Cisco NSF with SSO Configuration Constraints

350-401 By islever Editorial Last updated

Explain the working principles of the Cisco Catalyst SD-WAN solution

Short answer

CD Nonstop Forwarding requires SSO to be configured, and HSRP is not supported with NSF/SSO.

Question

Which of the following are valid statements when configuring Nonstop Forwarding (NSF) with Stateful Switchover (SSO) on a Cisco device? (Choose two.)
  1. supports multicast routing protocols
  2. Supports IPv4 and IPv6
  3. Nonstop Forwarding requires SSO to also be configured Correct Answer
  4. HSRP is not supported with NSF/SSO Correct Answer
  5. Improper implementation of NSF/SSO can result in routing loops

Key Takeaways

The core trap involves distinguishing between general router redundancy protocols and specific NSF constraints, particularly regarding IPv6 support and HSRP compatibility.

This question examines the strict dependencies and limitations of Cisco Nonstop Forwarding (NSF) when paired with Stateful Switchover (SSO). It establishes that SSO is a mandatory prerequisite for NSF operation and that HSRP is explicitly unsupported in this high-availability context.

Common mistake: Many learners incorrectly select B (IPv6 support) or E (routing loops) because they assume modern IOS versions universally support IPv6 NSF or confuse configuration errors with inherent protocol limitations.

Expert Analysis

Why the Answer Is Correct

Option C is fundamentally correct because Cisco’s architecture dictates that NSF relies on the stateful switchover mechanism to preserve forwarding table information during a supervisor engine failover; without SSO, NSF cannot function. Option D is also correct as per Cisco documentation, HSRP is not supported with NSF/SSO because HSRP performs its own state transitions that conflict with the NSF graceful restart process.

Why the Other Options Are Wrong

Option A is incorrect because NSF does not support IP Multicast Routing, as it is not SSO-aware. Option B is historically incorrect for many platforms where NSF was restricted to IPv4 only, although newer releases may vary, the exam standard often treats this as a restriction compared to unicast. Option E is incorrect because while misconfiguration can cause issues, improper implementation is not an inherent characteristic or 'valid statement' of the feature's design principles in the same factual way as C and D.

Community Comment Notes

Several users like Huntkey and TSKARAN cite official restrictions stating 'NSF capability is supported for IPv4 routing protocols only' and 'HSRP is not supported with NSF SSO,' confirming CD. However, users like Marcinko argue that modern IOS versions now support IPv6 and HSRP with SSO, suggesting BC or CE. The consensus for the exam blueprint remains focused on the traditional restrictions where SSO is required and HSRP is excluded.

Official Reference

https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst9400/software/release/16-6/configuration_guide/stck_mgr_ha/b_166_nsf_sso_9400_cg.html

This link opens the official vendor documentation in a new tab.

Exam Strategy

Memorize the specific exclusions for NSF features, such as the lack of multicast support and the incompatibility with HSRP, as these are frequent exam differentiators between similar HA technologies.

Frequently Asked Questions

Why is HSRP not supported with NSF/SSO?

HSRP manages its own active/standby states which conflict with the NSF graceful restart mechanism, leading to potential packet loss or instability during failover.

Does NSF support IPv6 on all Cisco platforms?

Historically, NSF was limited to IPv4. While some newer IOS-XE versions add IPv6 support, exam questions often treat IPv6 NSF as unsupported or restricted compared to IPv4.

More 350-401 FAQ →

Discussion 13 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 13

  1. Huntkey 👍 23
    NSF capability is supported for IPv4 routing protocols only. NSF capability is not supported for IPv6 routing protocols. NSF does not support IP Multicast Routing, as it is not SSO-aware. You must configure SSO in order to use NSF with any supported protocol. The Hot Standby Routing Protocol (HSRP) is not supported with NSF SSO. Do not use HSRP with NSF SSO. https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst9400/software/release/16-6/configuration_guide/stck_mgr_ha/b_166_nsf_sso_9400_cg.html
  2. TSKARAN 👍 7
    Restrictions for Cisco Nonstop Forwarding with Stateful Switchover The following are restrictions for configuring NSF with SSO: NSF capability is supported for IPv4 routing protocols only. NSF capability is not supported for IPv6 routing protocols. NSF does not support IP Multicast Routing, as it is not SSO-aware. For NSF operation, you must have SSO configured on the device. All Layer 3 neighboring devices must be an NSF helper or NSF-capable to support graceful restart capability. For IETF, all neighboring devices must be running an NSF-aware software image. The Hot Standby Routing Protocol (HSRP) is not supported with NSF SSO. Do not use HSRP with NSF SSO. An NSF-aware device cannot support two NSF-capable peers performing an NSF restart operation at the same time. However, both neighbors can reestablish peering sessions after the NSF restart operation is complete. For SSO operation, ensure that both active and standby devices run the same version of the Cisco IOS XE image. If the active and standby devices are operating different images, SSO failover might cause an outage.
  3. Marcinko 👍 5
    what about question 160: How does SSO work with HSRP to minimize network disruptions?
  4. Marcinko 👍 3
    Nowdays HSRP is supported in SSO as also IPV6 https://www.cisco.com/c/en/us/td/docs/routers/ios/config/17-x/ntw-servs/b-network-services/m_fhp-hsrp-sso.html https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst9300/software/release/16-10/configuration_guide/rtng/b_1610_rtng_9300_cg/b_1610_rtng_9300_cg_chapter_010001.html
  5. alexia_net 👍 2
    Yes, it is true — improper implementation or configuration of NSF/SSO can result in routing loops, among other network stability issues. Why This Can Happen NSF (Non-Stop Forwarding) and SSO (Stateful Switchover) are high availability mechanisms that maintain data forwarding during a control plane failover.
Show 8 more comments
  1. Shri_Fcb10 👍 2
    NSF does not support ipv6 https://www.cisco.com/c/dam/en/us/td/docs/switches/lan/catalyst9400/software/release/16-6/configuration_guide/stck_mgr_ha/b_166_nsf_sso_9400_cg.html
  2. cy111 👍 1
    Restrictions for Cisco Nonstop Forwarding with Stateful Switchover The following are restrictions for configuring NSF with SSO: • NSF does not support IP Multicast Routing, as it is not SSO-aware. • For NSF operation, you must have SSO configured on the device. • All Layer 3 neighboring devices must be an NSF helper or NSF-capable to support graceful restart capability. • For IETF, all neighboring devices must be running an NSF-aware software image. • The Hot Standby Routing Protocol (HSRP) is not supported with NSF SSO. Do not use HSRP with NSF SSO. • An NSF-aware device cannot support two NSF-capable peers performing an NSF restart operation at the same time. However, both neighbors can reestablish peering sessions after the NSF restart operation is complete. https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst9500/software/release/16-6/configuration_guide/b_166_ha_9500/b_166_ha_9500_chapter_00.pdf
  3. jmarko80 👍 1
    SSO HSRP alters the behavior of HSRP when a device with redundant Route Processors (RPs) is configured for stateful switchover (SSO) redundancy mode. When an RP is active and the other RP is standby, SSO enables the standby RP to take over if the active RP fails. With this functionality, HSRP SSO information is synchronized to the standby RP, allowing traffic that is sent using the HSRP virtual IP address to be continuously forwarded during a switchover without a loss of data or a path change. Additionally, if both RPs fail on the active HSRP device, then the standby HSRP device takes over as the active HSRP device. The feature is enabled by default when the redundancy mode of operation is set to SSO.
  4. iwanta 👍 1
    C. Nonstop Forwarding requires SSO to also be configured - Correct E. Improper implementation of NSF/SSO can result in routing loops — Correct HSRP can be used with SSO. If you have two supervisor cards in a single L3 Switch, you can still have SVI(s) with HSRP in and active state Then the HSRP standby is a totally separate (likely identical) device. The confusion is if you're thinking that HSRP is active on one SUP and standby on another SUP (in the same chassis)
  5. Nmk3216 👍 1
    https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst9400/software/release/16-6/configuration_guide/stck_mgr_ha/b_166_nsf_sso_9400_cg.html https://www.cisco.com/en/US/technologies/tk869/tk769/technologies_white_paper0900aecd801dc5e2.html
  6. matass_md 👍 1
    C. Nonstop Forwarding requires SSO to also be configured D. HSRP is not supported with NSF/SSO Doubled checked the answers , this is 100% correct.
  7. jmarko80 👍 1
    But SSO with "NFS" does not support HSRP. So C D are correct
  8. Mustafa2z 👍 1
    he question about NSF/SSO not SSO.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

What is a primary characteristic of traffic shaping?

S-grade

What is a Key Characteristic of Cisco vManage?

S-grade

What Is Achieved by This Python NETCONF XML Parsing Code?

S-grade

How to Configure VTY Lines for Idle Session Termination

S-grade

Practice All 350-401 Questions

Access 218 questions with complete answers and detailed explanations.

View Full 350-401 Practice Test →

← Back to 350-401 Study Guide