300-420

ENSLD 300-420 Exam Details

Domain Weight Breakdown

Certification Path & Prerequisites

The 300-420 ENSLD is a concentration exam for the CCNP Enterprise certification. To earn CCNP Enterprise, candidates must pass the core exam (350-401 ENCOR) plus one concentration exam. ENSLD focuses on enterprise network design principles, validating the ability to design advanced addressing schemes, routing architectures, campus networks, WAN solutions, and network services. Unlike implementation-focused exams, ENSLD emphasizes design methodology, scalability, high availability, and best practices for building enterprise-grade networks.

Cisco recommends 3-5 years of enterprise network design experience. Candidates should understand routing protocols (OSPF, EIGRP, BGP, IS-IS), switching technologies (VLANs, STP, VxLAN), WAN architectures (MPLS, DMVPN, SD-WAN), and network services (QoS, multicast, security). This exam tests the ability to translate business requirements into technical network designs, making real-world design experience particularly valuable for exam preparation.

Tip: Domains 1 and 2 (Advanced Addressing/Routing and Advanced Campus Networks) together account for 50% of the exam. Focus on hierarchical network design models, OSPF multi-area design, BGP design for enterprise WAN, and campus fabric (SD-Access) architecture. This is a design exam - questions focus on choosing the right solution for given requirements rather than specific CLI commands.

IP Addressing Design Principles

Effective IP addressing design is foundational to scalable enterprise networks. A well-designed addressing scheme supports route summarization, simplifies access control lists, and enables efficient routing. The design process should consider current requirements, future growth projections, and alignment with the physical and logical network hierarchy to minimize routing table sizes and administrative overhead.

OSPF Design Considerations

OSPF multi-area design is essential for large enterprise networks. Proper area design reduces LSA flooding, limits SPF calculations to within the area, and enables route summarization at Area Border Routers (ABRs). The backbone area (Area 0) must be contiguous and connects all other areas.

• Scalability Guideline: Maximum 50-100 routers per area, depends on hardware and link stability
• Summarization: Configure at ABRs (area range) and ASBRs (summary-address) to reduce routing table
• Virtual Links: Use to connect disconnected areas to Area 0 (temporary fix, not best practice)

BGP Enterprise Design

BGP is used in enterprise networks for internet edge connectivity, WAN routing between sites (especially with MPLS VPN), and inter-AS communication. Enterprise BGP design focuses on scalability using route reflectors, community-based policy, and prefix filtering for security.

Route Redistribution Design

Tip: OSPF area design is a high-priority exam topic. Know all area types and which LSA types each permits. Totally stubby areas provide maximum LSDB reduction (only Type 1 and 2 LSAs, plus a default route). For BGP, understand when to use route reflectors vs confederations - route reflectors are preferred for enterprise (simpler), while confederations are used by service providers. Always design addressing to support summarization at area and regional boundaries.

Hierarchical Network Design Model

The three-tier hierarchical model (Access, Distribution, Core) is the foundation of enterprise campus network design. This model provides modularity, scalability, fault isolation, and simplified management. In smaller deployments, the distribution and core layers may be collapsed into a single layer (collapsed core design). Understanding when to use each tier and the design principles for each layer is fundamental to the ENSLD exam.

Layer 2 vs Layer 3 Access Design

Cisco SD-Access (Campus Fabric)

Cisco SD-Access is a software-defined campus solution built on Cisco DNA Center that provides automated network segmentation, policy-based access control, and fabric-based forwarding using VXLAN and LISP. SD-Access transforms the traditional campus into an identity-based, intent-driven network where policies follow users regardless of their physical location.

High Availability Design

Tip: The exam heavily tests campus design choices. Know when to recommend Layer 2 vs Layer 3 access - Layer 3 routed access is the modern best practice as it eliminates STP, enables ECMP, and provides faster convergence. For SD-Access, understand the three fabric node roles (Edge, Border, Control Plane) and their corresponding protocols (LISP for control plane, VXLAN for data plane). Cisco DNA Center is the management and automation platform, while ISE provides identity services and SGT assignment for micro-segmentation.

WAN Architecture Options

Enterprise WAN design must balance performance, cost, reliability, and security across multiple transport options. Modern WAN architectures increasingly leverage hybrid approaches combining traditional MPLS with Internet-based VPN technologies and SD-WAN overlay solutions. The choice of WAN architecture depends on application requirements, budget constraints, site locations, and the organization's operational capabilities.

DMVPN Design

Dynamic Multipoint VPN (DMVPN) provides a scalable VPN overlay using mGRE, NHRP, and IPsec. DMVPN enables dynamic spoke-to-spoke tunnels without requiring static configuration at the hub for each spoke, making it ideal for large enterprise WAN deployments with many branch sites.

• mGRE: Multipoint GRE tunnel interface on hub, point-to-point on spokes (Phase 1) or mGRE on all (Phase 2/3)
• NHRP: Next Hop Resolution Protocol maps tunnel IP to NBMA (physical) IP, spokes register with hub as NHS
• IPsec Profile: Applied to tunnel interface for encryption, uses tunnel protection mode
• Best Practice: Phase 3 with EIGRP or BGP, allows summarization while enabling direct spoke-to-spoke

WAN Redundancy Design Patterns

SD-WAN vs Traditional WAN Design Decision

Tip: Know DMVPN phases thoroughly - Phase 3 is the recommended design because it supports summarization at the hub while still allowing direct spoke-to-spoke tunnels via NHRP redirect/shortcut. The exam often presents scenarios where you must choose between MPLS, DMVPN, and SD-WAN based on business requirements. SD-WAN is the preferred answer when multi-transport, centralized management, and application-aware routing are requirements. Remember that DMVPN Phase 2 cannot summarize routes at the hub because spokes need specific routes for NHRP resolution.

QoS Design Methodology

Quality of Service design ensures that critical applications receive predictable network performance. The QoS design process involves classifying traffic, defining per-hop behaviors, and implementing marking, queuing, and policing mechanisms. A well-designed QoS policy is essential for convergence networks carrying voice, video, and data traffic over shared infrastructure.

Multicast Design

IP multicast enables efficient one-to-many and many-to-many communication, reducing bandwidth consumption by sending a single stream to multiple receivers simultaneously. Multicast design involves selecting the appropriate PIM mode, designing the RP infrastructure, and configuring multicast routing across the enterprise network.

• Auto-RP: Cisco proprietary, uses 224.0.1.39 (announce) and 224.0.1.40 (discovery)
• BSR (Bootstrap Router): Standards-based, uses PIM messages for RP distribution
• Anycast RP with MSDP: Multiple RPs share same IP, MSDP synchronizes source registrations for redundancy

Network Security Design

Tip: QoS design questions focus on the DiffServ model - know the recommended DSCP markings and bandwidth allocations for each traffic class. Voice (EF) must always be in a strict priority queue (LLQ) and should not exceed 33% of link bandwidth to prevent queue starvation. For multicast, PIM Sparse Mode is the enterprise standard - always choose it unless the scenario specifically describes SSM (known sources) or BiDir (many-to-many). The trust boundary should be at the access layer switch port, not at the endpoint.

Cisco DNA Center

Cisco DNA Center (now Cisco Catalyst Center) is the centralized management and automation platform for Cisco enterprise networks. It provides intent-based networking capabilities including automated provisioning, policy management, network assurance, and analytics. DNA Center serves as the controller for SD-Access fabric and provides a programmable API-driven interface for network automation workflows.

Network Programmability Protocols

Model-Driven Telemetry

Model-driven telemetry replaces traditional SNMP polling with a push-based model where network devices stream operational data to collectors in real-time. This approach provides near-real-time visibility, reduces device CPU overhead (no polling), and enables proactive monitoring and automation workflows.

• Dial-In: Collector initiates subscription (gNMI Subscribe RPC), device streams data
• Dial-Out: Device is pre-configured to push to specific collector (configured subscription)
• Transport: gRPC (preferred), TCP, UDP (for high-volume, loss-tolerant telemetry)
• Encoding: GPB (compact binary), GPB-KV (key-value), JSON (human-readable)

Infrastructure as Code (IaC) Tools

Network Assurance Design

Tip: Although Automation is only 10% of the exam, it covers critical modern concepts. Know the difference between NETCONF (SSH-based, XML, port 830, full CRUD + commit/rollback) and RESTCONF (HTTPS-based, JSON/XML, RESTful interface to YANG models). Model-driven telemetry replaces SNMP polling with push-based streaming - understand the dial-in vs dial-out subscription models. For DNA Center, know the four workflow areas: Design, Policy, Provision, and Assurance, and how SD-Access fabric relies on DNA Center for orchestration.