Router and Switch Configuration Questions

Practical knowledge and hands on skills to configure routers and switches using a command line interface on industry platforms. Core abilities include setting Internet Protocol addresses on interfaces, enabling and disabling interfaces, configuring hostnames and administrative access, saving and backing up configurations, and understanding configuration modes and command structure. Routing topics cover basic static routing, default routes, and introductory dynamic routing protocols and how to verify routing table entries. Switch topics cover virtual local area network creation and assignment, trunk configuration, port configuration and management. Security and policy configuration includes access control lists and basic interface security. Verification and troubleshooting skills include using platform show and status commands to inspect running configuration, routing table and interface state, using ping and traceroute to test connectivity, and interpreting logs and counters. Candidates should understand platform syntax differences such as those between Cisco and Juniper devices, configuration management and restoration processes, and common troubleshooting workflows. Familiarity with practicing these tasks in lab environments or simulators is expected.

HardTechnical

39 practiced

Translate the following Cisco IOS trunk configuration into an equivalent Juniper Junos configuration and explain semantic differences and important platform behaviors to be aware of:

interface GigabitEthernet0/1 description uplink-to-core switchport trunk encapsulation dot1q switchport mode trunk switchport trunk native vlan 99 switchport trunk allowed vlan 10,20,99 no shutdown

Provide the Junos configuration and discuss differences in configuration hierarchy, default behaviors, and where explicit settings are required on Junos compared to IOS.

Sample Answer

**Junos configuration (example for EX/QFX/A series switching platform)**

text

set interfaces ge-0/0/1 description "uplink-to-core"
set interfaces ge-0/0/1 unit 0 family ethernet-switching interface-mode trunk
set interfaces ge-0/0/1 unit 0 family ethernet-switching native-vlan-id 99
set interfaces ge-0/0/1 unit 0 family ethernet-switching vlan members [ 10 20 99 ]

set vlans vlan10 vlan-id 10
set vlans vlan20 vlan-id 20
set vlans vlan99 vlan-id 99

**Translation notes / semantic differences**

- Hierarchy: Junos is hierarchical/config-model driven. You configure the switching family under the physical interface (unit 0 → family ethernet-switching). Cisco’s switchport commands are interface-mode attributes; Junos splits physical + logical unit + family.- VLAN existence: On Junos you typically create vlans under the global vlans stanza (vlans vlan10 vlan-id 10). Some platforms accept numeric members without an explicit vlan stanza, but creating VLAN objects is best practice for features (IRB, L2 policing).- Encapsulation: Junos supports 802.1Q by default for ethernet-switching trunks; there is no explicit "switchport trunk encapsulation dot1q" command — nothing to set.- Native VLAN: native-vlan-id 99 on Junos maps untagged ingress frames to VLAN 99 and sends untagged egress frames. Behavior matches Cisco native VLAN, but Junos treats untagged traffic as mapped to native-vlan-id; if you omit native-vlan-id, untagged frames may be dropped or treated per platform defaults.- Allowed VLANs: Junos uses "vlan members" per interface. If you omit members on a trunk, the interface accepts all VLANs by default — opposite of some Cisco designs where you might restrict allowed VLANs explicitly.- Interface state: no shutdown is not necessary; interfaces are enabled by default. To administratively disable use "disable" on the interface in Junos.- Commit model: Junos uses transactional commit; you must commit changes. This prevents half-applied configs compared to line-by-line Cisco commits.- Other platform behaviors: - PVID / access-port: For access ports use "interface-mode access" and set "vlan members <id>". - On aggregated links (ae), configure unit 0 on aeX and set members on physical interfaces as part of bundle. - Some features (BPDU handling, protected ports, storm-control) require explicit per-VLAN or interface stanzas in Junos (not always same defaults as IOS).

Checklist when migrating:- Ensure VLAN objects exist.- Verify default-allowed behavior and explicitly configure members if you must restrict VLANs.- Confirm native-vlan behavior with your peer device (untagged handling) and enable bpdu/filter settings if needed.- Remember to commit and validate with "show configuration | display set" and test with "show ethernet-switching interfaces".

EasyTechnical

44 practiced

Configure Port Address Translation (PAT / NAT overload) on a Cisco router to allow hosts in the 192.168.10.0/24 inside network to reach the Internet using the public IP 198.51.100.2 assigned to GigabitEthernet0/1. Provide the exact IOS commands to configure NAT overload including interface directionality, explain the difference between static NAT and PAT/overload, and list the verification commands and what they show.

Sample Answer

**Configuration (commands to enter in global config):**

bash

interface GigabitEthernet0/1
 description WAN - public IP
 ip address 198.51.100.2 255.255.255.0
 ip nat outside
!
interface GigabitEthernet0/0
 description LAN - inside
 ip address 192.168.10.1 255.255.255.0
 ip nat inside
!
access-list 10 permit 192.168.10.0 0.0.0.255
ip nat inside source list 10 interface GigabitEthernet0/1 overload

- The ACL matches the inside local network. The last command configures NAT overload (PAT) using the interface IP 198.51.100.2.

**Interface directionality**- ip nat inside: applied to interfaces on the private/LAN side.- ip nat outside: applied to the interface facing the public/Internet side.

**Static NAT vs PAT/Overload**- Static NAT: 1:1 mapping (ip nat inside source static <local> <public>) — preserves a fixed public IP for an internal host; required for inbound reachability.- PAT/Overload: many-to-one mapping using ports; multiple internal hosts share one public IP with different source ports — ideal for outbound Internet access.

**Verification commands and what they show**- show ip nat translations - Lists active NAT translations (inside local/inside global and protocol/ports).- show ip nat statistics - Shows NAT engine counters, overload pool info, and translation counts.- show running-config | section ip nat - Confirms NAT config (ACL, pool/interface, overload).- show access-lists 10 - Verifies ACL matches the intended inside subnet.- debug ip nat - Real-time NAT translation events (use carefully in production).

Use these to confirm translations, troubleshoot port exhaustion, and validate ACL matching.

EasyTechnical

43 practiced

On a Cisco Catalyst switch, provide the CLI steps to create VLAN 10 named 'users' and VLAN 20 named 'servers', assign access ports GigabitEthernet0/1-0/10 to VLAN 10, assign ports 0/11-0/15 to VLAN 20, and configure a management SVI for VLAN 10 with IP 10.10.10.2/24 and default gateway 10.10.10.1. Include the verification commands you would run and explain when the SVI will transition to an 'up' state.

Sample Answer

**Approach (brief)** Below are the exact CLI steps I would run on a Cisco Catalyst switch, verification commands, and an explanation of when the SVI becomes up.

**Configuration steps**

enable
configure terminal
! Create VLANs and names
vlan 10
 name users
exit
vlan 20
 name servers
exit

! Configure access ports Gi0/1 - Gi0/10 to VLAN 10
interface range GigabitEthernet0/1 - 10
 switchport mode access
 switchport access vlan 10
 no shutdown
exit

! Configure access ports Gi0/11 - Gi0/15 to VLAN 20
interface range GigabitEthernet0/11 - 15
 switchport mode access
 switchport access vlan 20
 no shutdown
exit

! Create SVI for management on VLAN 10
interface Vlan10
 ip address 10.10.10.2 255.255.255.0
 no shutdown
exit

! Set default gateway for the switch (if Layer 2 device)
ip default-gateway 10.10.10.1
end
write memory

**Verification commands**- Show VLANs and port assignment:

show vlan brief
show interfaces status | include Gi0/1|Gi0/10|Gi0/11|Gi0/15

- Check SVI and IP:

show ip interface brief | include Vlan10
show running-config interface Vlan10

- Test reachability:

ping 10.10.10.1
show mac address-table vlan 10

**When SVI becomes 'up'** An SVI enters “up/up” only when the VLAN exists and at least one active (up) L2 port in that VLAN has link up or a routed interface/neighbor is reachable for that VLAN. For a Catalyst switch acting as access-layer, ensure at least one access port in VLAN 10 is physically up (or a host is connected) — then Vlan10 will show line protocol up. If no local ports are up, SVI stays administratively up but line protocol down until carrier is present or routed adjacency (e.g., EVPN) provides reachability.

MediumTechnical

45 practiced

Write an extended ACL (named) for a Cisco router that permits HTTPS (TCP/443) from the 10.1.1.0/24 network to the 172.16.0.0/16 server network, explicitly denies Telnet, permits DNS queries, denies all other traffic, and logs denied matches. Apply it inbound on the WAN-facing interface. Explain the order of ACL processing and any performance or operational considerations about heavy logging.

Sample Answer

**Sample ACL configuration**

text

ip access-list extended WAN-IN
 remark Allow HTTPS from 10.1.1.0/24 to 172.16.0.0/16
 permit tcp 10.1.1.0 0.0.0.255 172.16.0.0 0.0.255.255 eq 443
 remark Deny Telnet and log
 deny tcp 10.1.1.0 0.0.0.255 172.16.0.0 0.0.255.255 eq 23 log
 remark Permit DNS (UDP and TCP)
 permit udp 10.1.1.0 0.0.0.255 any eq 53
 permit tcp 10.1.1.0 0.0.0.255 any eq 53
 remark Deny everything else and log
 deny ip any any log
!
interface GigabitEthernet0/0
 description WAN-facing interface
 ip access-group WAN-IN in

**Order of ACL processing**- ACLs are evaluated top-to-bottom. The first matching ACE (access control entry) is applied and processing stops.- If no ACE matches, implicit "deny ip any any" at the end would drop the packet. Here we explicitly deny-and-log remaining traffic.

**Performance & operational considerations**- Logging on every denied match can be CPU-intensive and flood buffers during attacks or scans. Avoid logging high-frequency matches.- Use targeted logging (only on critical denies), rate-limit syslog, or sample/aggregate with NetFlow/IPS for analytics.- Consider using ACL counters (show access-lists) for monitoring instead of verbose logging.- For stateful needs or complex policies, use a firewall or zone-based firewall rather than large router ACLs.

EasyTechnical

36 practiced

On a Cisco IOS device, list and demonstrate the full set of CLI commands to enable SSH v2, set an ip domain-name, generate an RSA key pair with 2048 bits, create a local username 'admin' with a secret and privilege 15, and configure the vty lines to use local authentication while disabling Telnet. Also show how to restrict SSH access to a management subnet (10.0.0.0/24).

Sample Answer

**Brief approach**Show the exact IOS commands in order: set domain, create local user, enable SSHv2, generate 2048-bit RSA key, configure vty to use local auth and disable Telnet, and restrict SSH to 10.0.0.0/24 using an ACL applied to vty lines.

**Commands**

text

conf t
 ip domain-name example.com
 username admin privilege 15 secret StrongSecret!   ! replace with secure secret
 ip ssh version 2
 crypto key generate rsa modulus 2048
! (When prompted, confirm overwrite if needed)
!
! Restrict SSH to management subnet 10.0.0.0/24
access-list 10 permit 10.0.0.0 0.0.0.255
access-list 10 deny any
!
line vty 0 4
 access-class 10 in        ! apply ACL to incoming VTY sessions
 login local               ! use local username database
 transport input ssh       ! disable telnet (no transport input telnet)
 exit
end
write memory

**Notes / reasoning**- ip domain-name must exist before generating RSA keys (key uses fqdn).- ip ssh version 2 enforces SSHv2 for stronger crypto.- crypto key generate rsa modulus 2048 produces a 2048-bit key (recommended minimum).- username with privilege 15 gives full admin rights; use secret (hashed) not plain password.- transport input ssh ensures Telnet is disabled.- access-class on vty limits which source IPs can initiate SSH; ACL 10 example permits only 10.0.0.0/24.- Save config with write memory.

Unlock Full Question Bank

Get access to hundreds of Router and Switch Configuration interview questions and detailed answers.

Join thousands of developers preparing for their dream job.