Switching & Routing — Interview Q&A Guide
Switching & Routing
Interview Q&A Guide
55 Questions with Detailed Answers
1. Switching Fundamentals
Q1. What is the difference between a hub, switch, and router?
A hub is a Layer 1 device that broadcasts all traffic to every port — all devices share the same collision
domain. A switch is a Layer 2 device that forwards frames based on MAC addresses; each port is its
own collision domain, but all ports share the same broadcast domain. A router is a Layer 3 device that
forwards packets based on IP addresses and separates broadcast domains, enabling communication
between different networks.
Q2. How does a switch learn MAC addresses and build its CAM table?
When a frame arrives, the switch reads the source MAC address and records it along with the incoming
port number and a timestamp into the Content Addressable Memory (CAM) table. This is called
dynamic learning. When the switch needs to forward a frame, it looks up the destination MAC in the
CAM table to determine the correct outgoing port. Entries age out (default 300 seconds) if not
refreshed.
Q3. What happens when a switch receives a frame with an unknown destination MAC?
The switch performs a unicast flood — it forwards (floods) the frame out all ports except the one it
arrived on. This is also called unknown unicast flooding. The correct destination host will respond,
allowing the switch to learn its MAC address and port. The same flooding behavior applies to broadcast
and multicast frames.
Q4. Explain the difference between a collision domain and a broadcast domain.
A collision domain is a network segment where simultaneous transmissions collide. Each switch port is
its own collision domain (eliminating collisions in full-duplex). A broadcast domain is the set of devices
that receive a broadcast frame. Switches forward broadcasts to all ports within the same VLAN, so a
single VLAN equals one broadcast domain. Routers break up broadcast domains — they do not
forward broadcasts by default.
Q5. What is store-and-forward vs. cut-through switching?
In store-and-forward mode, the switch receives the entire frame, checks it for errors (via FCS/CRC),
and only then forwards it — higher latency but ensures error-free delivery. In cut-through mode, the
switch begins forwarding the frame as soon as it reads the destination MAC (after just 14 bytes),
resulting in much lower latency but no error checking. A middle ground called fragment-free waits for 64
bytes before forwarding, catching the most common collision-caused errors.
Q6. What is MAC flooding and how do you mitigate it?
MAC flooding is an attack where an adversary sends thousands of frames with spoofed source MAC
addresses, filling the CAM table. Once the table is full, the switch behaves like a hub and floods all
Page 1 of 10
Switching & Routing — Interview Q&A Guide
traffic — exposing it to the attacker. Mitigation techniques include Port Security (limiting the number of
MAC addresses per port and defining actions like shutdown or restrict), 802.1X authentication, and
Dynamic ARP Inspection (DAI).
2. VLANs & Trunking
Q7. What is a VLAN and why is it used?
A VLAN (Virtual LAN) is a logical segmentation of a switch that groups ports into separate broadcast
domains without requiring physical separation. Benefits include improved security (isolating sensitive
traffic), reduced broadcast traffic, simplified administration, and the ability to apply different QoS
policies. VLANs are defined by IEEE 802.1Q.
Q8. What is the difference between an access port and a trunk port?
An access port belongs to a single VLAN and connects end devices (PCs, printers). It does not tag
frames — the device is unaware of VLANs. A trunk port carries traffic for multiple VLANs
simultaneously, tagging frames with 802.1Q tags so the receiving switch knows which VLAN each
frame belongs to. Trunks are typically used between switches, or between a switch and a
router/firewall.
Q9. Explain 802.1Q tagging. What is the native VLAN?
IEEE 802.1Q adds a 4-byte tag into the Ethernet frame header after the source MAC address. The tag
includes a 12-bit VLAN ID (supporting up to 4094 VLANs), a 3-bit Priority Code Point (PCP) for QoS,
and a Drop Eligible Indicator (DEI). The native VLAN is the one VLAN on a trunk whose frames are
sent untagged. Both ends of a trunk must agree on the native VLAN, or a VLAN mismatch vulnerability
arises. By default, VLAN 1 is the native VLAN on Cisco devices.
Q10. What is VLAN hopping and how do you prevent it?
VLAN hopping allows an attacker to send traffic to a VLAN they should not have access to. Two
methods exist: Switch Spoofing (where the attacker tricks a switch into forming a trunk using DTP) and
Double Tagging (nesting an inner VLAN tag inside a native VLAN frame). Prevention: disable DTP on
all access ports (switchport nonegotiate), change the native VLAN to an unused VLAN (e.g., VLAN
999), and disable unused ports.
Q11. What is a voice VLAN and how does it work?
A voice VLAN allows a single access port to carry both data and voice traffic by tagging voice frames
with a separate VLAN ID. The switch sends CDP/LLDP to the IP phone telling it to use the configured
voice VLAN. The phone tags its voice traffic with that VLAN and passes untagged data traffic for the PC
connected behind it. This allows QoS to be applied differently to voice vs. data traffic.
Q12. How do you allow inter-VLAN routing?
Since VLANs are separate broadcast domains, routing is required for communication between them.
Three methods: (1) Router on a Stick — a single router interface with sub-interfaces for each VLAN,
each tagged with 802.1Q; (2) Layer 3 Switch — a switch with a routing engine using Switched Virtual
Interfaces (SVIs) for each VLAN; (3) Separate physical router interfaces per VLAN (rarely used due to
port waste). Layer 3 switching is the preferred enterprise solution for performance.
Page 2 of 10
Switching & Routing — Interview Q&A Guide
3. Spanning Tree Protocol (STP)
Q13. What problem does STP solve?
STP (IEEE 802.1D) prevents Layer 2 loops in redundant switched networks. Without STP, a broadcast
frame entering a loop would circulate indefinitely — consuming all bandwidth and causing a broadcast
storm. STP logically blocks redundant paths while keeping them available for failover, ensuring there is
only one active path between any two devices.
Q14. Explain the STP port states: Blocking, Listening, Learning, Forwarding, Disabled.
Blocking: the port receives BPDUs but does not forward traffic or learn MACs — prevents loops.
Listening: the port participates in BPDU exchange to determine the active topology; no user traffic or
MAC learning yet. Learning: the port builds the MAC table but still does not forward user frames.
Forwarding: the port fully forwards traffic and learns MACs — this is the operational state. Disabled: the
port is administratively shut down. STP convergence moves ports through these states, taking up to 50
seconds in classic STP.
Q15. How is the Root Bridge elected?
The switch with the lowest Bridge ID becomes the Root Bridge. The Bridge ID is an 8-byte value
composed of a 2-byte priority (default 32768) and the switch's 6-byte base MAC address. The switch
with the lowest priority wins; ties are broken by the lowest MAC address. Administrators can influence
election by setting a lower priority (e.g., 4096 or 0) on the desired root bridge using 'spanning-tree vlan
X priority Y'.
Q16. What is the difference between STP, RSTP, and MSTP?
STP (802.1D) is the original standard with convergence times of 30–50 seconds. RSTP (802.1w —
Rapid STP) introduces rapid convergence (1–2 seconds) using new port roles (Alternate, Backup) and
a handshake mechanism, replacing Listening/Blocking with Discarding. MSTP (802.1s — Multiple STP)
maps multiple VLANs to multiple spanning tree instances, reducing CPU overhead and enabling load
balancing across redundant links. Modern networks use RSTP or MSTP (Cisco's PVST+/Rapid PVST+
are vendor-specific variants).
Q17. What are PortFast, BPDU Guard, and BPDU Filter — and when would you use
each?
PortFast skips the Listening and Learning states and immediately moves a port to Forwarding — used
only on access ports connected to end devices (not switches) to speed up connectivity. BPDU Guard
shuts down a PortFast-enabled port if a BPDU is received, preventing rogue switches from affecting the
STP topology. BPDU Filter suppresses BPDUs on a port; when applied globally it only suppresses if no
BPDUs are received — use carefully, as it can create loops if misconfigured.
Q18. What is a topology change notification (TCN)?
A TCN is a special BPDU sent toward the Root Bridge when a switch detects a topology change (e.g.,
a port transitions to Forwarding or a link goes down). The Root Bridge responds by sending a Topology
Change (TC) BPDU to all switches, causing them to flush their MAC tables and shorten the aging timer
to 15 seconds. This ensures old MAC-to-port mappings are removed quickly, preventing traffic from
being sent to incorrect ports.
Q19. What is Root Guard and Loop Guard?
Root Guard prevents a port from becoming a root port — if a superior BPDU is received on a Root
Guard-enabled port, that port is placed into a root-inconsistent state and does not forward traffic. This
Page 3 of 10
Switching & Routing — Interview Q&A Guide
protects the current Root Bridge. Loop Guard protects against unidirectional link failures where a non-
designated port stops receiving BPDUs (and STP might incorrectly transition it to Forwarding). With
Loop Guard enabled, the port enters a loop-inconsistent blocking state instead.
4. Routing Fundamentals
Q20. How does a router make a forwarding decision?
When a router receives a packet, it looks at the destination IP address and performs a longest prefix
match in its routing table — finding the most specific route that matches the destination. If a match is
found, the router forwards the packet out the corresponding interface toward the next hop. If multiple
routes with the same prefix length exist from different protocols, the one with the lowest Administrative
Distance wins. If no match exists, the packet is sent via the default route ([Link]/0), or dropped if none
is configured.
Q21. What is the difference between static routing and dynamic routing?
Static routes are manually configured by an administrator and do not adapt to network changes — they
are simple, predictable, and carry no routing protocol overhead, making them ideal for small networks
or specific policy routes. Dynamic routing uses protocols (OSPF, EIGRP, BGP) to automatically
discover routes and adapt to topology changes. Dynamic routing scales well but requires protocol
overhead and careful design to avoid routing loops or misconfiguration.
Q22. What is Administrative Distance (AD)? Give examples for common protocols.
Administrative Distance is a metric used to rank the trustworthiness of a routing information source.
When multiple protocols advertise the same prefix, the route with the lowest AD wins. Common values:
Connected (0), Static (1), EIGRP Summary (5), eBGP (20), EIGRP Internal (90), OSPF (110), IS-IS
(115), RIP (120), EIGRP External (170), iBGP (200). A connected interface is always preferred; iBGP is
least trusted among dynamic protocols.
Q23. What is the difference between routed and routing protocols?
A routed protocol carries user data across the network — it defines the packet format and addressing
scheme (e.g., IP, IPv6, IPX). A routing protocol is used by routers to exchange network reachability
information and build routing tables (e.g., OSPF, EIGRP, RIP, BGP). Think of it this way: routing
protocols build the map, routed protocols carry the traffic using that map.
Q24. Explain the concept of longest prefix match.
When a router has multiple routes that could match a destination IP, it selects the route with the longest
(most specific) subnet mask — this is longest prefix match. For example, if the routing table has
[Link]/24 and [Link]/25, a packet for [Link] matches both, but /25 is more
specific and is chosen. This enables hierarchical routing and route summarization while still allowing
specific exceptions.
Q25. What is a default route and when would you use it?
A default route ([Link]/0 for IPv4, ::/0 for IPv6) is a catch-all route used when no more specific match
exists in the routing table. It is commonly used on edge routers to forward all internet-bound traffic to an
ISP, and on spoke sites in hub-and-spoke designs to route all traffic through the hub. As the least
specific route, it is only selected when no other route matches.
Page 4 of 10
Switching & Routing — Interview Q&A Guide
5. Routing Protocols
Q26. What is the difference between distance-vector and link-state routing protocols?
Distance-vector protocols (RIP, EIGRP) share routing tables with directly connected neighbors — each
router knows the 'distance' and 'direction' (vector) to a destination but not the full topology. They are
simpler but slower to converge and more prone to routing loops (mitigated by split horizon, poison
reverse). Link-state protocols (OSPF, IS-IS) share information about the state of each link with all
routers in the area. Every router builds a complete topology map and runs Dijkstra's SPF algorithm.
They converge faster and are more scalable but require more CPU and memory.
Q27. Compare RIP, OSPF, and EIGRP — when would you use each?
RIP (Routing Information Protocol) is a simple distance-vector protocol using hop count as its metric
(max 15 hops). It is slow to converge (up to 180 seconds) and unsuitable for large networks — useful
only in small, simple labs. OSPF is an open-standard link-state protocol that scales well, converges
fast, and supports hierarchical design with areas. It is the preferred IGP in most enterprise and service
provider environments. EIGRP (Enhanced IGRP) is a Cisco advanced distance-vector protocol that
offers fast convergence via DUAL algorithm, uses composite metric (bandwidth + delay by default), and
supports unequal-cost load balancing — ideal in Cisco-only environments.
Q28. What is split horizon and why is it important?
Split horizon is a loop-prevention rule that states a router should not advertise a route back out the
same interface from which it was learned. This prevents a router from misleading its neighbor into
thinking it has a path through it to a network it actually reaches through that neighbor. For example, if
Router A learns about Network X from Router B, A will not re-advertise Network X back to B. Poison
reverse is an enhancement where the router does advertise the route back but with an infinite metric,
more aggressively breaking potential loops.
Q29. Explain OSPF neighbor states (Down → Full).
Down: no hellos received. Init: a hello has been received but the router's own RID is not in it yet. 2-
Way: the router sees its own RID in the neighbor's hello — basic bidirectional communication
established (DR/BDR election happens here). ExStart: routers negotiate master/slave roles and initial
sequence numbers for DBD exchange. Exchange: routers exchange Database Description (DBD)
packets summarizing their LSDBs. Loading: routers send Link State Requests (LSRs) and receive Link
State Updates (LSUs) for missing LSAs. Full: LSDBs are synchronized — this is the desired operational
state.
Q30. What is an OSPF DR/BDR and why are they needed?
On multi-access networks (like Ethernet), if every OSPF router formed full adjacencies with every other
router, the number of adjacencies would grow as n(n-1)/2. A Designated Router (DR) and Backup DR
(BDR) are elected to act as a central hub — all other routers (DROthers) form full adjacencies only with
the DR and BDR, reducing the number of adjacencies. All routing updates are sent to the DR (multicast
[Link]), which then floods them to all routers ([Link]). DR election is based on highest OSPF
priority (default 1), then highest RID.
Q31. What are OSPF area types (backbone, stub, NSSA, totally stubby)?
Backbone (Area 0): the core area — all other areas must connect to it. Normal Area: receives all LSA
types including external routes. Stub Area: does not accept Type 5 external LSAs — ABRs inject a
default route instead, reducing LSDB size. Totally Stubby Area (Cisco proprietary): also blocks Type 3
summary LSAs — only a default route is injected, minimizing the LSDB. NSSA (Not-So-Stubby Area):
Page 5 of 10
Switching & Routing — Interview Q&A Guide
like stub but allows redistribution of external routes via Type 7 LSAs, which are converted to Type 5 at
the ABR. Totally NSSA combines NSSA with totally stubby behavior.
Q32. What is route redistribution and what are the risks?
Route redistribution is the process of taking routes learned from one routing protocol and injecting them
into another (e.g., redistributing OSPF into EIGRP). It is necessary when multiple routing protocols
coexist in a network. Risks include: routing loops (if redistribution happens bidirectionally without care),
suboptimal routing (metrics are not directly comparable between protocols), and route feedback (a
route learned via redistribution re-enters the original protocol, causing confusion). Mitigation: use route
maps and prefix lists to filter and control what is redistributed, and set appropriate metrics and tags.
Q33. Explain BGP and when you would use it over IGPs.
BGP (Border Gateway Protocol) is the routing protocol of the internet — a path-vector protocol that
uses TCP (port 179) for reliable neighbor sessions. BGP is used when you need to exchange routes
between different Autonomous Systems (AS), such as connecting to multiple ISPs (multi-homing),
becoming a transit provider, or implementing complex routing policy. Unlike IGPs, BGP does not
optimize for shortest path; instead, it makes decisions based on policies using attributes like AS path,
local preference, MED, and communities. You would use BGP over IGPs when you need inter-AS
routing, traffic engineering, or policy-based routing at scale.
Q34. What is the difference between iBGP and eBGP?
iBGP (internal BGP) runs between routers within the same AS. eBGP (external BGP) runs between
routers in different ASes. Key differences: iBGP requires full-mesh peering (or route
reflectors/confederations) because iBGP routes are not re-advertised to other iBGP peers (split horizon
rule). eBGP changes the next-hop attribute to itself when advertising routes; iBGP typically does not
change next-hop. eBGP TTL defaults to 1 (directly connected peers); iBGP uses TTL 255.
Administrative distance: eBGP is 20, iBGP is 200.
Q35. What are BGP path selection attributes (weight, local preference, AS path, MED,
etc.)?
BGP selects the best path using a sequential decision process: (1) Highest Weight (Cisco-specific,
local to router); (2) Highest Local Preference (preferred exit from the AS); (3) Locally originated routes
(network/aggregate/redistribute); (4) Shortest AS Path; (5) Lowest Origin (IGP < EGP < ?); (6) Lowest
MED (Multi-Exit Discriminator — hints to a neighboring AS about preferred entry); (7) eBGP over iBGP;
(8) Lowest IGP metric to next hop; (9) Lowest Router ID. Understanding and manipulating these
attributes is core to BGP traffic engineering.
6. IP & Subnetting
Q36. What is CIDR and how does it differ from classful addressing?
Classful addressing assigned fixed subnet masks based on the first octet: Class A (/8), Class B (/16),
Class C (/24). This was extremely wasteful — a company needing 500 addresses had to get a Class B
(/16 = 65,534 hosts). CIDR (Classless Inter-Domain Routing, RFC 1519) allows any prefix length,
enabling right-sized allocations (e.g., /23 for ~500 hosts). CIDR also enables route summarization,
dramatically reducing the size of internet routing tables.
Page 6 of 10
Switching & Routing — Interview Q&A Guide
Q37. Subnet a /24 into 8 equal subnets — what is the new mask?
To create 8 subnets from a /24, you need to borrow 3 bits (2^3 = 8). The new mask becomes /27 (24 +
3 = 27), or [Link]. Each /27 subnet provides 30 usable host addresses (32 - 2 for network
and broadcast). For [Link]/24, the 8 subnets would be: .0, .32, .64, .96, .128, .160, .192, .224 —
each with a /27 mask.
Q38. What is the difference between public and private IP addresses?
Private IP addresses are defined in RFC 1918 and are not routable on the public internet: [Link]/8,
[Link]/12, and [Link]/16. They can be reused within any private network. Public IP
addresses are globally unique and routable on the internet — they must be registered and allocated
through IANA/RIRs. Private addresses reach the internet via NAT, which translates them to a public
address.
Q39. How does NAT/PAT work? What are its advantages and drawbacks?
NAT (Network Address Translation) maps private IP addresses to public IP addresses. PAT (Port
Address Translation), also called NAT overload, extends this by multiplexing many private IPs onto a
single public IP using unique source port numbers. Advantages: conserves public IPv4 addresses,
hides internal topology (security by obscurity), and simplifies ISP changes (only the NAT device needs
reconfiguring). Drawbacks: breaks end-to-end connectivity, complicates applications that embed IP
addresses in payloads (FTP, SIP), adds latency, and makes troubleshooting harder.
Q40. What is IPv6 and how does it differ from IPv4 in routing behavior?
IPv6 uses 128-bit addresses (vs. 32-bit in IPv4), providing a virtually unlimited address space. Key
routing differences: IPv6 eliminates broadcast (replaced by multicast and anycast), uses NDP
(Neighbor Discovery Protocol) instead of ARP, and supports stateless address autoconfiguration
(SLAAC). OSPFv3 is used for IPv6, and BGP carries IPv6 prefixes via MP-BGP (Multi-Protocol BGP).
IPv6 headers are simpler (fixed 40 bytes) and include a Flow Label field for QoS. Fragmentation is
handled only by the source host, not routers.
7. High Availability & Redundancy
Q41. What is HSRP, VRRP, and GLBP? How do they differ?
All three are First Hop Redundancy Protocols (FHRP) that provide a virtual gateway IP for hosts. HSRP
(Hot Standby Router Protocol) is Cisco-proprietary — one router is Active, one is Standby; only the
Active router forwards traffic. VRRP (Virtual Router Redundancy Protocol, RFC 5798) is the open-
standard equivalent of HSRP with similar behavior. GLBP (Gateway Load Balancing Protocol) is Cisco-
proprietary and unique in that it actively load-balances traffic across multiple routers simultaneously
using a virtual MAC address per router, unlike HSRP/VRRP which waste the standby router's
forwarding capacity.
Q42. What is ECMP (Equal-Cost Multi-Path) routing?
ECMP allows a router to use multiple paths of equal cost to a destination simultaneously, distributing
traffic across them for load balancing and increased throughput. The load distribution method varies by
platform — common methods include per-destination (hash on src/dst IP), per-packet (round robin), or
per-flow (hash on 5-tuple). OSPF, EIGRP, IS-IS, and BGP all support ECMP. EIGRP additionally
supports unequal-cost load balancing via the variance command.
Page 7 of 10
Switching & Routing — Interview Q&A Guide
Q43. What is the difference between link aggregation (LAG/LACP) and spanning tree?
Link Aggregation (LAG) combines multiple physical links between two devices into a single logical link
using LACP (IEEE 802.3ad) or PAgP (Cisco). The bundled link provides increased bandwidth and
active/active redundancy — both links forward traffic simultaneously. STP, by contrast, blocks
redundant links to prevent loops, wasting bandwidth. LAG is preferred where possible because it
provides both redundancy and load balancing without blocking. STP is still needed for network-wide
loop prevention, but LAG reduces the number of blocked ports.
Q44. Explain active/active vs. active/passive failover.
In active/passive (or active/standby) failover, one device handles all traffic while the other sits idle and
monitors the primary. If the primary fails, the secondary takes over. This is simple but wasteful — the
standby device capacity is unused. In active/active failover, both devices handle traffic simultaneously.
This maximizes resource utilization and provides redundancy, but requires more complex configuration
and state synchronization. Examples: HSRP is active/passive; GLBP is active/active; firewall clustering
can be either model depending on the vendor and configuration.
8. Troubleshooting
Q45. A host cannot reach a gateway — walk me through your troubleshooting steps.
Start at Layer 1 and work up. (1) Physical: verify cable and interface link status — 'show interfaces' for
errors, duplex/speed mismatches. (2) Layer 2: confirm the host is in the correct VLAN and the switch
port is in the right access VLAN. (3) Layer 3: verify the host has the correct IP, subnet mask, and
default gateway configured. (4) Ping the gateway from the host — if it fails, ping from the switch SVI. (5)
Check the gateway SVI is up/up. (6) Review ACLs that might block ICMP. (7) Check for MAC/ARP
table entries — 'show mac address-table' and 'show arp'. Use systematic OSI-model troubleshooting:
isolate the layer of failure before diving into specific protocols.
Q46. Two hosts in the same VLAN cannot ping each other — what do you check?
If both hosts are in the same VLAN, routing is not involved. Check: (1) Both are assigned the same
VLAN and IP subnet. (2) No ACL on the switch or upstream device blocking the traffic. (3) Port security
— is one port shutdown due to a MAC violation? (4) STP — is a port in blocking state? (5) Check the
MAC table: 'show mac address-table' — do both MACs appear on the correct ports? (6) Check for
duplicate IP addresses causing ARP confusion. (7) Verify both hosts have correct ARP entries — clear
ARP cache and retry. (8) Check for firewall software on the hosts blocking ICMP.
Q47. You have an asymmetric routing problem — how do you identify and fix it?
Asymmetric routing occurs when the forward and return paths of a flow differ. Signs include stateful
firewall dropping sessions, TCP sessions not establishing, or traceroute showing different paths in each
direction. To identify: run traceroute from both ends and compare paths. Also check routing tables on
all devices involved. Fixes: adjust routing metrics to prefer the same path in both directions (e.g., OSPF
cost, BGP local preference), use policy-based routing to force symmetric paths, or configure stateful
devices to handle asymmetric flows (some firewalls support asymmetric routing mode).
Q48. OSPF neighbors are stuck in EXSTART/EXCHANGE — what are common causes?
The most common cause is an MTU mismatch — if one router's interface MTU differs from the
neighbor's, DBD packets may be fragmented or dropped. Fix with 'ip ospf mtu-ignore' or align MTUs.
Other causes: duplicate OSPF Router IDs (two routers with the same RID cannot fully synchronize),
Page 8 of 10
Switching & Routing — Interview Q&A Guide
authentication mismatch (one side has MD5 auth, the other does not), or access list blocking OSPF
packets (IP protocol 89). Check 'show ip ospf neighbor', 'show ip ospf interface', and 'debug ip ospf adj'
for diagnostics.
Q49. BGP session keeps dropping — what would you investigate?
BGP uses TCP port 179 — check connectivity first with a TCP test. Then investigate: (1) BGP
keepalive/hold timer mismatch — if hold timer expires, the session drops; verify with 'show bgp
neighbors'. (2) MD5 authentication key mismatch. (3) Routing issue — can the routers reach each
other's BGP source IPs? For iBGP, this is often a loopback — ensure the loopback is reachable. (4)
Interface flapping causing the BGP TCP session to reset. (5) Route reflector or confederation
misconfiguration. (6) ISP-side issues in eBGP. Use 'debug ip bgp' and 'show bgp neighbors' for detailed
state.
Q50. How do you use traceroute and ping to isolate a routing issue?
Ping tests end-to-end reachability — a successful ping confirms Layer 3 connectivity; a failed ping
narrows the problem. Ping with extended options (source interface, size, repeat count) to test specific
paths. Traceroute maps the path by incrementing TTL from 1 and recording each hop's ICMP TTL
Exceeded response — it identifies exactly where in the path packets stop. Analyze traceroute: where
does it stop or show high latency? Asymmetry between forward and reverse paths indicates
asymmetric routing. Asterisks (*) mean either the hop is filtering ICMP or the return path is broken.
Combine with 'show ip route' on each hop to trace the forwarding decision.
9. Scenario-Based / Design Questions
Q51. Design a redundant L3 network for a 3-tier architecture (core/distribution/access).
In a 3-tier design: Access layer switches connect end devices and uplink to Distribution switches in a
redundant triangle (two uplinks, one to each distribution switch). Use RSTP with PortFast on access
ports. Distribution layer handles inter-VLAN routing via SVIs, implements QoS, and uplinks to Core with
L3 links (no STP). Core layer provides high-speed, low-latency routing between distribution blocks and
to the WAN/data center — use OSPF or EIGRP for routing, with ECMP for load balancing. Use
HSRP/VRRP at distribution for gateway redundancy. Keep the core L3-only (routed links) to eliminate
STP dependencies and maximize performance.
Q52. When would you choose L2 over L3 at the access layer?
L2 access is traditional and still common when: VMs or servers need to move between hypervisor hosts
without IP changes (vMotion), applications require Layer 2 adjacency, or when simplicity is preferred in
smaller environments. L3 access is increasingly preferred in modern networks and data centers —
each access switch has a routed uplink, eliminating STP and providing faster convergence, more
deterministic load balancing, and better scalability. Choose L2 access when application mobility and
broadcast requirements demand it; choose L3 access for scale, predictability, and eliminating STP risk
in large environments.
Q53. How would you segment a network for security using VLANs and ACLs?
Segment the network into security zones using VLANs: User VLAN, Server VLAN, DMZ VLAN,
Management VLAN, and Voice VLAN. Apply ACLs at the L3 boundary (distribution/core SVIs or
firewall) to control inter-VLAN traffic based on business policy — for example, allow user VLAN to reach
server VLAN on specific ports (HTTP/S, DNS) but block server-to-user initiated connections. Place
internet-facing services in a DMZ with strict ACLs on both sides. Isolate the management VLAN — only
Page 9 of 10
Switching & Routing — Interview Q&A Guide
authorized IP ranges should access network devices. Use private VLANs (PVLANs) in sensitive
segments to prevent lateral movement between hosts in the same VLAN.
Q54. A customer needs to connect two data centers — what routing options would you
consider?
Options depend on distance, bandwidth, and latency requirements. (1) MPLS L3VPN: the most
common enterprise WAN solution — ISP provides a private routed overlay with QoS guarantees; use
BGP or OSPF over the VPN. (2) Dark fiber or dedicated leased line: highest performance, no shared
medium, but expensive. (3) SD-WAN: overlays multiple transports (MPLS, internet, LTE) with
centralized policy — good for cost optimization. (4) VXLAN/EVPN: extends L2/L3 over IP for seamless
VM mobility between data centers. (5) IPsec VPN over internet: low cost but variable latency. For
critical workloads, MPLS or dedicated fiber is preferred; SD-WAN suits enterprises needing flexibility
and cost control.
Q55. How do you handle route summarization and when is it beneficial?
Route summarization (aggregation) combines multiple specific prefixes into a single, shorter prefix
advertisement. For example, [Link]/24 through [Link]/24 can be summarized as [Link]/21.
Benefits: smaller routing tables (lower memory and CPU), faster SPF calculations in OSPF, reduced
convergence time, and hiding internal topology instability. In OSPF, summarization is configured at
ABRs (inter-area) and ASBRs (external). In EIGRP, it can be done per interface. Summarization
requires careful IP address planning — addresses within a summary must be contiguous. The
downside is that a summary masks failures of individual subnets, so black-hole routes (null0) are used
to prevent routing loops when summarizing.
Page 10 of 10