300-410

ENARSI 300-410 Exam Details

Domain Weight Breakdown

Certification Path & Prerequisites

The 300-410 ENARSI is one of the concentration exams for the CCNP Enterprise certification. To earn CCNP Enterprise, candidates must pass the core exam (350-401 ENCOR) plus one concentration exam. ENARSI focuses on advanced routing, VPN services, and infrastructure security at the professional level. It validates the ability to implement and troubleshoot complex enterprise routing solutions including EIGRP, OSPF, BGP, redistribution, VRFs, DMVPN, and security features on Cisco IOS-XE routers.

There is no formal prerequisite, but Cisco recommends 3-5 years of enterprise networking experience. Candidates should be comfortable with IOS-XE CLI, subnetting, and the concepts covered in CCNA and ENCOR before attempting this exam. ENARSI is also one of the qualifying exams for the CCIE Enterprise Infrastructure lab exam.

EIGRP Advanced Concepts

EIGRP Classic Composite Metric

Metric = 256 × [ K1×BW + (K2×BW)/(256-Load) + K3×Delay ] × [ K5/(Reliability+K4) ]

Tip: With defaults (K1=1, K2=0, K3=1, K4=0, K5=0), the metric simplifies to: 256 × (BW + Delay). K-values MUST match between neighbors or the adjacency will not form.

EIGRP Named Mode vs Classic Mode

OSPF Multi-Area Architecture

OSPF LSA Types (Must Know)

Tip: Stub areas block Type 4, 5 LSAs and use a default route. Totally Stubby blocks Type 3, 4, 5 (only default route). NSSA allows external routes via Type 7 but still blocks Type 5 from outside.

OSPF Area Types

BGP Path Selection Order (ENARSI Must Know)

BGP evaluates paths in this order. The first attribute that differs determines the best path:

Tip: Mnemonic "We Love Oranges AS Oranges Mean Pure Refreshment" = Weight, Local Pref, Originated, AS-path, Origin, MED, Paths (eBGP>iBGP), Refreshment (lowest metric). Weight is local only and never advertised to peers.

BGP Communities & Filtering

Route Redistribution

Tip: Redistribution pitfall - routing loops. Always use route tags, route maps, or distribute lists to prevent mutual redistribution feedback loops. Tag routes at redistribution points and filter tagged routes at the other redistribution point.

VRF-Lite & Policy-Based Routing

VRF-Lite: Creates multiple virtual routing tables on a single router without MPLS. Each VRF has its own RIB, interfaces, and routing processes. Used for network segmentation and multi-tenancy in enterprise environments.

PBR (Policy-Based Routing): Overrides the normal routing table decision by matching traffic with a route-map and setting a next-hop, interface, or default next-hop. Applied inbound on an interface.

GRE Tunnels

IPsec Framework

DMVPN (Dynamic Multipoint VPN)

DMVPN combines GRE, IPsec, and NHRP to build scalable VPN topologies. A hub router acts as the NHRP server (NHS), and spoke routers register their NBMA (public) addresses with the hub. Spokes can then dynamically build direct spoke-to-spoke tunnels on demand.

Tip: Phase 3 is the preferred deployment. The hub sends an NHRP Redirect to the initiating spoke, and the receiving spoke installs an NHRP Shortcut route. This allows spoke-to-spoke tunnels even when the hub summarizes routes. Key commands: ip nhrp redirect (hub), ip nhrp shortcut (spokes).

FlexVPN (IKEv2-Based VPN)

FlexVPN is Cisco's IKEv2-based VPN framework that unifies site-to-site, remote access, and hub-and-spoke VPN topologies. It replaces legacy crypto maps and DMVPN with a modular, standards-based approach using IKEv2 profiles, keyring, and FlexVPN smart defaults.

MPLS L3VPN Concepts

Tip: RD makes routes unique; RT controls which VRFs import/export routes. They often look the same (e.g., 65001:100) but serve completely different purposes. You can have the same RT across VRFs to create a full-mesh VPN topology.

Control Plane Policing (CoPP)

CoPP protects the route processor (CPU) from excessive or malicious traffic by applying a QoS policy to the control plane interface. It classifies traffic destined to the router itself (routing protocols, management, etc.) and rate-limits or drops unwanted packets before they consume CPU resources.

Unicast Reverse Path Forwarding (uRPF)

Tip: uRPF prevents IP spoofing. Strict mode is the most secure but breaks with asymmetric routing. If CEF is not enabled, uRPF will not function. Always verify with show ip verify source.

AAA Framework (Authentication, Authorization, Accounting)

IPv6 First-Hop Security

Device Hardening Best Practices

• Disable unused interfaces: shutdown
• Use SSH version 2 only: ip ssh version 2 and transport input ssh
• Set strong enable secret: enable algorithm-type scrypt secret <password>
• Encrypt all passwords: service password-encryption (Type 7, weak) or use Type 8/9 hashes
• Configure login banner: banner motd # Authorized Access Only #
• Limit VTY access with ACL: access-class <ACL> in on line vty
• Set exec timeout: exec-timeout 5 0 (5 minutes idle timeout)
• Disable CDP on external interfaces: no cdp enable
• Enable login delay and block: login block-for 120 attempts 3 within 60
• Configure logging with timestamps: service timestamps log datetime msec
• Disable unnecessary services: no ip http server, no ip finger, no service pad

DHCP Server & Relay

ip helper-address forwards UDP broadcasts as unicast to the specified server. By default it forwards: DHCP (67/68), DNS (53), TFTP (69), NTP (37), NetBIOS (137/138), TACACS (49), and time service (37). Use no ip forward-protocol udp <port> to limit forwarded protocols.

NTP (Network Time Protocol)

Tip: Always configure NTP authentication in production to prevent rogue time sources. Use at least two NTP servers for redundancy.

SNMP (Simple Network Management Protocol)

Syslog & NetFlow

NetFlow / Flexible NetFlow: Monitors IP traffic flows passing through an interface. A flow is defined by 5-tuple (src IP, dst IP, src port, dst port, protocol) plus ingress interface and ToS. NetFlow v9 and IPFIX use templates for flexible field definitions. Configure with: flow record, flow monitor, flow exporter, then apply to interface.

IP SLA (Service Level Agreement)

IP SLA probes generate synthetic traffic to measure network performance metrics like latency, jitter, packet loss, and reachability. Results can trigger actions such as route failover via object tracking.

EEM (Embedded Event Manager)

EEM monitors events on the router and executes actions when conditions are met. Applets use CLI-based event detectors and action handlers. Common event detectors include syslog messages, SNMP OID thresholds, timers, interface counters, and IP SLA state changes.

RESTCONF, NETCONF & YANG

YANG: A data modeling language (RFC 7950) that defines the structure, syntax, and constraints of configuration and operational data. YANG models are used by both NETCONF and RESTCONF to ensure consistent data representation. Models organized as: module → container → list → leaf.

EIGRP vs OSPF vs BGP

OSPF E1 vs E2 & N1 vs N2

Tip: E1 routes are preferred over E2 routes when both exist for the same destination. Within the same type, lowest metric wins. E1 is better when multiple ASBRs exist because it factors in the internal cost to each ASBR.

DMVPN vs FlexVPN

GRE vs IPsec vs GRE over IPsec

Administrative Distance Reference

Tip: Lower AD is preferred. When the same prefix is learned from multiple routing protocols, the one with the lowest AD is installed in the routing table. AD is a Cisco-specific concept (other vendors call it route preference). Key exam values: EIGRP 90 < OSPF 110 < EIGRP external 170 < iBGP 200.

NETCONF vs RESTCONF vs CLI/SNMP