VRF-Lite & MPLS L3VPN Practice Questions

Answers and explanations appear when you work through the set above.

1. Using the newer IOS/IOS-XE syntax, which command creates a VRF that can be configured to support both IPv4 and IPv6 address families?

   • ip vrf <name>
   • vrf definition <name>, followed by address-family configuration under it
   • router vrf <name>
   • vrf forwarding <name> entered at global configuration mode

2. A newly created vrf definition BLUE does not show IPv6 listed as a supported address family in show vrf. What is the most likely reason?

   • VRF names must be lowercase for IPv6 support
   • The IPv6 address family was never explicitly enabled under the VRF definition with address-family ipv6
   • IPv6 requires a separate vrf ipv6 definition BLUE6 command
   • show vrf never displays IPv6 regardless of configuration

3. Using the newer interface-level syntax, which command assigns an interface to VRF BLUE?

   • ip vrf forwarding BLUE
   • vrf forwarding BLUE
   • ip address vrf BLUE
   • vrf-member BLUE

4. Using the classic (pre vrf definition) syntax, which interface command assigns an interface to a VRF?

   • vrf forwarding <name>
   • ip vrf forwarding <name>
   • ip vrf-lite <name>
   • interface vrf <name>

5. An engineer types vrf forwarding RED on an interface that already had an IPv4 address configured, and the previously configured IP address disappears from the interface. What should be done next?

   • Nothing; the address will silently reappear once OSPF reconverges
   • Re-enter the IP address configuration on the interface now that it belongs to VRF RED
   • Reboot the router to restore the address
   • Remove and recreate the VRF from scratch

6. Which command gives a consolidated view of configured VRF instances, their enabled address families, and the interfaces assigned to each?

   • show ip route vrf all
   • show vrf
   • show running-config | section vrf
   • show ip protocols vrf

7. A VRF is created as RED, but a subsequent interface command references red in lowercase and the command fails to apply as expected. What explains this?

   • VRF names are case sensitive, so red and RED are treated as two different (and in this case, non-existent) VRFs
   • VRF names are always converted to uppercase automatically
   • The router requires VRF names shorter than four characters
   • Lowercase VRF names are reserved for IPv6-only VRFs

8. Which command is used to verify routes specifically inside a named VRF rather than the global routing table?

   • show ip route
   • show ip route vrf <name>
   • show ip cef
   • show vrf detail routes

9. Customer A and Customer B both use the overlapping prefix 10.10.10.0/24 inside an MPLS Layer 3 VPN. What mechanism lets MP-BGP carry both routes as distinct, non-conflicting VPNv4 routes?

   • A route distinguisher prepended to each customer's prefixes within their respective VRF, making otherwise identical IP prefixes unique in the VPNv4 address family
   • A shared OSPF process ID for both customers
   • A common BFD discriminator value
   • Identical route targets configured on both VRFs

10. What does a route target primarily control in an MPLS Layer 3 VPN?

    • Which VPNv4 routes a given VRF imports from, and exports to, MP-BGP
    • Making overlapping customer prefixes unique across the provider core
    • The IGP metric used to reach the egress PE
    • Which LDP router ID a PE advertises

11. Which statement correctly distinguishes a route distinguisher from a route target?

    • The RD makes otherwise identical customer prefixes unique in the VPNv4 address family, while the RT governs which VRFs import and export a given VPN route
    • The RD controls import/export policy, while the RT provides prefix uniqueness
    • RD and RT are two names for the exact same value and are interchangeable
    • RD applies only to IPv6 VPNs, while RT applies only to IPv4 VPNs

12. PE1 exports a customer route tagged with route target 65000:55. What must a remote VRF on PE2 have configured for that route to actually be imported into its routing table?

    • An identical route distinguisher of 65000:55
    • A matching import route target of 65000:55 configured under that VRF
    • The same interface bandwidth as PE1's customer-facing interface
    • A static route pointing at PE1's loopback

13. Does VRF-Lite require MPLS label switching to be enabled in the core to provide routing separation?

    • Yes, VRF-Lite cannot function without LDP running between routers
    • No, VRF-Lite provides per-hop routing and forwarding separation using standard IP forwarding between VRF-aware routers, without requiring an MPLS label-switched core
    • Yes, but only when IPv6 VRFs are involved
    • No, but it requires BGP as the sole routing protocol between VRF hops

14. In a typical MPLS L3VPN topology, why does the customer-edge (CE) router typically need no VRF configuration while the provider-edge (PE) router does?

    • CE routers are technically incapable of supporting VRFs
    • The PE serves multiple customers' separate routing contexts on shared infrastructure, while a given CE router normally belongs to just one customer and therefore has no overlapping-context problem to solve
    • VRFs are only relevant to IPv6 deployments and CE routers are IPv4-only by convention
    • CE routers always use static default routes instead of dynamic routing

15. show vrf lists VRF BLUE but its Interfaces column is empty. What does that tell an engineer troubleshooting connectivity for BLUE?

    • The VRF has a routing loop
    • The VRF definition exists, but no interface has yet been assigned to it with a vrf forwarding (or ip vrf forwarding) command
    • MPLS LDP has failed for that VRF
    • The VRF was created with the wrong route distinguisher

16. An unlabeled IPv4 packet arrives at an MPLS-enabled ingress PE and its next hop is reached through the MPLS core. What forwarding action does the ingress router perform on that packet?

    • It replaces the destination IP address with a locally significant label address
    • It looks up the destination in the FIB and pushes an MPLS label stack onto the packet based on that forwarding information before sending it into the core
    • It converts the packet into a GRE-encapsulated frame
    • It pops a label that does not yet exist on the unlabeled packet

17. A labeled packet arrives at an intermediate LSR deep inside the MPLS core. Which table primarily drives the label swap decision at that hop?

    • The ARP table
    • The LFIB (Label Forwarding Information Base)
    • The OSPF link-state database
    • The BGP Adj-RIB-In

18. What is the core role of LDP (Label Distribution Protocol) in a basic MPLS network?

    • It encrypts payloads exchanged between PE routers
    • It distributes label bindings for forwarding equivalence classes between neighboring label switch routers, building the transport label-switched paths
    • It functions as a replacement interior gateway protocol
    • It assigns BGP extended communities to VPNv4 routes

19. A penultimate-hop router receives an implicit-null label binding from the egress LSR for a given FEC. What action should it take when forwarding a matching labeled packet toward that egress LSR?

    • Push an additional label onto the stack
    • Pop the top (transport) label before forwarding the packet on to the egress LSR, a behavior known as penultimate hop popping
    • Drop the packet because the implicit-null value is invalid
    • Convert the MPLS label into an 802.1Q VLAN tag

20. What is a forwarding equivalence class (FEC) in the MPLS architecture?

    • A group of packets that share a common forwarding treatment and are therefore mapped to the same label
    • A list of route reflector clients
    • A VRF's configured set of import route targets
    • A security association negotiated for IPsec ESP

21. In a typical MPLS Layer 3 VPN, a customer packet crossing the provider core commonly carries two stacked labels. What does the outer (top) label accomplish?

    • It selects the customer VRF at the egress PE
    • It transports the packet, label-switched hop by hop, across the provider core toward the correct egress PE, without any P router needing customer VRF awareness
    • It encrypts the customer's payload for confidentiality
    • It carries the customer CE router's MAC address

22. In that same two-label MPLS L3VPN packet, what does the inner (VPN) label tell the egress PE once the outer transport label has been popped?

    • The IGP cost of the path just traversed
    • Which customer VRF (and therefore which VRF-specific forwarding table) should process the packet
    • The BGP router ID of the ingress PE
    • The DSCP marking to apply for QoS

23. How do PE routers in an MPLS L3VPN typically learn the VPN labels associated with remote VPNv4 routes?

    • Through LDP sessions established directly between PE routers
    • Through MP-BGP, which carries the VPN label as part of the VPNv4 NLRI advertisement between PE routers
    • Through OSPF Type 5 LSAs
    • Through manual static label configuration on each PE

24. A P router in the MPLS core has no knowledge of any customer VPN or VRF configuration, yet customer traffic still transits it correctly. Why does the outer transport label make this possible?

    • The P router decapsulates the VPN label and inspects the customer IP header directly
    • The transport label lets the P router forward strictly by swapping labels toward the correct egress PE, without ever needing to look at, or understand, the inner VPN label or any customer routing context
    • P routers secretly maintain a copy of every customer VRF for redundancy
    • MPLS disables all P router forwarding and relies on flooding instead