CCNP Enterprise ENCOR (350-401) - Fact Sheet¶

Quick Reference¶

Exam Code: 350-401 Duration: 120 minutes Format: Multiple choice + drag-and-drop + simulations + testlets Cost: $400 USD Validity: 3 years Earns: Cisco Certified Specialist - Enterprise Core (and CCNP Enterprise when paired with a concentration exam)

Cisco Learning Network ENCOR hub CCNP Enterprise official page

Domain Weights¶

Administrative Distance (memorize)¶

Lower AD wins when multiple sources offer the same prefix.

Routing Protocol Comparison¶

EIGRP Metric Components¶

EIGRP composite metric (default uses K1 and K3):

Metric = 256 * ((K1*BW + K2*BW/(256-Load) + K3*Delay) * K5/(Reliability + K4))

Default K-values: K1=1, K2=0, K3=1, K4=0, K5=0

Simplified default:

Metric = 256 * (BW + Delay)

Where:

• BW = 10^7 / minimum_bandwidth_along_path (kbps)
• Delay = sum_of_interface_delays / 10 (microseconds)

EIGRP terminology¶

OSPF Deep Reference¶

LSA Types¶

Area Types¶

Network Types and Timers¶

Neighbor states¶

Down → Attempt → Init → 2-Way → Exstart → Exchange → Loading → Full

Stuck in Exstart/Exchange typically = MTU mismatch or OSPF auth issue. Stuck in Init = one-way hello (ACL or unicast neighbor problem).

Adjacency requirements¶

• Same area ID
• Same subnet / mask
• Same hello/dead timers
• Same authentication (and key)
• Matching MTU (or ip ospf mtu-ignore)
• Matching stub flags
• Unique router-ID per router

Path selection (OSPF best-path order)¶

1. Intra-area (O)
2. Inter-area (O IA)
3. External Type 1 (O E1) - cost includes internal + external
4. External Type 2 (O E2) - cost is external only (default)
5. NSSA Type 1 (O N1)
6. NSSA Type 2 (O N2)

OSPF cost formula¶

Cost = reference_bandwidth / interface_bandwidth

Default reference bandwidth = 100 Mbps. Anything 100 Mbps or faster gets cost = 1 by default. Set auto-cost reference-bandwidth 100000 (100 Gbps) on every router for accurate costs in modern networks.

BGP Path Attributes (best-path selection order)¶

Memorize the mnemonic "WALLT-OMNIB" or "N WLLA OMNI":

1. Weight (Cisco-only, local to router, higher wins, default 0 / 32768 for self)
2. Local Preference (within AS, higher wins, default 100)
3. Locally originated (network or aggregate over received)
4. AS_PATH length (shorter wins)
5. Origin (IGP i < EGP e < incomplete ?)
6. MED (Multi-Exit Discriminator, lower wins, default 0)
7. eBGP over iBGP
8. IGP metric to next-hop (lowest wins)
9. Oldest eBGP route (stability)
10. Lowest BGP router-ID
11. Lowest neighbor IP

BGP states¶

Idle → Connect → Active → OpenSent → OpenConfirm → Established

Stuck in Active usually means TCP 179 unreachable (ACL, no route, neighbor wrong IP).

Common BGP message types¶

QoS Reference¶

Markings¶

Common DSCP-to-traffic mapping (Cisco recommended)¶

CoS to DSCP default mapping (Cisco)¶

QoS components¶

• Classification - identify traffic (NBAR, ACL, DSCP)
• Marking - apply CoS / DSCP / EXP
• Queuing - LLQ, CBWFQ, WFQ, FIFO
• Congestion avoidance - WRED (weighted random early detection)
• Policing - drop or remark over rate (single-rate three-color, two-rate three-color)
• Shaping - buffer and slow to a rate (egress only)

Trust boundaries¶

Push the trust boundary as close to the endpoint as possible. IP phones mark voice EF; switch trusts CoS from phones (mls qos trust cos) but typically not from PCs.

IPv6 Quick Reference¶

Address types¶

Multicast scope and groups¶

IPv6 acquisition¶

• Static
• SLAAC - router advertisement carries prefix; host generates host-bits via EUI-64 or random
• Stateless DHCPv6 - SLAAC for address, DHCPv6 for DNS/options
• Stateful DHCPv6 - DHCPv6 assigns full address
• DHCPv6-PD - prefix delegation (ISP gives a /56 or /48 to customer router)

NDP (Neighbor Discovery Protocol)¶

Wireless 802.11 Standards¶

2.4 GHz channels¶

22 MHz wide. Non-overlapping in NA: 1, 6, 11. 11 channels total (NA), 13 (most of world), 14 (JP for 11b only).

5 GHz channels¶

20/40/80/160 MHz options. 24 non-overlapping at 20 MHz in NA (depends on DFS/UNII rules).

UNII bands (5 GHz)¶

Wireless terminology¶

AP modes (Cisco)¶

CAPWAP¶

• Control: UDP 5246 (DTLS-encrypted)
• Data: UDP 5247 (optionally DTLS)

WLC discovery (in order)¶

1. Static config (priming) on AP
2. DHCP option 43 (controller IPs)
3. DNS (CISCO-CAPWAP-CONTROLLER.<domain>)
4. Broadcast / multicast on local subnet

STP / RSTP / MST Quick Reference¶

Bridge ID¶

Priority (4 bits) | Extended-system-ID = VLAN (12 bits) | MAC (48 bits)

Default priority = 32768. Configure in increments of 4096 (spanning-tree vlan X priority 24576).

Port states (RSTP)¶

Discarding → Learning → Forwarding

Port roles (RSTP)¶

Protections¶

Cisco IOS Command Cheat Sheet (ENCOR-relevant)¶

Multi-area OSPF¶

router ospf 10
 router-id 1.1.1.1
 auto-cost reference-bandwidth 100000
 area 0 authentication message-digest
 area 1 stub no-summary                    ! totally stubby
 area 2 nssa
 network 10.0.0.0 0.255.255.255 area 0
 network 10.1.0.0 0.0.255.255 area 1
 passive-interface default
 no passive-interface gi0/0

interface gi0/0
 ip ospf 10 area 0
 ip ospf network point-to-point
 ip ospf hello-interval 5
 ip ospf authentication message-digest
 ip ospf message-digest-key 1 md5 SECRET

EIGRP (named mode preferred)¶

router eigrp ENT
 address-family ipv4 unicast autonomous-system 100
  network 10.0.0.0 0.255.255.255
  af-interface default
   passive-interface
  exit-af-interface
  af-interface gi0/0
   no passive-interface
   authentication mode md5
   authentication key-chain ENT-KEYS
  exit-af-interface
  topology base
   variance 2                              ! enable unequal-cost load balancing
  exit-af-topology
 exit-address-family

BGP (eBGP and iBGP basics)¶

router bgp 65001
 bgp router-id 1.1.1.1
 bgp log-neighbor-changes
 neighbor 192.0.2.2 remote-as 65002         ! eBGP
 neighbor 10.0.0.2 remote-as 65001          ! iBGP
 neighbor 10.0.0.2 update-source loopback0
 neighbor 10.0.0.2 next-hop-self

 address-family ipv4 unicast
  network 198.51.100.0 mask 255.255.255.0
  neighbor 192.0.2.2 activate
  neighbor 10.0.0.2 activate
 exit-address-family

HSRP (FHRP)¶

interface vlan 10
 ip address 10.10.10.2 255.255.255.0
 standby version 2
 standby 10 ip 10.10.10.1
 standby 10 priority 110
 standby 10 preempt
 standby 10 authentication md5 key-string SECRET
 standby 10 track gi0/1 30                  ! decrement priority by 30 if uplink down

VRRP / GLBP¶

! VRRP
interface vlan 10
 vrrp 10 ip 10.10.10.1
 vrrp 10 priority 110
 vrrp 10 preempt

! GLBP (active/active load balancing)
interface vlan 10
 glbp 10 ip 10.10.10.1
 glbp 10 priority 110
 glbp 10 load-balancing round-robin

MST¶

spanning-tree mode mst
spanning-tree mst configuration
 name ENTERPRISE
 revision 1
 instance 1 vlan 10,20
 instance 2 vlan 30,40
spanning-tree mst 1 priority 4096

LACP EtherChannel (L2 trunk)¶

interface range gi0/1 - 2
 channel-group 1 mode active                ! LACP

interface port-channel 1
 switchport mode trunk
 switchport trunk allowed vlan 10,20,30

VRF-Lite¶

ip vrf RED
 rd 100:1
 route-target export 100:1
 route-target import 100:1

interface gi0/1
 ip vrf forwarding RED
 ip address 10.1.1.1 255.255.255.0

ip route vrf RED 0.0.0.0 0.0.0.0 10.1.1.254
ping vrf RED 10.1.1.254

GRE tunnel¶

interface tunnel 0
 ip address 10.255.0.1 255.255.255.252
 tunnel source GigabitEthernet0/0
 tunnel destination 198.51.100.2
 tunnel mode gre ip                         ! default

IPsec site-to-site (IKEv2)¶

crypto ikev2 keyring KR
 peer SITE2
  address 198.51.100.2
  pre-shared-key local SECRET
  pre-shared-key remote SECRET

crypto ikev2 profile PROF
 match identity remote address 198.51.100.2 255.255.255.255
 authentication local pre-share
 authentication remote pre-share
 keyring local KR

crypto ipsec transform-set TS esp-aes 256 esp-sha256-hmac
 mode tunnel

crypto ipsec profile IPSEC-PROF
 set transform-set TS
 set ikev2-profile PROF

interface tunnel 1
 ip address 10.255.1.1 255.255.255.252
 tunnel source GigabitEthernet0/0
 tunnel destination 198.51.100.2
 tunnel mode ipsec ipv4
 tunnel protection ipsec profile IPSEC-PROF

NetFlow (Flexible NetFlow)¶

flow record FR-V4
 match ipv4 source address
 match ipv4 destination address
 match transport source-port
 match transport destination-port
 match ipv4 protocol
 collect counter bytes
 collect counter packets

flow exporter FE-COLLECTOR
 destination 10.0.0.50
 transport udp 2055
 source loopback0

flow monitor FM-V4
 record FR-V4
 exporter FE-COLLECTOR
 cache timeout active 60

interface gi0/1
 ip flow monitor FM-V4 input

IP SLA (ICMP echo)¶

ip sla 10
 icmp-echo 8.8.8.8 source-interface gi0/0
 frequency 10
 timeout 1000
ip sla schedule 10 life forever start-time now

track 10 ip sla 10 reachability
ip route 0.0.0.0 0.0.0.0 192.0.2.1 track 10

SNMPv3¶

snmp-server group GRP v3 priv read READ write WRITE
snmp-server user admin GRP v3 auth sha SHASECRET priv aes 128 AESSECRET
snmp-server host 10.0.0.50 version 3 priv admin

Syslog¶

service timestamps log datetime msec localtime show-timezone
logging buffered 16384 informational
logging host 10.0.0.50 transport udp port 514
logging trap informational
logging facility local6

CoPP (Control Plane Policing)¶

class-map match-any COPP-CRITICAL
 match access-group name ACL-CRITICAL
policy-map COPP
 class COPP-CRITICAL
  police 8000 conform-action transmit exceed-action transmit
control-plane
 service-policy input COPP

NETCONF / RESTCONF (IOS XE)¶

netconf-yang
restconf
ip http secure-server                       ! HTTPS for RESTCONF
aaa new-model
aaa authentication login default local
aaa authorization exec default local
username admin privilege 15 secret cisco

Cisco SD-WAN component summary¶

Cisco SD-Access (Campus Fabric) summary¶

Python / REST API examples¶

GET with requests¶

import requests
import json

url = "https://sandboxdnac.cisco.com/dna/intent/api/v1/network-device"
token = "<auth_token>"
headers = {
    "X-Auth-Token": token,
    "Content-Type": "application/json"
}

response = requests.get(url, headers=headers, verify=False)
response.raise_for_status()
devices = response.json()["response"]
for d in devices:
    print(d["hostname"], d["managementIpAddress"])

Auth (DNA Center)¶

import requests
from requests.auth import HTTPBasicAuth

auth_url = "https://sandboxdnac.cisco.com/dna/system/api/v1/auth/token"
r = requests.post(auth_url, auth=HTTPBasicAuth("devnetuser", "Cisco123!"), verify=False)
token = r.json()["Token"]

POST (create resource)¶

payload = {
    "interfaces": [
        {"name": "GigabitEthernet0/1", "description": "Uplink", "vlan": 10}
    ]
}
r = requests.post(
    "https://device.example.com/api/v1/interfaces",
    headers={"Authorization": f"Bearer {token}", "Content-Type": "application/json"},
    data=json.dumps(payload)
)

NETCONF (ncclient)¶

from ncclient import manager

with manager.connect(
    host="10.0.0.1", port=830, username="admin", password="cisco",
    hostkey_verify=False, device_params={"name": "iosxe"}
) as m:
    for c in m.server_capabilities:
        print(c)
    response = m.get_config(source="running")
    print(response.xml)

YANG / NETCONF / RESTCONF reference¶

Sample RESTCONF GET (URI)¶

GET https://10.0.0.1/restconf/data/ietf-interfaces:interfaces/interface=GigabitEthernet1
Accept: application/yang-data+json

Ansible network playbook (NETCONF)¶

- name: Configure interface description
  hosts: routers
  gather_facts: no
  connection: netconf
  tasks:
    - name: Set description
      cisco.iosxe.iosxe_interfaces:
        config:
          - name: GigabitEthernet1
            description: Uplink to core
            enabled: true
        state: merged

Common show / verify commands (high-yield)¶

show ip route
show ip route ospf
show ip ospf
show ip ospf neighbor
show ip ospf database
show ip ospf interface brief
show ip eigrp neighbors
show ip eigrp topology
show bgp ipv4 unicast summary
show bgp ipv4 unicast
show bgp ipv4 unicast neighbors 192.0.2.2 advertised-routes
show standby brief
show vrrp brief
show glbp brief
show etherchannel summary
show spanning-tree
show spanning-tree mst
show vlan brief
show interfaces trunk
show ip nat translations
show ip sla statistics
show flow monitor FM-V4 statistics
show flow exporter
show ip cef                                 ! data-plane FIB
show platform hardware fed                  ! Cat9k TCAM / FED
show ap summary                             ! WLC: APs registered
show wireless summary
show capwap client mn                       ! AP CLI: WLC mn-info
show running-config | section interface
show netconf-yang status
show platform software trace                ! IOS XE detailed trace

Things candidates commonly forget¶

• Reference bandwidth must match across every OSPF router or path costs are skewed. Set it to 100000 (100 Gbps) cluster-wide.
• Stub area types prevent specific LSAs - know the exact matrix.
• OSPF MTU mismatch sticks neighbors in Exstart/Exchange. Use ip ospf mtu-ignore as a workaround.
• iBGP neighbors need next-hop-self or you get unreachable next-hops.
• HSRP virtual MAC is 0000.0c07.acXX where XX is the group. VRRPv2 uses 0000.5e00.01XX.
• CoPP policy-map must be applied with service-policy input COPP under control-plane.
• TrustSec SGT is carried in CMD field (Ethernet) or VXLAN GPO; SXP propagates IP-to-SGT.
• MACsec is hop-by-hop L2 encryption; IPsec is L3 endpoint-to-endpoint.
• DNA Center auth uses /dna/system/api/v1/auth/token; token expires after 1 hour.
• NETCONF default port is 830, not 22.
• YANG models can be open (OpenConfig, IETF) or native (Cisco-IOS-XE-native).
• Wi-Fi 6 (802.11ax) is the first to use OFDMA (multiple users per channel via subcarriers).

High-yield memorization list¶

• Administrative distances table (top of this sheet)
• BGP best-path order (WALLT-OMNIB)
• OSPF LSA types 1-5 + 7
• OSPF area types and what each blocks
• DSCP markings (EF=46, CS6=48, AF41=34, AF31=26)
• Cisco SD-WAN components (vManage / vSmart / vBond / vEdge)
• Cisco SD-Access components (DNA-C / ISE / Fabric edge / border / control-plane)
• 802.11 standards table
• AP modes (Local / FlexConnect / Sniffer / Monitor / OEAP / Bridge / SE-Connect)
• HSRP / VRRP / GLBP differences and virtual MACs
• NETCONF port 830, RESTCONF URI structure
• Python requests GET/POST patterns
• HTTP status codes (200/201/204/400/401/403/404/429/500/503)
• TrustSec SGT vs MACsec roles