CCIE Enterprise study plan
CCIE Enterprise · Give each week a clear focus.
8 weeks · About 8 hours per week
Network Infrastructure
Configure and verify multi-area OSPFv2 and OSPFv3 with stub/NSSA areas and route summarization
Manipulate BGP best-path selection in a lab using weight, local preference, AS-path prepending, and MED
Build EIGRP named-mode adjacencies with stub routing, variance, and manual summarization
Troubleshoot mutual redistribution between OSPF, EIGRP, and BGP while preventing routing loops with tags and distribute-lists
Your checkpoint
A 6-router GNS3/EVE-NG topology with all four routing scenarios passing a written verification checklist (every 'show' output captured), plus a 20-question self-quiz scored 80% or higher
Network Infrastructure
Configure and verify MST and RSTP with root guard, BPDU guard, loop guard, and UDLD on a redundant L2 topology
Configure Layer 3 EtherChannel with OSPF adjacency over the bundle and verify per-flow load balancing
Implement VRF-lite with VRF-aware OSPF and BGP plus controlled route leaking between VRFs
Configure and verify PIM Sparse Mode with a static RP, IGMP snooping, and SSM channels
Configure device-level infrastructure services: NTP authentication, PTP-aware clocking, SNMPv3, and syslog TLS
Your checkpoint
A single converged lab file where every L2/L3/multicast verification passes after a full device reload, with a diff report showing zero unintended config drift
Network Infrastructure & Transport Technologies and Solutions
Build an MPLS L3VPN with MP-BGP, VRFs, and verify PHP and label stack behavior with traceroute
Configure DMVPN Phase 3 with IPsec protection and verify spoke-to-spoke direct tunnel formation
Configure and verify GRE over IPsec with a VTI and validate with IKEv2 debug output
Compare and document when to select MPLS L3VPN, DMVPN, or FlexVPN for a given WAN requirement
Your checkpoint
A one-page transport selection decision matrix plus working configs for all three WAN technologies in a shared topology
Transport Technologies and Solutions
Configure a VXLAN data plane with a distributed anycast gateway and verify host-to-host flows across VTEPs
Configure and verify LISP-based host mobility with an xTR and Map-Server/Map-Resolver
Deploy a minimal SD-WAN fabric (controllers plus two edges) and verify OMP route propagation and a traffic-steering policy
Troubleshoot underlay and overlay failures in a time-boxed scenario without documentation
Your checkpoint
A timed 4-hour practice lab attempt covering transport and routing scenarios, scored against a written rubric with a remediation list for every missed item
Infrastructure Security and Services
Configure 802.1X and MAB with ISE (or a local AAA substitute) and verify authorization results per user group
Implement Control Plane Policing, uRPF, and infrastructure ACLs, then validate under a traffic generator
Configure Zone-Based Firewall and verify stateful inspection between security zones
Harden device access with AAA, role-based CLI views, SSH-only management, and password policy enforcement
Your checkpoint
A security hardening baseline template applied to all lab devices, plus captured evidence of a blocked attack and a permitted flow for each control
Infrastructure Security and Services & Software Defined Infrastructure
Implement TrustSec/SGT classification and enforcement across a switched path and verify tag propagation
Configure and verify MACsec or an equivalent L2 encryption control on an uplink
Deploy SD-Access fabric roles (control plane, edge, border) and verify host onboarding through the fabric
Integrate an external AAA/identity source and demonstrate fabric guest versus corporate policy
Your checkpoint
An SD-Access fabric lab with three distinct endpoint policy outcomes documented end-to-end, from authentication to data-plane enforcement
Software Defined Infrastructure & Infrastructure Automation and Programmability
Automate DNA Center fabric provisioning with a Python script using the intent API and confirm idempotency on a second run
Configure and verify NETCONF and RESTCONF with YANG models to read and modify device state
Write an Ansible playbook that pushes a standard interface and routing baseline to multiple devices
Configure EEM applets and guest-shell or on-box Python to react to a link-state event
Your checkpoint
A version-controlled Git repository containing at least three working automation artifacts (Python script, Ansible playbook, on-box script) with a README that reproduces the result from scratch
Software Defined Infrastructure & Infrastructure Automation and Programmability & Network Infrastructure & Transport Technologies and Solutions & Infrastructure Security and Services
Automate configuration validation using a CI-style pipeline that runs syntax and intent checks before deployment
Complete a full 8-hour mock lab under exam conditions with no external references
Review every missed mock-lab item and re-run the failed scenarios until they pass cleanly
Consolidate all weak-area notes into a single pre-exam review sheet
Your checkpoint
A scored 8-hour mock lab with a documented pass/fail per domain section and a residual-risk list of no more than five items
Milestones
Week 2: All Domain 1 routing and switching labs reconverge after a full reload with captured verification output for every goal; self-quiz score 80% or higher
Week 4: First timed 4-hour lab completed and scored; at least 70% of scenarios pass, and every failure is written into a remediation backlog
Week 6: Security and SD-Access labs complete; can explain and demonstrate authentication-to-enforcement flow for three distinct endpoint types without notes
Week 8: 8-hour mock lab scored against a domain-by-domain rubric with an overall result of 70% or higher and no single domain below 60%