CCIE Enterprise flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

EIGRP feasible successor rule

A neighbor's reported distance must be lower than the current successor's feasible distance for that route to qualify as a loop-free backup path.

BGP weight versus local preference

Weight is Cisco-proprietary and local to the router, higher wins, and is checked first; local preference is propagated inside the AS by iBGP and checked second.

OSPF type 3 summary LSA

Area border routers generate type 3 LSAs to advertise networks from one area into another; the LSA is flooded only inside the target area.

Rapid PVST+ port roles

RSTP defines root, designated, alternate, and backup roles; an alternate port receives a superior BPDU from another bridge and offers a loop-free path to the root.

VXLAN encapsulation overhead

50 bytes total: 14-byte outer Ethernet, 20-byte outer IP, 8-byte UDP, and 8-byte VXLAN header added in front of the original Ethernet frame.

HSRP virtual MAC address

HSRP uses 0000.0c07.acXX where XX is the hex group number, while VRRP uses 0000.5e00.01XX for its virtual router address.

Longest prefix match first

Routers select the most specific matching prefix first; administrative distance is compared only among routes to the identical prefix, and metric only within one protocol.

SD-Access control plane node

Runs the LISP map-server and map-resolver functions and holds the fabric host database mapping endpoint EIDs to RLOCs; deployed in pairs for redundancy.

VXLAN-GPO security group tag

Carries a 16-bit Scalable Group Tag in a Group Policy option field of the VXLAN header so fabric devices can enforce group-based policy inline.

SD-WAN vSmart controller role

Distributes control-plane routing information with OMP to all WAN Edge routers and pushes topology and policy; it never forwards data-plane traffic.

OMP transport and port

The Overlay Management Protocol runs over DTLS or TLS on port 12346 between WAN Edge devices, vSmart controllers, and the vBond orchestrator.

SD-WAN TLOC definition

A Transport Locator identifies a WAN Edge WAN interface by system IP, color, encapsulation, and public or private address; BFD liveness runs per TLOC.

ACI endpoint group

An EPG is a logical collection of endpoints that share policy, maps to a bridge domain, and connects to other EPGs through contracts.

vBond orchestrator function

Authenticates WAN Edge devices, performs NAT traversal, and tells each device how to reach its assigned vSmart and vManage controllers.

DMVPN phase 3 shortcut

The hub sends an NHRP redirect to spokes; the originating spoke then resolves the destination and builds a direct spoke-to-spoke tunnel, leaving the hub in the control path only.

MPLS label stack fields

Each 32-bit entry contains a 20-bit label, 3-bit EXP field for QoS, 1-bit bottom-of-stack flag, and an 8-bit TTL.

MPLS VPN route distinguisher

A 64-bit value prepended to an IPv4 prefix to make it unique in MP-BGP VPNv4, while route targets control which VRFs import and export routes.

IPsec ESP and AH protocols

ESP is IP protocol 50 and provides encryption plus integrity; AH is protocol 51 and provides integrity only, with no confidentiality.

LLQ priority queue behavior

A low-latency queue is serviced before all other classes and is protected by a policer; priority traffic exceeding the rate is dropped rather than queued.

PIM sparse mode rendezvous point

Sources register with the rendezvous point and receivers join the shared tree; traffic then switches to the shortest-path tree toward the source.

802.1X three roles

Supplicant is the client, authenticator is the switch port, and authentication server is RADIUS; EAPOL runs only between supplicant and authenticator.

Zone-based firewall default action

Traffic between two different zones is denied unless an explicit zone-pair policy permits it; traffic staying inside one zone is not inspected by default.

DHCP snooping trusted port

Only trusted ports may deliver DHCP server replies, while untrusted ports may send client messages only, which blocks rogue DHCP servers on access ports.

Control Plane Policing purpose

CoPP applies a QoS policy to the control plane to rate-limit and protect traffic punted to the device CPU from DoS and overload.

RADIUS and TACACS+ ports

RADIUS authentication uses UDP 1812 and accounting uses UDP 1813 (legacy 1645/1646), while TACACS+ uses TCP 49.

MACsec 802.1AE scope

Provides hop-by-hop Layer 2 encryption and integrity on a link between two directly connected devices; it gives no end-to-end protection across a routed path.

NETCONF port and operations

NETCONF runs over SSH on TCP 830 and uses XML-encoded RPCs such as get-config and edit-config against YANG-modeled running and candidate datastores.

RESTCONF media type

RESTCONF uses HTTP methods on port 443 with the media type application/yang-data+json or +xml and resource paths derived from YANG modules.

YANG leaf versus leaf-list

A leaf holds a single scalar value, a leaf-list holds multiple values of the same type, and a list holds multiple entries each with several leaves.

gNMI streaming telemetry port

gNMI runs over gRPC, typically on TCP 57400 on IOS-XE, and supports Capabilities, Get, Set, and Subscribe requests for model-driven telemetry.

Ansible agentless idempotency

Playbooks written in YAML describe desired state and are executed without an agent over SSH or APIs; re-running converges to the same state without duplicate changes.

EEM applet components

An Event Manager applet consists of an event detector such as syslog, timer, or CLI, optional conditions, and actions that run CLI commands or Tcl/Python scripts.