Cisco ENARSI 300-410 cheat sheet

EIGRP feasible successor condition: reported distance (neighbor's metric) must be strictly less than the local feasible distance; equal RD does not qualify.

EIGRP DUAL: route enters Active when a path fails and no feasible successor exists; stuck-in-active occurs when queries go unanswered past 3 minutes by default.

OSPF virtual link: area must be a normal transit area (not stub/NSSA), and both ABRs need an interface in the transit area plus a common backbone connection.

OSPF LSA types: 1 router, 2 network, 3 summary, 4 ASBR summary, 5 external, 7 NSSA external; type 7 is translated to type 5 by the NSSA ABR.

OSPF metric = reference bandwidth (100 Mbps default) / interface bandwidth; cost on a loopback is 1 unless auto-cost reference-bandwidth is raised.

BGP best-path order: weight, local preference, locally originated, AS path length, origin, MED, eBGP over iBGP, lowest IGP metric to next hop, oldest route, lowest router ID.

BGP next-hop-self is required on iBGP when the advertising router is not reachable via the IGP inside the AS, since iBGP does not change next hop.

Route redistribution loop prevention: tag routes on the boundary ASBR and match/drop the tag on the reverse redistribution point; never redistribute both ways without a filter.

Policy-based routing uses route-map with match ip address and set ip next-hop/interface; applied under the interface with ip policy route-map.

DMVPN phase 3: hub uses 'ip nhrp redirect', spokes use 'ip nhrp shortcut'; spoke-to-spoke traffic bypasses the hub while the hub still holds the NHRP mapping.

DMVPN phase 2 requires no split horizon on the hub tunnel (no ip split-horizon eigrp / no ip split-horizon for RIP) so spoke routes propagate.

mGRE tunnel interface needs 'tunnel mode gre multipoint', 'ip nhrp network-id', and 'ip nhrp map multicast dynamic' on the hub for dynamic spoke registration.

IPsec ESP tunnel mode encrypts the entire original packet and adds a new outer IP header; transport mode keeps the original IP header.

IPsec phase 1 (IKE) parameters that must match: encryption, hash, DH group, authentication method, and pre-shared key; mismatch yields 'no proposal chosen'.

IPsec phase 2 uses a transform set (ESP encryption + hash) and a matching access list (crypto ACL) on both peers; ACL mismatch is a common failure.

GRE carries multicast and non-IP traffic; IPsec alone cannot carry multicast, so GRE over IPsec is used for routing protocols across a VPN.

MPLS L3VPN: PE routers hold VRFs; MP-BGP with VPNv4 address family and route targets (import/export) control which VRF receives which prefix.

GET VPN uses group member registration to a key server and preserves the original IP header (no tunnel header), so routing is unchanged across the group.

AAA order on the interface/line: authentication, then authorization, then accounting; 'aaa new-model' enables the AAA subsystem.

TACACS+ is TCP 49, encrypts the full payload, and separates authentication/authorization/accounting; RADIUS is UDP 1812/1813 and encrypts only the password.

802.1X roles: supplicant (client), authenticator (switch), authentication server (RADIUS); EAPoL runs between supplicant and authenticator.

DHCP snooping: trusted ports (uplinks, DHCP server) may send DHCP server messages; untrusted ports may only send client messages; option 82 insertion is configurable.

Dynamic ARP Inspection validates ARP packets against the DHCP snooping binding table; 'ip arp inspection validate src-mac dst-mac ip' adds extra checks.

IP Source Guard uses the DHCP snooping binding table (or static ip source binding) to permit only the assigned source IP/MAC on a port.

Control-plane policing (CoPP) matches traffic with class-map/access lists and applies a policy-map to 'control-plane'; protects the RP from DoS.

uRPF strict mode drops packets whose source is not reachable via the receiving interface; loose mode only checks reachability in the routing table.

Port security violation modes: protect (drop, no log), restrict (drop, log, increment counter), shutdown (err-disable the port).

DHCP relay: 'ip helper-address' on the SVI forwards client broadcasts as unicast to the server; DHCP option 82 carries relay agent information.

NAT order on Cisco IOS: inside-to-outside is routing, then NAT (inside) before encryption; outside-to-inside NAT happens before routing.

NAT overload (PAT) uses 'ip nat inside source list interface overload'; static PAT uses 'ip nat inside source static tcp ...'.

NTP stratum: stratum 0 is a reference clock, stratum 1 is directly attached; 'ntp master ' makes the router a source; authentication uses MD5 keys.

Syslog severity: 0 emergency, 1 alert, 2 critical, 3 error, 4 warning, 5 notice, 6 informational, 7 debug; 'logging trap ' sets the threshold.

SNMPv3 provides authentication (MD5/SHA) and privacy (DES/AES); 'snmp-server group v3 priv' enforces both.

HSRP: virtual MAC 0000.0c07.acXX (XX = group in hex), default priority 100, preempt disabled by default; VRRP uses 0000.5e00.01XX and preempt enabled.

FHRP tracking: 'standby track ' lowers priority so the standby takes over when the tracked interface/object fails.

NetFlow and Flexible NetFlow export flow records (src/dst IP, ports, protocol, bytes) to a collector; IP SLA probes measure latency, jitter, and reachability for tracking.

NETCONF runs over SSH (port 830), uses XML data encoding, and defines operations get, get-config, edit-config, copy-config, delete-config, lock, unlock; YANG models the data.

RESTCONF maps YANG data to HTTP methods: GET (read), POST (create), PUT/PATCH (update), DELETE (remove); runs over HTTPS.

gNMI uses gRPC with protobuf encoding and supports streaming telemetry via subscribe; it is not XML-based.

Ansible is agentless, uses YAML playbooks over SSH/network CLI, and is push-based; Puppet and Chef are agent-based and pull-based.

EEM: event (syslog, timer, interface, SNMP) triggers an applet; actions include CLI commands, reload, and syslog; 'event manager run' triggers manually.

Python with ncclient (NETCONF) or requests (RESTCONF) performs programmatic config; JSON is the typical RESTCONF payload format.

Configuration management: 'archive' and 'configure replace' with a stored config provide rollback; 'show archive config differences' compares running to stored.

SD-WAN controllers: vManage (management), vSmart (control plane / OMP), vBond (orchestration / NAT traversal); data plane uses IPsec tunnels.