JNCIE-DC study plan
JNCIE-DC · Give each week a clear focus.
8 weeks · About 7 hours per week
EVPN-VXLAN Fabric Configuration & Layer 2 and Layer 3 Underlay and Overlay Networking
Build a three-stage EVPN-VXLAN spine-leaf lab (two spines, four leaves, two border leaves) in a virtual environment and bring up eBGP underlay peering on every fabric link
Configure and verify EVPN Type-2 and Type-3 routes so that MAC learning is control-plane based rather than data-plane flooded
Explain in writing how anycast gateway, ESI-LAG multihoming, and ARP/ND suppression interact, and which knob changes which forwarding behavior
Capture and annotate a packet walk showing VXLAN encap/decap for an intra-VRF and an inter-VRF flow
Your checkpoint
A working lab fabric with a one-page topology diagram and a verified show-command output sheet proving Type-2/Type-3 routes and multihomed ESI state
EVPN-VXLAN Fabric Configuration & Layer 2 and Layer 3 Underlay and Overlay Networking
Design and implement a full underlay addressing plan (loopbacks, point-to-point /31s, ECMP-safe BGP policy) and validate ECMP hashing across at least four equal paths
Configure EVPN Type-5 route advertisement for a tenant VRF and confirm symmetric IRB forwarding between two VRFs
Tune EVPN route-target and route-distinguisher strategy per tenant so that a new tenant can be added without touching existing VRFs
Break the fabric deliberately (shut a spine, withdraw a route-target) and record convergence timings and the recovery sequence
Your checkpoint
An underlay/overlay design document with addressing tables, RT/RD allocation matrix, and a failure-recovery log with measured convergence times
Data Center Architecture and Design & Network Virtualization and Multitenancy
Compare collapsed-core, spine-leaf, and super-spine topologies on oversubscription ratio, failure domain size, and east-west latency, and select one for a stated workload profile
Size a fabric for a given rack count, 25G/100G port mix, and 3:1 oversubscription target, showing the arithmetic for spine and leaf counts
Implement at least three isolated tenants on the lab fabric using separate VRFs and route-targets, and prove that leaking between them is impossible
Document the multitenancy model (VRF-per-tenant vs. VLAN-per-tenant) with the operational trade-offs of each
Your checkpoint
A capacity and topology decision record with port-count math and a tenant isolation test matrix showing pass/fail for cross-tenant reachability
High Availability, Resiliency, and Troubleshooting
Enable and verify BFD for underlay BGP and for EVPN multihoming, then measure detection and reconvergence with a link failure
Configure ESI-LAG active-active multihoming and validate that a single leaf failure does not black-hole traffic to dual-homed hosts
Build a troubleshooting runbook covering the ten most common fabric faults (VNI mismatch, MTU, RT mismatch, missing Type-2, stale ARP, asymmetric routing) with the exact commands to isolate each
Inject three faults into the lab without documenting them for yourself, then diagnose each from symptoms alone
Your checkpoint
A troubleshooting runbook with command sequences plus a fault-injection log recording symptom, root cause, and time-to-diagnosis for each injected fault
Data Center Interconnect (DCI) & High Availability, Resiliency, and Troubleshooting
Design a DCI solution for a two-site fabric using EVPN Type-5 over a WAN, and state where stretch-L2 is genuinely required versus avoidable
Implement the DCI in the lab with route-target rewriting or a dedicated interconnect VRF, and verify tenant reachability across sites
Test DCI failure modes: WAN link loss, border-leaf failure, and duplicate MAC detection across sites, recording the resulting behavior
Explain the role of MAC mobility, sequence numbers, and the designated forwarder in preventing DCI loops and stale entries
Your checkpoint
A DCI design and test report covering the chosen model, the RT/VRF mapping, and observed behavior for all three failure scenarios
Automation, Programmability, and Orchestration
Automate fabric provisioning with a templating approach (Jinja2 plus a device-facing API) so that adding a leaf requires editing only an inventory file
Push a configuration change to at least four devices idempotently and prove a second run makes no changes
Implement a pre-change and post-change validation script that collects and diffs operational state (BGP peer counts, EVPN route counts, interface status)
Use a telemetry or streaming source to detect one specific fabric event and describe how it would feed an orchestration workflow
Your checkpoint
A version-controlled repository containing templates, inventory, an idempotent deploy script, and a validation script with captured before/after output
Security and Policy Enforcement in the Data Center & Network Virtualization and Multitenancy
Implement tenant-level policy using stateless filters at the border and host-facing ports, and verify that permitted and denied flows behave as intended
Configure a stateful security boundary for north-south traffic and explain where stateful inspection belongs in a spine-leaf fabric and why
Apply control-plane hardening (BGP authentication, max-prefix limits, interface-level protection) and confirm each control is active
Map the policy design to the tenant model from week 3 so that adding a tenant inherits the correct default posture
Your checkpoint
A security policy matrix with per-tenant permit/deny rules and verification output proving each filter and hardening control is operational
Data Center Architecture and Design & EVPN-VXLAN Fabric Configuration & Layer 2 and Layer 3 Underlay and Overlay Networking & Data Center Interconnect (DCI) & Network Virtualization and Multitenancy & Automation, Programmability, and Orchestration & High Availability, Resiliency, and Troubleshooting & Security and Policy Enforcement in the Data Center
Rebuild the full multi-site, multi-tenant lab from scratch using only your own documentation and automation, within a fixed time budget
Run a timed end-to-end scenario that combines underlay failure, DCI link loss, and a tenant policy violation, and resolve all three
Audit every domain against the blueprint and list the specific gaps you still cannot demonstrate confidently
Condense the runbook, design records, and policy matrix into a single indexed reference you can navigate in under thirty seconds per topic
Your checkpoint
A from-scratch rebuild completed inside the time budget plus a gap list naming each weak area and the concrete lab exercise that would close it
Milestones
Week 2: You can add a brand-new tenant VRF with EVPN Type-5 routes and verify end-to-end reachability without consulting notes, and you can explain the underlay ECMP path selection from show output
Week 4: Given an undocumented fabric fault, you isolate the root cause in under twenty minutes using only CLI diagnostics, and you can state which EVPN route type or timer is responsible
Week 6: Adding a new leaf to the lab requires editing only inventory and templates, the deploy script is idempotent, and the validation diff is clean on a second run
Week 8: You rebuild the complete multi-site, multi-tenant fabric from your own documentation within the time budget and resolve a combined failure scenario without external help