CCIE Enterprise cheat sheet

OSPF hello/dead timers by network type: broadcast and point-to-point 10/40 seconds, NBMA 30/120, point-to-multipoint 30/120.

EIGRP feasible successor: a neighbor qualifies as a loop-free backup only when its reported distance is lower than the feasible distance of the current successor.

BGP best-path order: weight, local preference, locally originated, shortest AS path, lowest origin type, lowest MED, eBGP over iBGP, lowest IGP metric to next hop, oldest route, lowest router ID.

Rapid PVST+ bridge priority is configurable in increments of 4096; the root bridge is elected on lowest priority, then lowest MAC address.

VXLAN adds 50 bytes of overhead: 14 outer Ethernet + 20 outer IP + 8 UDP + 8 VXLAN header, before the original Ethernet frame.

HSRP group virtual MAC is 0000.0c07.acXX (XX = group number in hex); VRRP uses 0000.5e00.01XX for the virtual router.

Forwarding decision order: longest prefix match first, then administrative distance among routes to the same prefix, then lowest metric within one protocol.

802.1D transition: blocking, listening (15 s), learning (15 s), forwarding; RSTP collapses these to discarding, learning, and forwarding.

Cisco SD-WAN controller roles: vManage (management), vSmart (OMP control plane), vBond (orchestration, authentication, NAT traversal); WAN Edge devices forward data.

OMP runs over DTLS/TLS on port 12346 and carries routes, TLOCs, and service-side VPN routes; BFD per TLOC provides tunnel liveness.

SD-Access fabric roles: control plane node (LISP map-server/map-resolver), border node (LISP proxy tunnel router to outside), edge node (LISP xTR for endpoints), intermediate node (underlay only).

VXLAN-GPO carries the 16-bit Scalable Group Tag in a Group Policy option field of the VXLAN header, letting fabric nodes enforce group policy inline.

LISP operation: an ETR registers EID-to-RLOC bindings to the map-server; an ITR sends a map-request and receives a map-reply via the map-resolver.

ACI building blocks: APIC cluster, spine/leaf fabric, tenants, bridge domains, EPGs, and contracts; a VXLAN VNID maps one-to-one with a bridge domain.

Cisco SD-WAN data plane: IPsec tunnels between TLOCs over the underlay; topology and application-aware routing policy are distributed by vSmart.

SD-Access virtual networks map to VRFs; SGTs are assigned at the fabric edge and enforced in the fabric, with ISE as the identity and policy source.

DMVPN phases: phase 1 hub-and-spoke only; phase 2 NHRP spoke-to-spoke shortcuts with next hop preserved; phase 3 NHRP redirect plus shortcuts, allowing summarization at the hub.

MPLS shim header entry: 20-bit label, 3-bit EXP, 1-bit bottom-of-stack, 8-bit TTL, 4 bytes per entry.

MPLS L3VPN: the RD makes an IPv4 prefix unique in MP-BGP VPNv4; route targets define VRF import/export; PE-CE routing may be static, OSPF, EIGRP, or BGP.

IPsec: ESP is IP protocol 50 (encryption plus integrity), AH is protocol 51 (integrity only); IKEv2 uses UDP 500 and UDP 4500 for NAT traversal.

GRE adds 24 bytes (4 outer IP + 4 GRE + 20 inner IP); DMVPN tunnels therefore commonly use an MTU near 1400 with TCP MSS clamping.

QoS: LLQ gives strict priority backed by a policer, CBWFQ guarantees minimum bandwidth per class, and WRED drops select traffic before tail drop.

Multicast: PIM-SM builds an RP-rooted shared tree then switches to the shortest-path tree; PIM-SSM (232.0.0.0/8) builds source trees directly with no RP.

802.1X: EAPOL runs between supplicant and authenticator; RADIUS (UDP 1812/1813, legacy 1645/1646) runs between authenticator and authentication server; TACACS+ uses TCP 49.

Zone-based firewall: interfaces are assigned to zones, traffic between zones requires a zone-pair policy, and unmatched inter-zone traffic is dropped by default.

DHCP snooping: trusted ports may carry server replies while untrusted ports carry only client messages; DAI and IP Source Guard use the snooping binding table.

Control Plane Policing applies an MQC policy under control-plane with 'service-policy ... input' to rate-limit traffic punted to the CPU.

TrustSec: the SGT is a 16-bit tag carried inline in Cisco Meta Data (EtherType 0x8909) or in VXLAN-GPO; SGACLs enforce policy on tag, not on IP address.

Site-to-site IPsec: the crypto ACL defines interesting traffic, IKE phase 1 policies must match on both peers, phase 2 uses a transform set or profile, and a crypto map is applied to the interface.

MACsec (802.1AE) encrypts and integrity-protects a point-to-point Ethernet link hop by hop; it provides no end-to-end protection across routers.

NTP uses UDP 123; stratum 1 is directly synchronized to a stratum 0 reference clock, and each additional stratum level increases distance from the reference.

NETCONF runs over SSH on TCP 830 and uses XML RPCs such as get-config, edit-config, copy-config, lock/unlock, and close-session against YANG datastores.

RESTCONF uses HTTP verbs GET/POST/PUT/PATCH/DELETE on ports 443/80 with media type application/yang-data+json; resource paths are derived from YANG module namespaces.

YANG node types: container (grouping), leaf (single value), leaf-list (multiple values of one type), list (keyed entries), rpc, and notification.

gNMI runs over gRPC, typically on TCP 57400 on IOS-XE, and supports Capabilities, Get, Set, and Subscribe for model-driven streaming telemetry.

Python libraries: 'requests' for REST APIs, 'json' for serialization, 'netmiko'/'paramiko' for SSH, 'ncclient' for NETCONF, 'yaml' for playbook-style data.

Ansible is agentless and idempotent, uses YAML playbooks plus an inventory, and executes modules over SSH or HTTPS APIs.

EEM applet structure: event detector (syslog, timer, CLI, or SNMP) plus optional conditions plus actions; actions can run CLI commands or Tcl/Python scripts.

Cisco Catalyst Center (DNA Center) Intent API authenticates to /dna/system/api/v1/auth/token and passes the returned token in the X-Auth-Token header.