especially if you're functioning as a transit AS), then yes, you'll have to bounce your sessions.

If you revised your question to 'You have a working BGP connection and you just added a new network statement to advertise a new netowrk prefix, but it's not propagating. What is the next thing you would do?' then I would have answered immediately to clear the BGP sessions.

tim100

down77 wrote: »

3. You have arrived at Company "X" to provide top-notch network consulting on an issue they currently have.

What happens if you solve the issue but don't provide "top-notch" consulting?

b1tbuck3t wrote: »

Here is a basic CCNP level interview question but it still amazes me how many people answer it wrong:

You have two laptops, Laptop 1 and Laptop 2 connected to two different switches in two different vlans. Both switches connect to Router A.

Laptop 1 sends a packet to Laptop 2. Explain in detail how the packet goes from Laptop 1 to Laptop 2.

Ok so Laptop with its configured subnet mask and Default gateway will know the network its trying to communicate with is on a different network.
Laptop1 will arp for the mac of its D.G

D.G will responsd with its MAC for the segment facing Laptop 1.
Lap1 will then send the packet to the D.G
Sour MAC: Laptop1s mac
Sour IP: :Laptop1s IP
Dest Mac: Routers MAC
Dest IP: Laptop2

When the router receives the packet it will check its arp cache, as the VLAN will be a connected VLAN it will arp for Laptop 2 on the other vlan. Once it gets that the router will address the packet as follows:

Sour MAC:Routers MAC
Sour IP: Laptop 1
Destin MAC: Laptop 2
Destin IP: Laptop 2

This is a great question, the same really goes for if User A types in "www.techexams.net" what happens? Essentially the same thing except its going to through that twice, once to get the ip address of "www.techexams.net", through a iterative DNS query and then again to actually send the packet using the method above.

Please correct me if im wrong.

mattsthe2 wrote: »

Ok so Laptop with its configured subnet mask and Default gateway will know the network its trying to communicate with is on a different network.
Laptop1 will arp for the mac of its D.G

D.G will responsd with its MAC for the segment facing Laptop 1.
Lap1 will then send the packet to the D.G
Sour MAC: Laptop1s mac
Sour IP: :Laptop1s IP
Dest Mac: Routers MAC
Dest IP: Laptop2

When the router receives the packet it will check its arp cache, as the VLAN will be a connected VLAN it will arp for Laptop 2 on the other vlan. Once it gets that the router will address the packet as follows:

Sour MAC:Routers MAC
Sour IP: Laptop 1
Destin MAC: Laptop 2
Destin IP: Laptop 2

This is a great question, the same really goes for if User A types in "www.techexams.net" what happens? Essentially the same thing except its going to through that twice, once to get the ip address of "www.techexams.net", through a iterative DNS query and then again to actually send the packet using the method above.

Please correct me if im wrong.

Absolutely perfect answer. I was hoping you would include the detail down to the arp requests.

Amazing get confused on the interview and claim Laptop A sends the frame address to the switch. If they answer that way I try to help them correct themselves by asking them to define transparent switching.

Here is a fun

question. Still not a trick but does require experience and did actually happen to me.

An end user calls you up and says when they receive spreadsheets attached to an email message they are corrupted. The user is at a remote office connected by frame-relay over a T1 line. The email server is at a central site. No other users are reporting problems at the site and the user that is complaining can access all other network resources including email fine. They claim the problem is the network.

How would you troubleshoot this?

b1tbuck3t wrote: »

Absolutely perfect answer. I was hoping you would include the detail down to the arp requests.

Amazing get confused on the interview and claim Laptop A sends the frame address to the switch. If they answer that way I try to help them correct themselves by asking them to define transparent switching.

Here is a fun question. Still not a trick but does require experience and did actually happen to me.

An end user calls you up and says when they receive spreadsheets attached to an email message they are corrupted. The user is at a remote office connected by frame-relay over a T1 line. The email server is at a central site. No other users are reporting problems at the site and the user that is complaining can access all other network resources including email fine. They claim the problem is the network.

How would you troubleshoot this?

Hmm to be honest im not sure on this one.
Check interface stats for errors?

I'm dying to know. Please post the answer.