I85PREP
⌘ K
Cisco ENARSI 300-410 study materials
Cisco ENARSI 300-410 study resources

Cisco ENARSI 300-410: Infrastructure Security

Cisco ENARSI 300-410 · Work through your exam, one topic at a time.

All guide sections

Infrastructure Security

Infrastructure Security tests device and first-hop protections: AAA, ACLs, uRPF, CoPP, DHCP snooping, dynamic ARP inspection, IP Source Guard, and port security. Questions focus on why a protection drops legitimate traffic and how to place trust boundaries.

AAA and ACLs

  • TACACS+ uses TCP 49 and encrypts the entire packet body; RADIUS uses UDP 1812/1813 and hides only the password. AAA order is authentication, authorization, accounting.
  • ACLs evaluate top-down and stop at the first match, with an implicit deny. Wildcard masks invert subnet masks; any is 0.0.0.0 255.255.255.255 and host is an exact match. Extended ACLs should be placed near the source; standard ACLs near the destination.
  • Control-plane ACLs and CoPP are different. CoPP uses MQC to classify and police traffic destined to the CPU; it does not filter transit traffic.

uRPF and first-hop security

  • Strict uRPF checks that the source is reachable through the same interface; loose mode checks only that a route exists. Strict mode breaks asymmetric routing; default routes can cause drops unless allow-default is used.
  • DHCP snooping trusts DHCP server and uplink ports; untrusted ports cannot offer DHCP. DAI validates ARP against DHCP snooping bindings. IP Source Guard uses the same binding table to filter source IP and MAC addresses.

Worked example

An edge router has ISP A and ISP B with unequal-cost outbound routing. Strict uRPF on the ISP A interface drops packets sourced from ISP B because the reverse lookup points to ISP B. The business requires spoofing protection but cannot change routing. On the dual-homed interface, configure loose uRPF with ip verify unicast source reachable-via any, or keep strict uRPF only on single-homed customer interfaces; add an ACL exception for the ISP B prefix if strict mode is mandatory. Verify with show ip interface and show ip cef.

Traps

  • Applying an ACL with an implicit deny to a control-plane interface can lock out management.
  • DAI does not function without DHCP snooping bindings; static hosts need ARP ACLs.
  • Trusting all uplinks defeats DHCP snooping.
  • TACACS+ and RADIUS differ in transport ports and encryption scope.
  • CoPP protects the CPU but does not secure data-plane forwarding.