300-410 ENARSI Lab: Stop a Two-Router Redistribution Loop With Route Tags

Mutual redistribution between OSPF and EIGRP on two routers is safe only when each boundary router refuses to send a route back into the protocol it came from. On Cisco IOS the simplest way to enforce that is a route tag, set on the way out and denied on the way back. That one idea covers the first four tasks of the 300-410 ENARSI blueprint: administrative distance, route maps, loop prevention and redistribution.

This post builds the problem in a four-router lab, shows what breaks, and fixes it twice: once with tags and once with administrative distance. Every command is standard IOS or IOS XE, so you can paste it into CML, EVE-NG or GNS3.

What does 300-410 ENARSI test, and where does redistribution fit?

ENARSI is the CCNP Enterprise concentration exam on advanced routing and services. According to Cisco's 300-410 ENARSI exam page, it is a 90-minute exam that costs US$300 (or Cisco Learning Credits) and is offered in English and Japanese. Passing it also earns the Cisco Certified Specialist - Enterprise Advanced Infrastructure Implementation credential.

The blueprint has four domains:

Domain	Weight
1.0 Layer 3 Technologies	35%
2.0 VPN Technologies	20%
3.0 Infrastructure Security	20%
4.0 Infrastructure Services	25%

The first four tasks in domain 1.0 read like a description of this lab: troubleshoot administrative distance (1.1), route maps with tagging and filtering (1.2), loop prevention (1.3) and redistribution between any routing protocols (1.4). The official 300-410 ENARSI v1.1 exam topics list them word for word and say questions come as performance-based items, multiple choice and drag-and-drop.

What does the lab look like?

Four routers, two routing domains and two boundary routers:

• R1 runs OSPF area 0 only and has Loopback0, 1.1.1.1/32, in OSPF.
• R2 and R3 run OSPF area 0 toward R1 and EIGRP AS 100 toward R4. Both redistribute in both directions.
• R4 runs EIGRP only and injects its LAN, 172.16.4.0/24, with redistribute connected. That makes the LAN an EIGRP external route before it ever reaches a boundary router.

The starting configuration on R2 is below. R3 gets the same lines with its own router ID and interfaces.

router ospf 1
 router-id 2.2.2.2
 network 10.0.12.0 0.0.0.255 area 0
 redistribute eigrp 100 subnets
!
router eigrp 100
 network 10.0.24.0 0.0.0.255
 redistribute ospf 1 metric 100000 10 255 1 1500

EIGRP needs a seed metric for anything it takes from another routing protocol. The five values are bandwidth in kbps, delay in tens of microseconds, reliability, load and MTU. Leave them out and the OSPF routes never show up in EIGRP. OSPF needs no seed: redistributed routes arrive as type E2 with a metric of 20.

Why does R3 send traffic the long way?

Follow 172.16.4.0/24 from R4:

1. R4 advertises it to R2 and R3 as an EIGRP external route with administrative distance 170.
2. Say R2 redistributes it into OSPF first. R1 and R3 now receive an O E2 route for the same prefix, with administrative distance 110.
3. R3 holds two candidates: D EX at 170 from R4 next door, and O E2 at 110 through R1 and R2. Lower distance wins, so R3 installs the OSPF route and sends traffic for R4's LAN three hops round instead of one.
4. Because R3's routing table now lists the prefix as OSPF, R3's own redistribute ospf 1 hands it back to EIGRP with the seed metric. A route that started in EIGRP is now advertised into EIGRP by a router that learned it from OSPF.

When R4's LAN goes down, those copies take time to drain, and for a short while R4 can learn its own LAN back from R3. With more prefixes and more paths, this is how mutual redistribution produces flapping routes and transient loops. Which boundary router "wins" also depends on timing, so the symptom can move after a reload.

The Cisco tech note on configuring routing protocol redistribution describes the same pattern: mutual redistribution at two points can cause suboptimal routing, routing loops or slow convergence. Its rule is to never announce information received from one routing process back into that same process.

Prove the problem before you fix it:

R3# show ip route 172.16.4.0
! Known via "ospf 1", distance 110 ... type extern 2   <- the long way
R3# show ip eigrp topology 172.16.4.0/24
! the EIGRP external path from R4 is still here, just not installed
R3# traceroute 172.16.4.1
! three hops (R1, R2, R4) instead of one

The second command also explains why R3 does not redistribute that prefix into OSPF. Cisco's rule is that a redistributed route must be in the routing table; a route that only sits in the EIGRP topology table does not count.

How do route tags stop the feedback?

A tag is a number that travels with an external route. OSPF carries it in the type 5 LSA and EIGRP carries it in the external route data, so a boundary router can mark a route on the way out and recognise it on the way back. The plan has two rules:

• EIGRP into OSPF: deny anything tagged 110, tag the rest 90.
• OSPF into EIGRP: deny anything tagged 90, tag the rest 110.

The numbers are arbitrary. Using the default administrative distance of the source protocol just makes them easy to read in show output. Apply the same block on R2 and R3:

route-map EIGRP-TO-OSPF deny 10
 match tag 110
route-map EIGRP-TO-OSPF permit 20
 set tag 90
!
route-map OSPF-TO-EIGRP deny 10
 match tag 90
route-map OSPF-TO-EIGRP permit 20
 set tag 110
!
router ospf 1
 redistribute eigrp 100 subnets route-map EIGRP-TO-OSPF
!
router eigrp 100
 redistribute ospf 1 metric 100000 10 255 1 1500 route-map OSPF-TO-EIGRP

Three details matter in the exam and on a real network:

1. A route map ends with an implicit deny. Without the permit 20 clauses nothing is redistributed at all.
2. Both boundary routers need both route maps. A route map on R2 alone protects nothing when R3 is the router that sends the route back.
3. Tags do not change which route wins on R3. The OSPF copy of R4's LAN still has distance 110, so R3 still takes the long way. It simply no longer feeds that copy back into EIGRP.

Verify the tags from both sides:

R1# show ip ospf database external 172.16.4.0
! External Route Tag: 90
R4# show ip eigrp topology 1.1.1.1/32
! R1's loopback is OSPF-learned, so R4 sees it as external:
! External data ... Administrator tag is 110
R3# show ip protocols
! confirms what is redistributed and the distances in use

Can administrative distance fix the long way round?

Yes, but it is a blunt tool. The suboptimal path exists because OSPF external routes (110) beat EIGRP external routes (170). Raise the OSPF external distance above 170 on both boundary routers and R3 keeps the direct EIGRP path:

router ospf 1
 distance ospf external 171

Check the side effects before you rely on it. Intra-area and inter-area OSPF routes keep 110, so R1's loopback still beats its EIGRP copy. But every OSPF external route on R2 and R3 now loses to an EIGRP external copy of itself, including routes that some other router injected into OSPF. In this lab that is fine; in a larger network a tag-based filter is more precise. OSPF can also keep tagged routes out of its routing table with distribute-list route-map NAME in, matching on the tag.

The opposite tweak, distance eigrp 90 105, looks tempting and backfires. The EIGRP external copy of R1's loopback would then arrive at 105 and beat the original OSPF route at 110.

What changes in EIGRP named mode?

Task 1.9 covers EIGRP in classic and named mode, so practise the same redistribution in both. In named mode the redistribution line moves under the topology base:

router eigrp ENARSI
 address-family ipv4 unicast autonomous-system 100
  network 10.0.24.0 0.0.0.255
  topology base
   redistribute ospf 1 metric 100000 10 255 1 1500 route-map OSPF-TO-EIGRP
  exit-af-topology
 exit-address-family

The route maps stay exactly as they are. The autonomous system number, 100 here, must still match R4's classic router eigrp 100 for the two to become neighbours.

How should you practise this before the exam?

• Build it, break it, fix it: remove one permit 20 clause and watch the redistributed routes disappear.
• Run debug ip routing on R3 while you shut R4's LAN interface and watch the routing table change. Keep that to the lab; on shared gear, scope it with a conditional debug, which is task 4.3.
• Time yourself. 90 minutes across all four domains does not leave long for one redistribution scenario.

Cisco does not publish a question count or a passing score. The 300-410 ENARSI syllabus and exam guide on NWExam estimates 55 to 65 questions and a variable pass mark, which works out to roughly a minute and a half per item.

Is there a short video on preparing for ENARSI?

NWExam's short video on how to prepare for 300-410 ENARSI is below.

Frequently asked questions

1. Does passing 300-410 ENARSI alone make me CCNP Enterprise certified?

No. On its own, ENARSI earns the Cisco Certified Specialist - Enterprise Advanced Infrastructure Implementation credential. For CCNP Enterprise it counts as the concentration exam, so check the CCNP Enterprise requirements for the core exam as well.

2. How much does the 300-410 exam cost, and how long is it?

Cisco lists it at US$300, or Cisco Learning Credits, with a 90-minute time limit, in English and Japanese. Pass or fail results are typically available online within 48 hours.

3. How many questions are on 300-410 ENARSI, and what is the passing score?

Cisco does not publish either figure. NWExam's guide estimates 55 to 65 questions and a variable passing score of roughly 750 to 850 out of 1000.

4. Which tag values should I use for redistribution?

Any numbers work, as long as both boundary routers use the same scheme and each deny clause matches the tag set by the other direction. Many engineers reuse the source protocol's default administrative distance, such as 90 and 110, because it reads well in show output.

5. Do I need to memorise the order of the EIGRP seed metric?

Yes. The order is bandwidth, delay, reliability, load and MTU, and the delay value is in tens of microseconds. To test the routing theory around it, work through NWExam's 300-410 ENARSI sample questions.

Written by the team behind NWExam.