Cisco ENNA 300-445 cheat sheet

OSI layers 1-7: Physical, Data Link, Network, Transport, Session, Presentation, Application; TCP/IP model maps Application (5-7), Transport (4), Internet (3), Network Access (1-2).

Encapsulation order at sender: data -> segment (TCP/UDP) -> packet (IP) -> frame (Ethernet) -> bits; de-encapsulation reverses at receiver.

Ethernet frame: preamble/SFD, destination MAC (6B), source MAC (6B), EtherType (2B), payload 46-1500B, FCS (4B); minimum frame 64B, MTU default 1500B.

IPv4 header key fields: version, IHL, DSCP/ECN, total length, identification, flags/fragment offset, TTL, protocol, header checksum, source/destination; minimum header 20B.

Private ranges (RFC 1918): 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16; loopback 127.0.0.0/8; link-local 169.254.0.0/16; APIPA indicates DHCP failure.

Subnet math: hosts = 2^h - 2 (h = host bits); usable subnets from borrowed bits b = 2^b (with ip subnet-zero); block size = 256 - mask octet value.

IPv6 address is 128 bits, 8 hex groups; global unicast 2000::/3, link-local FE80::/10, multicast FF00::/8, loopback ::1; no broadcast, no ARP (uses NDP).

TCP three-way handshake SYN, SYN-ACK, ACK; TCP is reliable/ordered with windowing; UDP is connectionless with 8B header (source port, destination port, length, checksum).

MAC address 48 bits written as 12 hex digits; OUI is first 24 bits; unicast has LSB of first octet = 0, multicast/broadcast = 1; broadcast is FF:FF:FF:FF:FF:FF.

Cabling: Cat5e/Cat6 UTP 100m channel limit; single-mode fiber for long haul, multimode for building/short reach; straight-through for unlike devices, crossover for like devices (auto-MDIX often removes need).

Ethernet standards: 1000BASE-T = 1 Gbps over Cat5e copper at 100m; 10GBASE-SR multimode ~400m; 10GBASE-LR single-mode ~10km.

Duplex mismatch symptom: collisions, late collisions, FCS/CRC errors, and slow throughput on one side; speed mismatch usually prevents link or yields errors.

VLAN range: normal 1-1005 (1-1001 usable), extended 1006-4094; VLAN 1 is default native VLAN; VLAN 1002-1005 reserved for legacy Token Ring/FDDI.

Access port carries one VLAN untagged; trunk port carries multiple VLANs with 802.1Q tag (4B: TPID 0x8100 + PCP/DEI/VID); native VLAN traffic is untagged on an 802.1Q trunk.

Trunk mismatch symptoms: native VLAN mismatch logs/CDP errors, VLANs missing from allowed list, or DTP mode mismatch; both ends must agree on encapsulation (dot1q).

DTP modes: dynamic auto (passive), dynamic desirable (active), trunk, access, nonegotiate; auto+auto = access, desirable+auto = trunk; disable with switchport nonegotiate.

VTP modes: server (can create/modify VLANs and propagate), client (learns, cannot modify), transparent (local only, forwards VTP messages); VTP pruning limits flooded VLAN traffic.

STP IEEE 802.1D: root bridge = lowest bridge ID (priority + MAC, default priority 32768); port roles root/non-root/designated; states blocking, listening, learning, forwarding, disabled.

RSTP 802.1w converges in seconds with roles root, designated, alternate, backup and edge (PortFast) ports; PVST+ is per-VLAN Cisco STP; MST maps multiple VLANs to one instance.

PortFast bypasses listening/learning on access ports; BPDU Guard err-disables a PortFast port receiving BPDUs; Root Guard prevents a port becoming root; Loop Guard blocks on BPDU loss.

EtherChannel negotiation: LACP (active/passive, IEEE), PAgP (desirable/auto, Cisco); on/on requires both static; member ports must match speed, duplex, VLAN/trunk config, and be contiguous or allowed by hardware.

LACP uses system priority + MAC for system ID and port priority + port number to select active links; max 8 active links per bundle (16 with standby in LACP).

Wireless 802.11 standards: 802.11n (Wi-Fi 4, 2.4/5 GHz, MIMO), 802.11ac (Wi-Fi 5, 5 GHz), 802.11ax (Wi-Fi 6, 2.4/5/6 GHz, OFDMA); channels 1/6/11 are non-overlapping in 2.4 GHz.

WLC AP discovery: DHCP option 43, DNS, broadcast, OTAA (locally stored), or manual; CAPWAP uses UDP 5246 (control) and 5247 (data); AP modes include local, flexconnect, monitor, sniffer.

Router decision order: longest prefix match first, then administrative distance, then metric; directly connected AD 0, static AD 1, eBGP 20, EIGRP 90, OSPF 110, RIP 120, iBGP 200.

Static route syntax: ip route {next-hop | exit-interface} [distance]; floating static uses AD > dynamic protocol AD to act as backup.

IPv4 forwarding requires destination subnet in routing table; if none, default route 0.0.0.0/0 is used; else packet dropped with ICMP unreachable.

OSPFv2 basics: link-state, IP protocol 89, multicast 224.0.0.5/224.0.0.6, hello 10s (broadcast) / 30s (NBMA), dead = 4x hello; cost = reference bandwidth (100 Mbps default) / interface bandwidth.

OSPF neighbor states: Down, Init, 2-Way, ExStart, Exchange, Loading, Full; stuck in 2-Way is normal on non-DR/BDR; stuck ExStart/Exchange indicates MTU mismatch.

OSPF LSA types: 1 router, 2 network, 3 summary, 4 ASBR summary, 5 external, 7 NSSA external; areas must touch area 0 (backbone) or use virtual links.

OSPF network types: broadcast (DR/BDR elected), point-to-point (no DR), NBMA (manual neighbors, DR), point-to-multipoint (no DR); DR election by priority then router ID, highest wins.

EIGRP: advanced distance-vector, protocol 88, multicast 224.0.0.10; metric uses bandwidth and delay by default (K1, K3); feasible successor requires reported distance < feasible distance.

First-hop redundancy: HSRP (Cisco, v1 virtual MAC 0000.0c07.acXX, v2 0000.0c9f.fXXX, multicast 224.0.0.2/224.0.0.102), VRRP (IEEE, 224.0.0.18, master/backup), GLBP (Cisco, load balancing).

HSRP states: Initial, Learn, Listen, Speak, Standby, Active; preemption is disabled by default; higher priority (default 100) wins when preempt enabled.

IPv6 routing: enable with ipv6 unicast-routing; static route ipv6 route ::/0 ; OSPFv3 uses link-local next hops and runs per-interface; NDP uses RS/RA, NS/NA, and DAD.

Route summarization: summarize on bit boundaries common to all networks; a summary must be at least as specific as the components; OSPF inter-area summarization configured on ABR with area range.

NAT types: static (1:1), dynamic (pool), PAT/overload (many:1 using ports); inside local/global and outside local/global define translation perspective.

NAT config order: ip nat inside source list interface overload; interface ip nat inside / ip nat outside; verify with show ip nat translations.

DHCP DORA: Discover, Offer, Request, Acknowledge; server uses UDP 67, client UDP 68; relay with ip helper-address on the client-facing SVI/interface.

DHCP options: option 43 for WLC discovery; excluded addresses with ip dhcp excluded-address; lease and pool configured in ip dhcp pool.

NTP uses UDP 123; stratum 0 is reference clock, stratum 1 directly attached; command ntp server [prefer]; authentication with ntp authentication-key and trusted-key.

Syslog severity 0-7: 0 emergency, 1 alert, 2 critical, 3 error, 4 warning, 5 notice, 6 informational, 7 debug; logging trap sends that level and lower numbers.

SNMP: manager polls agent on UDP 161; traps sent to UDP 162; SNMPv2c uses community strings, SNMPv3 adds authentication (MD5/SHA) and privacy (DES/AES).

QoS trust boundary: enable mls qos then trust cos/dscp/ip-precedence at the access edge; DSCP EF (46) for voice, AF41 (34) for video, CS1 for scavenger; per-hop behaviors: priority queuing (LLQ), CBWFQ, policing, shaping.

First-hop and services ports: SSH TCP 22, Telnet TCP 23, HTTP 80, HTTPS 443, TFTP UDP 69, FTP TCP 20/21, DNS UDP/TCP 53, RADIUS UDP 1812/1813, TACACS+ TCP 49.

CDP is Cisco proprietary Layer 2 (multicast 01:00:0C:CC:CC:CC); LLDP is IEEE 802.1AB; both discover neighbors; disable on untrusted edge ports.

FTP active mode uses server-initiated data connection from TCP 20; passive mode client initiates data channel; TFTP is connectionless UDP 69 with no authentication.

SLAAC: router advertisements provide prefix and default gateway; EUI-64 forms interface ID from MAC with FFFE inserted and U/L bit flipped; DHCPv6 uses UDP 546/547.

AAA: authentication verifies identity, authorization controls access, accounting logs activity; TACACS+ (TCP 49, encrypts full payload, per-command authorization) vs RADIUS (UDP, encrypts password only).

802.1X roles: supplicant, authenticator (switch), authentication server (RADIUS); EAP methods include EAP-TLS (certificates both sides), PEAP/EAP-FAST (server cert + inner MS-CHAPv2).

Port security: switchport port-security maximum, mac-address {sticky | }, violation {protect | restrict | shutdown}; shutdown is default and err-disables the port; restrict sends SNMP/log and drops.

DHCP snooping: enable globally and on VLANs; trusted ports face DHCP servers/uplinks; rate-limit untrusted; option 82 insertion; works with ip dhcp snooping database for persistence.

Dynamic ARP Inspection validates ARP against DHCP snooping binding table; configure ip arp inspection vlan and trust uplinks; DAI drops invalid ARP.

IP Source Guard binds source IP/MAC to DHCP snooping or static entries; prevents spoofed source addresses on untrusted ports.

Standard ACL 1-99, 1300-1999 filter source only and should be placed near destination; extended 100-199, 2000-2699 filter source/dest/protocol/port and are placed near source.

ACL processing is top-down, first match wins; implicit deny any at the end; wildcard mask 0 = must match, 1 = ignore; every ACL needs at least one permit or all traffic is dropped.

Password hardening: enable secret uses MD5/SHA hash; service password-encryption is weak type 7; use type 8/9 (scrypt) or local AAA; SSH requires hostname, domain name, RSA keys, and vty transport input ssh.

Switch attacks and mitigations: MAC flooding -> port security; VLAN hopping via double tagging -> disable unused ports, set native VLAN to unused ID, disable DTP; STP manipulation -> BPDU Guard/Root Guard.

VPN basics: IPsec uses AH (protocol 51) and ESP (protocol 50); IKE phase 1 builds ISAKMP SA (UDP 500), phase 2 builds IPsec SA; ESP provides confidentiality and integrity.

Threat vocabulary: phishing = social engineering email; DoS/DDoS = resource exhaustion; MITM = interception; spoofing = forged identity; reconnaissance = scanning; malware = malicious software.

Data formats: JSON keys in double quotes, supports objects/arrays/strings/numbers/booleans/null; XML uses tags and attributes; YAML uses indentation and is common in Ansible/CI pipelines.

REST API: CRUD maps to HTTP POST (create), GET (read), PUT/PATCH (update), DELETE (delete); status codes 200 OK, 201 Created, 400 bad request, 401 unauthorized, 404 not found, 500 server error.

RESTCONF uses HTTP verbs over YANG-modeled data (RFC 8040); NETCONF uses SSH transport, XML encoding, and operations get, get-config, edit-config, commit, and candidate datastore.

YANG is the data modeling language for NETCONF/RESTCONF; models define containers, lists, leaves, and leaf-lists; OpenConfig models are vendor-neutral.

Configuration management tools: Ansible is agentless over SSH/YANG; Puppet and Chef typically use agents; Terraform is declarative infrastructure as code with state files.

SDN architecture separates control plane from data plane; controllers (Cisco DNA Center, APIC) provide northbound APIs to apps and southbound APIs to devices; underlay is the physical transport.

Cisco DNA Center uses intent-based workflows (design, policy, provision, assurance); its northbound API is REST/HTTPS with token authentication; SD-Access fabric uses LISP for control plane and VXLAN for data plane.

Python basics for automation: requests.get(url, headers=..., auth=...) returns response; response.json() parses JSON; json.dumps() serializes; loops and functions handle repeated device calls.

NETCONF/RESTCONF ports: NETCONF over SSH TCP 830; RESTCONF HTTPS 443; gRPC/gNMI commonly 57400; gNMI streams telemetry instead of polling SNMP.

Idempotency means applying the same configuration repeatedly yields the same result with no extra changes; declarative tools converge to desired state, imperative scripts execute steps in order.

API authentication: basic auth sends base64 credentials (not encrypted without TLS); token-based (OAuth/JWT) sends bearer token in Authorization header; API keys identify client, not user.

Model-driven telemetry replaces SNMP polling with push subscriptions; benefits include higher frequency, structured data (JSON/protobuf), and reduced CPU on the device.