300-730 Sample Questions & Answers

In DMVPN Phase 2 with EIGRP, the hub runs no ip next-hop-self eigrp so that every spoke learns the other spokes' networks with the remote spoke as next hop. Phase 3 removes that need: Cisco's NHRP shortcut-switching guide says spokes can use summarized routes whose next hop is the hub's tunnel address and still build spoke-to-spoke tunnels, because NHRP installs shortcut routes after the hub sends an NHRP redirect. The migration therefore adds ip nhrp redirect on the hub tunnel, so the hub signals spokes when traffic enters and leaves the same tunnel, and returns EIGRP next-hop-self to its default on the hub so the hub can advertise itself as next hop, including summaries. Cisco's Phase 3 example hub has ip nhrp redirect and ip summary-address eigrp and no 'no ip next-hop-self eigrp'. Disabling next-hop-self is the Phase 2 setting, not a migration step. The spokes need ip nhrp shortcut to act on the redirects, so adding shortcuts on the hub, or redirects on the spokes in place of the hub, does not give the hub the redirect role Phase 3 depends on. Sources: Cisco, 'Shortcut Switching Enhancements for NHRP in DMVPN Networks' (IOS XE 16.9); Cisco, 'Configure Phase-3 Hierarchical DMVPN with Multi-Subnet Spokes'.

In DMVPN Phase 2 with EIGRP, the hub runs no ip next-hop-self eigrp so that every spoke learns the other spokes' networks with the remote spoke as next hop. Phase 3 removes that need: Cisco's NHRP shortcut-switching guide says spokes can use summarized routes whose next hop is the hub's tunnel address and still build spoke-to-spoke tunnels, because NHRP installs shortcut routes after the hub sends an NHRP redirect. The migration therefore adds ip nhrp redirect on the hub tunnel, so the hub signals spokes when traffic enters and leaves the same tunnel, and returns EIGRP next-hop-self to its default on the hub so the hub can advertise itself as next hop, including summaries. Cisco's Phase 3 example hub has ip nhrp redirect and ip summary-address eigrp and no 'no ip next-hop-self eigrp'. Disabling next-hop-self is the Phase 2 setting, not a migration step. The spokes need ip nhrp shortcut to act on the redirects, so adding shortcuts on the hub, or redirects on the spokes in place of the hub, does not give the hub the redirect role Phase 3 depends on. Sources: Cisco, 'Shortcut Switching Enhancements for NHRP in DMVPN Networks' (IOS XE 16.9); Cisco, 'Configure Phase-3 Hierarchical DMVPN with Multi-Subnet Spokes'.

IKEv2 supports asymmetric authentication, meaning the two peers do not need to use the same method to authenticate each other. In this scenario, the hub configures authentication local rsa-sig to present a certificate to the spoke, and authentication remote eap to demand EAP authentication from the spoke.

In DMVPN Phase 3, the ip nhrp shortcut command is required on the spoke routers. This command enables the spoke to accept NHRP redirect messages from the hub and to resolve the NBMA address of the target spoke to install a CEF shortcut (specific route) for direct communication.

The ASA Clientless SSL VPN portal includes a native file browser that supports CIFS (Common Internet File System). This allows users to browse file shares directly through the web portal interface using HTML rendering, without requiring Java or ActiveX plug-ins.

The 'Policy not found' error in IKEv2 typically indicates that the receiver could not find an IKEv2 profile that matches the incoming request. This matching is primarily done via the match identity commands.

While 'Policy not found' points to profile selection, if no valid IKEv2 proposal exists (or the default smart defaults don't match), the negotiation cannot proceed to a point where a policy is fully established. However, profile matching is the most direct cause of this specific error text.