Cisco Certified Network Professional (CCNP) Enterprise Study Guide

Issuing body: Cisco Jurisdiction: Global (vendor certification — not a legal license to practice) Level: Professional Prerequisites: None formal; Cisco recommends solid enterprise networking experience. CCNA-level knowledge is assumed throughout. (Source: catalogue record computer-cert-002.) Renewal: 3-year validity; renew by exam or continuing education credits.

1. What this exam is

CCNP Enterprise = core exam 350-401 ENCOR + one concentration exam (e.g., 300-410 ENARSI for routing, 300-415 ENSDWI for SD-WAN, 300-420 ENSLD for design, 300-430 ENWLSI for wireless, 300-435 ENAUTO for automation). ENCOR is the shared foundation — deepened routing/switching, virtualization, network assurance, security, and automation. The concentration is where you specialize. This guide covers ENCOR in depth plus the ENARSI concentration (the classic routing-heavy choice), with orientation to the others. Where CCNA asks "configure OSPF," CCNP asks "redesign this OSPF domain to converge in under a second without melting the routers."

2. Pathway and exam format

Typical path: CCNA → 2–4 years running enterprise networks → ENCOR + concentration → CCIE (ENCOR doubles as the CCIE qualifying exam).
Format per exam: ~100 questions, ~120 minutes, ~$400 USD each (two exams ≈ $800 total). Same scaled scoring family as CCNA (~825/1000 target).
ENCOR is the gate: pass it once and it counts toward both CCNP and (as the core qualifier) CCIE. Choose the concentration that matches your job — ENARSI for pure routing engineers, ENSDWI if your enterprise is doing SD-WAN, ENSLD for architects.
Lab/simulation fluency must be deeper than CCNA: you'll troubleshoot multi-protocol redistribution and BGP policy, not just bring up a neighbor.

3. Knowledge domains — ENCOR (with theory)

ENCOR blueprint (approximate): Architecture 15%, Virtualization 10%, Infrastructure 30%, Network Assurance 10%, Security 20%, Automation 15%.

Infrastructure: routing at professional depth

EIGRP (the DUAL algorithm, properly):

EIGRP is a distance-vector protocol with link-state-like convergence via DUAL (Diffusing Update Algorithm). Key concepts: Feasible Distance (FD) = best metric to a destination; Reported Distance (RD) = neighbor's metric; Feasibility Condition: RD < FD — a neighbor qualifies as a feasible successor (loop-free backup) only if its reported distance is strictly less than your current best. This is the loop-prevention insight: it guarantees the backup path doesn't route through you.
Metric = 256 × (10^7 / slowest-BW-kbps + cumulative-delay-tens-of-µs / 10), with K1=K3=1 by default. Wide metrics (64-bit, for >1 Gbps interfaces) change the formula — know they exist.
Named mode (address-family) is the modern config; classic mode is legacy. Authentication via key chains. Stub routing for hub-and-spoke (spoke advertises connected/summary only — prevents the spoke becoming a transit path).

OSPF at scale:

LSA types: 1 (Router), 2 (Network, from DR), 3 (Summary, from ABR), 4 (ASBR summary), 5 (External), 7 (NSSA external). Know which crosses area boundaries (3, 4, 5) and which don't (1, 2 stay in-area; 7 is NSSA-only, translated to 5 by the ABR).
Area types: stub (no type 5; default route injected), totally stubby (no 3/5 except default), NSSA (allows limited external via type 7 — the "we need to redistribute here but stay a stub" answer), totally NSSA.
Summarization: area range on ABRs (type 3), summary-address on ASBRs (type 5/7). Summarization shrinks LSDBs and hides flapping — the exam's scaling answer. Cost of a summary = lowest component cost.
Virtual links (transit area through a non-backbone area to reach area 0) — know they're a temporary fix, not a design.
OSPF authentication: null / clear-text / MD5 / HMAC-SHA (modern). Mismatched auth = neighbors stuck in INIT/EXSTART.

Redistribution — the most tested CCNP topic:

Redistribution is where loops are born. Two-way redistribution between protocols without filtering creates feedback loops (route learned from OSPF redistributed into EIGRP, then back into OSPF with better metric).
Controls: route-maps with prefix-lists, tag routes at redistribution points and deny tagged routes on the way back (the classic loop-prevention pattern), administrative distance manipulation (raise the AD of redistributed external routes so the native protocol wins), distribute-lists.
Seed metrics: redistributed routes need an explicit metric (EIGRP requires it — no default; OSPF defaults to 20, or 1 for BGP). Forgetting the seed metric = route not redistributed (EIGRP) — the #1 redistribution sim failure.
Route tagging pattern: on redistribution into protocol B, set tag 100; on redistribution back into A, deny tag 100. Memorize this pattern — it answers half the redistribution questions.

BGP (the exam's deepest protocol):

Path-vector; TCP 179; eBGP (AD 20) between ASes, iBGP (AD 200) within. iBGP's full-mesh requirement (O(n²)) is solved by route reflectors (clients peer only with RRs; cluster-ID prevents loops) or confederations.
BGP table vs RIB: a route must be in the local routing table (via network statement matching, redistribution, or aggregate) to be advertised — network 10.0.0.0 mask 255.255.255.0 requires an exact RIB match.
Path selection algorithm (memorize the order): 1. Highest WEIGHT (Cisco-proprietary, local to the router), 2. Highest LOCAL_PREF (AS-wide), 3. Locally originated (network/redistribute > aggregate > iBGP-learned), 4. Shortest AS_PATH, 5. Lowest origin (IGP < EGP < incomplete), 6. Lowest MED (between neighboring ASes), 7. eBGP over iBGP, 8. Lowest IGP metric to next-hop, 9. Oldest eBGP, 10. Lowest router ID, 11. Lowest neighbor IP. The exam lives in steps 1–6.
WEIGHT vs LOCAL_PREF: weight influences outbound path for one router; local-pref influences the whole AS. "Prefer ISP-A for all outbound traffic" → local-pref on ingress from ISP-A. "This router prefers ISP-B" → weight.
MED influences inbound path selection by the neighbor AS (compared only between same-AS paths by default). AS_PATH prepending makes your AS look longer — de-preferring inbound traffic without neighbor cooperation.
BGP communities (standard, extended, large): tags for policy — e.g., community 65000:100 = "prefer via peer X." Route maps apply the policy. BGP filtering: prefix-lists + filter-list (AS-path ACLs) on eBGP edges — never accept full tables without filtering (and know why: route leaks/hijacks).
Synchronization (legacy, disabled by default — know it's off). Next-hop processing: eBGP changes next-hop to itself; iBGP preserves it — next-hop-self on iBGP edges toward the IGP is the standard fix for unreachable next-hops.

Multicast (ENCOR breadth): PIM sparse mode + RP (rendezvous point); IGMP snooping on switches; ip multicast-routing. Know the concepts (shared tree → source tree switchover, BSR/Auto-RP) at a conceptual level.

Infrastructure: switching at scale

STP deep: PVST+ (per-VLAN STP — Cisco default), Rapid-PVST+ (the one you actually run), MST (802.1s — instances map multiple VLANs to reduce STP instances; regions, IST/CST). Know MST region config must match (name, revision, VLAN mapping) or switches fall into separate regions.
StackWise / VSS / vPC concepts: logical single-switch from physical pairs (control-plane implications for STP and EtherChannel).
VXLAN (data center overlay): 24-bit VNI (16M segments vs 4K VLANs), VTEP encapsulation (UDP 4789), EVPN as control plane (BGP EVPN for MAC/IP learning — replaces flood-and-learn). The exam tests why (multi-tenancy at scale, L2 over L3), not deep config.

Architecture, virtualization, assurance, security, automation

Enterprise architecture: 2-tier/3-tier campus, SD-Access (fabric: underlay + overlay with LISP, VXLAN, CTS/SGT microsegmentation), SD-WAN (vManage/vSmart/vBond/vEdge — centralized policy, OMP routing).
Virtualization: VRF-lite (multiple routing tables, ip vrf), GRE/IPsec tunnels, LISP concepts, device virtualization (VDCs).
Network assurance: NetFlow/Flexible NetFlow (traffic analysis), SPAN/RSPAN/ERSPAN (packet capture), IP SLA (synthetic probes: jitter, loss, MOS for voice), DNA Center assurance concepts.
Security: DHCP snooping/DAI (from CCNA) + 802.1X deep (EAP-TLS vs PEAP, MAB for non-supplicant devices), Cisco TrustSec/SGT (tag-based microsegmentation), control-plane policing (CoPP — protect the route processor from DoS), uRPF (anti-spoofing: strict/loose), REST API security, switch hardening at scale.
Automation: YANG/NETCONF/RESTCONF (deeper than CCNA — actually read data models), EEM (embedded event manager applets — on-device automation), Python/Ansible for config management at scale, Cisco DNA Center APIs.

4. Key formulas and numbers

EIGRP classic metric: 256 × (10⁷ / min-bandwidth-kbps + total-delay-tens-of-microseconds / 10). Bandwidth dominates; delay breaks ties.
OSPF cost: 10⁸ / interface-bps (set reference-bandwidth to 100000 for 100G-era networks).
BGP decision: WEIGHT → LOCAL_PREF → local origination → AS_PATH length → origin → MED → eBGP>iBGP → IGP metric → oldest → RID. Memorize cold.
Feasibility condition: RD < FD ⟹ feasible successor (loop-free backup).
Summarization: summary route cost = min(component costs); summary hides flapping specifics.
Convergence budget: detection (carrier-delay/BFD ~ms) + propagation (LSA/flooding) + SPF computation (throttled) + RIB/FIB update. BFD (50 ms × 3 = 150 ms detection) is the exam's answer to "sub-second convergence."

5. Worked examples

Example 1 — Redistribution loop with tags. Scenario: OSPF and EIGRP domains redistributed both ways at two boundary routers; routes flap and loop. Solution: At each redistribution point, tag on the way out (route-map OSPF-TO-EIGRP: set tag 10 when redistributing OSPF→EIGRP; set tag 20 for EIGRP→OSPF), and deny on the way back in (redistribute EIGRP→OSPF with route-map denying tag 10). Additionally raise AD of redistributed routes (e.g., EIGRP external 170 is already high; for OSPF externals consider distance ospf external 175). Verify with show ip route (no oscillation) and show ip ospf database / show ip eigrp topology. The tag pattern is the professional answer; distribute-lists alone are brittle.

Example 2 — BGP traffic engineering. Scenario: Dual-homed enterprise, AS 65001, ISP-A (primary) and ISP-B (backup). Requirements: all outbound via ISP-A unless it fails; inbound should prefer ISP-A; ISP-B must never transit traffic between other ASes. Solution: Outbound: set LOCAL_PREF 200 on routes learned from ISP-A, 100 on ISP-B (AS-wide preference). Inbound: prepend AS_PATH 3× on advertisements to ISP-B (de-preference without ISP cooperation); optionally MED. Anti-transit: no iBGP full mesh issues here, but ensure no route is advertised from ISP-A to ISP-B: prefix-list outbound filters permitting only the enterprise's own prefixes (never accept/advertise full tables blindly). Verify: show ip bgp (loc-pref column), show ip bgp neighbors <x> advertised-routes.

Example 3 — OSPF scaling with areas and summarization. Scenario: 400-router single-area OSPF; SPF runs constantly due to flapping access links; routers are CPU-bound. Solution: Migrate to multi-area: area 0 backbone, distribution areas per region; ABRs summarize with area range (e.g., 10.1.0.0/16 per area); make access-layer areas totally stubby (area 2 stub no-summary) so they get only a default route. Flapping /32s no longer flood type-1/2 LSAs beyond the area; SPF runs per-area. Add BFD on critical links for fast failure detection without aggressive OSPF timers (which risk false positives).

Example 4 — EIGRP feasible successor design. Scenario: Hub-and-spoke WAN; spoke routers lose their primary path and take 30+ s to reconverge via DUAL active queries. Solution: Ensure feasible successors exist before failure: tune metrics so backup paths satisfy RD < FD (adjust delay on interfaces — delay is the safe knob, bandwidth affects the whole path computation). Where topology can't provide one, use EIGRP stub at spokes + summarized routes from hub so queries don't go active across the WAN (SIA — stuck-in-active — is the WAN killer). Verify: show ip eigrp topology shows (F) feasible successors; show ip eigrp topology active should be empty in steady state.

Example 5 — Campus loop protection at scale. Scenario: Large campus, Rapid-PVST+, users plugging in unmanaged switches causing TCN storms. Solution: PortFast + BPDU Guard on all access ports (BPDU → errdisable), Root Guard on distribution downlinks (superior BPDU → root-inconsistent, not new root), Loop Guard on redundant trunk links (unidirectional failure → loop-inconsistent instead of forwarding), Storm Control on access ports. UplinkFast/BackboneFast are legacy (RSTP handles it). Verify: show spanning-tree inconsistentports. Layered guards, not just PortFast — that's the CCNP-level answer.

6. Standards and regulations cross-reference

IEEE 802.1s (MST), 802.1w (RSTP), 802.1Q, 802.3ad (LACP) — know which standard each technology implements; the exam occasionally tests standard numbers.
IETF RFCs: 2328 (OSPFv2), 4271 (BGP-4), 4760 (multiprotocol BGP), 3021 (/31), 1918 (private space), 4364 (MPLS/BGP VPNs — VRF concept origin).
FCC Part 15 — wireless deployments (ENWLSI concentration): unlicensed spectrum rules, EIRP limits.
CALEA / EECC — lawful intercept as carrier obligations (context, not config).
PCI DSS v4.0 — segmentation (VRFs, firewalls, ACLs), Requirement 1 & 11; CCNP-level: TrustSec/SGT microsegmentation as the modern answer.
ISO/IEC 27001 — A.8.20 network security, A.8.21 security of network services: the management-system wrapper around the technical controls.

7. Pitfalls, traps, and exam strategy

Trap patterns:

The seed-metric trap: EIGRP redistribution without a metric silently fails. Always default-metric or per-route-map set metric.
The iBGP full-mesh trap: "why aren't iBGP routes propagating?" — split-horizon: iBGP learned routes aren't re-advertised to iBGP peers. Answer: route reflector or full mesh.
The next-hop trap: iBGP route with unreachable next-hop — next-hop-self on the edge router.
The WEIGHT-vs-LOCAL_PREF trap: weight is per-router, local-pref is AS-wide. Read the scope in the question.
The summarization-blackhole trap: summary routes point to Null0 — a component failure with an overly broad summary can blackhole traffic. The exam tests this via "traffic dropped after summarization."
The concentration-choice trap: pick the concentration matching your experience. ENARSI is the deepest routing test; ENSDWI is policy/architecture-heavy.

Strategy: ENCOR is wide — don't neglect automation/assurance (25% combined). For ENARSI, live in the BGP decision process and redistribution patterns; draw the topology for every sim. Memorize: BGP decision order, LSA types, EIGRP feasibility condition, area types. Time: same ~2.4 min/question discipline as CCNA but the sims are longer — triage ruthlessly.

8. Practice problems

P1. BGP table shows two paths to 192.0.2.0/24: via ISP-A (local-pref 100, AS_PATH 701 702) and via ISP-B (local-pref 200, AS_PATH 703). Which is chosen and which attribute decided? Answer: ISP-B — LOCAL_PREF (200 > 100) is evaluated (step 2) before AS_PATH length (step 4). The shorter AS_PATH via ISP-A never gets considered. To prefer ISP-A, raise its local-pref above 200.

P2. An EIGRP router's topology table shows a successor (FD 3072) and a second path with RD 4096. Is the second path a feasible successor? What if RD were 2048? Answer: RD 4096 > FD 3072 → fails feasibility (RD < FD required) → not a feasible successor; DUAL must go active on failure. RD 2048 < 3072 → feasible successor, instant local failover. This is the DUAL loop-prevention guarantee in action.

P3. OSPF area 1 is configured stub; a router inside needs to advertise a static route to a partner network. What breaks, and what's the fix? Answer: Stub areas block type-5 LSAs — the ASBR can't inject the external route. Fix: convert to NSSA (area 1 nssa) so the ASBR generates type-7, translated to type-5 by the ABR. (Totally stubby/NSSA variants per how much summarization you want.)

P4. eBGP session won't establish; show ip bgp summary shows Active. TCP 179 is open. List three likely causes. Answer: (1) AS number mismatch in neighbor statements, (2) source-interface/update-source mismatch (multihop or loopback peering without ebgp-multihop/update-source), (3) router-ID or MD5 password mismatch. Check show tcp brief and debugs; BGP has no multicast discovery — every parameter is manual, so mismatch is the default hypothesis.

P5. After enabling summarization at an ABR, users report some subnets unreachable though the summary is advertised. Diagnose. Answer: The summary's Null0 discard route is fine — the issue is a missing/more-specific component: either the component route was withdrawn (flapping link) while the summary persists, or the summary is too broad (covers addresses with no valid path). Check show ip route <specific> on the ABR: if the longest match is the Null0 summary, that's the blackhole. Fix: tighten the summary range or restore the component advertisement.

P6. Design loop prevention for two-way redistribution between OSPF and BGP at two border routers. Give the mechanism. Answer: Tag at redistribution: OSPF→BGP set community/tag 100; BGP→OSPF deny tag 100 on ingress (route-map). Simultaneously: raise AD of redistributed BGP routes in OSPF (distance ospf external 210 > iBGP 200? careful — set external 210 so native iBGP wins), and filter with prefix-lists so only intended prefixes cross. Two independent mechanisms (tags + AD) because any single one has edge cases.

Original ETS reference writing, verified against public sources on 2026-09-30. Thin sourcing is flagged inline. Not legal advice — confirm current editions with the issuing body.

Cisco Certified Network Professional (CCNP) Enterprise Study Guide