CCNP,CCIE Enterprise: ENCOR 350-401 Training Part-2/2

Learn border gateway protocol, the exterior dynamic routing protocol for internet connectivity. Discover its TCP-based operation on port 179, path vector routing, iBGP and eBGP flavors, and policy based routing.

Learn how autonomous system numbers identify networks in BGP, the shift from 16-bit to 32-bit AS numbers, and how AS dot notation helps configure them across IPv4 and IPv6 routers.

Explore the two BGP flavors internal (iBGP) and external (eBGP), and learn how TTL, administrative distance, and neighbor relationships differ, including iBGP’s indirect connectivity and EBGP’s direct connectivity.

Explore how BGP uses neighbor table, forwarding table, and routing table to track neighbors, updates, and best route, via commands like show ip bgp summary and show ip route bgp.

Learn BGP active and passive modes, where the lowest router ID initiates the TCP session on port 179, with verification via show ip bgp neighbor and show tcp brief.

Explore the six BGP neighbor states—idle, connect, active, open send, open confirm, established—driven by a TCP three-way handshake on port 179 with manual neighbor configuration, no broadcast or multicast discovery.

Learn the four BGP message types: open, update, keep alive, and notification, and how they establish neighbors, exchange routes, and flag misconfigurations in a hands-on lab.

Configure BGP multihop and update-source when using loopback interfaces for EBGP sessions. Ensure reachability with static routes and verify neighbors with show ip bgp summary and show ip bgp neighbor.

Explore how BGP timers use keep alive and hold-down periods, adjust per-neighbor timers, and apply a hard reset; hold timer must be at least three times keep alive.

Explains the BGP next-hop self fix for iBGP learning routes from an external BGP, showing how changing the next hop and advertising the internal subnet restores reachability to 111.

Understand how BGP synchronization controls advertising of routes learned via internal BGP to external BGP, illustrated with R1, R2, R3 topology, version differences, and IGP/EGP scenarios.

Explore border gateway protocol attributes, including origin, as-path, and next-hop, and learn how well known mandatory, discretionary, and optional transitive and non-transitive attributes shape BGP path selection for internet routing.

Explore how BGP selects the best path using weight, local preference, originate, as-path, and path length, with tie-breakers like router id and next-hop IP shaping routing decisions.

Explore BGP best path selection via a lab, focusing on weight, local preference, origin, AS path, oldest path, and router ID. Understand how these attributes shape real-world route choices.

Configure and understand network address translation on Cisco devices, including static and dynamic NAT and PAT, translating inside local to inside global and outside local to outside global.

Configure and verify static NAT, dynamic NAT, and PAT on Cisco routers, mapping inside local addresses to outside global addresses, using pools, ACLs, and show ip nat translation.

Learn how to use debug and conditional debug on Cisco routers and switches, manage cpu and memory impact, and filter output by ip, mac, interface, or acl.

Explore how ping and traceroute diagnose connectivity by sending ICMP echo requests and tracing hops, learn adjustable packet size, count, and source options, and interpret results for reachability and latency.

Configure and verify snmp versions 2 and 3 for network monitoring; compare v1/v2 with v3 security, and explain the roles of manager, agent, mib, read/write, traps, and port usage 161/162.

Explain how the network time protocol uses udp port 123 to synchronize clocks and stratum levels across devices, ensuring accurate timestamps for syslog, snmp, and authentication.

Configure entropy and verify network time protocol across routers with ntp server/client roles, external time sources, md5 authentication, acls, and peer mode.

Explore IP SLA to monitor service level agreement promises, measuring latency, jitter, packet loss, and congestion, and use ICMP and track to failover between dual ISPs.

Explore how network automation uses Python scripts to automate configuration, management, testing, and deployment across switches and routers, reducing human error and enabling rapid VLAN and IP setup.

Explore what an application programming interface (API) is, a middleman that connects applications and devices, with examples from PayPal, social media, and weather services, using XML or JSON.

Netconf is a southbound API using SSH on port 830 and XML RPC to configure and monitor devices, with get-config, edit-config, copy-config, and delete operations and capability exchange via hello.

Software defined networking centralizes control in a controller, enabling centralized configuration and monitoring, and uses application, control, and data planes to manage routing with protocols like BGP and OSPF.

Explains northbound and southbound APIs, using the waiter analogy, and shows rest-based northbound APIs connecting the application layer to the controller, while netconf and restconf drive the controller to devices.

Centralize your network with Cisco DNA Center, a central appliance or virtual platform for design, provision, policy, and assurance. Enable discovery, health monitoring, and one-click upgrades across devices.

Explore json fundamentals: objects, arrays, and key-value pairs in double quotes. Understand json's role in lightweight, human- and machine-readable data exchange for routers, switches, and APIs, with lab examples.

Explore data modeling with YANG, a vendor-agnostic template that enables configuring multi-vendor devices through Netconf and Restconf, using XML and JSON representations.

Discover Cisco’s embedded event manager (eem) to automate router tasks, generate syslog alerts, and enforce controls by executing CLI actions and preventing critical commands.

Explore NetFlow, a traffic collection and analysis approach that uses a cache to group packets into flows by seven attributes, enabling near real-time network visibility, monitoring, and security insights.

Configure Cisco net flow on the edge router, export traffic to a net flow collector, and verify top talkers and application details using version 5 flow records.

Secure routers by using enable secret with algorithm type hashing (MD5 or SHA-256), enabling password encryption, and protecting vty and console access through SSH version 2 with RSA keys.

Learn how AAA, comprising authentication, authorization, and accounting, provides centralized management for network resources with Cisco ISE, using local or LDAP databases and comprehensive device access logging.

Explore centralized device administration with Cisco ISE using TACACS+ (tech X) to manage switches and routers from a single, policy-driven interface, including group-based command sets, shells, and auditing.

Learn to protect the control plane with policing and protection, securing device-to-device traffic such as CDP, ARP, OSPF, and BGP against UDP and ICMP floods through practical lab demos.

Trace the evolution from snort, a 1998 open-source intrusion detection system, to Cisco firepower threat defense with FMC, detailing next-generation IPS/IDS features.

Protect endpoints with antivirus, anti spyware, firewall and email filtering, and keep OS, apps, and firmware updated. Deploy endpoint protection agents and enforce multi-factor authentication to safeguard the network.

Introduce Trustsec and Macsec as key concepts in Cisco Ise, explain tagging and Vlan separation for access control, and describe Macsec layer-two hop encryption between switches.

Explore 802.1x dot1x port-based authentication, using EAPOL to secure wired and wireless access, with the three components: supplicant, authenticator, and authentication server (ISE).

Understand media access control authentication bypass (map) for devices lacking 802.1X, using MAC addresses stored in Cisco ISE to authenticate printers, phones, and endpoints, with dynamic VLAN and ACL restrictions.

Learn how central web authentication redirects wired and wireless users to a web portal for guest access, enabling temporary login and VLAN isolation.

Explore access control lists, including standard and extended types, time-based and infrastructure variants, with top-to-bottom processing, permit and deny actions, and interface placements for inbound and outbound traffic.

Set up a lab with routers and servers, then apply a standard ACL to block a single host from reaching a server, using outbound ip access-group.

Learn to configure extended ACLs that specify source, destination, port, and protocol, apply them inbound near the source, and block http traffic on port 80 using tcp.

Learn to configure named ACLs with standard and extended types using ip access-list, apply them on interfaces, verify their behavior, and resequence for flexible modification.

Configure a time-based ACL by creating a time range (absolute or periodic, such as weekdays), apply it to an interface, and verify access with tests like ping, telnet, and ssh.

Configure and verify infrastructure access control lists on edge routers to block unwanted traffic, including private ranges, loopback traffic, and multicast, while permitting essential icmp types.

Discover how virtualization converts physical servers into multiple virtual machines using hypervisors, and compare type one and type two designs with virtual switches and VLANs.

Learn the concept of GRE (generic routing encapsulation), a point-to-point tunnel for layer 3 traffic, and how IPsec secures GRE to enable multicast-capable VPN between branches.

Understand virtual routing and forwarding concepts, compare vrf lite and vrf with MPLS, and learn to partition routing tables by creating vrfs, assigning interfaces, and verifying routes.

Explore vxlan, an overlay that extends vlan beyond 4094 by encapsulating layer 2 traffic over a layer 3 underlay with udp, and learn lisp, locator/ID separation protocol.

Differentiate between on-premises and cloud infrastructure. Compare private, public, hybrid, and community clouds, and explain access via internet and vpn.

Describe how multicast uses one-to-many delivery to save bandwidth, leveraging IGMP and PIM protocols, with IGMP snooping to manage receivers, and handling class D multicast addresses from 224.0.0.0 to 239.255.255.255.

Define quality of service (QoS) and show how to manage bandwidth, delay, jitter, and packet loss with classification, marking, policing, queuing, shaping, and congestion management.

Configure and verify QoS policing in a lab, applying a police policy to ICMP traffic on the ISP side, using class and policy maps and observing drops.

Identify and classify traffic for quality of service using NBAR, recognizing telnet, http, https, ssh, and icmp, then apply policy with class maps and service policies.

Configure and verify QoS marking to identify and prioritize web traffic by marking HTTP packets with class maps and policy maps, using ACLs and interfaces to observe the marked packets.

Explore two-tier and three-tier architectures, with core, distribution, and access layers, using layer 3 switches for high-speed backbone, redundancy, and load balancing; learn their benefits for scalable, easy management.

Explore software defined networking concepts, showing how centralized controllers replace per-device control planes to define, design, and monitor networks—enabling SD-WAN for WANs and SD-Access for LANs.

Explore the basics of wireless technology, including wifi concepts, unlicensed radio spectrum, frequency, hertz, amplitude, wavelength, cycles, channels, and key 802.11 standards from 2G to 5G.

Explains autonomous ap architecture, cloud based architecture, split make architecture, centralized wireless network architecture, and converged wireless network architecture for enterprise wireless deployment.

Explore access points, autonomous versus lightweight controller-based APs, and modes like local, monitor, flex connect, sniffer, rogue detector, bridge, flex bridge, and C connect with a wireless LAN controller.

Learn how lightweight access points boot, discover wireless LAN controllers, and join via capwap to receive the latest iOS and controller configurations.

Explore antenna basics, including built-in and detachable types, omnidirectional and directional patterns, and mimo, with emphasis on home wifi use and point-to-point applications.

Centralize management of access points using a wireless LAN controller, configure via web or CLI, and perform first-time setup with management IP, DHCP, and mobility options.

Configure and verify a wireless lab in Cisco Packet Tracer by setting up a wireless LAN controller, lightweight access points, DHCP server, IP addressing, SSIDs, and client connectivity.

Explore wireless security features by configuring open, personal pre-shared key (psk) and WPA/WPA2/WPA3, plus enterprise options like radius and web authentication, enabling strong encryption and access control.