CCNP Advanced Enterprise 350-401 ENCOR Part2/2

Learn how network address translation on a Cisco router translates private to public IPs, covering static NAT, dynamic NAT, and port address translation, plus inside/outside terminology.

Apply static nat on a Cisco edge router by mapping inside local to inside global and translating outside local to outside global, then verify with show ip nat translation.

Learn PAT on Cisco routers by configuring overload with a single IP, applying ACLs to define inside networks, and using port numbers to distinguish translated sessions.

Configure snmp v2 on Cisco devices with an snmp agent and manager, using a test read/write community, define location and contact, enable traps, and validate with snmp be and wireshark.

Configure snmp version 3 across core switch, r1, and edge router with three security levels—no authentication no privacy, authentication no privacy, and authentication plus privacy—using group and user profiles.

Explore syslog on Cisco routers and switches to centralize logs for monitoring and troubleshooting, using severity levels 0–7 and configuring console, terminal, buffer logging, and a centralized syslog server.

Configure Cisco devices to forward syslog messages to a Windows server, using logging host, buffer, trap levels, and source interfaces across the router, core switch, and edge router.

Learn how network time protocol synchronizes device clocks with a central source, ensuring accurate timestamps for logs, SNMP, and syslog, using NTP modes, stratum levels, and versions 3 and 4.

Configure and test a network time protocol lab environment by establishing an NTP master and multiple clients, syncing from internet and hardware clocks, with optional authentication.

Explore Cisco NetFlow theory, how unidirectional flows capture source and destination IPs, ports, and protocol to monitor bandwidth, identify top talkers, and export UDP-based flow data to a central app.

Configure and verify Cisco NetFlow version 5 and version 9 on an edge router, export flows to a NetFlow server, and analyze traffic with real-time NetFlow tools.

Explore how ACLs filter traffic by permit or deny, evaluated top-to-bottom on routers, with implicit deny, two directions, and standard (1–99) and extended (100–199) variants.

The lecture covers configuring a standard ACL on the edge router, denying a single host by source IP, applying it inbound on interface 1/0, and verification via ping.

Configure an extended acl to block port 80 from a specific pc using acl 100, applying on the interface Ethernet 1/0, with implicit deny and verification of traffic results.

Demonstrates named IP access-list configuration, comparing standard and extended ACLs, and shows how to apply a named IP access-list to interfaces and verify with show IP access-list.

Configure a time-based ACL by creating a time range (absolute or periodic), applying it to an extended ACL, and enforcing it on an interface to allow or block traffic.

Configure the infrastructure ACL on the edge router facing the internet to filter external traffic, blocking ICMP, spoofed addresses, special-use and private address spaces, and then permit remaining traffic.

learn to use debug and conditional debug on cisco devices. understand real-time logs, cpu and memory costs, and filtering by ip or interface.

Learn how to use ping and traceroute to assess reachability and trace network paths, covering ICMP echo requests and replies, and extended ping options in Windows and Linux.

Understand control plane traffic as the device-to-device exchange, alongside data and management planes, and learn to protect it with policing and protection using ACLs, class maps, and policy maps.

Protect the control plane from udp and icmp flooding by implementing control plane policing with acl, class maps, and policy maps on the edge router, and enable logs for monitoring.

Configure Cisco routers to use enable secret, enable service password encryption, and strong algorithm types (md5, sha-256); secure vty with ssh and ACL-restricted login.

Explore the triple-a framework—authentication, authorization, and accounting—and how radius and tacacs+ secure network and device access, policy enforcement, and auditing.

Trace the evolution from Snort, an open-source intrusion detection system, to Sourcefire, later Cisco Firepower, and finally the threat defense device with FTD, FMC, and NGFW capabilities.

protect endpoints with antivirus, firewall, and up-to-date software; deploy endpoint protection agents (trend micro or fireeye), enable anti-phishing, and enforce MFA to safeguard the network.

Explore the next generation firewall, combining traditional firewall functions with App ID, User ID, and Content ID for high-performance deep packet inspection, application-level control, and intrusion prevention.

Explore trustsec tagging and macsec encryption to enforce access control and protect traffic, with 802.1x, mab, web auth, and Cisco ISE.

Learn how ieee 802.1x dot1x enables port-based authentication at layer 2, using eapol between supplicant and authenticator and radius to Cisco ISE for authentication and authorization.

Explain how mab authentication uses the mac address as identity for devices lacking 802.1x, sending the mac to radius/ise while the switch drops other frames and enables dynamic vlan.

Explore web authentication, an http/https portal-based method using Cisco ISE for guest, BYOD, and employee access on wired or wireless networks, redirected to a central portal for login.

Learn to implement IP SLA on Cisco routers to monitor latency, packet loss, and jitter across dual ISP links and enable automatic failover for high availability.

Learn to configure IP SLA on Cisco routers to monitor the primary and backup links, use track and floating static routes for automatic failover, and verify with SLA statistics.

Explore virtualization fundamentals, including physical servers, hypervisors, host and guest operating systems, and how type 1 and type 2 hypervisors create virtual machines, virtual switches, and VLAN networks.

Explore VRF lite, creating multiple virtual routing tables beyond the default global table. Compare partitions to VLANs and security contexts, and note the MPLS distinction for VRF versus VRF lite.

Demonstrates a vrf lite lab that partitions a router into green and blue vrfs, with per vrf interfaces, routing tables, and static and rip or ospf configurations.

Discover the generic routing encapsulation (GRE) tunneling protocol, its lack of encryption, its use for carrying multicast traffic, and how to secure GRE with a site-to-site VPN, plus five-step configuration.

Configure a site-to-site vpn with a gre tunnel between two edge routers to carry private networks and multicast. Enable ipsec to encrypt the tunnel and secure the transmitted data.

Explain how vxlan extends vlans into an overlay over an underlay ip network using vtep encapsulation and udp, and how lisp reduces routing tables with endpoint identifiers and routing locators.

Quality of service in networks manages resources and assigns priority to traffic such as video and IP phone on Cisco routers and switches to reduce packet loss, latency, and jitter.

Explore qos terminologies such as bandwidth, congestion, delay, latency, jitter, and packet loss, and learn how Weiss, video, and data traffic are prioritized (tcp vs udp).

Explore quality of service tools, including classification and marking, congestion avoidance, and congestion management. Apply shaping and policing, with ACLs, class maps, and network based application recognition to QoS.

Explore qos queuing features on Cisco routers, including first-come, first-served (fcfs) default handling, weighted fair queuing, class-based weighted fair queuing, and low-latency queuing with traffic classification and priorities.

Explore quality of service shaping on Cisco routers, configuring ACLs, class maps, and policy maps to cap outbound bandwidth and verify with iperf on R1/R2 and XP clients.

Apply policing on the R2 interface to limit icmp traffic with a class map icmp and a policy map; verify with show policy map and ping tests.

Classify traffic for quality of service using acl-based and nbar methods on routers, identifying telnet, http, ssh, and https to prioritize traffic.

Configure quality of service marking using an ACL named web to identify http traffic, apply class and policy maps to set high precedence, and verify marks on the interface.

Learn the theory and benefits of multicast, compare it with unicast and broadcast, and see how PIM, IGMP snooping, and class d ranges enable scalable one-to-many delivery.

Discover how IGMP, the internet group management protocol, manages multicast membership with versions 1–3, using reports, queries, and leaves, while enabling switches to snoop and routers to route efficiently.

Understand how ICMP snooping prevents multicast flooding by building a multicast table that forwards multicast packets only to joined hosts, while routers manage multicast signaling.

Explain how multicast routing uses the PIM protocol, independent multicast, to carry traffic, with dense mode flooding then prune and sparse mode delivering to interested receivers.

Learn how network automation automates configuration, provisioning, management, testing, and deployment of physical and virtual devices using Python to boost efficiency, reduce errors, and cut costs.

Explore network automation with python through a hands-on lab using csr routers, nexus switches, and ubuntu, configuring vlan, ip addresses, and secure remote access.

Explore how JSON, JavaScript Object Notation, represents data as a lightweight, text-based format for exchanging information between servers and clients using objects, arrays, and key-value pairs.

Explore converting device configurations to JSON, using JSON and JSON pretty commands, and viewing JSON formatted output on Nexus and CSR devices, including Python and Postman API approaches.

Explore Cisco DNA Center as a centralized, single pane of glass platform that automates, configures, and monitors network devices from one place with templates, policies, and assurance.

Learn to access Cisco DNA Center through the API with Postman, obtain a token via POST with basic authentication, and retrieve VLAN, device, and topology data from RESTful endpoints.

Explore NETCONF, the IETF network configuration protocol for automating device config via SSH on port 830, including get, edit-config, copy-config, delete-config, and session control, with RESTCONF as easier HTTP alternative.

Explore netconf in a hands-on lab using Ubuntu and a CSR router, enable netconf, connect over port 830, retrieve running configurations and device capabilities with Python scripts.

Enable rest conf on the CSR router, configure http/https, and retrieve or modify device data via rest conf using Postman or curl with get, post, put, and delete operations.

Explore the theory of data models and the YANG data model language, detailing how data is encoded, retrieved, and displayed from Cisco devices.

Embedded event manager sits inside Cisco routers and switches to automate actions from syslog or cli events, detecting events and preventing reboots or shutting down interfaces.

Explore how to configure an embedded event manager (eem) lab to auto recover interfaces by triggering on syslog messages, creating eem applets, and issuing no shut or other actions.

Explore configuration management tools such as Puppet, Ship, Ansible, and Salt Stick to deploy, configure, and automate servers, storage, and network devices, comparing agent-based and agentless approaches.

Explore software defined networking, where a centralized control plane manages the data plane with zero-touch deployment and centralized management; SD-WAN applies this to connect branches via MPLS and broadband.

Explore how Vmanage provides a centralized, virtual dashboard to deploy, monitor, and push policies across VEdge devices and their data plane, while Vsmart handles control-plane routing and Vbond manages onboarding.

Discover software defined networking, including software defined access and software defined wide area network, for centralized, software-driven control of LAN, data center, and WAN with zero-touch provisioning.