CCIE Enterprise Infrastructure (v1.0) - Technical Classes

Master software defined networking through Cisco DNA and SD-Access, covering basics, VXLAN, SD-Access deployment, policy, fabric bring-up, ISE integration, then explore Cisco SD-VAN and DNA assurance.

Explore how DNA fabric integrates automation, assurance, provisioning, planning, and analytics within the DNA center, detailing the management, control, data, and policy planes and edge nodes.

Compare automated underlay provisioning using Cisco DNA Center seed devices with plug-and-play devices against manual underlay setup, highlighting seed devices, DHCP detection, BNP, and temporary configurations erased after automation ends.

Explore DNA fabric architecture with control plane, edge, and border nodes, including host tracking, VXLAN tunnels, anycast gateways, and internal versus external border routing.

Explain how fabric-enabled wireless unifies wired and wireless networks using VXLAN and CAPWAP tunnels, host pools, and control plane integration to onboard and manage devices.

Explore fabric constructs and roles, from underlay to overlay, with virtual networks, OMP, Lisp, and vxlan encapsulation. Learn about host pools, scalable groups, anycast gateways, and security group tagging.

Configure a discovery in DNA Center to locate devices using an IP range or CDP, connect via SSH, SNMP, Netconf, or CLI, then assign devices to sites.

Learn the DNA discovery workflow: discover devices, assign sites via provisioning, view inventory and topology, and manage global configurations with inheritance across site labels.

Explore the Cisco DNA Center design workflow, mastering the network hierarchy, site and floor structuring, network settings, image repositories, and authentication templates to design enterprise infrastructure.

Navigate policy workflow, create group-based ACLs and IP-based access control, define virtual networks, and implement dynamic or static host onboarding for IoT devices.

Configure policy-based host onboarding using an address pool, authentication policy, and traffic type, with layer two flooding, and practice static and dynamic provisioning through port assignments.

Discover and onboard devices via DNA Center, verify SSH reachability, assign devices to a site, and provision a fabric with edge node, border, and control plane roles over VXLAN tunnels.

Provision and deploy devices in the fabric, assign control plane and border roles, monitor provisioning status, configuration pushes, and telemetry in DNA Center.

Explore the ISE smart dashboard, navigate the policy administration node and PSN, and review authentication, authorization, profiling, posture, and client provisioning in single or distributed deployments.

Demonstrate day zero deployment of ISE 3.0 by running setup, configuring IP, subnet, gateway, DNS, and SSH, then enable pixie grid setting and URLs for later DNS integration.

Learn to integrate Cisco ISE with DNAC, establish trust, enable pxGrid, exchange certificates, and create a secure SSL tunnel for contextual data via external RESTful services.

Learn to integrate DNA Center with ISE by configuring deployments, enabling pixie grid and urs services, creating identities and groups, establishing trust, and using rest api to enable policy-driven access.

Migrate policy data from ISE to Cisco DNA Center and set DNA Center as the policy administration point, migrating scalable groups and enforcing ISE read-only policies.

Vxlan creates a virtual extensible local area network that supports millions of layer-2 segments with non-blocking, equal-cost multipathing, enabling underlay-overlay separation and multitenancy.

Explore vxlan encapsulation, detailing the 50-byte overhead and headers: vxlan, udp, ip, and mac, with a 24-bit vni mapping to vlan and vtep-based outer addressing for unicast or multicast traffic.

Explore the Lisp concepts of locator ID separation, where endpoint identity and location form a map-driven control plane with map server and map resolver for optimal routing.

Explore the Lisp packet walk, detailing data plane movement, log mapping, multihoming, virtualization, and proxy scenarios, plus control plane queries and dns resolution.

Demonstrate end-to-end LISP verification by running trace routes, end-to-end ping, and registration checks across R2, R3, and R4, while inspecting map servers, resolvers, and router IDs.

Explore how DNA Center assurance enables proactive troubleshooting, visibility, and remediation via a single dashboard that ties design, policy provisioning, telemetry, and ISE integration to network, client, and application health.

Explore sd-wan concepts from basics to migration, including architecture, controller deployment, and central policies, with labs using vsmart to push central policies, guiding migration planning.

Explore Cisco's sd-wan architecture, fabric overview, and centralized vs localized policies, plus security and cloud multi-cloud integration for end-to-end visibility and intent-based automation.

Explore sd-wan features enabling end-to-end, label-based traffic with transport-independent WAN, unified analytics, and inbuilt security, integrated with ISE, DNA Center, and cloud gateways like Zscaler and Umbrella.

Explore Cisco's end-to-end sd-wan architecture across campus, branch, and data center, with a single tag-based policy, global routing, analytics, and integrated security, QoE optimization, and cloud and on-prem integrations.

Learn how the data plane forms IPsec tunnels and establishes the sd-wan control connection with Vmanage, Vbond, and Vsmart, including onboarding and certificates.

Understand how the sd-wan fabric operates, from edge devices and vSmart via OMP to IPsec data planes with BFD, and how multi-topology VPNs underpin transport, management, and service networks.

Understand the overlay management protocol (omp) in sd-wan, where vsmart exchanges keys and pushes policies while advertising service VPN, tloc, and service routes to edge devices, plus best-path criteria.

Explore the sd-wan policy framework, comparing centralized and localized policies for control and data planes, and how vmanage and vsmart push policies to edge devices using netconf, yang, and omp.

Learn the building blocks of centralized sd-wan policies: define group of interest, choose control or data policy, apply per site with tloc and VPN lists, and support application aware routing.

Apply multi topology sd-wan policies to enforce hub-and-spoke for vpn ten and full mesh for vpn twenty, using vmanage to build control and data policies.

Explore service insertion and policy routing to redirect VPN traffic to a firewall and hub-and-spoke vs full mesh topologies, with practical steps to create, edit, apply, and test policies.

Configure a data center priority control policy in sd-wan to prefer DC1 as primary and balance across data centers for site groups, then apply and activate the centralized policy.

Explore extranet or route-leak policies that control sharing of routes between VPNs, using a loopback 100 and site IDs to export routes from VPN 100 to VPNs 20 and 40.

Enable application aware routing policies in data policy to route traffic by app id recognized by dpi engines (Cosmos and Nbar), enabling SLA-based path selection and failover with bfd metrics.

Learn the sd-wan migration strategy from data centers to branches, covering OMP and vpn zero, service and transport vpn, feature templates, and lab deployment steps.

Plan a data center first sd-wan migration, using dual core paths and added edge routers to balance sd-wan and non sd-wan traffic as you migrate branches.

Bring up other data center devices by installing certificates, validating bootstrap configuration, serial numbers, and tokens, activating chassis numbers, and deploying a Vmanage template across edge devices.

Configure and verify BGP between core and cEdge devices, establish neighbors, advertise default routes and data centers prefixes, and redistribute between underlay OMP and BGP via templates.

Learn to advertise BGP inside OMP to vSmart and redistribute OMP routes into BGP, with templates for data center and branches, and apply tags to avoid route loops.

Redistribute OMP into BGP and verify route propagation from vSmart to core routers across data centers, while exploring tagging and local policy to steer sd-wan traffic toward core one.

Upgrade and migrate branch devices by validating sd-wan compatibility, upgrading images, and setting boot variables, then verify bootstrap configuration, certificates, and push sd-wan templates from Vmanage.

Continue the branch 3 migration by configuring bootstrap, authenticating, installing the permanent certificate, joining the fabric, attaching the single outer MPLS template, and uploading branch 3 variables via vmanage.

execute the branch five migration to sd-wan, using an internet link for cutover and mpls for non-sd-wan prefixes; onboard devices with bootstrap configs and templates while verifying ipsec and bgp.

Post branch migration checks validate BGP peering with the sd-wan and MPLS networks, update a BGP template to redistribute OMP, and verify routes and traceroutes.

Master the basics of MPLS and DMVPN, with labs and playlist videos covering MPLS and DMVPN concepts in section 3.0.

Explore how MPLS replaces routing table lookups with label switching to improve efficiency, enabled by Cisco Express Forwarding, and learn how labels are imposed to route traffic in large networks.

Activate mpls on routers, inspect 20-bit labels, bottom of the stack, and ttl, and verify bindings, ldp, and forwarding using show mpls commands for unicast 0x8847 and multicast 0x8848.

Learn MPLS basics from customer edge to provider edge and core routers, including edge label imposition and removal, with LDP and label tables in the control and data planes.

Explore how ldp builds lsp in an mpls network, examine the rib table and label information base, and see how nexthop changes affect the forwarding and bindings.

Explore how MPLS uses RIB, LIB, and FIB across control and data planes, and how label operations—push, swap, pop, untagged, aggregate, and penultimate hop popping—drive forwarding decisions.

Explore MPLS layer 3 VPN concepts, VRF separation, and BGP-based routing between customer and provider edges, with a lab walkthrough of C to P and P to P communications.

Enable the vpnv4 address family between provider edges with BGP and iBGP, implement MPLS labels, and understand route distinguisher, route target, and import/export with extended communities.

Configure the mpls backbone with ospf as the igp, form bgp neighbors between provider routers, and enable vpnv4 address family with route distinguisher and route target for vpn connectivity.

Configure PE-CE routing for customer one, enabling OSPF on one side and RIP on the other, with two-way redistribution between OSPF and BGP using route tagging, import/export, and VRF.

Configure customer two with VRF and VCF, set up BGP inside AS 15, perform redistribution between P and C, and verify connectivity while troubleshooting one-way route advertisement.

Master troubleshooting steps for one-way traffic and vpnv4 redistribution between BGP and IGP, verify configurations, redistribution, and MPLS labels using commands like show ip route and show bgp vpnv4 unicast.

Explore DMVPN concepts and related terminologies, then demonstrate Cisco DMVPN configuration in the lab, highlighting its multi-site, high-scalability IPsec VPN solution before SD-WAN.

Dmvpn enables dynamic hub-and-spoke and spoke-to-spoke tunnels with scalable, transport-agnostic IPsec security, using next-hop resolution protocol caching and multi-point tunnel configurations for flexible underlay routing.

Explore how DMVPN creates hub-and-spoke tunnels, maps tunnel IPs to loopback and public addresses, performs registration with cache binding, and exchanges routing databases through encapsulated tunnels in phase two.

Delve into dmvpn three phases: phase one hub-and-spoke, phase two where spokes know each other’s routing, and phase three dynamic spoke-to-spoke tunnels with hub route summarization and redirect behavior.

Learn automation and programmability for enterprise networking, covering basics of automation programming, sd-wan vmanage automation programming, related automation programming, and Netconf client, with a curated 26-video playlist.

Trace the evolution of network management from snmp to rest-based APIs, highlighting snmp limitations and the rise of programmable, real-time, machine-to-machine management with netconf and restconf.

Leverage model driven network programmability to manage multi-vendor infrastructure with open APIs, data models, and encodings like XML and JSON via Netconf, Restconf, and gRPC.

Learn json as a data encoding format, its similarity to Python dictionaries, name-value pairs, and how dumps converts dicts to json strings for use in network automation with Nexus OS.

XML describes data, unlike HTML which displays it, and this lecture shows integrating XML with Python using SAX to parse movies.xml into a human-readable output, highlighting XML vs JSON.

Learn rest, the representational state transfer, and how http verbs like get, post, put, patch, and delete enable create, read, update, and delete operations with json or xml payloads.

Explore how Python's interpreter language powers fast, easy networking automation and artificial intelligence workloads, with inline coding or script files (.py) across operating systems.

Enables the guest shell on the switch, accesses the Linux kernel, and runs Python 3 scripts to execute CLI commands like show ip route and show ip brief.

Learn to trigger Python scripts from Cisco real-time event manager applets to automatically reconfigure routes when a line protocol goes down, using logs, VLANs, and lab testing.

Explore sd-wan vmanage api and postman through restful api concepts, token-based authentication, and python automation to manage devices, templates, and monitoring tasks.

Explore the SD-WAN vManage monitoring API by converting raw JSON data to a table and CSV, then extracting device ID, hostname, and reachability for reporting.

Navigate the DNA Center dashboard to verify REST APIs, review API references, and enable access, then practice retrieval of VLAN topology data via Swagger using get, post, put, and delete.

Obtain a token by posting to the dnac api in a Cisco sandbox lab, then reuse the token for subsequent api calls; structure includes config, library, and main programs.

Explore network discovery device APIs in DNA Center and view discovery counts. Learn to convert API responses to Python and export results to CSV, including get discovery by range.

Use a script and template API to create a project, build a basics.txt template, and push it to one or many devices, then verify deployment status and show run configurations.

Explore ncclient, a Python netconf client that maps XML to Python constructs for configuring IOX-XE devices, with pip installation and labs for iOS configurations.

This lab demonstrates using ncclient with netconf on ios-xe, to verify device capabilities, retrieve interface details and statistics, and apply configuration changes via XML payloads.

Explore model driven telemetry to replace snmp polling with fast, structured, push-based data collection. Learn how yang models, netconf, and elastic/grafana enable scalable, real-time analytics.

Explore network subscription concepts, including the contract between service and subscriber, publication, and xpath-filtered push telemetry with periodic or on change timing, plus young model with xml and json encoding.

Explore a model driven telemetry lab in DevNet, configuring IETF subscriptions with XPath filters on a CSR 1000 V, then visualize metrics in InfluxDB, Grafana, Kibana, and Kafka.

Explore gRPC as a high-performance, simple client development protocol, a functional subset of Netconf over https, with json encoding and http transport, supporting get, put, post, delete, and config operations.

Examine authentication, authorization, and accounting using Cisco Identity Services, including policy and rule sets, MAB and S0 2.1, and auditing for network access.

Explore how access and authentication work in ISE, from supplicant, authenticator, and radius to identity stores like Active Directory, with policy, monitoring, and pxgrid integration.

Configure the switch for Tripoli by setting voice and data VLANs on gig0/1, connecting the access point on gig0/2, and enabling aaa with radius for authentication, authorization, and accounting.

Configure router R1 and the ac with radius aaa, creating a radius server CCI at 198.19.10.27, ports 1645/1646, key Cisco, and authorize ssh exec via aaa and firewall radius settings.

Protect the control plane by creating and applying a policy that limits control plane traffic using class maps and policy maps, with burst and drop actions.

This lab shows configuring control plane policy with class maps (icmp, dhcp, ip redirect), building a policy map, applying a service policy, and verifying with show commands and counters.

Explore switch and router security features, plus IPv6 security features, as you begin section 4.2. Follow an 11-video playlist to master 802.1X port-based authentication and complete subsection 4.2.

Learn basic Cisco router security by configuring line security, Telnet transport, privilege levels, and md5-hashed enable secret plus service password encryption.

Configure line and enable passwords, enforce encryption, and use login local with admin users and privilege levels; enable SSH with domain name, RSA keys, and version 2, aligning to ISE.

Explore standard and extended ACLs, including named ACLs, learn how to match source and destination addresses, protocol types, and ports, and apply permit or deny decisions on ingress or egress.

Demonstrates configuring standard ACLs to block loopback addresses using an even-allow and odd-block rule, then converts to named ACLs with remarks and checks reachability.

Build named extended acl to permit specific source and destination IPs, including loopback addresses, apply inbound on fast ethernet, with implicit deny and tcp/udp options.

Learn to implement time based ACLs by creating absolute and periodic time ranges, naming them, and applying them to deny http during defined windows.

Enable switch port security to limit mac addresses and define violation actions. Use dhcp snooping and dynamic arp inspection to prevent rogue servers and arp spoofing.

Learn how private VLANs divide a single VLAN into a primary and secondary VLANs (community or isolated) with host and promiscuous ports, and map them for gateway layer 3 forwarding.

Explore the SNMP architecture with managers, agents, and a management information base, using get and set methods across v1, v2c, and v3, plus traps and informs for asynchronous notifications.

Understand Cisco MIB structures and SNMP versions 1, 2c, and 3, contrasting community-based authentication with the secure v3 model, and learn how SNMP managers query agents using the get method.

Configure SNMP in the lab by setting community strings, views, and ACLs for v1/v2 and v3, enable traps or informs, and verify with show commands.

Perform an SNMP lab setup with a manager and agent, configure SNMP on switch and host, define read/write access, and verify with an SNMP walk while noting port 161.

Perform a quick revision of SNMP configurations across v1, v2c, and v3, including community strings, acl-based access, traps, dns or url hosts, and auth/priv options.

Configure and verify syslog by selecting log levels from emergencies to debugging. Send messages to a remote syslog server over UDP port 514 with buffering and configurable history size.

Explore using debugs and conditional debugs on Cisco routers to monitor traffic without overloading cpu, enable and refine debugging for IP and ICMP, and interpret show debug outputs.

Enable conditional debug for IP packets on a router, apply ACL-based conditions (standard, extended, number-based), and match fast ethernet interfaces to reduce verbose output.

Learn how to use debugs and conditional debugs on Cisco routers to troubleshoot ping, monitor icmp and ip traffic, and minimize cpu impact.

Demonstrates conditional debug on routers using acls (standard and extended, named- and number-based) to filter and reduce debug output for specific interfaces and hosts.

Learn how quality of service manages congestion and packet loss with traffic classification, policing, and end-to-end policy mapping across Cisco hardware, including trust boundaries and nbar-based application recognition.

Design and implement quality of service on enterprise hardware by classifying and marking traffic, mapping to queues, configuring trust, and applying service policies on multilayer switches.

Explore ingress trust models, policy maps, and nbar-based classification to implement qos on Cisco platforms, including marking and policing across per-port VLAN policies.

Explore qos design across 4500, 6500/6800, and nexus platforms, mapping 12 class models to priority queues with bandwidth thresholds and AF classes, using weighted random early detection or tail drop.

Explore Cisco express forwarding fundamentals, including control plane versus data plane, and how the supervisor engine programs the FIB, ARP, and adjacency tables for fast longest-prefix matching.

Verify CIF on VLAN interfaces with show interface and show IP interface, then explore TCAM resources for MAC host routes, IGMP, LPM, and multicast routes using the switch CLI.

Explore hot standby router protocol (hsrp) to provide first hop redundancy with a virtual gateway and virtual mac, using active and standby roles, priority, preemption, and fast convergence.

Configure hsrp on r2 and r3, assign a virtual ip, set priority and preempt, and verify active and standby roles with show standby brief while testing failover.

Explore virtual router redundancy protocol as the industry standard gateway protocol, compare it with hsrp, examine timers, preempt, mac address, and implement manual load balancing with grouped virtual ip addresses.

Configure VRRP in a lab to run a virtual router redundancy protocol across routers. Set priorities, enable preemption, and create multiple groups for load balancing.

Run the NAT lab with router R1 and switch, configure master, set the server IP, verify with show entropy association and status, then configure MD5 authentication with trusted keys.

Demonstrate the NAT lab 02 topology by configuring R2 as master router with R4 and R5 on a LAN, verify synchronization via show run, show http status, and show clock.

Explore NAT concepts, including static, dynamic, overload (PAT), and the transfer of private addresses to public addresses. Learn inside local/global and outside local/global terms, packet flow, and basic lab commands.

Learn to configure nat and pat on a small network by defining inside and outside interfaces, creating a host acl and nat pool, enabling nat overload, and verifying translations.

Continue nat and pat lab in GNS3, configuring inside local to inside global and outside local to outside global, verify with show ip nat translations and show ip nat statistics.

Cover network optimization, network operations, the span feature, and packet capture, with NetFlow and span videos guiding you through sections 4.6 and 4.7.

Explore net flow and flexible net flow, comparing versions 1, 5, and 9 to analyze fields, traffic metadata, and application data with NBAR for security and network analysis.

Master traditional and flexible net flow by configuring key and non-key items, flow records, exporters, and templates, and leveraging nbar to reveal application-level traffic.

Configure flexible netflow by defining an exporter, creating a flow record with matched fields (source and destination addresses, application, routing, transport), and applying a monitor to an interface.

Learn how to capture data plane traffic using span, rspan, and erspan, configuring source and destination ports, using Wireshark for analysis, and distinguishing local versus remote encapsulated capture.

This lecture explains Cisco IP SLA as a mechanism using ICMP echo to monitor loss, latency, and jitter and switch to a backup path when the primary fails.

Learn to perform packet captures on Cisco devices using netflow and embedded packet capture tools across iOS, Catalyst, Nexus, and firewalls, and configure flow records, exporters, and monitors.

Explore packet capture across Cisco devices using embedded, iOS based, and Acer captures; export to a TFTP server and analyze with Wireshark, using span and monitor session techniques.

Update your sd-wan training with ten new videos aligned to the CCI 1.1 update. Complete your sd-wan learning to master the sd-wan curriculum.

Explore SD-WAN architecture with Estevan, detailing decoupled data and control planes and the management and orchestration layers, and how Vmanage, Vbond, and VSmart coordinate IPsec data-plane tunnels.

Learn to bring up a Cisco SD-WAN home lab end-to-end, manually configuring vmanage, vbond, vsmart, edge devices, and certificates through baseline setup, zero-touch provisioning, PnP, and certification.

Master plug and play onboarding with the BNP portal, smart accounts, vbond profiles, and vManage and vSmart integration, including templates, variables, and bootstrap configurations.

Build device templates and feature templates with system wide configurations, VPNs, and interfaces, then push via netconf using we manage to edge devices, enabling OMP and OSPF redistribution.

Create and push device feature templates via netconf from vmanage, assemble generic template from small feature templates for vpn ten, and understand omp routing with tloc and vsmart route reflector.

Explore OMB theory, best-path selection, and graceful restart, then learn SD-WAN policy construction—centralized vs localized and data vs control—built with match-action rules and directional policy application.

Learn to design and apply multi topology SD-WAN control policies and route leaks between VPNs using Vmanage, Vsmart, and OMP, with data and control policy blocks and hub-and-spoke traffic flows.

Learn to configure sd-wan control policy to prefer dc one or dc two for branches and to implement data policy with cflowd, using site identifiers and routing preferences.

Explore application aware routing policy in sd-wan, covering data policies, SLA-driven path selection between MPLS and internet, and BFD monitoring. Apply practical policy deployment with Vmanage and Vsmart.

Learn how vpn membership policy controls ipsec tunnel formation for specific vpns and how local route policy shapes traffic across branches.