Cisco SPCOR 350-501 cheat sheet

Classic three-tier: access (L2, port density), distribution (policy, SVIs, summarization), core (fast L3 forwarding, no policy). Collapsed core merges distribution and core into one layer.

Spine-leaf (Clos): every leaf connects to every spine, one hop between any two leaves; ECMP across spines; east-west traffic scales by adding spines; no STP in the fabric.

Cisco SD-Access: fabric underlay (IS-IS) + LISP control plane (map-server/resolver) + VXLAN data plane; edge nodes = fabric edge, border nodes = fabric border, plus control plane node.

SD-WAN (Viptela): vSmart (control/policy), vBond (orchestration/NAT traversal), vManage (management), vEdge/cEdge (data plane); OMP distributes routes, TLOCs, and policies over DTLS/TLS.

Cisco SD-Access roles: fabric edge (host attachment), fabric border (external handoff, can be internal/CP/anycast gateway border), control plane node (LISP map-server), intermediate nodes (underlay only).

Hierarchical design rule: summarize at distribution toward core, filter/aggregate at boundary, keep core stateless to preserve fast convergence and scalability.

Cisco Catalyst SD-WAN control components: OMP runs over DTLS; TLOC = system IP + color + encapsulation; colors steer traffic (biz-internet, mpls, lte).

Underlay requirements for fabric: routed L3 to every node, MTU sized for VXLAN (typically 1550+), loopbacks as router-ids, IS-IS or OSPF for reachability.

Cisco SD-Access anycast gateway: same SVI IP/MAC on all edge nodes for a VN, so hosts keep gateway on roam; uses distributed anycast gateway (VXLAN).

OSPF: neighbors must match area, hello/dead timers, subnet/mask, area type, authentication; MTU mismatch blocks DBD exchange (stuck in EXSTART/EXCHANGE).

OSPF LSA types: 1 router, 2 network (DR), 3 summary, 4 ASBR summary, 5 external, 7 NSSA external; type 3 default injected by ABR with default-information originate.

IS-IS: L1 intra-area, L2 backbone, L1/L2 router leaks L1 into L2; uses CLNS/NLPID; wide metrics recommended; DIS elected per LAN (no BDR).

BGP path selection order (Cisco): weight, local preference, locally originated, AS-path length, origin, MED, eBGP over iBGP, lowest IGP metric to next hop, oldest route, lowest router ID, lowest neighbor address.

BGP: iBGP full mesh or route reflector (RR); cluster-id and originator-id prevent loops; confederation uses sub-AS for large AS scaling.

EIGRP: feasible successor requires reported distance < feasible distance; uses DUAL; named mode supports address families and per-AF topology.

First-hop redundancy: HSRPv2 (Cisco, group 0-4095, virtual MAC 0000.0c9f.fxxx), VRRP (IEEE, 0000.5e00.01xx), GLBP (Cisco, load balancing with AVG/AVF).

IPv6: SLAAC uses RA + EUI-64 or stable-privacy; DHCPv6 stateful (M/O flags); NDP replaces ARP; link-local fe80::/10; anycast uses subnet-router anycast.

QoS: classification/marking (DSCP 6 bits, IPP 3 bits), policing vs shaping (drop vs buffer), LLQ for voice, CBWFQ for classes, WRED for congestion avoidance.

MPLS label stack: 20-bit label, 3-bit EXP, 1-bit S (bottom of stack), 8-bit TTL; label 0 (IPv4 explicit null) and 3 (implicit null) are reserved.

LDP distributes labels for IGP prefixes over TCP 646; LDP session needs IGP reachability to loopback; label bindings stored in LIB, installed in LFIB.

PHP (penultimate hop popping): penultimate router pops label and forwards with implicit-null (label 3) advertised by egress.

MPLS L3VPN: VRF on PE, MP-BGP VPNv4 (RD + IPv4 prefix = 96-bit), route targets control import/export; VRFs isolate customer routing.

RD (8 bytes) makes prefixes unique; RT (extended community) controls VRF import/export - RT does not have to equal RD.

LDP vs RSVP-TE: LDP follows IGP shortest path; RSVP-TE supports explicit paths, bandwidth reservation, FRR (facility/node protection).

MPLS TE: tunnel interface, path-option explicit/dynamic, autoroute announce, forwarding adjacency; CSPF computes path with constraints.

Segment Routing (SR-MPLS): SID = index + SRGB base; prefix-SID advertised via IGP; adjacency-SID for explicit paths; SR-TE policies as segment lists (no LDP needed).

MPLS MTU: label stack reduces payload; core MTU must accommodate labels (4 bytes per label); fragmentation/PMTUD issues if MTU mismatched.

Multicast: PIM-SM uses RP and (*,G)/(S,G) joins; PIM-SSM uses (S,G) with IGMPv3; MSDP connects RPs across domains; Anycast-RP with MSDP or PIM anycast.

IGMP versions: v1 report/leave, v2 adds leave group and query, v3 adds source filtering (include/exclude).

QoS trust boundaries: trust DSCP at access edge for IP phones (CDP/LLDP), police at untrusted edge; MQC = class-map + policy-map + service-policy.

Cisco SD-WAN application-aware routing: SLA classes (latency, jitter, loss), best-path selection per app; policies via vSmart; AAR uses BFD probes.

NAT: static (1:1), dynamic (pool), PAT (overload); NVI (ip nat enable) supports same interface in/out; NAT64 translates IPv6 to IPv4.

DHCP: DORA (discover, offer, request, ack); relay uses giaddr; DHCP snooping builds binding table; option 82 inserts relay info; DHCPv6 uses solicit/advertise/request/reply.

IPsec: IKEv2 (RFC 7296) uses IKE_SA_INIT/IKE_AUTH; ESP for confidentiality+integrity; AH integrity only; transport vs tunnel mode; DMVPN uses NHRP + mGRE + IPsec.

Cisco SD-WAN segmentation: VPN IDs (VRF-like), service VPNs, transport VPN (VPN 0), and policies per VPN; TLOC color maps to transport.

First-hop security: DHCP snooping, dynamic ARP inspection, IP Source Guard; RA Guard and IPv6 snooping for IPv6 first hop.

YANG models data; NETCONF (RFC 6241) uses SSH 830 with operations get-config, edit-config, copy-config, commit; datastores running/startup/candidate.

RESTCONF (RFC 8040) maps YANG to HTTP verbs (GET, PUT, PATCH, POST, DELETE) with JSON/XML; uses /restconf/data/ path.

gNMI uses protobuf over gRPC for streaming telemetry (subscribe, get, set); preferred for high-frequency model-driven telemetry.

NETCONF/RESTCONF use YANG; SNMP uses MIB/OID; SNMPv3 adds auth (MD5/SHA) and privacy (DES/AES).

Ansible: agentless, YAML playbooks, idempotent modules (ios_config, ios_command); inventory + roles; push model over SSH/NETCONF.

Python: ncclient for NETCONF, requests for RESTCONF, ncclient/gnmi for telemetry; paramiko for SSH; Jinja2 for config templates.

Model-driven telemetry: dial-out vs dial-in; subscription types periodic, on-change, event; gRPC/gNMI and NETCONF subscriptions.

Assurance: Cisco DNA Center/SD-WAN analytics, syslog (UDP 514), SNMP traps (162), NetFlow/IPFIX for flow records, streaming telemetry for counters.

Cisco SD-WAN vManage REST API: /dataservice/ endpoints, token-based auth (j_security_check), used for templates, policies, and device inventory.