Routing
What to know
Candidates must understand dynamic routing fundamentals as used in a leaf-spine fabric: OSPF and BGP, plus EVPN as a BGP address family. Know that eBGP is commonly used in the underlay (each leaf and spine in its own AS, or a shared AS with allowances) to provide ECMP and loop prevention. Understand BGP path selection basics (weight, local preference, AS-path length, origin, MED) and that lower is generally better except weight/local-pref where higher wins.
Know EVPN route types: Type 2 (MAC/IP advertisement), Type 3 (inclusive multicast / VTEP discovery), Type 5 (IP prefix). Understand VXLAN data-plane encapsulation paired with EVPN control plane. Know route summarization, next-hop behavior, and the purpose of BFD for fast failure detection.
Traps
- Reversing BGP preference direction: higher weight and higher local preference win; shorter AS-path wins.
- Confusing EVPN Type 2 (MAC/IP) with Type 5 (IP prefix) or Type 3 (VTEP discovery).
- Assuming OSPF is the default fabric IGP in Arista leaf-spine designs; eBGP underlay is common.
- Forgetting that ECMP requires equal-cost paths and consistent hashing inputs.
Worked example / rule of thumb
Two paths to a prefix: Path A has AS-path length 3 and local pref 100; Path B has AS-path length 5 and local pref 200. Local preference is evaluated before AS-path, so Path B wins (higher local pref). Rule of thumb: memorize the order - weight, local pref, locally originated, AS-path, origin, MED - and remember higher wins only for weight and local pref.
Observability and Security Solutions
What to know
Observability covers how you know the network is healthy: streaming telemetry, sFlow, ERSPAN, and CloudVision analytics. Candidates should distinguish flow sampling (sFlow) from packet capture (ERSPAN/tap) and from metrics (telemetry counters). Understand timestamping and buffer/latency monitoring (e.g., queue depth, drop counters) and why high-resolution telemetry beats polling for microbursts.
Security solutions include: control-plane protection (CoPP), ACLs, and segmentation. Know that VXLAN/EVPN fabrics enable micro-segmentation and that Arista offers security features like MACsec for link encryption and threat/flow analytics. Understand the principle of least privilege for management access (AAA, TACACS+/RADIUS, role-based access) and the difference between data-plane ACLs and control-plane policing.
Traps
- Confusing sFlow (sampled flows) with full packet capture (ERSPAN/tap).
- Assuming polling catches microbursts; it usually misses them - telemetry does not.
- Mixing CoPP (protects the CPU/control plane) with data-plane ACLs (filter transit traffic).
- Forgetting MACsec is hop-by-hop link encryption, not end-to-end.
Worked example / rule of thumb
A latency spike lasts 200 ms and disappears; 60-second polling never sees it. Enable streaming telemetry with sub-second interval on queue/drop counters to catch the microburst. Rule of thumb: use telemetry for "what happened and when," sFlow for "who is talking," and ERSPAN for "show me the exact packets."