3.1 Layer 2 Infrastructure
Layer 2 forms the switching fabric of every campus network. The ENCOR exam tests your ability to troubleshoot trunking, EtherChannel, and Spanning Tree — three technologies that must work together flawlessly.
VLANs and 802.1Q Trunking
A VLAN (Virtual LAN) segments a physical switch into isolated broadcast domains. 802.1Q trunking carries traffic for multiple VLANs across a single link by inserting a 4-byte tag (TPID 0x8100 + 12-bit VLAN ID) between the source MAC and EtherType fields.
- Native VLAN: traffic sent untagged on a trunk (default VLAN 1 — change for security)
- Allowed VLANs: list of VLANs permitted to traverse the trunk
- DTP (Dynamic Trunking Protocol): Cisco proprietary — auto-negotiates trunk. Disable on edge ports with
switchport nonegotiate - VTP (VLAN Trunking Protocol): propagates VLAN database. VTP v3 supports extended VLANs (1006–4094) and MST configuration
Common trunk failures: native VLAN mismatch (generates CDP warnings), allowed VLAN pruning, DTP mode mismatch (dynamic auto ↔ dynamic auto = access), encapsulation mismatch on older platforms.
EtherChannel (LACP / PAgP / Static)
EtherChannel bundles 2–8 (IOS) or 2–16 (LACP standard) physical links into one logical interface (port-channel). STP sees a single link — no blocking. Load is distributed per-flow using a hashing algorithm (src-dst-IP, src-dst-MAC, etc.).
| Protocol | Standard | Modes | Negotiation | Key Detail |
|---|---|---|---|---|
| LACP | IEEE 802.3ad | active / passive | Yes — sends LACP PDUs | active+active or active+passive form channel |
| PAgP | Cisco proprietary | desirable / auto | Yes — sends PAgP PDUs | desirable+desirable or desirable+auto |
| Static (on) | — | on | No | Both sides must be on; no negotiation — risky |
All member ports must match: speed, duplex, mode (access/trunk), native VLAN, allowed VLANs, STP settings. A mismatch suspends the port-channel. Use
show etherchannel summary — look for (P)=bundled, (I)=standalone, (s)=suspended.Spanning Tree: RSTP and MST
RSTP (802.1w) — Rapid Spanning Tree Protocol — converges in ~1–2 seconds vs. 30–50 seconds for legacy 802.1D. Cisco implements it as Rapid PVST+ (one RSTP instance per VLAN).
| Port Role | RSTP State | Description |
|---|---|---|
| Root Port | Forwarding | Best path to Root Bridge (one per non-root switch) |
| Designated Port | Forwarding | Best port on each segment toward the Root Bridge |
| Alternate Port | Discarding | Backup path to Root Bridge (replaces Blocking in 802.1D) |
| Backup Port | Discarding | Redundant path on same segment (hub scenario) |
| Edge Port | Forwarding (immediate) | PortFast-enabled — never transitions through sync |
MST (802.1s) — Multiple Spanning Tree — maps multiple VLANs to a single STP instance (MSTI), reducing CPU/memory vs. Rapid PVST+. Requires all switches in an MST region to share the same: region name, revision number, and VLAN-to-instance mapping.
| Feature | 802.1D (STP) | 802.1w (RSTP) | 802.1s (MST) |
|---|---|---|---|
| Convergence | 30–50 sec | 1–2 sec | 1–2 sec |
| Instances | 1 (CST) | 1 per VLAN (PVST+) | 1 per MSTI (user-defined) |
| Port States | 5 (Block/Listen/Learn/Fwd/Disabled) | 3 (Discarding/Learning/Forwarding) | 3 (same as RSTP) |
| Topology Change | TC notification + 15s delay | Immediate flush MACs | Immediate flush MACs |
| CPU Overhead | High (per-VLAN) | High (per-VLAN) | Low (shared instances) |
3.2 Layer 3 Routing
Section 3.2 covers EIGRP, OSPF, eBGP, and route redistribution. These are the backbone of enterprise IP routing. The exam tests conceptual comparison, configuration, and troubleshooting across all four areas.
EIGRP (Enhanced Interior Gateway Routing Protocol)
EIGRP is Cisco’s advanced distance-vector protocol using the DUAL (Diffusing Update Algorithm). It sends partial, bounded updates only when topology changes occur — far more efficient than RIP’s periodic full-table updates.
| Parameter | EIGRP Value | Notes |
|---|---|---|
| Protocol | IP Protocol 88 | Multicast 224.0.0.10 |
| AD | 90 (internal) / 170 (external) | Redistributed routes = 170 |
| Metric | Composite: BW + Delay (+ Load, Reliability optional) | K1=1,K3=1 by default; K2,K4,K5=0 |
| Hello/Hold | 5s/15s (LAN) · 60s/180s (WAN) | Must match to form adjacency |
| Load Balancing | Equal AND unequal path | variance command for unequal |
| Successor | Best path to destination | Installed in routing table |
| Feasible Successor | Backup path meeting FC | FC: neighbor RD < local FD |
If no Feasible Successor exists, EIGRP goes Active — sends QUERY messages to neighbors. If all replies received → Passive (converged). Stuck-in-Active (SIA) after 3 min = neighbor relationship reset. Use
show ip eigrp topology to see Successor/FS and FD/AD values.OSPF Multi-Area
OSPF is a link-state IGP using the Dijkstra SPF algorithm. All areas must connect to Area 0 (backbone). Inter-area routing flows through ABRs (Area Border Routers).
| LSA Type | Name | Generated By | Scope |
|---|---|---|---|
| Type 1 | Router LSA | Every router | Within area |
| Type 2 | Network LSA | DR on broadcast segment | Within area |
| Type 3 | Summary LSA | ABR | Inter-area |
| Type 4 | ASBR Summary | ABR | Inter-area (points to ASBR) |
| Type 5 | External LSA | ASBR | Entire OSPF domain |
| Type 7 | NSSA External | ASBR in NSSA | Within NSSA, converted to Type 5 at ABR |
| Area Type | Blocks | Config Command |
|---|---|---|
| Regular | Nothing | (default) |
| Stub | Type 4, 5 (external LSAs) | area X stub |
| Totally Stub | Type 3, 4, 5 | area X stub no-summary |
| NSSA | Type 5; allows Type 7 | area X nssa |
| Totally NSSA | Type 3, 4, 5; allows Type 7 | area X nssa no-summary |
On multi-access segments (Ethernet), OSPF elects a DR and BDR to reduce LSA flooding. DR uses 224.0.0.6; all routers use 224.0.0.5. Election: highest interface priority (default 1), then highest Router-ID. Priority 0 = ineligible. Election is non-preemptive — clear process with
clear ip ospf process to force re-election.eBGP (External BGP)
BGP is the internet’s routing protocol — a path-vector EGP that routes between Autonomous Systems (AS). In enterprises, eBGP peers with ISPs or connects SD-WAN underlay paths. Unlike IGPs, BGP doesn’t auto-discover neighbors; peers must be explicitly configured.
| Attribute | Type | Description | Scope |
|---|---|---|---|
| Weight | Cisco local | Highest preferred for outbound (local router only) | Router-local |
| Local Preference | Well-known discretionary | Highest preferred for outbound (within AS) | iBGP |
| AS-Path | Well-known mandatory | Shortest preferred; loop prevention | eBGP |
| MED | Optional non-transitive | Lowest preferred for inbound (hint to neighbor AS) | eBGP |
| Origin | Well-known mandatory | i < e < ? (IGP < EGP < incomplete) | All |
| Next-Hop | Well-known mandatory | eBGP: set to self. iBGP: not changed by default | All |
BGP Best-Path Selection Order (mnemonic: “We Love Oranges AS Oranges Mean Pure Refreshment”): Weight → Local Pref → Locally originated → AS-Path (shortest) → Origin → MED → eBGP over iBGP → IGP metric to Next-Hop → Router-ID
eBGP sets IP TTL=1 by default — peers must be directly connected. Use
neighbor X.X.X.X ebgp-multihop <ttl> for non-directly-connected peers (loopback-based peering). iBGP uses TTL=255.Route Redistribution
Redistribution injects routes from one routing domain into another. Common scenarios: OSPF ↔ EIGRP at domain boundaries, static/connected → BGP, or legacy RIP → OSPF.
- Seed metric: When redistributing into EIGRP, must set metric (BW, delay, reliability, load, MTU) or use
default-metric - Metric-type: OSPF external routes are E2 (fixed metric) by default; E1 adds the internal OSPF cost
- Redistribution loops: In two-way redistribution (both directions), routes can loop back. Use route-maps with tags to filter already-redistributed routes
- Administrative Distance: If same prefix learned via two protocols, lower AD wins. Use
distancecommand or route-maps to control preference
| Protocol | AD (Internal) | AD (External) | Notes |
|---|---|---|---|
| Connected | 0 | — | Always preferred |
| Static | 1 | — | Next best after connected |
| EIGRP | 90 | 170 | External = redistributed |
| OSPF | 110 | 110 | E1/E2 both AD 110 |
| BGP (eBGP) | 20 | — | iBGP = 200 |
| RIP | 120 | — | Rarely used in enterprise |
3.3 IP Services
NTP (Network Time Protocol)
NTP synchronizes clocks across devices using a hierarchical stratum model. Accurate time is critical for log correlation, certificate validity, and SNMP timestamps.
| Stratum | Description | Example |
|---|---|---|
| 0 | Reference clock (atomic, GPS) | GPS receiver, cesium clock |
| 1 | Directly connected to stratum 0 | NTP primary servers (time.nist.gov) |
| 2 | Synced from stratum 1 | Enterprise NTP server |
| 3–15 | Downstream clients/servers | Routers, switches, firewalls |
| 16 | Unsynchronized | Device not yet synced or NTP disabled |
- NTP authentication: MD5-based; configure matching key on server and client
- NTP master: Makes the router act as an authoritative source (even without upstream sync) — use with caution
- Verify with:
show ntp status,show ntp associations
NAT / PAT
NAT (Network Address Translation) translates private RFC 1918 addresses to public IPs. Essential for IPv4 address conservation and ISP connectivity.
| NAT Type | Description | Use Case |
|---|---|---|
| Static NAT | One-to-one: fixed private ↔ public mapping | Servers (web, mail) needing consistent public IP |
| Dynamic NAT | Many-to-many: pool of public IPs, first-come-first-served | Outbound internet with IP pool |
| PAT (NAT Overload) | Many-to-one: all private hosts share one public IP via port numbers | Home/branch internet (most common) |
| Policy NAT | NAT applied only when route-map conditions match | Multi-ISP, VPN exclusion |
ip nat inside source translates the source of packets coming FROM inside TO outside. “Inside local” = private IP. “Inside global” = public IP seen on outside. show ip nat translations and show ip nat statistics are key verification commands.Multicast — IGMP and PIM
Multicast delivers one stream to many receivers efficiently. Hosts use IGMP to join multicast groups; routers use PIM to build delivery trees.
| Component | Version/Mode | Key Behavior |
|---|---|---|
| IGMP v1 | Legacy | Join only — no leave; 3-min timeout |
| IGMP v2 | Common | Adds Leave Group message for faster pruning (~3 sec) |
| IGMP v3 | Modern | Source-specific joins (SSM) — host specifies source IP |
| MLD | IPv6 equivalent | MLDv1≈IGMPv2, MLDv2≈IGMPv3 |
| PIM Dense Mode | Push model | Flood-and-prune; good for dense receiver populations |
| PIM Sparse Mode | Pull model | RP-based; receivers explicitly join; enterprise standard |
| PIM SSM | Source-Specific | No RP needed; uses 232.0.0.0/8; requires IGMPv3 |
| BIDIR-PIM | Bidirectional | Bidirectional tree; many-to-many; no SPT switchover |
Rendezvous Point (RP) discovery methods:
- Static RP:
ip pim rp-address— simple, no redundancy without Anycast RP - Auto-RP: Cisco proprietary — Candidate-RP announces to 224.0.1.39; Mapping Agent listens and floods to 224.0.1.40
- BSR (Bootstrap Router): RFC standard — Candidate-RPs register with BSR; BSR floods RP-Set to all PIM routers
- Anycast RP + MSDP: Multiple RPs share same IP address; MSDP synchronizes active sources between them
If a multicast packet fails the RPF check, it is dropped — this is the most common multicast troubleshooting issue. Use
show ip rpf <source-ip> to verify which interface RPF expects packets from. Asymmetric unicast routing causes RPF failures.Hands-On Labs
Lab 1 — 802.1Q Trunking and LACP EtherChannel
Configure an 802.1Q trunk between SW1 and SW2 carrying VLANs 10, 20, 30 with native VLAN 99.
SW1(config)# vlan 10 SW1(config-vlan)# name USERS SW1(config)# vlan 20 SW1(config-vlan)# name VOICE SW1(config)# vlan 30 SW1(config-vlan)# name MGMT SW1(config)# vlan 99 SW1(config-vlan)# name NATIVE SW1(config)# interface GigabitEthernet0/1 SW1(config-if)# switchport mode trunk SW1(config-if)# switchport trunk encapsulation dot1q SW1(config-if)# switchport trunk native vlan 99 SW1(config-if)# switchport trunk allowed vlan 10,20,30,99 SW1(config-if)# switchport nonegotiate
Bundle Gi0/2 and Gi0/3 into LACP EtherChannel (port-channel 1) on both switches.
SW1(config)# interface range GigabitEthernet0/2 - 3 SW1(config-if-range)# channel-group 1 mode active ! LACP active SW1(config-if-range)# exit SW1(config)# interface port-channel 1 SW1(config-if)# switchport mode trunk SW1(config-if)# switchport trunk allowed vlan 10,20,30,99 ! SW2 — use passive or active (active+passive also forms channel) SW2(config)# interface range GigabitEthernet0/2 - 3 SW2(config-if-range)# channel-group 1 mode passive ! LACP passive
Verify EtherChannel bundle and trunk status.
SW1# show etherchannel summary ! Look for Po1(SU) — S=Layer2, U=in use. Members should show (P)=bundled SW1# show interfaces trunk ! Verify allowed VLANs and native VLAN on both physical and port-channel interfaces SW1# show interfaces port-channel 1
Lab 2 — RSTP and MST Configuration
Enable Rapid PVST+ and set SW1 as root bridge for VLANs 10,20 and SW2 as root for VLANs 30,99.
SW1(config)# spanning-tree mode rapid-pvst SW1(config)# spanning-tree vlan 10,20 priority 4096 ! Root primary SW1(config)# spanning-tree vlan 30,99 priority 8192 ! Root secondary SW2(config)# spanning-tree mode rapid-pvst SW2(config)# spanning-tree vlan 30,99 priority 4096 SW2(config)# spanning-tree vlan 10,20 priority 8192 ! Enable PortFast + BPDU Guard on access ports SW1(config)# interface GigabitEthernet0/10 SW1(config-if)# spanning-tree portfast SW1(config-if)# spanning-tree bpduguard enable
Configure MST with two instances: MSTI 1 for VLANs 10,20 and MSTI 2 for VLANs 30,99.
SW1(config)# spanning-tree mode mst SW1(config)# spanning-tree mst configuration SW1(config-mst)# name CAMPUS SW1(config-mst)# revision 1 SW1(config-mst)# instance 1 vlan 10,20 SW1(config-mst)# instance 2 vlan 30,99 SW1(config-mst)# exit SW1(config)# spanning-tree mst 1 priority 4096 SW1(config)# spanning-tree mst 2 priority 8192 SW1# show spanning-tree mst SW1# show spanning-tree mst 1 ! View MSTI 1 topology
Lab 3 — OSPF Multi-Area with Summarization
Configure a 3-router OSPF topology: R1 in Area 1, R2 as ABR (Area 0+1), R3 in Area 0.
R1(config)# router ospf 1 R1(config-router)# router-id 1.1.1.1 R1(config-router)# network 10.1.1.0 0.0.0.255 area 1 R1(config-router)# network 10.1.2.0 0.0.0.255 area 1 R1(config-router)# passive-interface GigabitEthernet0/1 ! LAN-facing R2(config)# router ospf 1 R2(config-router)# router-id 2.2.2.2 R2(config-router)# network 10.1.0.0 0.0.255.255 area 1 R2(config-router)# network 10.0.0.0 0.0.0.255 area 0 R2(config-router)# area 1 range 10.1.0.0 255.255.0.0 ! Summarize Area 1 routes
Verify OSPF adjacencies, LSDB, and routing table.
R2# show ip ospf neighbor R2# show ip ospf database ! View all LSA types R2# show ip ospf database summary ! Type 3 LSAs generated by this ABR R3# show ip route ospf ! R3 should see 10.1.0.0/16 summary (not individual /24s) — summarization working
Lab 4 — eBGP Peering and Verification
Configure eBGP between R1 (AS 65001) and R2 (AS 65002) on directly connected interfaces.
R1(config)# router bgp 65001 R1(config-router)# bgp router-id 1.1.1.1 R1(config-router)# neighbor 10.0.0.2 remote-as 65002 R1(config-router)# network 192.168.1.0 mask 255.255.255.0 ! Advertise prefix R2(config)# router bgp 65002 R2(config-router)# bgp router-id 2.2.2.2 R2(config-router)# neighbor 10.0.0.1 remote-as 65001 R2(config-router)# network 172.16.0.0 mask 255.255.0.0
Verify BGP peering state and prefixes.
R1# show bgp summary ! State/PfxRcd — should show integer (# of prefixes), not "Active/Idle" R1# show bgp ipv4 unicast neighbors 10.0.0.2 R1# show bgp ipv4 unicast ! Full BGP table — > = best path R1# show ip route bgp ! BGP routes in RIB (B = BGP, AD 20 for eBGP)
Lab 5 — NAT Overload (PAT) + NTP
Configure PAT so all hosts on 192.168.1.0/24 share a single public IP (203.0.113.1) for internet access.
R1(config)# ip access-list standard NAT_INSIDE R1(config-std-nacl)# permit 192.168.1.0 0.0.0.255 R1(config)# ip nat inside source list NAT_INSIDE interface GigabitEthernet0/1 overload R1(config)# interface GigabitEthernet0/0 R1(config-if)# ip nat inside R1(config)# interface GigabitEthernet0/1 R1(config-if)# ip nat outside
Configure NTP — R1 syncs to upstream server, distributes time to downstream routers.
R1(config)# ntp server 216.239.35.0 prefer ! Upstream NTP R1(config)# ntp authenticate R1(config)# ntp authentication-key 1 md5 Cisco123 R1(config)# ntp trusted-key 1 R2(config)# ntp server 10.0.0.1 ! Sync from R1 R2(config)# ntp authentication-key 1 md5 Cisco123 R2(config)# ntp trusted-key 1 R2(config)# ntp authenticate R1# show ntp status R1# show ntp associations R1# show ip nat translations R1# show ip nat statistics
Lab 6 — PIM-SM Multicast Configuration
Enable IP multicast routing and configure PIM Sparse Mode on all routers. Designate R2 as the RP for 239.0.0.0/8.
R1(config)# ip multicast-routing R1(config)# interface GigabitEthernet0/0 R1(config-if)# ip pim sparse-mode R1(config)# interface GigabitEthernet0/1 R1(config-if)# ip pim sparse-mode R2(config)# ip multicast-routing R2(config)# ip pim rp-address 10.2.2.2 ! R2 is static RP R2(config)# interface GigabitEthernet0/0 R2(config-if)# ip pim sparse-mode ! Configure Auto-RP alternative (R2 = Candidate-RP + Mapping Agent) R2(config)# ip pim send-rp-announce Loopback0 scope 16 R2(config)# ip pim send-rp-discovery Loopback0 scope 16
Verify multicast routing, RP mapping, and PIM neighbors.
R1# show ip pim neighbor R1# show ip pim rp mapping ! Verify RP = 10.2.2.2 for 239.0.0.0/8 R1# show ip mroute ! Multicast routing table: (S,G) and (*,G) entries R1# show ip igmp groups ! IGMP group membership on local segment R1# show ip rpf 10.1.1.10 ! Verify RPF interface for source
Check Your Understanding
Twenty questions on this section. Each answer is explained as you go.
