300-420 ENSLD: Designing Cisco Enterprise NetworksDemo

A full Internet routing table combined with an inbound prefix list lets the enterprise locally permit the default route and only the required prefixes, while implicitly denying all other received routes. The prefix list can be updated by the enterprise without waiting for the ISP’s change process. Cisco documents that prefix lists can be applied to inbound BGP updates and that unmatched prefixes are implicitly denied.

To make OSPF routers prefer R2 when reaching EIGRP destinations, redistribute EIGRP routes into OSPF as Type 1 external routes at R2 and as Type 2 external routes at R3. OSPF gives Type 1 external paths preference over Type 2 external paths; E1 also accounts for the internal OSPF cost to the advertising ASBR.

IS-IS Nonstop Routing (NSR) synchronizes IS-IS state from the active supervisor to the standby supervisor. This preserves the routing state across a stateful switchover and avoids route recomputation without requiring the upstream neighbor to understand graceful-restart messaging. Cisco documents NSR as the IS-IS mechanism used to synchronize state between active and standby route processors when neighbors are not NSF-aware.

An out-of-band management network should enforce access control so only authorized administrators can manage infrastructure, and it should be isolated from the production/data network to reduce exposure and preserve an independent management path. NIST guidance supports using separate secured management networks and segregating management traffic from other network traffic.

Scalable groups provide SD-Access microsegmentation within a virtual network. Group-based policies associated with scalable group tags control which traffic is permitted or denied between user or device groups inside that VN.

A brownfield SD-Access deployment uses the existing, fully routed underlay, which is configured manually. Cisco LAN Automation is intended to automate underlay connectivity for greenfield deployments; Cisco DNA Center is then used to provision the SD-Access fabric over the existing underlay.

The L2VPN EVPN address family provides the BGP EVPN control plane for VXLAN. It distributes Layer 2 MAC and Layer 3 IP reachability information and supports endpoint mobility, enabling Layer 2 extension and VM migration over a Layer 3 IP underlay. OSPF supplies underlay reachability independently of the EVPN overlay control plane.

An MPLS Layer 3 VPN keeps customer routing domains separate by carrying VPN-IPv4 routes across the provider core, while ordinary IPv4 unicast is used for customer-edge to provider-edge route exchange in the appropriate VRF and for core IP reachability. VPNv4 adds a route distinguisher to make customer routes unique and supports segregating each company’s prefixes, so neither company receives the other’s routing information.

PortFast is used on access ports connected to individual end stations. It moves the interface directly to the STP forwarding state, bypassing the listening and learning states so attached devices can communicate without waiting for normal STP convergence.

Out-of-band management uses a dedicated management interface and a network independent of the production data network. This provides stronger control over access to management interfaces and allows management-plane traffic and access privileges to be restricted to the required protocols and authorized users.

A /120 IPv6 subnet provides 256 addresses, which meets a 200-host capacity requirement; a /121 provides only 128 addresses. Both 2a01:0c30:0016:7009::3a00/120 and 2a01:0c30:0016:7009::3b00/120 are correctly aligned /120 subnets contained within 2a01:c30:16:7009::3800/118, whose address range ends at ::3bff.

SaaS places operation and management of the application and underlying infrastructure with the service provider, limiting the customer’s direct control over both.

An MSDP Anycast RP deployment assigns the same /32 IP address to the loopback interfaces of multiple RPs. Unicast routing directs each source and receiver to the topologically closest RP, while MSDP synchronizes Source-Active information between the RPs for resilience. Cisco IP Multicast Technology Overview

Cisco StackWise connects compatible physical switches so that they operate as one logical switch. Adding a stack member increases the available access-port density through dedicated stack connections, without requiring another distribution-switch port for an uplink.

IS-IS Level 1 routing is confined to its own area, so configuring internal campus routers as Level 1 and assigning each campus a distinct NET area address creates separate campus areas without automatically distributing their detailed Level 1 routes to other campuses. Level 1/Level 2 routers at each campus edge act as area-border routers, connecting the campus Level 1 area to the Level 2 backbone for inter-area reachability.

IaaS offers elastic, on-demand compute infrastructure, allowing capacity to scale quickly when demand suddenly increases.

An out-of-band management network is separate from the production network, allowing administrators to continue accessing and managing network devices during a production-network outage.

BFD detects forwarding-path failures quickly and notifies BGP to tear down the affected peer session, reducing convergence time without requiring aggressive BGP keepalive and hold timers. BFD can distribute portions of failure detection to the data plane, making it less CPU-intensive than reducing protocol timers; retaining the default BGP timers avoids increased control-plane timer processing.

OMP service routes advertise the network services available at a site and associate OMP reachability with those services. This enables traffic to be directed through services such as firewalls or intrusion-detection systems for service insertion.

An OSPF NSSA does not accept Type 5 external LSAs from other areas, preventing redistributed RIP routes from entering Area 1. It permits redistribution within the NSSA using Type 7 LSAs, allowing the EIGRP routes connected to Area 1 to be advertised there. A Cisco NSSA documentation example specifically describes allowing EIGRP routes in Area 1 while excluding redistributed RIP routes.

On a DMVPN hub, EIGRP split horizon must be disabled on the mGRE tunnel interface so that routes learned from one spoke can be advertised out that same interface to the other spokes. Without this change, the branch routes cannot be propagated through the hub; route summarization is not an allowed alternative.

The aggregation layer is the appropriate route-summarization boundary. Advertising the VLAN space as the single 10.0.0.0/16 summary toward the core limits propagation of access-layer topology changes and reduces routing-table and control-plane overhead. A default route advertised from the core toward the aggregation layer provides reachability beyond the aggregation block without distributing detailed core routing information. Cisco identifies the distribution/aggregation layer as the logical point for IP route summarization and documents summary advertisements upstream toward the core.

The vSmart controller is the centralized control-plane component of Cisco SD-WAN. It exchanges and distributes overlay routing and policy information, implements centralized control policies, and supports network-wide routing decisions. Cisco Catalyst SD-WAN Solution overview

An SD-Access underlay is a Layer 3 routed foundation, so all underlay network devices must establish IP connectivity using a routing protocol. End-user endpoints and their subnets are part of the overlay rather than the underlay.