ENAUTO 300-435 cheat sheet

Idempotency: applying the same change twice yields the same end state; declarative tools (Ansible modules, Terraform resources, YANG-based config) target this, imperative CLI sequences do not.

REST verbs and semantics: GET is safe and idempotent, PUT is idempotent (full replace), DELETE is idempotent, POST is neither safe nor idempotent (create/execute).

HTTP status classes: 2xx success (200 OK, 201 Created, 204 No Content), 4xx client error (400 malformed, 401 unauthenticated, 403 unauthorized, 404 missing, 429 rate-limited), 5xx server error.

Data formats: JSON (objects, arrays, strings, numbers, booleans, null) is the default for REST APIs; XML is used by NETCONF; YAML is used by Ansible playbooks and is whitespace-sensitive.

Git workflow: working tree -> git add (index/staging) -> git commit (local repo) -> git push (remote). git pull = fetch + merge; branches isolate features before merge.

Python essentials for automation: requests for HTTP, json.dumps/loads for serialization, dict/list indexing, f-strings, try/except for error handling, and virtualenv/pip for dependency isolation.

Model-driven vs CLI-driven: model-driven (YANG/NETCONF/RESTCONF/gNMI) is structured and schema-validated; CLI scraping with regex/TextFSM is brittle and breaks on output changes.

CI/CD pipeline order: commit triggers build/test (lint, unit tests, config validation) then deploy; failures stop the pipeline before production changes.

Encoding and auth: base64 is used for HTTP Basic auth headers and for certificates/keys; JSON payloads are sent with Content-Type: application/json.

RESTCONF: HTTP-based, uses GET/POST/PUT/PATCH/DELETE on YANG-modeled resources; media type application/yang-data+json; runs over TLS (HTTPS) by default on port 443.

NETCONF: SSH-based (port 830), XML-encoded, uses with operations get, get-config, edit-config, copy-config, lock/unlock, close-session; datastores are running, candidate, startup.

NETCONF edit-config attributes: operation="merge" (default), "replace", "create", "delete", "remove"; merge adds/updates, replace overwrites the target subtree.

gNMI: gRPC-based, supports Capabilities, Get, Set (replace/update/delete), and Subscribe (streaming telemetry: ONCE, POLL, STREAM with sample/on-change).

SNMP: v2c uses community strings in cleartext (UDP 161); v3 adds USM authentication (MD5/SHA) and privacy (DES/AES). GET/GETNEXT/GETBULK for polling, TRAP/INFORM for notifications (162).

YANG: data modeling language with containers, lists (keys), leaves, leaf-lists, choice, and augment; typedefs and groupings promote reuse; deviations modify an existing model.

REST API pagination and filtering: query parameters such as limit/offset or page, plus field selection, keep response sizes manageable; follow Link headers or next tokens when provided.

Authentication patterns: API keys in headers, OAuth 2.0 bearer tokens, and session-based tokens (X-auth-token) that expire and must be refreshed; never place credentials in URLs.

Rate limiting and retries: 429 responses require backoff; exponential backoff with jitter plus idempotent operations prevents duplicate changes on retry.

Guest shell and on-box automation: IOS XE supports Python via the guest shell (guestshell CLI), EEM applets/scripts for event-driven actions, and Tcl policies for embedded scripting.

Zero-touch provisioning: PnP (Plug and Play) uses DHCP option 43 or DNS to point a device at the PnP server, which pushes day-0 configuration and image; POAP is the NX-OS equivalent using DHCP plus TFTP/HTTP script.

EEM components: event detector (syslog, timer, CLI, snmp, interface), trigger, and action (CLI command, syslog, mail, reload); applets are CLI-configured, scripts are Tcl or Python.

YANG tooling: pyang validates and renders models (tree, YANG, HTML); yangsuite and yang explorer browse models; generated code (Go/Python) drives gNMI/RESTCONF clients.

Application hosting: IOS XE and NX-OS can host containers (Docker) and Python apps on-box, enabling local telemetry processing and closed-loop automation without external servers.

Telemetry vs polling: model-driven streaming telemetry pushes structured data continuously (dial-out/dial-in) rather than SNMP polling, giving higher resolution and lower device CPU cost.

Configuration replace and rollback: candidate datastore plus commit (confirmed commit with timeout) and rollback-on-error allow safe multi-step changes; IOS XE supports 'configure replace' with rollback checkpoints.

Ansible for network devices: network_cli connection for CLI modules (ios_command, ios_config), netconf connection for netconf_config, httpapi for RESTCONF; inventory groups and host_vars hold per-device data.

DNA Center is an intent-based controller for campus: it covers design (sites, hierarchy, device credentials), policy (ISE integration), provisioning (device templates, fabric), and assurance.

Intent API base path: https:///dna/intent/api/v1/...; authentication via POST /dna/system/api/v1/auth/token with Basic auth returns a token valid for 1 hour, sent as X-Auth-Token.

Key intent endpoints: /network-device (inventory), /network-device/{id}/interface, /host (clients), /discovery (start discovery by IP range, CDP/LLDP/SNMP), /template-programmer/project and /template-programmer/template (templates), /task/{taskId} (async task status).

Command Runner API: POST /network-device-poller/cli/read-request with a list of device UUIDs and CLI commands, returns a task ID; results are fetched from the file returned by the task.

Async pattern: most write operations return a taskId; poll GET /task/{taskId} until endTime is set and isError is false before assuming success.

Templates: velocity or Jinja-based CLI templates with variables; composite templates sequence multiple templates; versioning and commit are required before deploying to a site or device.

Software image management (SWIM): import image, create image distribution, then activate; activation triggers reload, so schedule it in a maintenance window.

Assurance and telemetry: device health, client health, and network health scores derive from telemetry and SNMP; issues and insights are exposed via /assurance endpoints.

RBAC and integration: users are assigned roles (SUPER-ADMIN-ROLE, NETWORK-ADMIN-ROLE, OBSERVER-ROLE); integrations include ITSM (ServiceNow), CMX, ISE, and pxGrid.

Architecture planes: management plane (vManage), control plane (vSmart, OMP), data plane (vEdge/cEdge routers); vBond is the orchestration/authentication point for NAT traversal and initial bring-up.

OMP (Overlay Management Protocol): runs over DTLS/TLS between routers and vSmart, distributes routes, TLOCs, and policies; OMP routes carry originator, router, and TLOC attributes.

TLOC: identifies a WAN transport endpoint (system-IP, color, encapsulation); colors (biz-internet, mpls, lte, public-internet) drive path selection and policy.

Bring-up order: device boots with bootstrap config -> contacts vBond (via DHCP option 43/DNS/PnP) -> vBond authenticates and redirects to vSmart/vManage -> device receives full config from vManage.

vManage REST API: base /dataservice/... (older) and /dataservice/client/server; authentication via POST /j_security_check with j_username/j_password returns JSESSIONID cookie, sent on later calls.

Key vManage API endpoints: /dataservice/device (inventory), /dataservice/device/monitor or /dataservice/statistics/... (stats), /dataservice/template/device (device templates), /dataservice/template/feature (feature templates), /dataservice/device/action/... (deploy actions).

Templates: feature templates (per-feature CLI/parcels) are combined into device templates and attached to devices; variables make them reusable; CLI templates are the alternative to feature templates.

Policies: centralized policy types are topology, traffic-routing, and cflowd; application-aware routing (AAR) uses SLA classes (latency, loss, jitter) with best-path or strict criteria.

Security and scale: IPsec keys and rekey intervals, control-plane and data-plane encryption, plus vSmart/vManage redundancy (clusters of 3/6) for high availability.