Cisco CCNP Enterprise

SD-Access replaces hand-built campus configuration with a policy-driven fabric. You learn how underlay, overlay and segmentation fit together, what the fabric roles do, and how Catalyst Center ties intent to configuration.

• Underlay and overlay in a campus fabric
• Fabric roles: border, control plane and edge
• LISP and VXLAN as the fabric’s building blocks
• Segmentation with virtual networks and group tags
• Catalyst Center’s role in provisioning
• Where SD-Access is the right answer

You build A fabric design on paper that maps sites, roles and segments to a business need.

SD-WAN moves WAN control into a central system. You learn the roles of its controllers and edge devices, how OMP carries routes and policy, and how application-aware routing steers traffic across several transports.

• Management, control and data plane components
• How an edge device joins the fabric
• OMP and the routes it carries
• Transport locators and multiple underlays
• Application-aware routing and policy
• Comparing SD-WAN with traditional WAN design

You build A traffic policy design that sends voice and bulk data over different transports.

QoS is mostly about reading what is already configured. You trace classification, marking, queuing, policing and shaping through a policy, and predict what happens to voice, video and bulk traffic during congestion.

• Classification and marking with DSCP
• Trust boundaries in the campus
• Queuing and low-latency treatment
• Policing against shaping
• Reading a class-map and policy-map
• Verifying QoS with show commands

You build An annotated QoS policy that explains what each class gets and why.

Virtualization lets one device behave like many. You compare hypervisors, keep traffic separate with VRFs, build GRE and IPsec tunnels over shared networks, and see where LISP and VXLAN carry virtual networks across physical ones.

• Type 1 and type 2 hypervisors
• Virtual switches and virtual network functions
• VRF-Lite and route separation
• GRE tunnels and IPsec protection
• LISP and VXLAN encapsulation
• Verifying and troubleshooting tunnels

You build A lab with two VRFs sharing hardware and a protected tunnel between sites.

Layer 2 faults take whole floors down. You diagnose trunking and VLAN mismatches, build and troubleshoot EtherChannels, and control spanning tree so redundant links stay loop-free.

• Trunk negotiation and VLAN mismatch faults
• Layer 2 EtherChannel with LACP and PAgP
• Spanning tree: root placement and path cost
• Rapid PVST+ and MST compared
• Loop guard, root guard and BPDU protections
• Troubleshooting a topology change

You build A switched topology with deliberate root placement and a documented failure test.

Interior routing is the backbone of the enterprise. You configure OSPF with multiple areas and EIGRP, tune metrics and timers, summarize and filter routes, and troubleshoot neighbor and database problems.

• OSPF areas, LSA types and route types
• OSPF network types and neighbor states
• EIGRP metrics, successors and feasible successors
• Route summarization and filtering
• Redistribution between protocols
• Troubleshooting adjacencies

You build A multi-area OSPF and EIGRP network with controlled redistribution between them.

BGP connects the enterprise to providers and partners. You configure eBGP sessions, read the attributes that decide path selection, and shape inbound and outbound traffic with policy.

• eBGP peering and session states
• Advertising and receiving prefixes
• BGP attributes and the best-path decision
• Influencing path choice with local preference and MED
• Prefix lists and route maps
• Troubleshooting a session that will not establish

You build A dual-homed edge with eBGP peers and policy that prefers one provider.

A routed network needs services around it. You translate addresses with NAT, protect the default gateway with HSRP or VRRP, and distribute one-to-many traffic with IGMP and PIM.

• Static, dynamic and overload NAT
• HSRP and VRRP operation and tuning
• Gateway failover with object tracking
• Multicast addressing and IGMP
• PIM sparse mode and rendezvous points
• DHCP and NTP as network services

You build A redundant gateway pair with NAT and a working multicast stream.

Assurance is how you know the network works before users tell you it does not. You diagnose with debugs and traceroute, mirror traffic with SPAN, collect flows with Flexible NetFlow, measure paths with IP SLA, and use Catalyst Center assurance.

• Debug and conditional debug, used safely
• Ping, traceroute and what they miss
• SPAN for packet capture
• Flexible NetFlow records, exporters and monitors
• IP SLA probes and tracking
• Syslog and SNMP for event collection
• Catalyst Center assurance dashboards

You build A monitoring setup that measures a critical path and exports flows for analysis.

Every router and switch is a target. You control device access with AAA, TACACS+ and RADIUS, protect the control plane, apply infrastructure ACLs, understand the security of REST APIs, and read a network security design.

• Local, TACACS+ and RADIUS authentication
• Authorization and command accounting
• Control plane policing and management plane protection
• Infrastructure ACLs and Layer 2 protections
• REST API authentication and transport security
• 802.1X and network access control in a design
• Reading a security design for gaps

You build A hardened device baseline with central authentication and a review of its gaps.

Enterprise teams now manage networks through code. You read Python, build JSON, work with YANG models and REST responses, call Catalyst Center and SD-WAN APIs, script on-box with EEM applets, and weigh where AI belongs.

• Reading and tracing a Python script
• Building and parsing JSON
• YANG models and model-driven interfaces
• Reading REST responses and status codes
• Catalyst Center and SD-WAN APIs
• EEM applets for on-box reactions
• AI in network automation: uses and risks

You build A Python script plus an EEM applet that detect a fault and report it.

Work on one realistic enterprise network from end to end. You verify its design, break and repair routing, switching and services, add assurance and security, and automate one routine task.

• Verifying a network against its design
• Troubleshooting across Layers 2, 3 and services
• Adding assurance and logging
• Locking down device access
• Automating a recurring check

You build A documented, hardened lab network with a fault log and an automated health check.