VRF & MPLS VPN Practice Questions

Answers and explanations appear when you work through the set above.

1. When configuring IPsec site-to-site VPNs with VRF isolation on Cisco IOS XE, which concept maps the crypto map and transport interfaces to specific customer routing domains?

   • VRF-Aware IPsec
   • Dynamic VRF Trunking
   • Subinterface Tagging
   • GRE Multiplexing

2. Which BGP extended community attribute controls which received BGP routes are ingested into a local Virtual Routing and Forwarding (VRF) table?

   • Route Distinguisher (RD)
   • Import Route Target (RT)
   • Export Route Target (RT)
   • BGP Autonomous System Number

3. What occurs when an interface or sub-interface assigned an IPv4 address is assigned to a Virtual Routing and Forwarding (VRF) instance using the ip vrf forwarding <name> command?

   • Its IPv4 address is copied into every other VRF on the router.
   • Its IPv4 address is removed and must be re-entered.
   • It is converted into an 802.1Q trunk port for the VRF's VLANs.
   • The router reloads to apply the new VRF memory separation.

4. What problem does the Route Distinguisher (RD) solve in an MPLS L3VPN when two different customer VRFs use overlapping private IP address space?

   • It acts as an import filter, so a VRF installs only the routes that carry its matching value.
   • It prepends a unique value so MP-BGP can carry identical customer prefixes as distinct VPNv4 routes.
   • It encrypts customer traffic between the PE routers so that overlapping prefixes cannot be read in the core.
   • It assigns a unique VLAN ID to each customer-facing interface so overlapping subnets stay apart.

5. Which protocol distributes VPNv4 routes (customer prefixes tagged with a Route Distinguisher) between Provider Edge (PE) routers in an MPLS L3VPN?

   • OSPFv3 with a dedicated VPN area type
   • MP-BGP with the VPNv4 address family
   • EIGRP named mode with a VPN autonomous system
   • LDP extended to carry customer prefixes

6. In an MPLS L3VPN, what is the role of the Label Distribution Protocol (LDP) running between Provider (P) and Provider Edge (PE) routers?

   • It advertises the customer VPNv4 prefixes and their VPN labels end to end between PE routers.
   • It distributes the transport labels that switch packets hop by hop from ingress PE to egress PE.
   • It encrypts the MPLS label stack so that the P routers in the core cannot read the inner VPN label.
   • It replaces the need for an IGP such as OSPF or IS-IS to run anywhere in the provider core.

7. In the two-label MPLS L3VPN forwarding model, what does the inner (bottom) label typically identify once the packet arrives at the egress PE router?

   • The next-hop P router the packet must reach in the core
   • The VRF or VPN context the egress PE forwards the packet into
   • The DSCP marking that the egress PE applies for outbound QoS
   • The IGP metric of the transport path back to the ingress PE

8. What is the effect of configuring matching import and export Route Targets on two separate VRFs on the same or different PE routers?

   • The two VRFs stay fully isolated, because Route Targets can match inside a single VRF alone.
   • Routes exported by one VRF can be imported into the other, enabling controlled route leaking.
   • The Route Distinguishers of both VRFs are merged automatically into one shared RD value.
   • Both VRFs are forced onto the same VLAN so that their interfaces can share a broadcast domain.

9. Which command displays the routing table contents for a specific VRF instance on an IOS XE router, rather than the global routing table?

   • show ip route vrf <vrf-name>
   • show ip vrf interfaces <vrf-name>
   • show ip bgp vpnv4 all
   • show mpls forwarding-table

10. Which command creates a Layer 3 VRF instance under the newer multi-address-family VRF configuration model on IOS XE (replacing the legacy ip vrf command)?

    • vrf definition <name>
    • ip vrf definition <name>
    • vrf context <name>
    • ip vrf <name>

11. In VRF-Lite (no MPLS core), how is per-VRF traffic typically kept separated when it must cross a shared Layer 2 link between two routers each running multiple VRFs?

    • One physical interface without subinterfaces that merges all VRFs into one table
    • Dot1Q subinterfaces (or separate links), each bound to one VRF with vrf forwarding
    • GRE tunnels, which are mandatory for every VRF-Lite deployment across any shared link
    • MP-BGP VPNv4 address families, which are required even when no MPLS is running

12. What distinguishes an MPLS Label Switch Router's (LSR) forwarding decision from a traditional IP router's forwarding decision?

    • It performs a full longest-prefix-match IP lookup on every packet at every transit hop, like an IP router.
    • It swaps the incoming label for an outgoing one using the LFIB instead of doing an IP lookup at each hop.
    • It forwards only broadcast and multicast traffic, leaving unicast forwarding to the IP routers.
    • It requires OSPF to be disabled on all core interfaces so that labels can replace the IGP.

13. Why do most MPLS L3VPN designs use BGP route reflectors between PE routers instead of a full iBGP mesh?

    • LDP requires route reflectors, because labels can only be distributed through a BGP reflector.
    • A full mesh of VPNv4 sessions grows quadratically with PE count; reflectors cut each PE to a few sessions.
    • Route reflectors remove the need for Route Distinguishers, since the reflector itself keeps every prefix unique.
    • Route reflectors are used for eBGP sessions to customer sites, where a full mesh is not allowed.

14. Which command on an IOS XE PE router verifies that a specific VPNv4 prefix has been correctly received via MP-BGP along with its Route Distinguisher and Route Target attributes?

    • show ip bgp vpnv4 vrf <vrf-name>
    • show ip ospf database opaque-area
    • show mpls ldp neighbor detail
    • show standby brief

15. What is the functional difference between a Provider (P) router and a Provider Edge (PE) router in an MPLS L3VPN topology?

    • P routers maintain the per-customer VRF routing tables, while the PE routers only swap transport labels in the core.
    • P routers only swap transport labels with no VRF awareness; PE routers hold customer VRFs and run MP-BGP.
    • P routers run MP-BGP directly with customer sites, while PE routers run only LDP toward the core.
    • There is no architectural distinction, because the two terms are interchangeable in MPLS designs.

16. Which mechanism is commonly used in VRF-Lite deployments (without MP-BGP) to route specific traffic streams between two separate local VRF instances on the same router?

    • Route Target extended communities attached to each prefix in the routing table
    • Static routes in one VRF that point to an exit interface in the other VRF
    • LISP EID-to-RLOC mappings registered with a map server for each VRF
    • Spanning-tree instances mapped to each VRF through MST region configuration

17. In Multi-VRF and MPLS VPN deployments, what 64-bit parameter is prepended to an IPv4 prefix to create a globally unique 96-bit VPNv4 prefix?

    • Route Target (RT)
    • Route Distinguisher (RD)
    • Autonomous System Number (ASN)
    • Virtual Network Identifier (VNI)