---
last-updated: 2026-05-03
---

# CCNP Enterprise ENCOR (350-401) - Fact Sheet

## Quick Reference

**Exam Code:** 350-401
**Duration:** 120 minutes
**Format:** Multiple choice + drag-and-drop + simulations + testlets
**Cost:** $400 USD
**Validity:** 3 years
**Earns:** Cisco Certified Specialist - Enterprise Core (and CCNP Enterprise when paired with a concentration exam)

**[Cisco Learning Network ENCOR hub](https://learningnetwork.cisco.com/s/encor-exam-topics)**
**[CCNP Enterprise official page](https://learningnetwork.cisco.com/s/ccnp-enterprise)**

---

## Domain Weights

| Domain | Weight |
|---|---|
| 1.0 Architecture | 15% |
| 2.0 Virtualization | 10% |
| 3.0 Infrastructure | 30% |
| 4.0 Network Assurance | 10% |
| 5.0 Security | 20% |
| 6.0 Automation | 15% |

---

## Administrative Distance (memorize)

| Source | AD |
|---|---:|
| Connected interface | 0 |
| Static route | 1 |
| EIGRP summary route | 5 |
| External BGP (eBGP) | 20 |
| Internal EIGRP | 90 |
| IGRP (legacy) | 100 |
| OSPF | 110 |
| IS-IS | 115 |
| RIP | 120 |
| EIGRP external | 170 |
| Internal BGP (iBGP) | 200 |
| Unknown / unreachable | 255 |

Lower AD wins when multiple sources offer the same prefix.

---

## Routing Protocol Comparison

| Feature | EIGRP | OSPF | BGP |
|---|---|---|---|
| Type | Advanced distance-vector (hybrid) | Link-state | Path-vector |
| Algorithm | DUAL | Dijkstra (SPF) | Best-path (path attributes) |
| Metric | Composite (BW, delay default) | Cost (ref-bw / interface BW) | Path attributes |
| Transport | RTP over IP proto 88 | IP proto 89 | TCP 179 |
| Multicast/Unicast | 224.0.0.10 | 224.0.0.5 / 224.0.0.6 | Unicast TCP |
| AD (internal) | 90 | 110 | 200 (iBGP) |
| AD (external) | 170 | 110 | 20 (eBGP) |
| Hello / Dead | 5s / 15s (LAN) | 10s / 40s (broadcast) | 60s keepalive / 180s hold |
| Update style | Triggered, partial | Triggered LSA flood | Incremental |
| Loop prevention | Feasibility condition | SPF + area design | AS_PATH |
| Areas / hierarchy | No (flat with stubs/summarization) | Required (area 0 backbone) | AS-based |

---

## EIGRP Metric Components

EIGRP composite metric (default uses K1 and K3):

```
Metric = 256 * ((K1*BW + K2*BW/(256-Load) + K3*Delay) * K5/(Reliability + K4))
```

**Default K-values:** K1=1, K2=0, K3=1, K4=0, K5=0

Simplified default:

```
Metric = 256 * (BW + Delay)
```

Where:

- **BW** = `10^7 / minimum_bandwidth_along_path` (kbps)
- **Delay** = `sum_of_interface_delays / 10` (microseconds)

### EIGRP terminology

| Term | Meaning |
|---|---|
| **Successor** | Best (lowest-metric) route, installed in routing table |
| **Feasible Successor (FS)** | Backup route satisfying the feasibility condition |
| **Feasibility Condition (FC)** | Reported Distance (RD) < Feasible Distance (FD) of successor |
| **FD** (Feasible Distance) | Total metric to destination via best path |
| **RD** (Reported Distance) | Metric the neighbor reports to the destination |
| **Active route** | Topology change in progress, EIGRP querying |
| **Passive route** | Stable - no query in progress |

---

## OSPF Deep Reference

### LSA Types

| Type | Name | Generated by | Flooded |
|---|---|---|---|
| 1 | Router LSA | Every router | Within area |
| 2 | Network LSA | DR on broadcast/NBMA segment | Within area |
| 3 | Summary LSA | ABR | Between areas |
| 4 | ASBR Summary | ABR | Between areas (locates ASBR) |
| 5 | External LSA | ASBR | Through whole OSPF domain (not stub) |
| 6 | Multicast (deprecated) | - | - |
| 7 | NSSA External | ASBR in NSSA | Within NSSA, converted to type 5 at ABR |
| 9-11 | Opaque | Various | Local / area / domain (used by TE, segment routing) |

### Area Types

| Area Type | Allows Type 5? | Allows Type 7? | Notes |
|---|---|---|---|
| Standard | Yes | No | Normal area |
| Stub | No (replaces with default) | No | Blocks externals |
| Totally Stubby | No | No (also blocks Type 3) | Cisco-only; default route only |
| NSSA | No | Yes | Allows local ASBR |
| Totally NSSA | No (Type 3 blocked too) | Yes | Cisco-only |

### Network Types and Timers

| Type | Hello / Dead | DR Election | Default? |
|---|---|---|---|
| Broadcast | 10s / 40s | Yes | Ethernet |
| Point-to-point | 10s / 40s | No | Serial / sub-int |
| Non-broadcast (NBMA) | 30s / 120s | Yes (manual neighbors) | Frame Relay |
| Point-to-multipoint | 30s / 120s | No | Hub-spoke |
| Loopback | n/a | n/a | /32 advertised |

### Neighbor states

`Down → Attempt → Init → 2-Way → Exstart → Exchange → Loading → Full`

Stuck in **Exstart/Exchange** typically = MTU mismatch or OSPF auth issue.
Stuck in **Init** = one-way hello (ACL or unicast neighbor problem).

### Adjacency requirements

- Same area ID
- Same subnet / mask
- Same hello/dead timers
- Same authentication (and key)
- Matching MTU (or `ip ospf mtu-ignore`)
- Matching stub flags
- Unique router-ID per router

### Path selection (OSPF best-path order)

1. **Intra-area** (O)
2. **Inter-area** (O IA)
3. **External Type 1** (O E1) - cost includes internal + external
4. **External Type 2** (O E2) - cost is external only (default)
5. **NSSA Type 1** (O N1)
6. **NSSA Type 2** (O N2)

### OSPF cost formula

```
Cost = reference_bandwidth / interface_bandwidth
```

Default reference bandwidth = **100 Mbps**. Anything 100 Mbps or faster gets cost = 1 by default. Set `auto-cost reference-bandwidth 100000` (100 Gbps) on every router for accurate costs in modern networks.

---

## BGP Path Attributes (best-path selection order)

Memorize the mnemonic **"WALLT-OMNIB"** or **"N WLLA OMNI"**:

1. **Weight** (Cisco-only, local to router, higher wins, default 0 / 32768 for self)
2. **Local Preference** (within AS, higher wins, default 100)
3. **Locally originated** (`network` or aggregate over received)
4. **AS_PATH** length (shorter wins)
5. **Origin** (IGP `i` < EGP `e` < incomplete `?`)
6. **MED** (Multi-Exit Discriminator, lower wins, default 0)
7. **eBGP over iBGP**
8. **IGP metric to next-hop** (lowest wins)
9. **Oldest eBGP route** (stability)
10. **Lowest BGP router-ID**
11. **Lowest neighbor IP**

### BGP states

`Idle → Connect → Active → OpenSent → OpenConfirm → Established`

Stuck in **Active** usually means TCP 179 unreachable (ACL, no route, neighbor wrong IP).

### Common BGP message types

| Type | Use |
|---|---|
| OPEN | Establish session, exchange capabilities |
| UPDATE | Advertise / withdraw routes |
| KEEPALIVE | Maintain session (60s default) |
| NOTIFICATION | Error, tear down session |

---

## QoS Reference

### Markings

| Layer | Field | Bits | Common values |
|---|---|---|---|
| L2 802.1p (CoS) | PCP in 802.1Q tag | 3 | 0-7 |
| L3 IP DSCP | DiffServ Code Point | 6 | 0-63 |
| L3 IP Precedence (legacy) | Top 3 of TOS | 3 | 0-7 |
| MPLS EXP | Experimental bits | 3 | 0-7 |

### Common DSCP-to-traffic mapping (Cisco recommended)

| DSCP Name | Decimal | Binary | Use |
|---|---:|---|---|
| EF (Expedited Forwarding) | 46 | 101110 | Voice (RTP) |
| CS6 | 48 | 110000 | Routing protocols |
| CS5 | 40 | 101000 | Voice signaling (older), broadcast video |
| AF41 | 34 | 100010 | Interactive video |
| AF31 | 26 | 011010 | Multimedia streaming |
| AF21 | 18 | 010010 | Low-latency data |
| AF11 | 10 | 001010 | Bulk data |
| CS1 | 8 | 001000 | Scavenger |
| BE / DSCP 0 | 0 | 000000 | Best effort default |

### CoS to DSCP default mapping (Cisco)

| CoS | DSCP |
|---|---|
| 0 | 0 (BE) |
| 1 | 8 (CS1) |
| 2 | 16 (CS2) |
| 3 | 24 (CS3) |
| 4 | 32 (CS4) |
| 5 | 40 (CS5) |
| 6 | 48 (CS6) |
| 7 | 56 (CS7) |

### QoS components

- **Classification** - identify traffic (NBAR, ACL, DSCP)
- **Marking** - apply CoS / DSCP / EXP
- **Queuing** - LLQ, CBWFQ, WFQ, FIFO
- **Congestion avoidance** - WRED (weighted random early detection)
- **Policing** - drop or remark over rate (single-rate three-color, two-rate three-color)
- **Shaping** - buffer and slow to a rate (egress only)

### Trust boundaries

Push the trust boundary as close to the endpoint as possible. IP phones mark voice EF; switch trusts CoS from phones (`mls qos trust cos`) but typically not from PCs.

---

## IPv6 Quick Reference

### Address types

| Type | Range / Prefix |
|---|---|
| Loopback | `::1/128` |
| Unspecified | `::/128` |
| Link-local | `fe80::/10` (auto on every interface) |
| Unique local (private) | `fc00::/7` (typically `fd00::/8`) |
| Global unicast | `2000::/3` |
| Multicast | `ff00::/8` |
| IPv4-mapped | `::ffff:0:0/96` |
| 6to4 | `2002::/16` |
| Documentation | `2001:db8::/32` |

### Multicast scope and groups

| Scope (4th nibble) | Range |
|---|---|
| 1 - Interface-local | `ff01::` |
| 2 - Link-local | `ff02::` |
| 5 - Site-local | `ff05::` |
| 8 - Organization | `ff08::` |
| e - Global | `ff0e::` |

| Group | Use |
|---|---|
| `ff02::1` | All nodes on link |
| `ff02::2` | All routers on link |
| `ff02::5` | OSPFv3 all routers |
| `ff02::6` | OSPFv3 DR |
| `ff02::9` | RIPng |
| `ff02::a` | EIGRPv6 |
| `ff02::1:ff00:0/104` | Solicited-node (one per unicast/anycast) |

### IPv6 acquisition

- **Static**
- **SLAAC** - router advertisement carries prefix; host generates host-bits via EUI-64 or random
- **Stateless DHCPv6** - SLAAC for address, DHCPv6 for DNS/options
- **Stateful DHCPv6** - DHCPv6 assigns full address
- **DHCPv6-PD** - prefix delegation (ISP gives a /56 or /48 to customer router)

### NDP (Neighbor Discovery Protocol)

| Message | Purpose | Multicast |
|---|---|---|
| RS (Router Solicitation) | Host asks for RA | `ff02::2` |
| RA (Router Advertisement) | Router announces prefix, options | `ff02::1` |
| NS (Neighbor Solicitation) | Resolves L2 address (replaces ARP) | Solicited-node |
| NA (Neighbor Advertisement) | Reply to NS | Unicast or `ff02::1` |
| Redirect | Better next-hop | Unicast |

---

## Wireless 802.11 Standards

| Standard | Marketing | Year | Band(s) | Max PHY rate | Modulation |
|---|---|---|---|---:|---|
| 802.11 (legacy) | - | 1997 | 2.4 GHz | 2 Mbps | DSSS/FHSS |
| 802.11b | - | 1999 | 2.4 GHz | 11 Mbps | DSSS |
| 802.11a | - | 1999 | 5 GHz | 54 Mbps | OFDM |
| 802.11g | - | 2003 | 2.4 GHz | 54 Mbps | OFDM |
| 802.11n | Wi-Fi 4 | 2009 | 2.4 / 5 GHz | 600 Mbps | MIMO + OFDM |
| 802.11ac | Wi-Fi 5 | 2013 | 5 GHz | 6.93 Gbps | MU-MIMO + OFDM |
| 802.11ax | Wi-Fi 6 / 6E | 2019 | 2.4 / 5 / 6 GHz | 9.6 Gbps | OFDMA + MU-MIMO |
| 802.11be | Wi-Fi 7 | 2024 | 2.4 / 5 / 6 GHz | 46 Gbps | 4096-QAM, MLO |

### 2.4 GHz channels

22 MHz wide. **Non-overlapping in NA: 1, 6, 11.** 11 channels total (NA), 13 (most of world), 14 (JP for 11b only).

### 5 GHz channels

20/40/80/160 MHz options. **24 non-overlapping at 20 MHz** in NA (depends on DFS/UNII rules).

### UNII bands (5 GHz)

| Band | Range | Notes |
|---|---|---|
| UNII-1 | 5.150-5.250 GHz | Indoor / outdoor |
| UNII-2 | 5.250-5.350 GHz | DFS required |
| UNII-2 Extended | 5.470-5.725 GHz | DFS required |
| UNII-3 | 5.725-5.825 GHz | Higher power |

### Wireless terminology

| Term | Meaning |
|---|---|
| **RSSI** | Received Signal Strength Indicator (typical scale -30 to -90 dBm; closer to 0 is stronger) |
| **SNR** | Signal-to-Noise Ratio (dB; higher = better; >25 dB recommended for reliable Wi-Fi) |
| **EIRP** | Effective Isotropic Radiated Power (transmit + antenna gain - cable loss) |
| **dBi** | Antenna gain over isotropic |
| **DFS** | Dynamic Frequency Selection (radar avoidance on UNII-2) |
| **MIMO** | Multiple-Input Multiple-Output |
| **MU-MIMO** | Multi-User MIMO |
| **OFDMA** | Orthogonal Frequency-Division Multiple Access (Wi-Fi 6) |
| **BSS / ESS** | Basic / Extended Service Set |
| **BSSID** | MAC of the AP radio for that BSS |

### AP modes (Cisco)

| Mode | Use |
|---|---|
| **Local** | Default; data tunneled to WLC (CAPWAP) |
| **FlexConnect** | Data switched locally at branch (or central if WLC reachable) |
| **Sniffer** | Captures 802.11 frames for troubleshooting |
| **Monitor** | RF only (no client service); used for IPS / location |
| **Rogue Detector** | Listens for rogue APs |
| **Bridge / Mesh** | Outdoor mesh backhaul |
| **SE-Connect** | Spectrum analysis (Cisco CleanAir) |
| **OEAP** | Office Extend - teleworker AP at home, encrypted CAPWAP back to corporate |

### CAPWAP

- **Control:** UDP **5246** (DTLS-encrypted)
- **Data:** UDP **5247** (optionally DTLS)

### WLC discovery (in order)

1. Static config (priming) on AP
2. DHCP option 43 (controller IPs)
3. DNS (`CISCO-CAPWAP-CONTROLLER.<domain>`)
4. Broadcast / multicast on local subnet

---

## STP / RSTP / MST Quick Reference

| Variant | IEEE | Per | Convergence |
|---|---|---|---|
| STP | 802.1D | One topology for all VLANs | ~30s |
| PVST+ | Cisco | Per VLAN | ~30s |
| RSTP | 802.1w | One topology for all VLANs | ~6s |
| RPVST+ | Cisco | Per VLAN, rapid | ~6s |
| MST | 802.1s | Per instance (group of VLANs) | ~6s |

### Bridge ID

`Priority (4 bits) | Extended-system-ID = VLAN (12 bits) | MAC (48 bits)`

Default priority = 32768. Configure in increments of 4096 (`spanning-tree vlan X priority 24576`).

### Port states (RSTP)

`Discarding → Learning → Forwarding`

### Port roles (RSTP)

| Role | Meaning |
|---|---|
| Root | Best path to root bridge (one per non-root switch) |
| Designated | Forwarding on a segment |
| Alternate | Backup root (discards) |
| Backup | Backup designated on shared segment (rare with full-duplex) |

### Protections

| Feature | Purpose | Where |
|---|---|---|
| **PortFast** | Skip listening/learning | Edge access ports |
| **BPDU Guard** | Err-disable on BPDU | Edge access (with PortFast) |
| **BPDU Filter** | Drop BPDUs (silent) | Used carefully |
| **Root Guard** | Block superior BPDUs | Designated ports facing downstream |
| **Loop Guard** | Block on BPDU loss (UDLD-like) | Root / alternate ports |
| **UDLD** | Detect uni-directional fiber | Fiber uplinks |

---

## Cisco IOS Command Cheat Sheet (ENCOR-relevant)

### Multi-area OSPF

```
router ospf 10
 router-id 1.1.1.1
 auto-cost reference-bandwidth 100000
 area 0 authentication message-digest
 area 1 stub no-summary                    ! totally stubby
 area 2 nssa
 network 10.0.0.0 0.255.255.255 area 0
 network 10.1.0.0 0.0.255.255 area 1
 passive-interface default
 no passive-interface gi0/0

interface gi0/0
 ip ospf 10 area 0
 ip ospf network point-to-point
 ip ospf hello-interval 5
 ip ospf authentication message-digest
 ip ospf message-digest-key 1 md5 SECRET
```

### EIGRP (named mode preferred)

```
router eigrp ENT
 address-family ipv4 unicast autonomous-system 100
  network 10.0.0.0 0.255.255.255
  af-interface default
   passive-interface
  exit-af-interface
  af-interface gi0/0
   no passive-interface
   authentication mode md5
   authentication key-chain ENT-KEYS
  exit-af-interface
  topology base
   variance 2                              ! enable unequal-cost load balancing
  exit-af-topology
 exit-address-family
```

### BGP (eBGP and iBGP basics)

```
router bgp 65001
 bgp router-id 1.1.1.1
 bgp log-neighbor-changes
 neighbor 192.0.2.2 remote-as 65002         ! eBGP
 neighbor 10.0.0.2 remote-as 65001          ! iBGP
 neighbor 10.0.0.2 update-source loopback0
 neighbor 10.0.0.2 next-hop-self

 address-family ipv4 unicast
  network 198.51.100.0 mask 255.255.255.0
  neighbor 192.0.2.2 activate
  neighbor 10.0.0.2 activate
 exit-address-family
```

### HSRP (FHRP)

```
interface vlan 10
 ip address 10.10.10.2 255.255.255.0
 standby version 2
 standby 10 ip 10.10.10.1
 standby 10 priority 110
 standby 10 preempt
 standby 10 authentication md5 key-string SECRET
 standby 10 track gi0/1 30                  ! decrement priority by 30 if uplink down
```

### VRRP / GLBP

```
! VRRP
interface vlan 10
 vrrp 10 ip 10.10.10.1
 vrrp 10 priority 110
 vrrp 10 preempt

! GLBP (active/active load balancing)
interface vlan 10
 glbp 10 ip 10.10.10.1
 glbp 10 priority 110
 glbp 10 load-balancing round-robin
```

### MST

```
spanning-tree mode mst
spanning-tree mst configuration
 name ENTERPRISE
 revision 1
 instance 1 vlan 10,20
 instance 2 vlan 30,40
spanning-tree mst 1 priority 4096
```

### LACP EtherChannel (L2 trunk)

```
interface range gi0/1 - 2
 channel-group 1 mode active                ! LACP

interface port-channel 1
 switchport mode trunk
 switchport trunk allowed vlan 10,20,30
```

### VRF-Lite

```
ip vrf RED
 rd 100:1
 route-target export 100:1
 route-target import 100:1

interface gi0/1
 ip vrf forwarding RED
 ip address 10.1.1.1 255.255.255.0

ip route vrf RED 0.0.0.0 0.0.0.0 10.1.1.254
ping vrf RED 10.1.1.254
```

### GRE tunnel

```
interface tunnel 0
 ip address 10.255.0.1 255.255.255.252
 tunnel source GigabitEthernet0/0
 tunnel destination 198.51.100.2
 tunnel mode gre ip                         ! default
```

### IPsec site-to-site (IKEv2)

```
crypto ikev2 keyring KR
 peer SITE2
  address 198.51.100.2
  pre-shared-key local SECRET
  pre-shared-key remote SECRET

crypto ikev2 profile PROF
 match identity remote address 198.51.100.2 255.255.255.255
 authentication local pre-share
 authentication remote pre-share
 keyring local KR

crypto ipsec transform-set TS esp-aes 256 esp-sha256-hmac
 mode tunnel

crypto ipsec profile IPSEC-PROF
 set transform-set TS
 set ikev2-profile PROF

interface tunnel 1
 ip address 10.255.1.1 255.255.255.252
 tunnel source GigabitEthernet0/0
 tunnel destination 198.51.100.2
 tunnel mode ipsec ipv4
 tunnel protection ipsec profile IPSEC-PROF
```

### NetFlow (Flexible NetFlow)

```
flow record FR-V4
 match ipv4 source address
 match ipv4 destination address
 match transport source-port
 match transport destination-port
 match ipv4 protocol
 collect counter bytes
 collect counter packets

flow exporter FE-COLLECTOR
 destination 10.0.0.50
 transport udp 2055
 source loopback0

flow monitor FM-V4
 record FR-V4
 exporter FE-COLLECTOR
 cache timeout active 60

interface gi0/1
 ip flow monitor FM-V4 input
```

### IP SLA (ICMP echo)

```
ip sla 10
 icmp-echo 8.8.8.8 source-interface gi0/0
 frequency 10
 timeout 1000
ip sla schedule 10 life forever start-time now

track 10 ip sla 10 reachability
ip route 0.0.0.0 0.0.0.0 192.0.2.1 track 10
```

### SNMPv3

```
snmp-server group GRP v3 priv read READ write WRITE
snmp-server user admin GRP v3 auth sha SHASECRET priv aes 128 AESSECRET
snmp-server host 10.0.0.50 version 3 priv admin
```

### Syslog

```
service timestamps log datetime msec localtime show-timezone
logging buffered 16384 informational
logging host 10.0.0.50 transport udp port 514
logging trap informational
logging facility local6
```

### CoPP (Control Plane Policing)

```
class-map match-any COPP-CRITICAL
 match access-group name ACL-CRITICAL
policy-map COPP
 class COPP-CRITICAL
  police 8000 conform-action transmit exceed-action transmit
control-plane
 service-policy input COPP
```

### NETCONF / RESTCONF (IOS XE)

```
netconf-yang
restconf
ip http secure-server                       ! HTTPS for RESTCONF
aaa new-model
aaa authentication login default local
aaa authorization exec default local
username admin privilege 15 secret cisco
```

---

## Cisco SD-WAN component summary

| Component | Role |
|---|---|
| **vManage** | Single pane of glass, GUI/API for management |
| **vSmart** | Control plane, distributes routing (OMP), policies |
| **vBond** | Orchestrator, authenticates devices (only public-IP component) |
| **vEdge / cEdge** | Data plane devices at branches |
| **OMP** | Overlay Management Protocol (BGP-like, runs vSmart ↔ edges) |
| **TLOC** | Transport Locator (color, encap, system-IP) |
| **VPN 0** | Underlay / transport |
| **VPN 512** | Out-of-band management |

---

## Cisco SD-Access (Campus Fabric) summary

| Component | Role |
|---|---|
| **DNA Center** | Controller (automation + assurance) |
| **ISE** | Identity / policy server |
| **Fabric Edge** | Access switches in fabric |
| **Fabric Border** | Egress to outside fabric (handoff) |
| **Fabric Control Plane node** | LISP map server / map resolver |
| **Underlay** | IS-IS or OSPF reachability network (often automated by LAN Automation) |
| **Overlay** | VXLAN-encapsulated user traffic |
| **Encapsulation** | VXLAN with Group Policy Option (GPO) for SGT |
| **Identity** | 802.1X / MAB enforced via ISE; SGT carried in VXLAN |

---

## Python / REST API examples

### GET with `requests`

```python
import requests
import json

url = "https://sandboxdnac.cisco.com/dna/intent/api/v1/network-device"
token = "<auth_token>"
headers = {
    "X-Auth-Token": token,
    "Content-Type": "application/json"
}

response = requests.get(url, headers=headers, verify=False)
response.raise_for_status()
devices = response.json()["response"]
for d in devices:
    print(d["hostname"], d["managementIpAddress"])
```

### Auth (DNA Center)

```python
import requests
from requests.auth import HTTPBasicAuth

auth_url = "https://sandboxdnac.cisco.com/dna/system/api/v1/auth/token"
r = requests.post(auth_url, auth=HTTPBasicAuth("devnetuser", "Cisco123!"), verify=False)
token = r.json()["Token"]
```

### POST (create resource)

```python
payload = {
    "interfaces": [
        {"name": "GigabitEthernet0/1", "description": "Uplink", "vlan": 10}
    ]
}
r = requests.post(
    "https://device.example.com/api/v1/interfaces",
    headers={"Authorization": f"Bearer {token}", "Content-Type": "application/json"},
    data=json.dumps(payload)
)
```

### NETCONF (`ncclient`)

```python
from ncclient import manager

with manager.connect(
    host="10.0.0.1", port=830, username="admin", password="cisco",
    hostkey_verify=False, device_params={"name": "iosxe"}
) as m:
    for c in m.server_capabilities:
        print(c)
    response = m.get_config(source="running")
    print(response.xml)
```

---

## YANG / NETCONF / RESTCONF reference

| Term | Meaning |
|---|---|
| **YANG** | Data modeling language (RFC 7950) |
| **NETCONF** | XML config protocol over SSH (port **830**), RFC 6241 |
| **RESTCONF** | HTTP equivalent (RFC 8040), JSON or XML |
| **gNMI** | gRPC Network Management Interface (port 50051 typical) |
| **Datastores** | running, candidate, startup, intended, operational |
| **Open YANG models** | OpenConfig, IETF |
| **Native models** | Cisco-IOS-XE-native |

### Sample RESTCONF GET (URI)

```
GET https://10.0.0.1/restconf/data/ietf-interfaces:interfaces/interface=GigabitEthernet1
Accept: application/yang-data+json
```

---

## Ansible network playbook (NETCONF)

```yaml
- name: Configure interface description
  hosts: routers
  gather_facts: no
  connection: netconf
  tasks:
    - name: Set description
      cisco.iosxe.iosxe_interfaces:
        config:
          - name: GigabitEthernet1
            description: Uplink to core
            enabled: true
        state: merged
```

---

## Common show / verify commands (high-yield)

```
show ip route
show ip route ospf
show ip ospf
show ip ospf neighbor
show ip ospf database
show ip ospf interface brief
show ip eigrp neighbors
show ip eigrp topology
show bgp ipv4 unicast summary
show bgp ipv4 unicast
show bgp ipv4 unicast neighbors 192.0.2.2 advertised-routes
show standby brief
show vrrp brief
show glbp brief
show etherchannel summary
show spanning-tree
show spanning-tree mst
show vlan brief
show interfaces trunk
show ip nat translations
show ip sla statistics
show flow monitor FM-V4 statistics
show flow exporter
show ip cef                                 ! data-plane FIB
show platform hardware fed                  ! Cat9k TCAM / FED
show ap summary                             ! WLC: APs registered
show wireless summary
show capwap client mn                       ! AP CLI: WLC mn-info
show running-config | section interface
show netconf-yang status
show platform software trace                ! IOS XE detailed trace
```

---

## Things candidates commonly forget

- **Reference bandwidth** must match across every OSPF router or path costs are skewed. Set it to 100000 (100 Gbps) cluster-wide.
- **Stub area types** prevent specific LSAs - know the exact matrix.
- **OSPF MTU mismatch** sticks neighbors in Exstart/Exchange. Use `ip ospf mtu-ignore` as a workaround.
- **iBGP neighbors** need `next-hop-self` or you get unreachable next-hops.
- **HSRP virtual MAC** is `0000.0c07.acXX` where XX is the group. **VRRPv2** uses `0000.5e00.01XX`.
- **CoPP** policy-map must be applied with `service-policy input COPP` under `control-plane`.
- **TrustSec SGT** is carried in CMD field (Ethernet) or VXLAN GPO; SXP propagates IP-to-SGT.
- **MACsec** is hop-by-hop L2 encryption; **IPsec** is L3 endpoint-to-endpoint.
- **DNA Center auth** uses `/dna/system/api/v1/auth/token`; token expires after 1 hour.
- **NETCONF default port is 830**, not 22.
- **YANG models** can be open (OpenConfig, IETF) or native (Cisco-IOS-XE-native).
- **Wi-Fi 6 (802.11ax)** is the first to use **OFDMA** (multiple users per channel via subcarriers).

---

## High-yield memorization list

- Administrative distances table (top of this sheet)
- BGP best-path order (WALLT-OMNIB)
- OSPF LSA types 1-5 + 7
- OSPF area types and what each blocks
- DSCP markings (EF=46, CS6=48, AF41=34, AF31=26)
- Cisco SD-WAN components (vManage / vSmart / vBond / vEdge)
- Cisco SD-Access components (DNA-C / ISE / Fabric edge / border / control-plane)
- 802.11 standards table
- AP modes (Local / FlexConnect / Sniffer / Monitor / OEAP / Bridge / SE-Connect)
- HSRP / VRRP / GLBP differences and virtual MACs
- NETCONF port 830, RESTCONF URI structure
- Python `requests` GET/POST patterns
- HTTP status codes (200/201/204/400/401/403/404/429/500/503)
- TrustSec SGT vs MACsec roles