ENSLD 300-420 cheat sheet

Three-tier campus hierarchy: core (fast transport, no policy), distribution (policy, summarization, ACLs), access (port density, PoE, VLAN edge).

Two-tier collapsed core is appropriate when distribution functions can be merged into core without exceeding scalability or policy-complexity limits.

P2P /31 or /127 links conserve address space; /30 remains valid where legacy gear rejects /31.

Route summarization: a summary covers all component subnets only when the summary prefix is a bit-boundary superset; verify by masking each subnet with the summary length.

VLSM order of allocation: assign largest host-count subnets first, then descend; each subnet size = 2^n where 2^n - 2 >= required hosts.

Spanning tree: 802.1D has 1 spanning tree for all VLANs; PVST+ one per VLAN (Cisco); 802.1w (RSTP) converges faster; MSTP maps multiple VLANs to an instance.

First-hop redundancy: HSRP (Cisco, active/standby, virtual MAC 0000.0c07.acXX), VRRP (IEEE, master/backup, virtual MAC 0000.5e00.01XX), GLBP (Cisco, load-balanced active/standby).

Design models: Cisco hierarchical, spine-leaf (ECMP, east-west traffic, VXLAN), and SD-Access fabric (LISP control plane, VXLAN data plane, ISE policy).

QoS trust boundary at the access edge; classify and mark DSCP as close to the source as possible; use a per-hop behavior (EF, AF, CS) model rather than per-application queues.

PoE budget: sum per-port class draw against switch PSU capacity; 802.3af ~15.4W at PSE, 802.3at ~30W, 802.3bt up to 90W.

Stacking (StackWise/VSS) gives a single management plane and active-active forwarding; cross-stack EtherChannel requires matching member ports and protocols.

Wireless design: 5 GHz preferred for capacity; 2.4 GHz for coverage only; channel reuse plan 1/6/11 in 2.4 GHz, non-overlapping 20/40/80 MHz in 5 GHz.

AP coverage rule of thumb: -67 dBm RSSI for voice/data, -72 dBm for best-effort; SNR >= 25 dB for voice.

Cisco SD-Access: fabric edge (user ports), fabric border (external handoff), fabric control (LISP map-server), fabric intermediate nodes.

Branch design: single-router or router-on-a-stick with HSRP for redundancy; use a DMVPN or SD-WAN overlay instead of per-branch static routes.

Campus segmentation: VLAN + ACL at distribution, or SGT/Group-Based Policy in SD-Access; never rely on access-layer ACLs alone for cross-VLAN policy.

Redundant distribution pairs: use HSRP/VRRP plus rapid spanning tree and matched LACP bundles to avoid asymmetric routing.

WAN options by SLA: MPLS (guaranteed SLA, hub-and-spoke or any-to-any), Internet VPN (IPsec, lower cost, best-effort), 5G/LTE (backup/rapid deploy), dedicated Ethernet (point-to-point).

IPsec site-to-site: IKEv2 preferred; use AES-GCM, SHA-2 for integrity, DH group 14 or higher; rekey intervals per policy.

DMVPN phases: phase 1 (hub-to-spoke only, mGRE at hub), phase 2 (spoke-to-spoke via NHRP, mGRE at spokes), phase 3 (NHRP shortcut, spoke-to-spoke direct).

SD-WAN architecture: centralized controller (vManage/Cisco Catalyst SD-WAN Manager), orchestrator (vBond), and data-plane edges; control plane uses OMP.

SD-WAN policies: application-aware routing (SLA-based path selection), topology (hub-and-spoke, full mesh, partial mesh), and traffic steering (local Internet breakout).

Overlay vs underlay: underlay is the transport (MPLS/Internet/LTE); overlay is the encrypted tunnel fabric; design underlay diversity for path redundancy.

QoS over WAN: map DSCP to per-hop queues; use LLQ for voice (EF), CBWFQ for video (AF4x), and bandwidth remaining percent for bulk.

Routing over WAN: BGP for provider edge peering, OSPF/EIGRP for internal; use route summarization and prefix-lists to control redistribution.

Model-driven programmability: NETCONF (RFC 6241) over SSH, RESTCONF (RFC 8040) over HTTPS, YANG data models (RFC 7950) define schema.

Telemetry vs SNMP polling: streaming telemetry pushes structured data (gNMI/gRPC, JSON) at sub-second intervals; SNMP is pull-based and coarse.

Cisco DNA Center / Catalyst Center: intent-based design (site hierarchy, fabric), provisioning (plug-and-play), assurance (health scores, AI/ML analytics).

Infrastructure as Code: declarative templates (Jinja2, YANG) plus idempotent tools (Ansible, Terraform) reduce config drift; version control is mandatory.

Assurance metrics: device health (CPU/memory), interface utilization, application experience (MOS, latency, jitter, loss), and fabric underlay/overlay health.

API types: REST (stateless, HTTP verbs), RPC (NETCONF operations), streaming (gNMI subscribe). Use REST for CRUD, gNMI for telemetry.

Automation safety: use change validation (dry-run), rollback, and least-privilege RBAC; never automate config without a tested rollback path.

Assurance loop: collect (telemetry) -> correlate (analytics) -> act (policy/automation) -> verify (post-change validation).