CCNP Course Notes

SD-Access separates endpoint identity from location by using LISP to map endpoint identifiers to routing locators. The control plane node stores and answers those EID-to-RLOC mappings so fabric edge devices can forward traffic without flooding the campus. In ENCOR questions, the clue is usually whether the device is forwarding user traffic or maintaining endpoint-location state.

• Treating an SD-Access control plane node like a fabric edge; the control plane stores LISP endpoint mappings, while the edge node forwards user traffic.

• If the SD-WAN clue asks which controller distributes control policies and routes, look for vSmart.

Hypervisor questions test where virtualization control runs. A Type 1 hypervisor runs directly on server hardware and is common in production data centers, while a Type 2 hypervisor runs on top of a host operating system and is more common for labs or endpoint virtualization. The networking implication is that virtual switches, VM interfaces, and uplinks must still map back to real underlay connectivity.

• Thinking an overlay replaces the underlay; VXLAN, GRE, and IPsec still depend on routed underlay reachability and correct MTU planning.

• VXLAN questions usually involve VTEPs, Layer 2 extension over Layer 3, and extra encapsulation overhead.

MST questions focus on region consistency. Switches are in the same MST region only when the region name, revision number, and VLAN-to-instance mapping match. If those values differ, the switches treat each other as being in different regions, which changes how STP information is exchanged and can produce unexpected forwarding paths.

• Assuming two MST switches are in the same region when the region name, revision number, or VLAN-to-instance mapping differs.

• MST region consistency requires the same name, revision, and VLAN-to-instance mapping.

Traffic capture features answer different visibility needs. SPAN mirrors traffic on the same switch, RSPAN carries mirrored traffic across a Layer 2 VLAN, and ERSPAN encapsulates mirrored traffic across an IP network. The design question is where the analyzer sits relative to the source traffic and whether Layer 2 or Layer 3 transport is needed.

• Choosing SPAN when mirrored traffic must cross a routed IP network; ERSPAN encapsulates mirrored packets for remote analysis.

• Use IP SLA to generate synthetic tests, then object tracking when a route or FHRP state must react to the result.

CoPP protects the route processor by policing traffic destined to the control plane. It does not filter transit traffic the same way an interface ACL does. CCNP scenarios usually test whether the threat is excessive routing, management, or control traffic hitting the device itself rather than user traffic passing through the device.

• Confusing CoPP with an interface ACL; CoPP protects traffic destined to the control plane and keeps device CPU from being overwhelmed.

• DHCP Snooping builds the binding table that Dynamic ARP Inspection and IP Source Guard can use for enforcement.

REST API questions test how a client interacts with a resource. GET retrieves data, POST creates or submits data, PUT replaces or updates a resource, and DELETE removes a resource. The HTTP verb should match the operation, and the response status code indicates whether authentication, authorization, syntax, or server processing succeeded.

• Calling YANG a transport protocol; YANG models the data, while NETCONF and RESTCONF provide ways to access modeled configuration and state.

• GET reads, POST creates or triggers an action, PUT replaces or updates a named resource, and DELETE removes it.