ENSLD 300-420 flashcards

31 cards. Read the term and the definition here. The deck at the top of this page is optional.

Three-tier hierarchy

Core, distribution, and access layers. Core provides fast transport, distribution enforces policy and summarization, access provides port density and VLAN edge functions.

Collapsed core

Two-tier design merging distribution into core. Suitable when policy complexity and scale are low and core can handle both roles without bottlenecks.

Route summarization rule

A summary prefix covers all component subnets only if masking each subnet with the summary length yields the same network address. Verify bit boundaries before advertising.

VLSM allocation order

Assign largest host-count subnets first, then descend. Each subnet size is 2^n with 2^n minus 2 usable hosts, so plan from the top down.

HSRP vs VRRP

HSRP is Cisco proprietary with active/standby and virtual MAC 0000.0c07.acXX. VRRP is IEEE standard with master/backup and virtual MAC 0000.5e00.01XX.

Spine-leaf topology

Every leaf connects to every spine, enabling ECMP and predictable east-west latency. Common in data centers and VXLAN fabrics; avoids spanning tree loops.

QoS trust boundary

The point where DSCP markings are trusted. Place it at the access edge so classification and marking happen close to the source, not mid-network.

SD-Access fabric roles

Fabric edge (user ports), fabric border (external handoff), fabric control (LISP map-server), and intermediate nodes. VXLAN carries data, LISP the control plane.

PoE power budget

Sum per-port class draw against switch PSU capacity. 802.3af is about 15.4W at PSE, 802.3at about 30W, 802.3bt up to 90W.

Switch stacking benefits

StackWise or VSS gives a single management plane and active-active forwarding. Cross-stack EtherChannel requires matching member ports and protocols.

Wireless channel plan

Use 1/6/11 in 2.4 GHz for non-overlap; use 20/40/80 MHz channels in 5 GHz. 5 GHz carries capacity, 2.4 GHz only coverage.

Wireless RSSI targets

About -67 dBm for voice and data, -72 dBm for best-effort. Voice also needs SNR of at least 25 dB for acceptable call quality.

Branch redundancy pattern

Use a router-on-a-stick or single router with HSRP for gateway redundancy, and an overlay such as DMVPN or SD-WAN instead of per-branch static routes.

Campus segmentation options

VLAN plus ACL at distribution, or SGT/Group-Based Policy in SD-Access. Access-layer ACLs alone are insufficient for cross-VLAN policy enforcement.

Asymmetric routing avoidance

Pair HSRP/VRRP with rapid spanning tree and matched LACP bundles so return traffic follows the same path as forward traffic.

AP capacity planning

Plan AP count by client density and throughput per client, not just coverage. High-density areas need more APs and narrower channels to reduce contention.

WAN option selection

MPLS for guaranteed SLA, Internet IPsec VPN for lower cost best-effort, 5G/LTE for backup or rapid deploy, dedicated Ethernet for point-to-point.

IPsec recommended crypto

Use IKEv2 with AES-GCM, SHA-2 integrity, and DH group 14 or higher. Set rekey intervals per policy and avoid weak legacy ciphers.

DMVPN phase 2

mGRE at spokes and NHRP allow direct spoke-to-spoke tunnels. Phase 1 is hub-only; phase 3 adds NHRP shortcut for on-demand spoke paths.

SD-WAN control plane

OMP distributes routes, policies, and TLOCs between edges and controllers. The orchestrator (vBond) handles authentication and NAT traversal.

Application-aware routing

SD-WAN policy selects a path based on SLA thresholds such as latency, jitter, and loss. Traffic is re-steered when the active path violates the SLA.

Overlay vs underlay

Underlay is the transport (MPLS, Internet, LTE). Overlay is the encrypted tunnel fabric. Design underlay diversity so overlay paths remain redundant.

WAN QoS mapping

Map DSCP to per-hop queues: LLQ for voice (EF), CBWFQ for video (AF4x), and bandwidth remaining percent for bulk traffic.

Local Internet breakout

Branch traffic exits directly to the Internet instead of backhauling to the data center. Reduces latency and WAN cost; requires local security policy.

NETCONF and RESTCONF

NETCONF runs over SSH (RFC 6241); RESTCONF runs over HTTPS (RFC 8040). Both use YANG models (RFC 7950) to define configuration and state schema.

Streaming telemetry

Push-based structured data over gNMI/gRPC at sub-second intervals. Contrasts with pull-based SNMP polling, which is coarser and less scalable.

Catalyst Center assurance

Intent-based platform providing site hierarchy design, plug-and-play provisioning, and AI/ML health scoring for devices, clients, and applications.

Infrastructure as Code

Declarative templates (Jinja2, YANG) applied by idempotent tools such as Ansible or Terraform. Version control prevents configuration drift.

Assurance metrics

Track device health (CPU, memory), interface utilization, and application experience (MOS, latency, jitter, loss), plus fabric underlay and overlay health.

API type selection

Use REST for CRUD operations, NETCONF RPC for transactional config, and gNMI subscribe for telemetry streams. Match the API to the task.

Automation safety controls

Require dry-run validation, tested rollback, and least-privilege RBAC before automating configuration changes. Never automate without a rollback path.