Cisco NSF with SSO Configuration Constraints
Explain the working principles of the Cisco Catalyst SD-WAN solution
Which of the following are valid statements when configuring Nonstop Forwarding (NSF) with Stateful Switchover (SSO) on a Cisco device? (Choose two.)
Answer
Correct answer: C, D — Nonstop Forwarding requires SSO to be configured, and HSRP is not supported with NSF/SSO.
Community Insight
The core trap involves distinguishing between general router redundancy protocols and specific NSF constraints, particularly regarding IPv6 support and HSRP compatibility.
This question examines the strict dependencies and limitations of Cisco Nonstop Forwarding (NSF) when paired with Stateful Switchover (SSO). It establishes that SSO is a mandatory prerequisite for NSF operation and that HSRP is explicitly unsupported in this high-availability context.
Many learners incorrectly select B (IPv6 support) or E (routing loops) because they assume modern IOS versions universally support IPv6 NSF or confuse configuration errors with inherent protocol limitations.
Community Discussion (13 comments)
Nmk3216
👍 1
Selected: CE
https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst9400/software/release/16-6/configuration_guide/stck_mgr_ha/b_166_nsf_sso_9400_cg.html https://www.cisco.com/en/US/technologies/tk869/tk769/technologies_white_paper0900aecd801dc5e2.html
iwanta
👍 1
Selected: CE
C. Nonstop Forwarding requires SSO to also be configured - Correct E. Improper implementation of NSF/SSO can result in routing loops — Correct HSRP can be used with SSO. If you have two supervisor cards in a single L3 Switch, you can still have SVI(s) with HSRP in and active state Then the HSRP standby is a totally separate (likely identical) device. The confusion is if you're thinking that HSRP is active on one SUP and standby on another SUP (in the same chassis)
cy111
👍 1
Selected: CD
Restrictions for Cisco Nonstop Forwarding with Stateful Switchover The following are restrictions for configuring NSF with SSO: • NSF does not support IP Multicast Routing, as it is not SSO-aware. • For NSF operation, you must have SSO configured on the device. • All Layer 3 neighboring devices must be an NSF helper or NSF-capable to support graceful restart capability. • For IETF, all neighboring devices must be running an NSF-aware software image. • The Hot Standby Routing Protocol (HSRP) is not supported with NSF SSO. Do not use HSRP with NSF SSO. • An NSF-aware device cannot support two NSF-capable peers performing an NSF restart operation at the same time. However, both neighbors can reestablish peering sessions after the NSF restart operation is complete. https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst9500/software/release/16-6/configuration_guide/b_166_ha_9500/b_166_ha_9500_chapter_00.pdf
alexia_net
👍 2
Selected: CE
Yes, it is true — improper implementation or configuration of NSF/SSO can result in routing loops, among other network stability issues. Why This Can Happen NSF (Non-Stop Forwarding) and SSO (Stateful Switchover) are high availability mechanisms that maintain data forwarding during a control plane failover.
matass_md
👍 1
Selected: CD
C. Nonstop Forwarding requires SSO to also be configured D. HSRP is not supported with NSF/SSO Doubled checked the answers , this is 100% correct.
jmarko80
👍 1
Selected: AC
SSO HSRP alters the behavior of HSRP when a device with redundant Route Processors (RPs) is configured for stateful switchover (SSO) redundancy mode. When an RP is active and the other RP is standby, SSO enables the standby RP to take over if the active RP fails. With this functionality, HSRP SSO information is synchronized to the standby RP, allowing traffic that is sent using the HSRP virtual IP address to be continuously forwarded during a switchover without a loss of data or a path change. Additionally, if both RPs fail on the active HSRP device, then the standby HSRP device takes over as the active HSRP device. The feature is enabled by default when the redundancy mode of operation is set to SSO.
jmarko80
👍 1
But SSO with "NFS" does not support HSRP. So C D are correct
Shri_Fcb10
👍 2
Selected: CD
NSF does not support ipv6 https://www.cisco.com/c/dam/en/us/td/docs/switches/lan/catalyst9400/software/release/16-6/configuration_guide/stck_mgr_ha/b_166_nsf_sso_9400_cg.html
Mustafa2z
👍 1
he question about NSF/SSO not SSO.
Marcinko
👍 3
Selected: BC
Nowdays HSRP is supported in SSO as also IPV6 https://www.cisco.com/c/en/us/td/docs/routers/ios/config/17-x/ntw-servs/b-network-services/m_fhp-hsrp-sso.html https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst9300/software/release/16-10/configuration_guide/rtng/b_1610_rtng_9300_cg/b_1610_rtng_9300_cg_chapter_010001.html
TSKARAN
👍 7
Restrictions for Cisco Nonstop Forwarding with Stateful Switchover The following are restrictions for configuring NSF with SSO: NSF capability is supported for IPv4 routing protocols only. NSF capability is not supported for IPv6 routing protocols. NSF does not support IP Multicast Routing, as it is not SSO-aware. For NSF operation, you must have SSO configured on the device. All Layer 3 neighboring devices must be an NSF helper or NSF-capable to support graceful restart capability. For IETF, all neighboring devices must be running an NSF-aware software image. The Hot Standby Routing Protocol (HSRP) is not supported with NSF SSO. Do not use HSRP with NSF SSO. An NSF-aware device cannot support two NSF-capable peers performing an NSF restart operation at the same time. However, both neighbors can reestablish peering sessions after the NSF restart operation is complete. For SSO operation, ensure that both active and standby devices run the same version of the Cisco IOS XE image. If the active and standby devices are operating different images, SSO failover might cause an outage.
Huntkey
👍 23
Selected: CD
NSF capability is supported for IPv4 routing protocols only. NSF capability is not supported for IPv6 routing protocols. NSF does not support IP Multicast Routing, as it is not SSO-aware. You must configure SSO in order to use NSF with any supported protocol. The Hot Standby Routing Protocol (HSRP) is not supported with NSF SSO. Do not use HSRP with NSF SSO. https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst9400/software/release/16-6/configuration_guide/stck_mgr_ha/b_166_nsf_sso_9400_cg.html
Marcinko
👍 5
what about question 160: How does SSO work with HSRP to minimize network disruptions?
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Option C is fundamentally correct because Cisco’s architecture dictates that NSF relies on the stateful switchover mechanism to preserve forwarding table information during a supervisor engine failover; without SSO, NSF cannot function. Option D is also correct as per Cisco documentation, HSRP is not supported with NSF/SSO because HSRP performs its own state transitions that conflict with the NSF graceful restart process.Why the Other Options Are Wrong
Option A is incorrect because NSF does not support IP Multicast Routing, as it is not SSO-aware. Option B is historically incorrect for many platforms where NSF was restricted to IPv4 only, although newer releases may vary, the exam standard often treats this as a restriction compared to unicast. Option E is incorrect because while misconfiguration can cause issues, improper implementation is not an inherent characteristic or 'valid statement' of the feature's design principles in the same factual way as C and D.Community Comment Notes
Several users like Huntkey and TSKARAN cite official restrictions stating 'NSF capability is supported for IPv4 routing protocols only' and 'HSRP is not supported with NSF SSO,' confirming CD. However, users like Marcinko argue that modern IOS versions now support IPv6 and HSRP with SSO, suggesting BC or CE. The consensus for the exam blueprint remains focused on the traditional restrictions where SSO is required and HSRP is excluded.Official Reference
Exam Strategy
Memorize the specific exclusions for NSF features, such as the lack of multicast support and the incompatibility with HSRP, as these are frequent exam differentiators between similar HA technologies.
Frequently Asked Questions
Why is HSRP not supported with NSF/SSO?
HSRP manages its own active/standby states which conflict with the NSF graceful restart mechanism, leading to potential packet loss or instability during failover.
Does NSF support IPv6 on all Cisco platforms?
Historically, NSF was limited to IPv4. While some newer IOS-XE versions add IPv6 support, exam questions often treat IPv6 NSF as unsupported or restricted compared to IPv4.
Related Analysis
Practice All 350-401 Questions
Access 218 questions with complete answers and detailed explanations.
View Full 350-401 Practice Test →