ENCOR 350-401 v1.2 · Last Minute

Three-tier and collapsed core

Leaf-spine fabric

class-map match-any VOICE  ! OR of matches
 match dscp ef
class-map match-any VIDEO
 match dscp af41
policy-map CHILD
 class VOICE
  priority percent 20  ! LLQ, policed under congestion
 class VIDEO
  bandwidth percent 30  ! minimum guarantee
 class class-default
  fair-queue
policy-map PARENT
 class class-default
  shape average 100m  ! sub-rate, outbound only
  service-policy CHILD
interface g0/0
 service-policy output PARENT  ! nothing happens without this
! access edge: classify and mark inbound
policy-map MARK-IN
 class VOICE
  set dscp ef
interface g1/0/5
 service-policy input MARK-IN
show policy-map interface g0/0 output  ! matches, drops per class

Hierarchical QoS: parent shaper, child queues

Virtual switching

vrf definition RED
 address-family ipv4
interface g0/1
 vrf forwarding RED  ! removes the IP: re-add it
 ip address 10.1.1.1 255.255.255.0
interface g0/2.100  ! VRF-lite: one subinterface per VRF per hop
 encapsulation dot1Q 100
 vrf forwarding RED
 ip address 10.0.100.1 255.255.255.252
! routing inside the VRF (static or a VRF-aware IGP)
ip route vrf RED 10.2.0.0 255.255.0.0 10.0.100.2
router ospf 10 vrf RED
 network 10.0.100.0 0.0.0.3 area 0
show ip route vrf RED  ·  ping vrf RED 10.1.1.2  ·  show vrf

How the IPsec tunnel comes up

! Phase 1 (IKEv1 shown; IKEv2 uses proposal/policy/keyring/profile)
crypto isakmp policy 10
 encryption aes 256
 hash sha256
 authentication pre-share
 group 14
crypto isakmp key MyK3y address 203.0.113.2
! Phase 2
crypto ipsec transform-set TS esp-aes 256 esp-sha256-hmac
 mode transport  ! fine for GRE/VTI (tunnel mode also works)
crypto ipsec profile P
 set transform-set TS
interface Tunnel0
 ip address 172.16.0.1 255.255.255.252
 ip mtu 1400
 ip tcp adjust-mss 1360
 tunnel source g0/0
 tunnel destination 203.0.113.2
 tunnel mode ipsec ipv4  ! VTI; omit (= GRE) for GRE over IPsec
 tunnel protection ipsec profile P
router ospf 1
 network 172.16.0.0 0.0.0.3 area 0  ! routing over the tunnel
! never advertise the tunnel destination into the tunnel (recursive routing)
show crypto isakmp sa  ! QM_IDLE = Phase 1 up
show crypto ipsec sa  ! encaps/decaps counters
show interfaces tunnel0

What's wrong here? Native VLAN mismatch

A = access, T = trunk, ✗ = mismatch (doesn't work). auto + auto (orange) is the classic trap: no trunk.

vlan 10,20,30,99  ! VLANs must exist to be 'active'
interface g1/0/24
 switchport trunk encapsulation dot1q  ! only on ISL-capable models
 switchport mode trunk  ! or dynamic desirable/auto
 switchport nonegotiate  ! no DTP frames
 switchport trunk native vlan 99  ! same on both ends
 switchport trunk allowed vlan 10,20
 switchport trunk allowed vlan add 30  ! without add = replace
show interfaces trunk  ! allowed → active → STP forwarding
show interfaces g1/0/24 switchport  ! admin vs operational mode
show dtp interface g1/0/24

! SW1
interface range g1/0/1 - 2
 channel-group 1 mode active  ! LACP; desirable/auto = PAgP, on = static
interface port-channel 1
 switchport mode trunk  ! set L2 options on the Po, they copy down
! SW2: same members, mode active or passive (not passive on both)
interface range g1/0/1 - 2
 channel-group 1 mode passive
! Layer 3 bundle instead:
interface range g1/0/3 - 4
 no switchport
 channel-group 2 mode active
interface port-channel 2
 ip address 10.0.0.1 255.255.255.252
port-channel load-balance src-dst-ip  ! global hash
lacp system-priority 100  ! lower = decides active members
show etherchannel summary  ! P bundled · s suspended · I stand-alone
show lacp neighbor  ·  show etherchannel load-balance

spanning-tree mode rapid-pvst
spanning-tree vlan 10 root primary  ! = priority 24576 or lower
spanning-tree vlan 20 priority 28672  ! multiples of 4096
! MST instead:
spanning-tree mode mst
spanning-tree mst configuration
 name CAMPUS
 revision 1
 instance 1 vlan 10-20
spanning-tree mst 1 root primary
show spanning-tree vlan 10  ! root ID, role, state, cost
show spanning-tree mst configuration

interface g1/0/5  ! host port
 spanning-tree portfast
 spanning-tree bpduguard enable
spanning-tree portfast bpduguard default  ! all PortFast ports
interface g1/0/48  ! distribution downlink
 spanning-tree guard root
errdisable recovery cause bpduguard  ! optional auto-recovery
show spanning-tree inconsistentports  ! root-inconsistent ports
show interfaces status err-disabled

Feasible successor check

router ospf 1
 area 1 range 10.1.0.0 255.255.0.0  ! ABR: inter-area summary
 summary-address 172.16.0.0 255.255.0.0  ! ASBR: externals
 area 1 filter-list prefix NO-LAB in  ! ABR: block type 3 into area 1
 distribute-list prefix NO-LAB in  ! local RIB only
ip prefix-list NO-LAB deny 10.99.0.0/16
ip prefix-list NO-LAB permit 0.0.0.0/0 le 32
! OSPFv3 (address-family style)
ipv6 unicast-routing
router ospfv3 1
 router-id 1.1.1.1  ! needed if no IPv4 address
 address-family ipv6 unicast
  area 1 range 2001:db8:1::/48
  distribute-list prefix-list V6-FILTER in
show ip ospf database summary  ·  show ip route ospf  ·  show ospfv3 database

What's wrong here?

Both ends must use compatible types: broadcast on one side and point-to-point on the other forms an adjacency but routes break (a DR is expected on one side only).

router ospf 1
 router-id 1.1.1.1  ! manual > loopback > interface IP
 auto-cost reference-bandwidth 100000  ! 100 G; same on all routers
 passive-interface g0/2
 network 10.1.0.0 0.0.255.255 area 1
interface g0/0
 ip ospf network point-to-point  ! no DR/BDR
interface g0/3
 ip ospf 1 area 0  ! interface method instead of network
 ip ospf priority 255  ! wins DR (0 = never)
 ip ospf hello-interval 10  ! must match the neighbor
interface g0/1
 ospfv3 1 ipv6 area 0  ! OSPFv3 is enabled per interface
show ip ospf neighbor  ·  show ip ospf interface brief  ·  show ospfv3 neighbor

router bgp 65001
 bgp router-id 1.1.1.1
 neighbor 10.0.12.2 remote-as 65002  ! directly connected eBGP
 neighbor 2.2.2.2 remote-as 65002  ! loopback peering:
 neighbor 2.2.2.2 update-source Loopback0
 neighbor 2.2.2.2 ebgp-multihop 2
 address-family ipv4 unicast
  neighbor 10.0.12.2 activate
  neighbor 2.2.2.2 activate
  network 10.1.0.0 mask 255.255.0.0  ! exact RIB match needed
ip route 10.1.0.0 255.255.0.0 Null0  ! makes the match exist
ip route 2.2.2.2 255.255.255.255 10.0.12.2  ! reach the peer's loopback
! R2 mirrors it: remote-as 65001, update-source Lo0, ebgp-multihop 2
show ip bgp summary  ! number = Established, word = not up
show ip bgp  ! * valid · > best
show ip bgp neighbors 10.0.12.2 advertised-routes

Stuck in Active = TCP not forming (IP, AS, reachability, update-source). Idle = no route to peer or admin down.

access-list 10 permit 10.1.1.0 0.0.0.255
track 5 ip sla 5 reachability  ! optional: check the next hop
route-map PBR permit 10
 match ip address 10
 set ip next-hop verify-availability 192.0.2.1 10 track 5
route-map PBR permit 20  ! optional; no match = normal routing anyway
interface g0/1  ! LAN, inbound
 ip policy route-map PBR
ip local policy route-map PBR  ! only for the router's own traffic
show ip policy  ·  show route-map PBR  ! match counters  ·  debug ip policy

ntp authenticate
ntp authentication-key 1 md5 S3cr3t
ntp trusted-key 1
ntp server 10.1.1.1 key 1 prefer  ! client
ntp peer 10.1.1.2  ! symmetric
ntp master 5  ! serve own clock (no upstream)
ntp source Loopback0
show ntp status  ! synchronized? stratum? reference?
show ntp associations  ! * sys.peer + candidate ~ configured

Interpret the output

R1# show ntp associations   (columns trimmed)
  address      ref clock  st  reach
*~10.1.1.1     .GPS.       1   377
+~10.1.1.2     10.1.1.1    2   377
 ~10.9.9.9     .INIT.     16     0
 * sys.peer, # selected, + candidate, - outlyer, x falseticker, ~ configured
! 10.1.1.1 = chosen source (stratum 1) → R1 becomes stratum 2
! reach 377 = last 8 polls answered · st 16 + reach 0 = unreachable
R1# show ntp status
Clock is synchronized, stratum 2, reference is 10.1.1.1

ptp mode boundary delay-req  ! clock type + delay mechanism
ptp domain 0
ptp priority1 128  ! lower = preferred by BMCA
interface g1/0/1
 ptp enable
show ptp clock  ! local clock: type, domain, priority
show ptp parent  ! parent vs grandmaster identity
show ptp port  ! port state: MASTER / SLAVE / PASSIVE

Exact PTP CLI differs by platform (INE shows several); know what each show command reveals. Parent clock ≠ grandmaster in show output → you are behind a boundary clock. PTP domain = number grouping clocks under one GM.

interface g0/0
 ip nat inside  ! LAN side
interface g0/1
 ip nat outside  ! ISP side
access-list 1 permit 10.1.1.0 0.0.0.255  ! inside locals to translate
! PAT on the interface address
ip nat inside source list 1 interface g0/1 overload
! or dynamic NAT from a pool (add overload for PAT on the pool)
ip nat pool PUB 203.0.113.20 203.0.113.30 netmask 255.255.255.224
ip nat inside source list 1 pool PUB
! static one-to-one for an inside server
ip nat inside source static 10.1.1.10 203.0.113.10
show ip nat translations  ·  show ip nat statistics  ·  clear ip nat translation *

What's wrong here? STP root ≠ HSRP active

track 1 interface g0/1 line-protocol
! R1 (HSRP active)
interface vlan 10
 ip address 10.1.10.2 255.255.255.0
 standby version 2  ! both routers
 standby 10 ip 10.1.10.1
 standby 10 priority 110  ! default 100
 standby 10 preempt  ! off by default
 standby 10 track 1 decrement 20
! R2 (standby): must preempt to take over when R1 drops to 90
interface vlan 10
 ip address 10.1.10.3 255.255.255.0
 standby version 2
 standby 10 ip 10.1.10.1
 standby 10 preempt
! VRRP on IOS XE
fhrp version vrrp v3  ! enables VRRPv3 syntax
interface vlan 20
 ip address 10.1.20.2 255.255.255.0
 vrrp 20 address-family ipv4
  address 10.1.20.1 primary
  priority 110  ! preempt is on by default
  track 1 decrement 20
show standby brief  ·  show vrrp brief  ·  show track

RPF check (what's wrong here?)

logging host 10.1.1.50
logging trap warnings  ! send 0–4 to the server
logging source-interface Loopback0
logging buffered 16384 debugging
service timestamps log datetime msec
snmp-server view ALL iso included
snmp-server group NMS v3 priv read ALL
snmp-server user ops NMS v3 auth sha AuthPass priv aes 128 PrivPass
snmp-server host 10.1.1.60 informs version 3 priv ops
snmp-server enable traps
access-list 100 permit ip host 10.1.1.10 any  ! what to debug
debug condition interface g0/1  ! limit the next debug
debug ip packet 100  ! ACL 100 narrows it further
undebug all
ping 10.2.2.2 source lo0 size 1500 df-bit  ! extended ping: MTU test
traceroute 10.2.2.2 source lo0
show logging  ·  show snmp user  ·  show debugging

flow record R
 match ipv4 source address  ! key fields define the flow
 match ipv4 destination address
 match ipv4 protocol
 match transport source-port
 match transport destination-port
 collect counter bytes  ! non-key data
 collect counter packets
flow exporter E
 destination 10.1.1.50
 source Loopback0
 transport udp 2055
 export-protocol netflow-v9  ! or ipfix
flow monitor M
 record R
 exporter E
 cache timeout active 60
interface g0/1
 ip flow monitor M input
show flow monitor M cache  ·  show flow exporter E statistics  ·  show flow interface g0/1

! Local SPAN
monitor session 1 source interface g1/0/1 rx
monitor session 1 destination interface g1/0/24
! RSPAN: VLAN 99 on all switches in the path
vlan 99
 remote-span
! source switch
monitor session 2 source interface g1/0/1
monitor session 2 destination remote vlan 99
! destination switch
monitor session 2 source remote vlan 99
monitor session 2 destination interface g1/0/48
! ERSPAN (IOS XE)
monitor session 3 type erspan-source
 source interface g1/0/1
 destination
  erspan-id 10
  ip address 10.9.9.9  ! analyzer side
  origin ip address 10.1.1.1
 no shutdown  ! ERSPAN sessions start shut
show monitor session all

ip sla 1
 icmp-echo 8.8.8.8 source-interface g0/0
 frequency 10
 timeout 2000
ip sla schedule 1 life forever start-time now
track 1 ip sla 1 reachability
 delay down 10 up 30  ! optional: damp flapping
ip route 0.0.0.0 0.0.0.0 198.51.100.1 track 1
ip route 0.0.0.0 0.0.0.0 203.0.113.1 250  ! floating backup
! udp-jitter needs the far end to answer: ip sla responder
show ip sla statistics 1  ·  show track 1  ·  show ip route 0.0.0.0

username admin privilege 15 secret ****
aaa new-model
aaa authentication login default local
aaa authorization exec default local
netconf-yang  ! SSH 830
netconf-yang feature candidate-datastore
restconf  ! needs the HTTPS server
ip http secure-server
ip http authentication local
show netconf-yang status  ·  show netconf-yang sessions
! test from a host:
ssh admin@R1 -p 830 -s netconf
curl -k -u admin:**** -H "Accept: application/yang-data+json" \
 https://R1/restconf/data/ietf-interfaces:interfaces

NETCONF transaction in order

hostname R1
ip domain-name lab.local
crypto key generate rsa modulus 2048
ip ssh version 2
enable algorithm-type scrypt secret ****
username admin privilege 15 algorithm-type scrypt secret ****
aaa new-model
tacacs server T1
 address ipv4 10.1.1.5
 key ****
radius server R1  ! RADIUS alternative
 address ipv4 10.1.1.6 auth-port 1812 acct-port 1813
 key ****
aaa authentication login default group tacacs+ local
aaa authorization exec default group tacacs+ local
aaa authorization commands 15 default group tacacs+ local
aaa accounting exec default start-stop group tacacs+
ip access-list standard MGMT
 permit 10.10.10.0 0.0.0.255
line vty 0 4
 transport input ssh
 access-class MGMT in
 exec-timeout 10 0
! without AAA: login local
show aaa servers  ·  show users  ·  show ip ssh

What's wrong here?

ip access-list extended BLOCK-HTTPS
 10 deny tcp host 10.1.1.10 host 10.2.2.20 eq 443
 20 permit ip any any  ! or the implicit deny drops the rest
interface g0/0  ! near the source
 ip access-group BLOCK-HTTPS in
ip access-list standard MGMT
 permit 10.10.10.0 0.0.0.255
line vty 0 4
 access-class MGMT in
! VACL: in an access-map, permit = "match", the action decides
ip access-list extended VACL-HTTPS
 permit tcp any host 10.2.2.20 eq 443
vlan access-map V10 10
 match ip address VACL-HTTPS
 action drop
vlan access-map V10 20  ! no match clause = everything else
 action forward
vlan filter V10 vlan-list 10
! IPv6 ACL
ipv6 access-list V6-IN
 deny tcp any host 2001:db8::20 eq 443
 permit ipv6 any any  ! implicit permits ND before the implicit deny
interface g0/0
 ipv6 traffic-filter V6-IN in
ip access-list resequence BLOCK-HTTPS 10 10
show access-lists  ·  show ip interface g0/0 | include access list

ip access-list extended ACL-ROUTING
 permit ospf any any
 permit tcp any any eq bgp
ip access-list extended ACL-MGMT
 permit tcp 10.10.10.0 0.0.0.255 any eq 22
ip access-list extended ACL-ICMP
 permit icmp any any  ! = "belongs to this class"
class-map COPP-ROUTING
 match access-group name ACL-ROUTING
class-map COPP-MGMT
 match access-group name ACL-MGMT
class-map COPP-ICMP
 match access-group name ACL-ICMP
policy-map COPP
 class COPP-ROUTING
  police 1000000 conform-action transmit exceed-action transmit  ! generous
 class COPP-MGMT
  police 500000 conform-action transmit exceed-action drop
 class COPP-ICMP
  police 8000 conform-action transmit exceed-action drop
 class class-default
  police 64000 conform-action transmit exceed-action drop
control-plane
 service-policy input COPP
show policy-map control-plane

MACsec: hop-by-hop encryption

import requests, json  # modules
base = "https://cc.lab"
# 1. get a token (basic auth)
auth = requests.post(base + "/dna/system/api/v1/auth/token",
                     auth=("admin", "****"), verify=False)
token = auth.json()["Token"]  # dict lookup
# 2. call the Intent API with the token
hdr = {"X-Auth-Token": token, "Accept": "application/json"}
resp = requests.get(base + "/dna/intent/api/v1/network-device", headers=hdr, verify=False)
if resp.status_code == 200:  # block = indentation
    data = resp.json()  # JSON → dict
    for dev in data["response"]:  # list of dicts
        print(dev["hostname"], dev["managementIpAddress"])
else:
    print("Error", resp.status_code)

// valid
{
  "hostname": "R1",
  "vlans": [10, 20],
  "enabled": true,
  "mgmt": {"ip": "10.0.0.1", "mask": null}
}

module example-interfaces {
  namespace "urn:example:interfaces";
  prefix "ex";
  container interfaces {  // groups nodes
    list interface {  // repeated, keyed
      key "name";
      leaf name    { type string; }  // one value
      leaf enabled { type boolean; default true; }
      leaf-list vlan { type uint16; }  // many values
    }
  }
}
→ JSON: {"example-interfaces:interfaces":{"interface":[{"name":"Gi1","enabled":true,"vlan":[10,20]}]}}

Async change: 202 → taskId → poll

{"response": [ {"hostname": "C9300-1", "role": "ACCESS"} ],
 "version": "1.0"}
→ data["response"][0]["hostname"] = "C9300-1"

RESTCONF GET → 200 OK

GET https://R1/restconf/data/ietf-interfaces:interfaces/interface=GigabitEthernet1
Accept: application/yang-data+json
{
  "ietf-interfaces:interface": {
    "name": "GigabitEthernet1",
    "type": "iana-if-type:ethernetCsmacd",
    "enabled": true,
    "ietf-ip:ipv4": {"address": [{"ip": "10.1.1.1", "netmask": "255.255.255.0"}]}
  }
}
→ data["ietf-interfaces:interface"]["ietf-ip:ipv4"]["address"][0]["ip"] = "10.1.1.1"

RESTCONF error → 404

{"ietf-restconf:errors": {"error": [{
  "error-type": "application",
  "error-tag": "invalid-value",
  "error-message": "uri keypath not found"}]}}
→ wrong path/module name; 401 = credentials, 400 = bad body

event manager applet WAN-UP
 event syslog pattern "Interface GigabitEthernet0/0, changed state to administratively down"
 action 1.0 cli command "enable"
 action 2.0 cli command "configure terminal"
 action 3.0 cli command "interface g0/0"
 action 4.0 cli command "no shutdown"
 action 4.5 cli command "end"
 action 5.0 syslog msg "g0/0 re-enabled by EEM"
! data collection every day at 23:00
event manager applet NIGHTLY
 event timer cron cron-entry "0 23 * * *"
 action 1.0 cli command "enable"
 action 2.0 cli command "show ip route summary | append flash:routes.txt"
! block a command: event cli pattern "debug ip packet" sync no skip yes
! manual: event none → event manager run NAME
show event manager policy registered  ·  show event manager history events

Idempotent: running the same playbook/manifest again changes nothing if the device is already in the desired state. Push vs pull: agentless tools act when you run them; agents check in on a schedule (Puppet every 30 min by default).

v1.2 dropped the tool names from this objective, so expect the agent vs agentless concept first; the tools remain the usual examples.