Section 1.0: Architecture

Exam 350-401 | Comprehensive Study Guide with Labs & Quiz

15% of Exam Weight


Section 1.0 Architecture — Exam Overview

Section 1.0 Architecture accounts for 15% of the CCNP ENCOR 350-401 v1.2 exam. It covers enterprise design principles and high availability, the Cisco Catalyst SD-WAN and SD-Access solutions, and interpreting QoS configurations.

Changed in v1.2: wireless LAN design moved out of ENCOR entirely into the new CCNP Wireless track, and hardware/software switching mechanisms (CEF, CAM, TCAM, FIB, RIB) were removed. Both are gone from the sections below.

Section 1.0 — Architecture15% of the CCNP ENCOR 350-401 v1.2 exam1.1Enterprise network design principles2-tier / 3-tier / fabric / cloud · HA: redundancy, FHRP, SSO1.2Cisco Catalyst SD-WAN solutioncontrol and data plane elements · benefits and limitations1.3Cisco SD-Access solutioncontrol and data plane elements · traditional campus interop1.4Interpret QoS configurationsRemoved in v1.2 — no longer examinable✗ WLAN deployment design and location services — moved to CCNP Wireless (350-101 WLCOR)✗ Hardware and software switching mechanisms: CEF, CAM, TCAM, FIB, RIB
Section 1.0 mapped to the official CCNP ENCOR 350-401 v1.2 exam topics.

1.1 — Enterprise Network Design Principles

Cisco’s enterprise network design follows a hierarchical model that simplifies management, improves scalability, and increases fault tolerance. The three fundamental design approaches are the Three-Tier, Two-Tier (Collapsed Core), and Spine-Leaf (Fabric) architectures.

1.1.a — Design Models: Tier 2, Tier 3, and Fabric

Three-Tier (Tier 3) Architecture

The classic enterprise design separates the network into three distinct layers, each with a specific role:

  • Access Layer — Connects end devices (PCs, phones, APs). Enforces QoS, port security, and VLAN assignment.
  • Distribution Layer — Aggregates access switches. Handles inter-VLAN routing, policy enforcement, and redundant uplinks to the core.
  • Core Layer — High-speed backbone. Switches packets as fast as possible. No policy enforcement here.
CORE LAYER High-speed backbone switches (Catalyst 9500/9600) DISTRIBUTION (Left) DISTRIBUTION (Right) ACCESS SW 1 ACCESS SW 2 ACCESS SW 3 ACCESS SW 4 PCs / Phones / APs PCs / Phones / APs PCs / Phones / APs PCs / Phones / APs Distribution Access Core

Figure 1 — Three-Tier (Tier 3) Hierarchical Campus Architecture

Two-Tier (Collapsed Core) Architecture

The Two-Tier design merges the Core and Distribution layers into a single layer — ideal for medium-sized campuses (typically fewer than 200 switches). Benefits include reduced cost and simpler management.

COLLAPSED CORE / DISTRIBUTION Core + Distribution functions on same switches ACCESS SW 1 ACCESS SW 2 ACCESS SW 3 ACCESS SW 4 End Devices End Devices End Devices End Devices Ideal for < 200 access switches. Lower cost, simpler management.

Figure 2 — Two-Tier (Collapsed Core) Architecture

Spine-Leaf (Fabric) Architecture

Originally from data centers, the Spine-Leaf topology provides predictable latency and non-blocking bandwidth. Every Leaf switch connects to every Spine switch (full mesh at the spine layer). There are no Leaf-to-Leaf connections. Used in modern campus deployments with SD-Access.

  • Spine — Layer 3 routing fabric backbone. Typically 2–4 spine switches for redundancy.
  • Leaf — Layer 2/3 edge. Connects to servers, endpoints, or other Leaf switches via Spine.
  • Maximum hop count from any Leaf to Leaf = 2 hops (Leaf → Spine → Leaf). Each leaf-to-spine link is one hop, so every leaf sits exactly two hops from every other leaf.
SPINE 1 SPINE 2 LEAF 1 LEAF 2 LEAF 3 LEAF 4 LEAF 5 Servers VMs Storage End Users WAN/Border Max path = 2 hops (Leaf→Spine→Leaf). Equal-cost multipath via ECMP.

Figure 3 — Spine-Leaf Fabric Architecture

Capacity Planning Considerations

Factor Tier 3 Tier 2 (Collapsed) Spine-Leaf
Scale Large enterprise Medium campus Data center / large campus
Latency Variable (more hops) Low-moderate Consistent (always 2 hops)
Redundancy High Moderate Very high
Cost High Low-moderate High
STP dependency Yes (access/dist) Yes No (L3 fabric)
East-West traffic Poor Moderate Excellent
📝 Exam Tip: The key differentiator on the ENCOR exam: Spine-Leaf provides consistent latency and handles East-West traffic (server-to-server) efficiently. Three-tier is for North-South (client-to-server) dominated traffic patterns.

1.1.b — High Availability: Redundancy, FHRP & SSO

First Hop Redundancy Protocols (FHRP)

FHRPs provide default gateway redundancy so end devices never lose connectivity when a router fails.

Protocol Standard Virtual IP Ownership Preemption Load Balancing
HSRP v1/v2 Cisco proprietary Active router Optional (off by default) Per-group only
VRRP IEEE 802.1 (open) Master router Preempt on by default Per-group only
GLBP Cisco proprietary AVG assigns multiple AVFs Optional True per-host LB
Virtual IP: 10.0.0.1 Router A ACTIVE / Master Router B STANDBY Hello / Keepalive PC 1 PC 2 PC 3 All PCs use 10.0.0.1 as default gateway. Failover is transparent.

Figure 4 — HSRP/VRRP Active-Standby Default Gateway Redundancy

Stateful Switchover (SSO) & Non-Stop Forwarding (NSF)

  • SSO — On dual-supervisor routers/switches, the standby supervisor stays synchronized with the active one. On failover, switching continues with zero packet loss.
  • NSF (Graceful Restart) — Routing protocol peers are notified of the RP failover and continue forwarding traffic while the routing table rebuilds. Supported by OSPF, IS-IS, EIGRP, BGP.
  • NSR (Non-Stop Routing) — The standby RP maintains its own routing state. No neighbor awareness needed — fully transparent to peers.
  • BFD — Bidirectional Forwarding Detection. Sub-second failure detection for any routing protocol.
Technology What it does Peer awareness needed?
SSO Synchronizes supervisor state for instant failover No
NSF/GR Signals routing peers to hold routes during restart Yes
NSR Standby RP maintains full routing state No
BFD Sub-second link/path failure detection Yes (both ends)

1.1.a — Design Models: Cloud and On-Premises

On-Premises

  • Hardware & software owned and managed by the organization
  • Full control over data, compliance, and security posture
  • High CapEx (capital expenditure)
  • Longer deployment time
  • Examples: Cisco Catalyst switches, on-prem DNA Center appliance

Cloud Infrastructure

  • Resources delivered as-a-service (IaaS, PaaS, SaaS)
  • OpEx model — pay per use
  • Rapid elasticity and scalability
  • Shared responsibility model for security
  • Examples: Cisco Meraki (cloud WLC), Catalyst Center SaaS, AWS/Azure VPC

Cloud Service Models Relevant to ENCOR

Model Managed By Customer Managed By Provider Example
IaaS OS, Apps, Data, Runtime Hypervisor, Servers, Storage, Network AWS EC2, Azure VMs
PaaS Applications, Data OS, Runtime, Middleware, Infrastructure Heroku, Azure App Service
SaaS Data (partially) Everything else Webex, Salesforce, Meraki

Hybrid and Multi-Cloud

Enterprise networks increasingly use hybrid cloud (mix of on-prem + cloud) or multi-cloud (multiple cloud providers). Cisco SD-WAN and Cisco+ (Networking Cloud) provide consistent connectivity and policy across all environments.

⚠️ Key Concept: The ENCOR exam tests your ability to differentiate when to use on-prem vs cloud. On-prem is preferred for regulated data (HIPAA, PCI), ultra-low latency needs, and environments with limited internet reliability.

1.2 — Cisco Catalyst SD-WAN Solution

Cisco SD-WAN (formerly Viptela) decouples the WAN control plane from the data plane, enabling centralized policy, automated provisioning, and application-aware routing across any transport (MPLS, broadband, 4G/5G, satellite).

1.2.a — SD-WAN Control and Data Plane Elements

vManage Management Plane GUI / REST API / NetConf vBond Orchestration Plane Auth + NAT Traversal vSmart Control Plane OMP Route Reflector vEdge/cEdge Branch Router vEdge/cEdge DC Router vEdge/cEdge HQ Router IPsec Data Plane Tunnels (any transport) Orchestration Control Management

Figure 6 — Cisco SD-WAN Architecture (Viptela / IOS-XE SD-WAN)

SD-WAN Component Roles

Component Plane Function Protocol Used
vManage Management Central GUI, REST API, configuration templates, monitoring HTTPS / NetConf / RESTCONF
vBond Orchestration First point of contact; authenticates all devices; assists NAT traversal; requires public IP DTLS/TLS
vSmart Control Distributes routing & policy via OMP; acts as route reflector to all vEdge/cEdge OMP over TLS
vEdge / cEdge Data Physical/virtual WAN edge router; builds IPsec tunnels between sites; enforces app-aware policy IPsec / OMP

1.2.b — Benefits and Limitations vs Traditional WAN

Attribute Traditional WAN SD-WAN
Transport MPLS only (or limited) Any transport (MPLS, broadband, LTE, satellite)
Configuration CLI per-device Centralized templates via vManage
Routing OSPF/BGP/EIGRP per device OMP centrally reflects routes
Application visibility Limited (DPI optional) Built-in DPI & app-aware routing
Security Perimeter-only Built-in IPsec, cloud security integration (Zscaler, Umbrella)
ZTP (Zero-Touch) No Yes — plug in, contacts vBond, auto-provisions
📝 Exam Tip: OMP (Overlay Management Protocol) is the SD-WAN control plane protocol — analogous to BGP. It runs between vSmart and vEdge/cEdge over a TLS-secured connection.

1.3 — Cisco SD-Access Solution

SD-Access is Cisco’s campus fabric solution, managed by Cisco Catalyst Center (formerly DNA Center). It automates campus network provisioning, segmentation, and policy enforcement using an underlay/overlay model.

SD-Access Layered Architecture

Catalyst Center (DNA Center) Orchestration / Management (SWIM, PnP, Assurance) ISE Policy / Identity (SGT) OVERLAY NETWORK (Fabric) Control Plane Node LISP Map-Server Endpoint registration Border Node Connects external L3 networks to fabric Edge Node Connects wired endpoints VXLAN encapsulation UNDERLAY NETWORK (Routed IP) IS-IS or OSPF routed access. Physical switches/routers. No STP. Point-to-point L3 links. Loopback = VTEP source.

Figure 7 — SD-Access Architecture: Underlay / Overlay / Management Planes

1.3.a — SD-Access Control and Data Plane Elements

Plane Protocol Function
Control Plane LISP (Locator/ID Separation Protocol) Maps endpoint identities (EID) to RLOC (routing locator/VTEP IP). Handles mobility and any-to-any policy.
Data Plane VXLAN (Virtual Extensible LAN) MAC-in-UDP encapsulation. Carries original Ethernet frame including 802.1Q VLAN tag. Adds SGT header for policy.
Policy Plane Cisco TrustSec / SGT Scalable Group Tags embedded in VXLAN header. Identity-based micro-segmentation without complex ACLs.
Management Plane NETCONF / RESTCONF Catalyst Center programs all fabric nodes via API (Intent-Based Networking).

Why LISP for the Control Plane?

  • Traditional routing ties who you are (IP address) to where you are (location on the network).
  • LISP separates the EID (Endpoint ID — your IP address) from the RLOC (Routing Locator — the VTEP/edge node loopback).
  • When a client moves, only the LISP map updates — no re-IP, no spanning tree convergence.

Why VXLAN for the Data Plane?

  • Extends Layer 2 across a Layer 3 underlay using MAC-in-UDP encapsulation (UDP port 4789).
  • 24-bit VNID (Virtual Network Identifier) — supports 16 million virtual networks vs VLAN’s 4094.
  • Carries the original Ethernet frame including 802.1Q VLAN and SGT for policy enforcement.

1.3.b — Traditional Campus Interoperating with SD-Access

Not all campus areas can be migrated to SD-Access at once. The Border Node bridges between the fabric and legacy/external networks:

  • Default Border — Handles traffic to unknown destinations (exits fabric to external routing domain).
  • External Border — Connects to known external networks (e.g., data center, internet, legacy campus).
  • Traditional OSPF/BGP routes are redistributed into LISP by the border node.
📝 Exam Tip: SD-Access uses IS-IS (not OSPF) as the preferred underlay routing protocol because it is link-state, protocol-independent (not tied to IP), and handles large-scale networks efficiently. However, OSPF can also be used.

1.4 — Interpret QoS Configurations

QoS decides which packets matter most when a link has more traffic offered to it than it can carry. In v1.2 the exam objective is interpret rather than configure: you are expected to read an existing policy and say what it does, not build one from scratch.

The three building blocks you will see in any policy

Component Command What it does
Class map class-map Identifies traffic — by DSCP, ACL, or NBAR protocol
Policy map policy-map States the action for each class — priority, bandwidth, police, shape, set
Service policy service-policy Applies the policy to an interface, inbound or outbound

Reading a policy

class-map match-any VOICE
 match dscp ef
class-map match-any VIDEO
 match dscp af41 af42 af43

policy-map WAN-EDGE
 class VOICE
  priority percent 10          ! strict priority, policed at 10% when congested
 class VIDEO
  bandwidth remaining percent 30  ! 30% of what is left after the priority queue
 class class-default
  fair-queue
  random-detect              ! WRED — TCP only, never on voice

interface GigabitEthernet0/0/0
 service-policy output WAN-EDGE

Read it as: voice marked EF gets a strict-priority queue capped at 10%; video gets 30% of the remainder; everything else is fair-queued with WRED managing the queue depth before it overflows.

Markings worth recognising on sight

Marking Decimal Typical use
EF 46 Voice — the priority queue
AF41 / AF42 / AF43 34 / 36 / 38 Interactive video, three drop precedences
CS6 48 Network control — routing protocols
CS3 24 Call signalling
CS1 8 Scavenger — first to be discarded
DF / CS0 0 Best effort

The AF conversion is DSCP = 8x + 2y, so AF31 is (8×3)+(2×1) = 26. Higher y means more likely to be dropped.

Exam Tip — Policing vs Shaping
Policing drops or re-marks excess traffic and can act inbound or outbound. Shaping buffers excess and is egress only. TCP recovers far better from shaping, because policing appears as loss and halves the window.
Exam Tip — Verification
show policy-map interface is the command that answers almost every QoS question. Zero counters do not mean a broken policy: queuing only engages once the interface is congested.

For the full treatment — classification, marking, policing, shaping, queuing and congestion avoidance, with labs — see the QoS deep dive.

🧪 Lab Exercises

These labs use Cisco IOS/IOS-XE syntax (Cisco Packet Tracer, GNS3, or CML). Each lab reinforces a key architecture concept.

LAB 1

HSRP Active/Standby Configuration (Topic 1.1.b)

Objective: Configure HSRP between two routers so end devices have a redundant default gateway.

Topology: R1 (Active) and R2 (Standby) connected to same VLAN 10 (192.168.10.0/24). Virtual IP = 192.168.10.1

Configure R1 interface (Active — higher priority)
R1(config)# interface GigabitEthernet0/0
R1(config-if)# ip address 192.168.10.2 255.255.255.0
R1(config-if)# standby version 2
R1(config-if)# standby 10 ip 192.168.10.1
R1(config-if)# standby 10 priority 110
R1(config-if)# standby 10 preempt
R1(config-if)# standby 10 authentication md5 key-string Cisco123
R1(config-if)# no shutdown
Configure R2 interface (Standby — default priority 100)
R2(config)# interface GigabitEthernet0/0
R2(config-if)# ip address 192.168.10.3 255.255.255.0
R2(config-if)# standby version 2
R2(config-if)# standby 10 ip 192.168.10.1
R2(config-if)# standby 10 preempt
R2(config-if)# standby 10 authentication md5 key-string Cisco123
R2(config-if)# no shutdown
Verify HSRP state
R1# show standby
R1# show standby brief
! Expected output:
!                     P indicates configured to preempt.
! Interface   Grp  Pri P State   Active          Standby         Virtual IP
! Gi0/0       10   110 P Active  local           192.168.10.3    192.168.10.1
Test failover — shut R1 interface, verify R2 becomes Active
R1(config)# interface GigabitEthernet0/0
R1(config-if)# shutdown
! On R2:
R2# show standby brief
! R2 should now show Active state for group 10

LAB 3

Three-Tier Campus Design — Inter-VLAN Routing (Topic 1.1.a)

Objective: Build a three-tier topology with access VLANs, distribution SVIs, and core routing.

Access Layer — create VLANs and assign access ports
! On Access Switch SW-A1:
SW-A1(config)# vlan 10
SW-A1(config-vlan)# name USERS
SW-A1(config)# vlan 20
SW-A1(config-vlan)# name VOICE
SW-A1(config)# interface range Gi0/1 - 24
SW-A1(config-if-range)# switchport mode access
SW-A1(config-if-range)# switchport access vlan 10
SW-A1(config)# interface Gi0/0
SW-A1(config-if)# switchport mode trunk
SW-A1(config-if)# switchport trunk allowed vlan 10,20
Distribution Layer — configure SVIs and uplink to core
! On Distribution Switch DIST-1:
DIST-1(config)# ip routing
DIST-1(config)# vlan 10
DIST-1(config)# vlan 20
DIST-1(config)# interface vlan 10
DIST-1(config-if)# ip address 10.10.10.1 255.255.255.0
DIST-1(config-if)# no shutdown
DIST-1(config)# interface vlan 20
DIST-1(config-if)# ip address 10.20.20.1 255.255.255.0
DIST-1(config-if)# no shutdown
! Uplink to core (routed port)
DIST-1(config)# interface Gi1/0
DIST-1(config-if)# no switchport
DIST-1(config-if)# ip address 172.16.1.2 255.255.255.252
DIST-1(config-if)# no shutdown
! OSPF toward core
DIST-1(config)# router ospf 1
DIST-1(config-router)# network 10.0.0.0 0.255.255.255 area 0
DIST-1(config-router)# network 172.16.1.0 0.0.0.3 area 0
Verify routing between VLANs
DIST-1# show ip route
DIST-1# ping 10.20.20.100 source 10.10.10.1
DIST-1# show ip ospf neighbor

LAB 4

SD-WAN vEdge — OMP Route Verification (Topic 1.2)

Objective: Verify OMP sessions and route exchange on a Cisco IOS-XE SD-WAN (cEdge) router.

Verify OMP sessions to vSmart
cEdge# show sdwan omp summary
cEdge# show sdwan omp peers
! Displays connected vSmart controllers
! State should be "up" and "established"
View OMP advertised routes
cEdge# show sdwan omp routes
! Shows all routes received from vSmart
! Includes tloc-paths (transport locators) for each prefix

cEdge# show sdwan omp tlocs
! Shows Transport LOCations (color + system IP + encap)
View IPsec tunnel status to remote sites
cEdge# show sdwan ipsec inbound-connections
cEdge# show sdwan ipsec outbound-connections
cEdge# show sdwan bfd sessions
! BFD monitors each IPsec tunnel health
! State: up | down | AdminDown
Application-aware routing policy verification
cEdge# show sdwan policy from-vsmart
! Displays centralized policies pushed from vManage/vSmart
! Including app-route policies, cflowd, ACLs

LAB 5

SD-Access LISP/VXLAN Fabric Verification (Topic 1.3)

Objective: Verify LISP endpoint registration and VXLAN tunnel operation in an SD-Access fabric.

Verify LISP database on edge node
EdgeNode# show lisp instance-id 4098 ipv4 database
! Shows locally registered EIDs (endpoints connected to this edge)
! EID prefix       Locator         Pri/Wgt  Source   State
! 10.1.1.10/32     192.168.100.1   1/50     cfg-intf Reachable
Query LISP map-server (control plane node)
EdgeNode# show lisp instance-id 4098 ipv4 map-cache
! EID prefix       Locator         TTL      Action
! 10.1.2.20/32     192.168.100.2   1d0h     forward-native
! This shows the RLOC (VTEP) for a remote endpoint
Verify VXLAN tunnels
EdgeNode# show nve peers
! Interface  VNI  Peer-IP           State  uptime
! nve1       8192 192.168.100.2     UP     00:45:23

EdgeNode# show nve vni
! VNI       Mode    BD    IngressReplication
! 8192      L2      102   N/A
Trace a packet through the fabric
! From a client on VLAN 10 (10.1.1.10) to remote client (10.1.2.20):
! 1. Client sends to default GW (EdgeNode SVI)
! 2. EdgeNode queries LISP map-server: "Where is 10.1.2.20?"
! 3. Map-server replies: RLOC = 192.168.100.2
! 4. EdgeNode encapsulates in VXLAN, sends to 192.168.100.2
! 5. Remote EdgeNode decapsulates, delivers to 10.1.2.20

EdgeNode# debug lisp control-plane itr map-request

Check Your Understanding

Twenty questions on this section. Each answer is explained as you go.

1. 

In a Three-Tier campus design, which layer is responsible for inter-VLAN routing and applying QoS policies?

2. 

A company has 80 access layer switches. Which campus design model is MOST appropriate?

3. 

What is the maximum number of hops between any two leaf switches in a Spine-Leaf architecture?

4. 

Which FHRP protocol supports true load balancing across multiple routers using a single virtual IP?

5. 

In Cisco SD-WAN, which component is the FIRST point of contact for all new devices joining the fabric and requires a public IP?

6. 

What protocol does Cisco SD-WAN use to distribute routing and policy information from the vSmart controller to WAN edge routers?

7. 

In SD-Access, which protocol is used for the data plane to encapsulate endpoint traffic across the fabric underlay?

8. 

Which SD-Access fabric role connects the fabric to external Layer 3 networks such as the data center or internet?

9. 

On a dual-supervisor Catalyst switch, what does Stateful Switchover (SSO) provide when the active supervisor fails?

10. 

Which statement correctly distinguishes VRRP from HSRP?

11. 

In Cisco Catalyst SD-WAN, which component provides the graphical management interface and is where configuration templates and policies are authored?

12. 

What does a TLOC identify in a Cisco Catalyst SD-WAN fabric?

13. 

What is the primary advantage of NSR (Non-Stop Routing) over NSF/Graceful Restart for high availability?

14. 

Which cloud service model gives customers the MOST control over the operating system and runtime environment?

15. 

In SD-Access, what technology provides identity-based policy enforcement by embedding group tags in the VXLAN header?

16. 

Which routing protocol is preferred for the SD-Access fabric underlay, and why?

17. 

In an SD-Access fabric, which node type runs the LISP map-server and map-resolver, tracking where every endpoint currently resides?

18. 

A network engineer notices HSRP preemption is disabled on the primary router. What happens if the primary router recovers after a failure?

19. 

In the Cisco SD-WAN architecture, which component acts as a route reflector for OMP distributing routes and policies to all WAN edge routers?

20. 

Which LISP term describes the IP address of the edge device (VTEP) that provides access to an endpoint in the SD-Access fabric?

1 out of 1