CCNP Enterprise cheat sheet

Three-tier campus design uses access, distribution, and core layers; a collapsed-core design merges distribution and core into one pair.

Spine-leaf fabrics connect every leaf to every spine and do not connect leaves directly; server-to-server traffic crosses exactly one spine hop.

SD-Access control plane uses LISP, data plane uses VXLAN, and policy plane uses Cisco TrustSec security group tags enforced by ISE.

Cisco SD-WAN separates management (vManage), orchestration (vBond), and control (vSmart); edges use OMP to exchange routes and policies.

CAPWAP control uses UDP 5246 and data uses UDP 5247; APs discover controllers by DHCP option 43, DNS, or broadcast.

DSCP EF is 46 and is the standard marking for voice bearer; voice signaling is commonly marked CS3 (24).

HSRPv1 uses 224.0.0.2 and HSRPv2 uses 224.0.0.102, both UDP 1985; VRRP uses 224.0.0.18 with IP protocol 112.

OSPF backbone area is 0; all non-backbone areas must connect to area 0 through an ABR or a virtual link.

PIM-SM uses a rendezvous point to build shared trees; PIM-SSM uses source-specific joins and does not require an RP.

Type 1 hypervisors run directly on hardware, such as VMware ESXi; type 2 hypervisors run on a host operating system.

VMware vSwitch security policies include promiscuous mode, MAC address changes, and forged transmits; reject is the secure default for the latter two.

VLAN tagging modes on virtual switches include virtual switch tagging (VST), virtual guest tagging (VGT), and external switch tagging (EST).

VRF creates separate routing and forwarding tables on one router; VRF-lite does this without MPLS and requires per-VRF interface assignment.

GRE carries multicast and broadcast but supplies no encryption; IPsec ESP supplies confidentiality and integrity.

DMVPN uses mGRE, NHRP, and IPsec; spokes register their public addresses with the hub NHRP server to build direct tunnels.

VXLAN uses a 24-bit VNI and encapsulates Layer 2 frames in UDP, default destination port 4789, between VTEPs.

Containers share the host kernel and isolate processes; virtual machines include a guest OS and run on a hypervisor.

STP root bridge is the lowest bridge ID; default priority is 32768 and priority values increment in steps of 4096.

RSTP port roles are root, designated, alternate, and backup; PortFast bypasses listening/learning but should face edge devices.

EtherChannel member links must match speed, duplex, VLAN/trunk mode, and MTU; LACP is IEEE 802.3ad and PAgP is Cisco proprietary.

OSPF broadcast hello/dead timers are 10/40 seconds; NBMA is 30/120; default reference bandwidth is 100 Mbps.

EIGRP internal administrative distance is 90 and external is 170; a feasible successor reported distance must be less than the successor feasible distance.

BGP eBGP AD is 20 and iBGP AD is 200; best-path order starts with weight, local preference, locally originated, AS path length, origin, MED.

802.1Q trunk tags carry VLAN ID; the native VLAN is untagged, and a native VLAN mismatch can cause VLAN leakage and CDP warnings.

DHCP relay uses ip helper-address to unicast client broadcasts to a server; NTP stratum 0 is a reference clock and stratum 1 is directly attached.

HSRP active router is highest priority (default 100), then highest IP; preempt is disabled by default.

Syslog severity: 0 emergency, 1 alert, 2 critical, 3 error, 4 warning, 5 notice, 6 info, 7 debug; lower is more severe.

SNMPv3 authPriv provides authentication and encryption; traps are unacknowledged, informs are acknowledged.

NetFlow identifies a flow by source/destination IP, source/destination port, and IP protocol; Flexible NetFlow adds record fields.

Local SPAN copies traffic on one switch; RSPAN carries mirrored traffic in a VLAN; ERSPAN encapsulates mirrored traffic in GRE.

IP SLA generates probe traffic to measure delay, jitter, loss, and availability; tracking objects can trigger HSRP or route changes.

NETCONF uses TCP 830 over SSH and XML; RESTCONF uses HTTPS and JSON or XML; YANG defines the data model.

Model-driven telemetry pushes data to a collector, unlike SNMP polling; gRPC is a common transport and subscriptions control cadence.

DNA Center assurance computes device and client health from telemetry, showing issues and trends in dashboards.

TACACS+ uses TCP 49 and encrypts the full packet; RADIUS uses UDP 1812/1813 and encrypts only the password.

802.1X roles are supplicant, authenticator, and authentication server; EAPoL runs between supplicant and authenticator.

MAB authenticates a device by MAC address when 802.1X is unavailable; it is weaker than EAP-based authentication.

DHCP snooping trusted ports accept DHCP server messages; untrusted ports accept client messages; option 82 adds relay information.

DAI uses the DHCP snooping binding table to validate ARP; IP Source Guard uses the same binding table plus static entries.

Port security violation modes: protect drops and does not log, restrict drops and logs, shutdown puts the port into err-disabled state.

Standard ACLs filter by source only (1-99, 1300-1999); extended ACLs filter source, destination, protocol, and ports (100-199, 2000-2699).

IPsec ESP provides confidentiality and integrity; AH provides integrity and authentication but no encryption; IKE uses UDP 500 and NAT-T 4500.

MACsec is IEEE 802.1AE and provides line-rate Layer 2 encryption and integrity between adjacent devices.

NETCONF uses XML RPC over SSH TCP 830; RESTCONF uses HTTP methods over HTTPS with JSON or XML.

YANG is a data modeling language for configuration and state; NETCONF and RESTCONF use YANG models.

Ansible is agentless and uses SSH; playbooks are YAML and tasks are idempotent when modules are used correctly.

Terraform is declarative and uses HCL; it records resource mappings in a state file and plans before applying.

Git commit records staged changes with a hash; branch creates a movable pointer; merge combines histories.

Cisco DNA Center intent API uses token-based authentication and REST; asynchronous operations return task IDs.

Cisco SD-WAN vManage provides a REST API and OMP distributes overlay routes and policies.

gNMI and gRPC support model-driven telemetry and configuration; streaming telemetry is push-based.