Preparing for a network engineering interview? Use this guide as a question-led revision map: start with a short answer, explain the packet or protocol process, then show how you would prove it on a real network. The categorized reading list below connects the individual answers in the Network freak interview series.
Short answer: what should you prepare? Work through switching, routing, VPNs, security and data-center fundamentals, but rehearse a troubleshooting explanation rather than only memorizing definitions. For each topic, aim to state the purpose, describe normal behavior, identify one failure mode and choose a verification step.
“Most popular” is an editorial description of this fundamentals collection, not a measured ranking of employer interview frequency. Use it as a study route, not a prediction of a particular interview. Some linked archive articles use older platform terminology; check the relevant software documentation before applying commands or assuming defaults.
How to use this interview guide
Try each question aloud before opening its linked answer. Mark it ready, needs a diagram, or needs a lab. For a first pass, prioritize the OSPF and BGP state questions, VLAN/STP questions, routing-table decisions, and TCP/firewall troubleshooting. Then specialize for the role you want.
Use this answer template:
- Purpose: What problem does the protocol or feature solve?
- Process: What happens first, next and last?
- Boundary: Which version, network type or platform assumption matters?
- Evidence: Which state, counter, table or packet capture would you inspect?
- Recovery: What would you change only after confirming the cause, and how would you roll it back?
Seven short answers to rehearse first
Is OSPF 2-Way always a problem?
No. 2-Way means bidirectional Hello communication; not every neighboring pair is required to form a full adjacency, and the adjacency decision can leave a neighbor at 2-Way.[1]
Practice follow-up: Draw a broadcast segment and identify which pairs should become adjacent before declaring a fault. Explain what extra information you would request about network type and DR/BDR roles.
Does BGP Active mean the session is working?
No. In Active, BGP is trying to acquire a peer through TCP; this is not the Established state used for exchanging UPDATE messages.[2]
Interview answer: “I would first identify the exact peer and source addresses, then gather TCP connection evidence from both ends. I would investigate route reachability and filtering before changing BGP policy.” This is a proposed diagnostic order, not a claim that every Active session has the same cause.
What is the difference between RD and RT?
The route distinguisher forms part of the VPN-IPv4 address so otherwise identical IPv4 prefixes can be distinguished; route targets are attributes used to determine eligibility for import into VRFs.[3]
Practice follow-up: Draw two VRFs with overlapping prefixes. Explain route identity separately from import policy instead of saying that matching RDs connect the sites.
What is an EIGRP feasible successor?
A feasible successor is a neighbor satisfying the feasibility condition: its reported distance is strictly less than the local feasible distance for the destination.[4]
Feasible distance is historical and need not equal the current best distance; failure to satisfy the condition does not itself prove that a path contains a loop.[4]
Practice follow-up: Say which value is advertised by the neighbor, which value is local, and why an equality is not enough.
How should I describe IKEv2 establishment?
Describe IKE_SA_INIT followed by IKE_AUTH, normally establishing the IKE SA and the first Child SA; subsequent CREATE_CHILD_SA exchanges can create or rekey Child SAs.[5]
An IKE SA can be created even if creating the Child SA during IKE_AUTH fails, so do not use an IKE-SA status alone as proof that data protection is ready.[5]
Practice follow-up: Ask which IKE version is in use before relying on a “Phase 1 versus Phase 2” explanation.
What is VXLAN in one sentence?
VXLAN encapsulates Ethernet traffic in UDP/IP between tunnel endpoints, with a 24-bit VNI identifying the VXLAN segment.[6]
Practice follow-up: Sketch the inner frame and outer transport separately. Explain which addresses you would inspect when testing endpoint reachability, then use the linked overlay guide for the wider design discussion.
What does a normal TCP handshake look like?
In a basic active/passive open, the initiator sends SYN, the responder returns SYN-ACK, and the initiator acknowledges it; this establishes the TCP connection.[7]
Practice follow-up: Identify the first expected packet missing from paired captures instead of immediately blaming the firewall.
Related reading: the complete question map
The links below are the detailed answer articles. Work through them by category; use the questions as prompts, not as a checklist of configuration changes to make in production.
OSPF
- How does OSPF reach Full, and when is 2-Way expected? Read the detailed answer: OSPF Neighbor States: Step‑by‑Step.
- Which OSPF Hello parameters must match? Read the detailed answer: OSPF Hello Packets: Timers, Neighbors and Troubleshooting Checks.
- How would you isolate an ExStart or Exchange failure? Read the detailed answer: OSPF Stuck in ExStart or Exchange: MTU and DBD Troubleshooting.
- How are the DR and BDR elected, and what happens after a failure? Read the detailed answer: OSPF DR/BDR Election Explained: Priority, Router ID and Failover.
- What do LSA Types 1, 2, 3, 4, 5 and 7 describe? Read the detailed answer: OSPF LSA Types: Practical Guide for Network Engineers.
- How do stub, totally stubby and NSSA areas differ? Read the detailed answer: OSPF Stub vs Totally Stubby vs NSSA: Differences and Default Routes.
- When would you use an OSPF virtual link? Read the detailed answer: OSPF Virtual Links Explained: Area 0, Configuration and Troubleshooting.
- How do OSPF areas compare with IS-IS levels? Read the detailed answer: OSPF vs IS-IS Explained: Areas, Levels and Interview Answers.
BGP
- What do Idle, Connect, Active, OpenSent, OpenConfirm and Established mean? Read the detailed answer: BGP Neighbor States.
- What would you check first when BGP remains Active? Read the detailed answer: BGP Active State Troubleshooting: TCP 179, Source IP and TTL.
- How do eBGP and iBGP differ in advertisement and next-hop behavior? Read the detailed answer: BGP eBGP vs iBGP.
- Why use route reflectors instead of a full mesh? Read the detailed answer: BGP Route Reflectors: Scaling iBGP with a Simple Test Diagram.
- How would you explain best-path selection without confusing vendor defaults? Read the detailed answer: BGP Path Algorithm.
- How would you influence inbound versus outbound traffic? Read the detailed answer: How to Influence Inbound and Outbound BGP Traffic: LOCAL_PREF, Prepending and MED.
- How would you use communities to express routing policy? Read the detailed answer: BGP Communities Explained: Policy Tags, no-export and Blackhole Routing.
- How do CLUSTER_LIST and ORIGINATOR_ID help prevent reflection loops? Read the detailed answer: BGP CLUSTER_LIST Attribute: Route Reflector Loop Prevention.
MPLS and VPN services
- What is the difference between an RD and an RT? Read the detailed answer: RD vs RT in MPLS L3VPN: Differences, Examples and Interview Answer.
- How do VRFs, MP-BGP and MPLS transport fit together? Read the detailed answer: MPLS L3VPN Basics: VRFs, Route Targets and Provider Core Transport.
- How would you follow a packet through PHP and the LFIB? Read the detailed answer: MPLS PHP and LFIB Explained: Label Popping, Packet Flow and Verification.
- When would you choose a Layer 2 service rather than an L3VPN? Read the detailed answer: VPLS vs AToM vs MPLS L3VPN: Differences and Interview Answer.
Switching and gateway resilience
- How does a switch choose the STP root bridge? Read the detailed answer: STP Root Bridge Election Explained: Priority, Bridge ID and MAC Address.
- How do STP and RSTP port states and roles differ? Read the detailed answer: STP vs RSTP Port States and Roles Explained: Differences and Interview Answer.
- Where would you use each spanning-tree protection feature? Read the detailed answer: BPDU Guard vs BPDU Filter vs Root Guard vs Loop Guard Explained.
- Which settings define an MST region? Read the detailed answer: MSTP Region Parameters Explained: Name, Revision, VLAN Mapping and Digest.
- Can a VTP client overwrite a server, and which version matters? Read the detailed answer: Can a VTP Client Overwrite a Server? Revision Numbers Explained.
- How do access, trunk and native VLAN settings interact? Read the detailed answer: Access Port vs Trunk Port vs Native VLAN Explained.
- What do LACP active and passive mean, and how would you verify a bundle? Read the detailed answer: LACP EtherChannel Explained: Active vs Passive, Link Limits and Load Balancing.
- How would you compare gateway redundancy and test upstream failure? Read the detailed answer: HSRP vs VRRP vs GLBP Explained: Preempt, Tracking and Failover.
EIGRP and route selection
- What are successor, feasible successor, FD and RD? Read the detailed answer: EIGRP Successor and Feasible Successor Explained: FD, RD and Feasibility Condition.
- How would you diagnose and limit EIGRP Stuck in Active? Read the detailed answer: EIGRP Stuck in Active Explained: SIA Troubleshooting and Prevention.
- How do the EIGRP metric and K-values affect operation? Read the detailed answer: EIGRP Metric and K-Values Explained: Formula, Examples and Troubleshooting.
- How would you prevent feedback during redistribution? Read the detailed answer: Route Redistribution Risks Between OSPF, EIGRP and BGP: Loops, Tags and Metrics.
- How do administrative distance, metric and longest-prefix match differ? Read the detailed answer: Administrative Distance vs Metric vs Longest Prefix Match Explained.
Security, tunnels and packet troubleshooting
- How do NAT, PAT, static mappings and DNAT change a flow? Read the detailed answer: NAT vs PAT vs Static NAT vs DNAT Explained with Packet Flow.
- What do Phase 1 and Phase 2 mean, and how is IKEv2 different? Read the detailed answer: IPsec Phase 1 vs Phase 2 Explained: SAs, Crypto Maps and IKEv2.
- How do GRE tunnel endpoints differ from tunnel-interface addresses? Read the detailed answer: GRE Tunnel Basics Explained: Source, Destination and Tunnel Interface.
- What changes when a firewall tracks connection state? Read the detailed answer: Stateful vs Stateless Firewall Explained: Packet Flow and Interview Answer.
- How do class-map, policy-map and service-policy fit together? Read the detailed answer: Zone-Based Firewall Explained: Class-Map, Policy-Map and Service-Policy.
- How would you explain ACL order, direction and implicit deny? Read the detailed answer: ACL Basics Explained: Standard vs Extended, Implicit Deny and Examples.
- How would you compare DHCP snooping, DAI and IP Source Guard? Read the detailed answer: DHCP Snooping vs DAI vs IP Source Guard: Differences and Interview Answer.
- When would strict versus loose uRPF fit the routing design? Read the detailed answer: uRPF Strict vs Loose Mode Explained: Asymmetric Routing and Interview Answer.
- What should a successful TCP handshake look like in a capture? Read the detailed answer: TCP 3-Way Handshake Explained: TCP Flags and Firewall Troubleshooting.
- How would you distinguish connection failure from slow data transfer? Read the detailed answer: Why Is Traffic Through a Firewall Slow? TCP Troubleshooting and Interview Answer.
- How would you trace a new host from startup to application access? Read the detailed answer: What Happens When a PC Boots on a Switched Network? DHCP, ARP and DNS Explained.
- How does a Layer 3 switch decide between bridging and routing? Read the detailed answer: How Does a Layer 3 Switch Decide Between Switching and Routing?.
Multicast and data center
- How do the RP, shared tree and source tree fit into PIM-SM? Read the detailed answer: PIM-SM Explained: RP, Shared Tree, Source Registration and SPT Switchover.
- How would you explain FabricPath forwarding and MAC learning? Read the detailed answer: FabricPath Explained: IS-IS, Conversational MAC Learning and Multidestination Trees.
- What does a vPC peer-link carry, and how does it differ from keepalive? Read the detailed answer: vPC Peer-Link Explained: What It Carries and Why It Matters.
- What are the underlay, overlay, VTEP and VNI? Read the detailed answer: VXLAN and Overlay Networks Explained for Interviews.
- How would you explain a spine-leaf packet path and failure capacity? Read the detailed answer: Spine-Leaf and Clos Topology Explained for Network Engineers.
For the route-reflector loop-prevention question, also review ORIGINATOR_ID.
Troubleshooting practice: narrate the evidence, not a guess
Use this fictional exercise in a lab or mock interview. It is a proposed workflow, not an executed test or a universal device-processing order.
Scenario: A workstation cannot open an internal application. Your task is to explain what you would check without changing everything at once.
Define the failed flow and its scope
-> Validate host addressing and intended path
-> Inspect local segment and gateway evidence
-> Inspect routing and policy evidence on both sides
-> Compare captures at adjacent observation points
-> Identify the first divergence from the expected exchange
-> Make one justified change and repeat the original test
For the transport portion, sketch client SYN -> server SYN-ACK -> client ACK as the expected basic handshake.[7]
Then use this rehearsal checklist:
| Evidence to request | Question to answer before changing anything |
|---|---|
| Exact source, destination and application | What is failing, from where, and since when? |
| Host addressing and topology | Which path do we expect this test to take? |
| Interface and VLAN observations | Are we inspecting the intended segment and ports? |
| Relevant routing and forwarding entries | Which destination and routing context are we testing? |
| Firewall/session/NAT observations | What did the device actually do with this flow? |
| Paired packet captures | Where does the observed exchange first differ from expectation? |
| Post-change repetition | Did the original test pass, and were unrelated services preserved? |
Interview answer version: “I would define the exact failing flow, draw the expected path, and gather observations from both ends. I would compare the evidence at successive points, test one hypothesis at a time, and verify both recovery and unintended impact. I would not clear sessions or reboot devices merely to see whether the symptom disappears.”
Common preparation pitfalls
- Reciting without showing a process. After every definition, draw a packet path or state transition.
- Treating every non-final state as broken. Revisit the OSPF 2-Way example before diagnosing adjacency failures.[1]
- Giving a default without naming a platform. State the software family and version assumption, or explicitly say you would verify it.
- Offering a command dump instead of evidence. Explain what each requested output would prove or rule out.
- Claiming a lab was performed when it was only designed. Separate things you have tested from proposed tests.
- Using confidential production details as interview examples. Use fictional addressing and anonymized roles; describe the engineering decision rather than a customer's identity.
A practical revision plan
Use one study block per category rather than trying to memorize the whole list in one sitting. Start each block with a spoken explanation, draw one topology, then design a controlled failure and the observations you would collect. Finish with a mock interview that mixes a definition question and a troubleshooting scenario.
For a switching-focused role, begin with the VLAN, spanning-tree, LACP and gateway questions. For a routing or provider role, prioritize OSPF, BGP, MPLS and route-selection questions. For a security role, start with TCP, ACLs, NAT, firewall state and IPsec. Treat these as suggested study paths, not employer-specific requirements.
Summary
Use the linked answers to build a coherent explanation: purpose, process, assumptions, evidence and recovery. The goal is not to say the most protocol names; it is to show how you would reason about a network without guessing or making unsafe changes.
Preparing for a network engineering interview? Choose one question from this guide, explain it aloud without notes, and then open the detailed answer to check your reasoning. Bookmark this guide as your revision index.
Post a Comment