Section 3.0 — Infrastructure30% of the CCNP ENCOR 350-401 v1.2 exam3.1Layer 2802.1Q trunking · EtherChannel · RSTP / MST + root and BPDU guard3.2Layer 3EIGRP vs OSPF concepts · OSPFv2 / v3 · eBGP · policy-based routing3.3IP ServicesNTP and PTP · NAT / PAT · FHRP · multicast: PIM SM, IGMP, SSM, bidir, MSDPRemoved in v1.2 — no longer examinable✗ Wireless infrastructure: RF, AP modes, antennas, CAPWAP, roaming, segmentation
Section 3.0 mapped to the official CCNP ENCOR 350-401 v1.2 exam topics.

3.1 Layer 2 Infrastructure

Layer 2 forms the switching fabric of every campus network. The ENCOR exam tests your ability to troubleshoot trunking, EtherChannel, and Spanning Tree — three technologies that must work together flawlessly.

VLANs and 802.1Q Trunking

A VLAN (Virtual LAN) segments a physical switch into isolated broadcast domains. 802.1Q trunking carries traffic for multiple VLANs across a single link by inserting a 4-byte tag (TPID 0x8100 + 12-bit VLAN ID) between the source MAC and EtherType fields.

  • Native VLAN: traffic sent untagged on a trunk (default VLAN 1 — change for security)
  • Allowed VLANs: list of VLANs permitted to traverse the trunk
  • DTP (Dynamic Trunking Protocol): Cisco proprietary — auto-negotiates trunk. Disable on edge ports with switchport nonegotiate
  • VTP (VLAN Trunking Protocol): propagates VLAN database. VTP v3 supports extended VLANs (1006–4094) and MST configuration
Exam Tip — Trunk Mismatch
Common trunk failures: native VLAN mismatch (generates CDP warnings), allowed VLAN pruning, DTP mode mismatch (dynamic auto ↔ dynamic auto = access), encapsulation mismatch on older platforms.


802.1Q Tagged Ethernet Frame Dest MAC 6 bytes Src MAC 6 bytes 802.1Q Tag (4 bytes) TPID 0x8100 | PCP | DEI | VLAN ID 2 bytes | 3b | 1b | 12 bits (1–4094) EtherType 2 bytes Payload 46–1500 bytes FCS 4 bytes

EtherChannel (LACP / PAgP / Static)

EtherChannel bundles 2–8 (IOS) or 2–16 (LACP standard) physical links into one logical interface (port-channel). STP sees a single link — no blocking. Load is distributed per-flow using a hashing algorithm (src-dst-IP, src-dst-MAC, etc.).

Protocol Standard Modes Negotiation Key Detail
LACP IEEE 802.3ad active / passive Yes — sends LACP PDUs active+active or active+passive form channel
PAgP Cisco proprietary desirable / auto Yes — sends PAgP PDUs desirable+desirable or desirable+auto
Static (on) on No Both sides must be on; no negotiation — risky
Exam Tip — EtherChannel Prerequisites
All member ports must match: speed, duplex, mode (access/trunk), native VLAN, allowed VLANs, STP settings. A mismatch suspends the port-channel. Use show etherchannel summary — look for (P)=bundled, (I)=standalone, (s)=suspended.

Spanning Tree: RSTP and MST

RSTP (802.1w) — Rapid Spanning Tree Protocol — converges in ~1–2 seconds vs. 30–50 seconds for legacy 802.1D. Cisco implements it as Rapid PVST+ (one RSTP instance per VLAN).

Port Role RSTP State Description
Root Port Forwarding Best path to Root Bridge (one per non-root switch)
Designated Port Forwarding Best port on each segment toward the Root Bridge
Alternate Port Discarding Backup path to Root Bridge (replaces Blocking in 802.1D)
Backup Port Discarding Redundant path on same segment (hub scenario)
Edge Port Forwarding (immediate) PortFast-enabled — never transitions through sync

MST (802.1s) — Multiple Spanning Tree — maps multiple VLANs to a single STP instance (MSTI), reducing CPU/memory vs. Rapid PVST+. Requires all switches in an MST region to share the same: region name, revision number, and VLAN-to-instance mapping.


RSTP Topology — Root Bridge Election SW1 — Root Bridge Priority 4096 | MAC 0000.0000.0001 SW2 Priority 32768 SW3 Priority 32768 RP ↑ RP ↑ Alternate Port (Discarding) DP on SW1 link DP on SW1 link Root Bridge = lowest Bridge ID (priority + MAC). All ports on Root = Designated.

Feature 802.1D (STP) 802.1w (RSTP) 802.1s (MST)
Convergence 30–50 sec 1–2 sec 1–2 sec
Instances 1 (CST) 1 per VLAN (PVST+) 1 per MSTI (user-defined)
Port States 5 (Block/Listen/Learn/Fwd/Disabled) 3 (Discarding/Learning/Forwarding) 3 (same as RSTP)
Topology Change TC notification + 15s delay Immediate flush MACs Immediate flush MACs
CPU Overhead High (per-VLAN) High (per-VLAN) Low (shared instances)

3.2 Layer 3 Routing

Section 3.2 covers EIGRP, OSPF, eBGP, and route redistribution. These are the backbone of enterprise IP routing. The exam tests conceptual comparison, configuration, and troubleshooting across all four areas.

EIGRP (Enhanced Interior Gateway Routing Protocol)

EIGRP is Cisco’s advanced distance-vector protocol using the DUAL (Diffusing Update Algorithm). It sends partial, bounded updates only when topology changes occur — far more efficient than RIP’s periodic full-table updates.

Parameter EIGRP Value Notes
Protocol IP Protocol 88 Multicast 224.0.0.10
AD 90 (internal) / 170 (external) Redistributed routes = 170
Metric Composite: BW + Delay (+ Load, Reliability optional) K1=1,K3=1 by default; K2,K4,K5=0
Hello/Hold 5s/15s (LAN) · 60s/180s (WAN) Must match to form adjacency
Load Balancing Equal AND unequal path variance command for unequal
Successor Best path to destination Installed in routing table
Feasible Successor Backup path meeting FC FC: neighbor RD < local FD
Exam Tip — DUAL States
If no Feasible Successor exists, EIGRP goes Active — sends QUERY messages to neighbors. If all replies received → Passive (converged). Stuck-in-Active (SIA) after 3 min = neighbor relationship reset. Use show ip eigrp topology to see Successor/FS and FD/AD values.

OSPF Multi-Area

OSPF is a link-state IGP using the Dijkstra SPF algorithm. All areas must connect to Area 0 (backbone). Inter-area routing flows through ABRs (Area Border Routers).


OSPF Multi-Area Design Area 1 (Regular) R1 (Internal) R2 (Internal) Area 0 (Backbone) ABR-L Area 0+1 ABR-R Area 0+2 Area 2 (Stub) R3 (Internal) R4 (Internal) LSA Type 3 LSA Type 3 LSA Type 1+2 All LSA Types Type 1+2+3 only

LSA Type Name Generated By Scope
Type 1 Router LSA Every router Within area
Type 2 Network LSA DR on broadcast segment Within area
Type 3 Summary LSA ABR Inter-area
Type 4 ASBR Summary ABR Inter-area (points to ASBR)
Type 5 External LSA ASBR Entire OSPF domain
Type 7 NSSA External ASBR in NSSA Within NSSA, converted to Type 5 at ABR
Area Type Blocks Config Command
Regular Nothing (default)
Stub Type 4, 5 (external LSAs) area X stub
Totally Stub Type 3, 4, 5 area X stub no-summary
NSSA Type 5; allows Type 7 area X nssa
Totally NSSA Type 3, 4, 5; allows Type 7 area X nssa no-summary
Exam Tip — OSPF DR/BDR Election
On multi-access segments (Ethernet), OSPF elects a DR and BDR to reduce LSA flooding. DR uses 224.0.0.6; all routers use 224.0.0.5. Election: highest interface priority (default 1), then highest Router-ID. Priority 0 = ineligible. Election is non-preemptive — clear process with clear ip ospf process to force re-election.

eBGP (External BGP)

BGP is the internet’s routing protocol — a path-vector EGP that routes between Autonomous Systems (AS). In enterprises, eBGP peers with ISPs or connects SD-WAN underlay paths. Unlike IGPs, BGP doesn’t auto-discover neighbors; peers must be explicitly configured.

Attribute Type Description Scope
Weight Cisco local Highest preferred for outbound (local router only) Router-local
Local Preference Well-known discretionary Highest preferred for outbound (within AS) iBGP
AS-Path Well-known mandatory Shortest preferred; loop prevention eBGP
MED Optional non-transitive Lowest preferred for inbound (hint to neighbor AS) eBGP
Origin Well-known mandatory i < e < ? (IGP < EGP < incomplete) All
Next-Hop Well-known mandatory eBGP: set to self. iBGP: not changed by default All

BGP Best-Path Selection Order (mnemonic: “We Love Oranges AS Oranges Mean Pure Refreshment”): Weight → Local Pref → Locally originated → AS-Path (shortest) → Origin → MED → eBGP over iBGP → IGP metric to Next-Hop → Router-ID

Exam Tip — eBGP TTL
eBGP sets IP TTL=1 by default — peers must be directly connected. Use neighbor X.X.X.X ebgp-multihop <ttl> for non-directly-connected peers (loopback-based peering). iBGP uses TTL=255.

Route Redistribution

Redistribution injects routes from one routing domain into another. Common scenarios: OSPF ↔ EIGRP at domain boundaries, static/connected → BGP, or legacy RIP → OSPF.

  • Seed metric: When redistributing into EIGRP, must set metric (BW, delay, reliability, load, MTU) or use default-metric
  • Metric-type: OSPF external routes are E2 (fixed metric) by default; E1 adds the internal OSPF cost
  • Redistribution loops: In two-way redistribution (both directions), routes can loop back. Use route-maps with tags to filter already-redistributed routes
  • Administrative Distance: If same prefix learned via two protocols, lower AD wins. Use distance command or route-maps to control preference
Protocol AD (Internal) AD (External) Notes
Connected 0 Always preferred
Static 1 Next best after connected
EIGRP 90 170 External = redistributed
OSPF 110 110 E1/E2 both AD 110
BGP (eBGP) 20 iBGP = 200
RIP 120 Rarely used in enterprise

3.3 IP Services

NTP (Network Time Protocol)

NTP synchronizes clocks across devices using a hierarchical stratum model. Accurate time is critical for log correlation, certificate validity, and SNMP timestamps.

Stratum Description Example
0 Reference clock (atomic, GPS) GPS receiver, cesium clock
1 Directly connected to stratum 0 NTP primary servers (time.nist.gov)
2 Synced from stratum 1 Enterprise NTP server
3–15 Downstream clients/servers Routers, switches, firewalls
16 Unsynchronized Device not yet synced or NTP disabled
  • NTP authentication: MD5-based; configure matching key on server and client
  • NTP master: Makes the router act as an authoritative source (even without upstream sync) — use with caution
  • Verify with: show ntp status, show ntp associations

NAT / PAT

NAT (Network Address Translation) translates private RFC 1918 addresses to public IPs. Essential for IPv4 address conservation and ISP connectivity.

NAT Type Description Use Case
Static NAT One-to-one: fixed private ↔ public mapping Servers (web, mail) needing consistent public IP
Dynamic NAT Many-to-many: pool of public IPs, first-come-first-served Outbound internet with IP pool
PAT (NAT Overload) Many-to-one: all private hosts share one public IP via port numbers Home/branch internet (most common)
Policy NAT NAT applied only when route-map conditions match Multi-ISP, VPN exclusion


PAT (NAT Overload) — Many-to-One Translation 192.168.1.10:1024 192.168.1.11:1025 192.168.1.12:1026 NAT Router inside: Gi0/0 (192.168.1.1) outside: Gi0/1 (203.0.113.1) Internet 203.0.113.1:2001 203.0.113.1:2002

Exam Tip — NAT Direction Keywords
ip nat inside source translates the source of packets coming FROM inside TO outside. “Inside local” = private IP. “Inside global” = public IP seen on outside. show ip nat translations and show ip nat statistics are key verification commands.

Multicast — IGMP and PIM

Multicast delivers one stream to many receivers efficiently. Hosts use IGMP to join multicast groups; routers use PIM to build delivery trees.

Component Version/Mode Key Behavior
IGMP v1 Legacy Join only — no leave; 3-min timeout
IGMP v2 Common Adds Leave Group message for faster pruning (~3 sec)
IGMP v3 Modern Source-specific joins (SSM) — host specifies source IP
MLD IPv6 equivalent MLDv1≈IGMPv2, MLDv2≈IGMPv3
PIM Dense Mode Push model Flood-and-prune; good for dense receiver populations
PIM Sparse Mode Pull model RP-based; receivers explicitly join; enterprise standard
PIM SSM Source-Specific No RP needed; uses 232.0.0.0/8; requires IGMPv3
BIDIR-PIM Bidirectional Bidirectional tree; many-to-many; no SPT switchover


PIM-SM: Shared Tree (RPT) vs Shortest Path Tree (SPT) RP Source (S) Receiver 1 Receiver 2 Rtr-A Rtr-B — RPT (Shared Tree via RP) — SPT (after switchover, direct S→R) Source registers to RP via unicast RPF Check: multicast packet accepted only if it arrives on the interface used to reach the source/RP

Rendezvous Point (RP) discovery methods:

  • Static RP: ip pim rp-address — simple, no redundancy without Anycast RP
  • Auto-RP: Cisco proprietary — Candidate-RP announces to 224.0.1.39; Mapping Agent listens and floods to 224.0.1.40
  • BSR (Bootstrap Router): RFC standard — Candidate-RPs register with BSR; BSR floods RP-Set to all PIM routers
  • Anycast RP + MSDP: Multiple RPs share same IP address; MSDP synchronizes active sources between them
Exam Tip — RPF Failure
If a multicast packet fails the RPF check, it is dropped — this is the most common multicast troubleshooting issue. Use show ip rpf <source-ip> to verify which interface RPF expects packets from. Asymmetric unicast routing causes RPF failures.

Hands-On Labs

Lab 1 — 802.1Q Trunking and LACP EtherChannel

Configure an 802.1Q trunk between SW1 and SW2 carrying VLANs 10, 20, 30 with native VLAN 99.

SW1(config)# vlan 10
SW1(config-vlan)# name USERS
SW1(config)# vlan 20
SW1(config-vlan)# name VOICE
SW1(config)# vlan 30
SW1(config-vlan)# name MGMT
SW1(config)# vlan 99
SW1(config-vlan)# name NATIVE

SW1(config)# interface GigabitEthernet0/1
SW1(config-if)# switchport mode trunk
SW1(config-if)# switchport trunk encapsulation dot1q
SW1(config-if)# switchport trunk native vlan 99
SW1(config-if)# switchport trunk allowed vlan 10,20,30,99
SW1(config-if)# switchport nonegotiate

Bundle Gi0/2 and Gi0/3 into LACP EtherChannel (port-channel 1) on both switches.

SW1(config)# interface range GigabitEthernet0/2 - 3
SW1(config-if-range)# channel-group 1 mode active    ! LACP active
SW1(config-if-range)# exit
SW1(config)# interface port-channel 1
SW1(config-if)# switchport mode trunk
SW1(config-if)# switchport trunk allowed vlan 10,20,30,99

! SW2 — use passive or active (active+passive also forms channel)
SW2(config)# interface range GigabitEthernet0/2 - 3
SW2(config-if-range)# channel-group 1 mode passive   ! LACP passive

Verify EtherChannel bundle and trunk status.

SW1# show etherchannel summary
! Look for Po1(SU) — S=Layer2, U=in use. Members should show (P)=bundled
SW1# show interfaces trunk
! Verify allowed VLANs and native VLAN on both physical and port-channel interfaces
SW1# show interfaces port-channel 1

Lab 2 — RSTP and MST Configuration

Enable Rapid PVST+ and set SW1 as root bridge for VLANs 10,20 and SW2 as root for VLANs 30,99.

SW1(config)# spanning-tree mode rapid-pvst
SW1(config)# spanning-tree vlan 10,20 priority 4096     ! Root primary
SW1(config)# spanning-tree vlan 30,99 priority 8192     ! Root secondary

SW2(config)# spanning-tree mode rapid-pvst
SW2(config)# spanning-tree vlan 30,99 priority 4096
SW2(config)# spanning-tree vlan 10,20 priority 8192

! Enable PortFast + BPDU Guard on access ports
SW1(config)# interface GigabitEthernet0/10
SW1(config-if)# spanning-tree portfast
SW1(config-if)# spanning-tree bpduguard enable

Configure MST with two instances: MSTI 1 for VLANs 10,20 and MSTI 2 for VLANs 30,99.

SW1(config)# spanning-tree mode mst
SW1(config)# spanning-tree mst configuration
SW1(config-mst)# name CAMPUS
SW1(config-mst)# revision 1
SW1(config-mst)# instance 1 vlan 10,20
SW1(config-mst)# instance 2 vlan 30,99
SW1(config-mst)# exit
SW1(config)# spanning-tree mst 1 priority 4096
SW1(config)# spanning-tree mst 2 priority 8192

SW1# show spanning-tree mst
SW1# show spanning-tree mst 1           ! View MSTI 1 topology

Lab 3 — OSPF Multi-Area with Summarization

Configure a 3-router OSPF topology: R1 in Area 1, R2 as ABR (Area 0+1), R3 in Area 0.

R1(config)# router ospf 1
R1(config-router)# router-id 1.1.1.1
R1(config-router)# network 10.1.1.0 0.0.0.255 area 1
R1(config-router)# network 10.1.2.0 0.0.0.255 area 1
R1(config-router)# passive-interface GigabitEthernet0/1   ! LAN-facing

R2(config)# router ospf 1
R2(config-router)# router-id 2.2.2.2
R2(config-router)# network 10.1.0.0 0.0.255.255 area 1
R2(config-router)# network 10.0.0.0 0.0.0.255 area 0
R2(config-router)# area 1 range 10.1.0.0 255.255.0.0      ! Summarize Area 1 routes

Verify OSPF adjacencies, LSDB, and routing table.

R2# show ip ospf neighbor
R2# show ip ospf database                ! View all LSA types
R2# show ip ospf database summary        ! Type 3 LSAs generated by this ABR
R3# show ip route ospf
! R3 should see 10.1.0.0/16 summary (not individual /24s) — summarization working

Lab 4 — eBGP Peering and Verification

Configure eBGP between R1 (AS 65001) and R2 (AS 65002) on directly connected interfaces.

R1(config)# router bgp 65001
R1(config-router)# bgp router-id 1.1.1.1
R1(config-router)# neighbor 10.0.0.2 remote-as 65002
R1(config-router)# network 192.168.1.0 mask 255.255.255.0  ! Advertise prefix

R2(config)# router bgp 65002
R2(config-router)# bgp router-id 2.2.2.2
R2(config-router)# neighbor 10.0.0.1 remote-as 65001
R2(config-router)# network 172.16.0.0 mask 255.255.0.0

Verify BGP peering state and prefixes.

R1# show bgp summary
! State/PfxRcd — should show integer (# of prefixes), not "Active/Idle"
R1# show bgp ipv4 unicast neighbors 10.0.0.2
R1# show bgp ipv4 unicast           ! Full BGP table — > = best path
R1# show ip route bgp              ! BGP routes in RIB (B = BGP, AD 20 for eBGP)

Lab 5 — NAT Overload (PAT) + NTP

Configure PAT so all hosts on 192.168.1.0/24 share a single public IP (203.0.113.1) for internet access.

R1(config)# ip access-list standard NAT_INSIDE
R1(config-std-nacl)# permit 192.168.1.0 0.0.0.255

R1(config)# ip nat inside source list NAT_INSIDE interface GigabitEthernet0/1 overload

R1(config)# interface GigabitEthernet0/0
R1(config-if)# ip nat inside
R1(config)# interface GigabitEthernet0/1
R1(config-if)# ip nat outside

Configure NTP — R1 syncs to upstream server, distributes time to downstream routers.

R1(config)# ntp server 216.239.35.0 prefer         ! Upstream NTP
R1(config)# ntp authenticate
R1(config)# ntp authentication-key 1 md5 Cisco123
R1(config)# ntp trusted-key 1

R2(config)# ntp server 10.0.0.1                    ! Sync from R1
R2(config)# ntp authentication-key 1 md5 Cisco123
R2(config)# ntp trusted-key 1
R2(config)# ntp authenticate

R1# show ntp status
R1# show ntp associations
R1# show ip nat translations
R1# show ip nat statistics

Lab 6 — PIM-SM Multicast Configuration

Enable IP multicast routing and configure PIM Sparse Mode on all routers. Designate R2 as the RP for 239.0.0.0/8.

R1(config)# ip multicast-routing
R1(config)# interface GigabitEthernet0/0
R1(config-if)# ip pim sparse-mode
R1(config)# interface GigabitEthernet0/1
R1(config-if)# ip pim sparse-mode

R2(config)# ip multicast-routing
R2(config)# ip pim rp-address 10.2.2.2            ! R2 is static RP
R2(config)# interface GigabitEthernet0/0
R2(config-if)# ip pim sparse-mode

! Configure Auto-RP alternative (R2 = Candidate-RP + Mapping Agent)
R2(config)# ip pim send-rp-announce Loopback0 scope 16
R2(config)# ip pim send-rp-discovery Loopback0 scope 16

Verify multicast routing, RP mapping, and PIM neighbors.

R1# show ip pim neighbor
R1# show ip pim rp mapping               ! Verify RP = 10.2.2.2 for 239.0.0.0/8
R1# show ip mroute                        ! Multicast routing table: (S,G) and (*,G) entries
R1# show ip igmp groups                   ! IGMP group membership on local segment
R1# show ip rpf 10.1.1.10                ! Verify RPF interface for source

Check Your Understanding

Twenty questions on this section. Each answer is explained as you go.

1. 

VLAN 20 traffic is blocked on a trunk despite being in the allowed-list and not in STP blocking state. What is the most likely cause?

2. 

Which EtherChannel negotiation combination will NOT form a channel?

3. 

Which RSTP port role represents a backup path to the Root Bridge and is in Discarding state?

4. 

Which two MST parameters must match across all switches in the same MST region?

5. 

An EIGRP route loses its Feasible Successor. Into what state does the route enter?

6. 

The EIGRP Feasibility Condition (FC) is met when:

7. 

Which OSPF LSA type is generated by an ASBR and flooded throughout the entire OSPF domain for external routes?

8. 

A router in a Totally Stub area needs to reach an external destination. How does it get there?

9. 

What is the default TTL for eBGP sessions and which command extends it for loopback-based peering?

10. 

What is required when redistributing OSPF into EIGRP?

11. 

What is the minimum SNR threshold recommended for enterprise wireless deployments?

12. 

Which AP mode passively scans for rogue APs and interference without serving clients?

13. 

CAPWAP uses which UDP ports for its control and data channels?

14. 

How does a client retain its IP address when roaming to a different WLC subnet (Layer 3 roaming)?

15. 

In IOS-XE WLC tag architecture, which tag maps an SSID profile to a VLAN QoS and ACL policy?

16. 

Which NTP stratum value indicates a device is unsynchronized?

17. 

A NAT translation shows Inside Local 192.168.1.50:1500 mapped to Inside Global 203.0.113.1:2500. Which NAT type is this?

18. 

Which PIM mode uses an explicit join model and requires a Rendezvous Point (RP)?

19. 

A multicast packet arrives at a router but is dropped despite a correct (S,G) entry in show ip mroute. What is the most likely cause?

20. 

What is the recommended mechanism to prevent routing loops in two-way OSPF-EIGRP redistribution?

1 out of 1