CNPE cheat sheet

Three-tier design: core (fast transport, no policy), distribution (policy, routing boundaries, summarization), access (user attachment, PoE, port security).

Collapsed core merges core and distribution; suits small/medium sites where distribution-layer policy is minimal and WAN edge is centralized.

Spanning Tree scale rule: keep a single Layer 2 domain under roughly 250 hosts or 1,000 MAC entries; beyond that, route at the distribution layer.

Fat-tree/Spine-leaf: every leaf connects to every spine, equal-cost paths, no STP blocking; oversubscription ratio = downlink bandwidth / uplink bandwidth.

Campus QoS trust boundary sits at the access edge (IP phone or AP); untrusted PC ports are marked down or re-marked by policy.

Subnet sizing: usable hosts = 2^h - 2 for IPv4; /30 for point-to-point links, /31 permitted per RFC 3021 on modern gear.

Availability: MTBF / (MTBF + MTTR) = availability; 99.999% allows about 5.26 minutes of downtime per year.

Hierarchical addressing enables route summarization; allocate contiguous blocks per site so one summary covers the site's access VLANs.

OSPF: hello 10 s / dead 40 s on broadcast and point-to-point; 30 s / 120 s on NBMA and point-to-multipoint; area 0 is the backbone.

OSPF cost = reference bandwidth (default 100 Mbps) / interface bandwidth; raise reference bandwidth to 10 Gbps or higher on modern networks.

EIGRP composite metric uses bandwidth (slowest link) and delay (sum of path) by default; feasible successor requires reported distance < feasible distance.

BGP best-path order begins: highest weight, highest local preference, locally originated, shortest AS_PATH, lowest origin, lowest MED.

BGP loop prevention: AS_PATH repetition between eBGP peers; iBGP requires full mesh or route reflectors because split horizon blocks iBGP-to-iBGP advertisement.

VLAN trunking 802.1Q inserts a 4-byte tag; native VLAN traffic is untagged, so native VLANs must match on both ends to avoid merging.

RSTP port roles: root, designated, alternate (backup for root port), backup (backup for designated); edge/portfast ports skip listening and learning.

First-hop redundancy: VRRP uses a virtual MAC 00:00:5E:00:01:xx and a master/backup election by highest priority then highest IP; HSRP uses 00:00:0C:07:AC:xx.

IPsec: IKE phase 1 builds the ISAKMP SA (UDP 500, NAT-T 4500); phase 2 builds IPsec SAs for ESP (protocol 50) or AH (protocol 51, no encryption).

ESP tunnel mode encrypts the entire original packet and adds a new outer IP header; transport mode keeps the original IP header.

802.1X roles: supplicant (client), authenticator (switch/AP), authentication server (RADIUS); EAPoL runs between supplicant and authenticator.

DHCP snooping marks ports untrusted by default; trusted ports face the DHCP server. Dynamic ARP Inspection depends on the snooping binding table.

AAA command accounting uses TACACS+ (TCP 49, full packet encryption); RADIUS (UDP 1812/1813) encrypts only the password attribute.

Management plane hardening: restrict VTY with ACLs, use SSHv2, disable Telnet and HTTP, and set exec-timeout on all lines.

Zero Trust principle: authenticate and authorize every request regardless of network location; microsegmentation replaces perimeter-only trust.

Common ports: HTTPS 443, SSH 22, SNMPv3 161/162, Syslog 514, LDAP 389, LDAPS 636, RADIUS 1812/1813, TACACS+ 49.

Troubleshooting order: define the problem, gather information, analyze, eliminate causes, propose and test a hypothesis, solve, verify.

OSI bottom-up troubleshooting starts at physical (cabling, interface state); top-down starts at application; divide-and-conquer tests the most likely layer first.

Interface counters: CRC and input errors indicate Layer 1 problems; late collisions indicate duplex mismatch or excessive cable length; runts indicate collisions.

SNMPv3 adds authentication (MD5/SHA) and privacy (DES/AES); traps and informs are sent to a manager on UDP 162, informs are acknowledged.

Syslog severity 0 emerg, 1 alert, 2 crit, 3 err, 4 warning, 5 notice, 6 info, 7 debug; lower number means higher severity.

NetFlow/IPFIX records include source/destination IP and port, protocol, ToS, interface indexes, packet and byte counts, and timestamps.

Baseline metrics: interface utilization, error rate, latency, jitter (ideally under 30 ms for voice), and MOS score (4.0 or higher for toll quality).

Change management requires documented rollback; verify with show commands before and after, and log the change against the ticket.

MPLS Layer 3 VPN uses VRFs and MP-BGP with route targets; CE-PE routing can be static, eBGP, or OSPF.

DMVPN phases: phase 1 hub-to-spoke only; phase 2 spoke-to-spoke direct tunnels; phase 3 uses NHRP shortcut with a summarized tunnel network.

SD-WAN separates control plane (centralized controller) from data plane; application-aware policies steer traffic across broadband, MPLS, and LTE.

Cloud connectivity options: internet VPN (IPsec over public internet), dedicated private connection (AWS Direct Connect, Azure ExpressRoute), and SD-WAN to cloud gateways.

BGP to a cloud provider: eBGP multihop over loopback with an IPsec tunnel; advertise only summarized internal prefixes, never default inbound blindly.

Bandwidth-delay product = bandwidth x RTT; TCP throughput is capped by window size / RTT without window scaling.

GRE carries multicast and routing protocols but has no encryption; combine GRE with IPsec for encrypted multiprotocol tunnels.

QoS over WAN: classify at the edge, mark DSCP, and shape to the contracted rate; provider may re-mark or police above the committed rate.

NETCONF uses SSH transport (port 830) and XML-encoded data; operations are get, get-config, edit-config, copy-config, delete-config, lock, unlock, commit.

RESTCONF maps YANG to HTTP verbs: GET reads, POST creates, PUT/PATCH replace or modify, DELETE removes; runs over HTTPS.

YANG is the data modeling language for NETCONF/RESTCONF; models are organized in modules and support configuration and state data.

REST APIs are stateless; common status codes: 200 OK, 201 Created, 400 Bad Request, 401 Unauthorized, 404 Not Found, 500 Server Error.

Idempotency: an operation is idempotent if repeating it yields the same end state; declarative tools (Ansible, Terraform) rely on this.

Ansible is agentless over SSH; playbooks are YAML; idempotent modules such as ios_config or nxos_config push intended state.

JSON types: object (key/value), array (ordered list), string, number, boolean, null; JSON requires double quotes around keys and strings.

Telemetry streaming pushes data continuously from device to collector, replacing periodic SNMP polling for high-resolution metrics.

802.11 channels: 2.4 GHz uses 1, 6, 11 as non-overlapping in North America; 5 GHz channels are 20 MHz, with 36-48 and 149-165 commonly usable indoors.

2.4 GHz has 3 non-overlapping channels and better range; 5 GHz has more channels and higher throughput but shorter range and more attenuation.

Wi-Fi 6 (802.11ax) uses OFDMA and BSS coloring; Wi-Fi 6E adds the 6 GHz band; Wi-Fi 7 (802.11be) adds multi-link operation.

Security progression: WEP (broken), WPA/TKIP, WPA2/AES-CCMP, WPA3/SAE (Simultaneous Authentication of Equals) resistant to offline dictionary attacks.

Roaming: 802.11r fast BSS transition, 802.11k neighbor reports, 802.11v BSS transition management; all three are needed for seamless voice roaming.

CAPWAP: control traffic on UDP 5246, data on UDP 5247; split MAC places data forwarding at the AP in local mode, at the controller in central mode.

EIRP = transmit power (dBm) + antenna gain (dBi) - cable loss (dB); regulatory limits cap EIRP per band and channel.

Guest wireless isolation: separate SSID mapped to a guest VLAN and anchored to a DMZ controller; block inter-client traffic with peer-to-peer blocking.

ITIL change types: standard (pre-approved, low risk), normal (CAB review), emergency (expedited approval with retrospective review).

RTO is the maximum tolerable downtime; RPO is the maximum tolerable data loss measured in time; both drive backup and replication design.

Configuration management requires version control, documented baseline, and periodic backup; compare running-config against a known-good baseline.

Data classification tiers (public, internal, confidential, restricted) determine encryption, retention, and access-control requirements.

Incident versus problem: an incident is an unplanned interruption; a problem is the underlying cause of one or more incidents.

Compliance frameworks: PCI DSS for cardholder data, HIPAA for health data, GDPR for EU personal data, ISO/IEC 27001 for information security management.

Capacity management: monitor trend over 30/60/90 days, forecast against thresholds (for example 70% sustained utilization), and plan upgrades before exhaustion.

Professional ethics: document changes, disclose conflicts, protect confidential data, and escalate when a request would violate policy or law.