The CCNP ENARSI syllabus focuses on implementing and troubleshooting advanced enterprise routing, VPNs, infrastructure security and network services. It is tested through the Cisco 300-410 ENARSI exam, which can be used as the concentration exam for the CCNP Enterprise certification.
ENARSI is troubleshooting-heavy. Reading protocol theory is not enough; you must be able to interpret routing tables, neighbour states, packet paths, logs and Cisco IOS configuration under time pressure. Cisco can update exam blueprints, so compare your study plan with the current official blueprint before booking the exam.
What does the CCNP ENARSI syllabus cover?
The syllabus is organised into four broad domains: Layer 3 technologies, VPN technologies, infrastructure security and infrastructure services. Layer 3 routing has the largest emphasis, but the other domains can determine whether you can diagnose an end-to-end enterprise problem.
| Domain | Typical weighting | Main topics to practise |
|---|---|---|
| Layer 3 Technologies | 35% | Administrative distance, route filtering, redistribution, summarisation, PBR, VRF-Lite, EIGRP, OSPF and BGP |
| VPN Technologies | 20% | MPLS Layer 3 VPN concepts, GRE, NHRP, DMVPN and IPsec-related operation |
| Infrastructure Security | 20% | AAA, IPv4 and IPv6 filtering, uRPF, Control Plane Policing and IPv6 First Hop Security |
| Infrastructure Services | 25% | Device management, SNMP, syslog, DHCP, IP SLA, object tracking, NetFlow and diagnostic tools |
The percentages above reflect the commonly published 300-410 domain structure, but candidates should verify Cisco's current exam topics because individual objectives may change.
If you need guided routing and troubleshooting labs, the CCNP Enterprise course covers both core enterprise knowledge and concentration-level practice.
Which Layer 3 technologies should you learn first?
Start with route selection and routing-table interpretation before configuring individual protocols. Once you understand how prefix length, administrative distance and protocol metrics interact, EIGRP, OSPF, BGP, redistribution and policy routing become easier to troubleshoot.
Route selection and administrative distance
A router first selects the longest matching prefix for the destination. Administrative distance is used when different routing sources offer the same prefix, while a protocol metric compares routes learned by that same protocol.
Diagram in words: Host A sends traffic to R1. R1 has 10.20.0.0/16 through OSPF and 10.20.10.0/24 through EIGRP. Traffic for 10.20.10.50 follows the /24 route because it is the longer match; the lower OSPF administrative distance does not override that decision.
Use these commands to identify the selected route and its source:
show ip route 10.20.10.50
show ip route ospf
show ip route eigrp
show ip protocols
show ip cef 10.20.10.50 detailshow ip route explains the control-plane choice. show ip cef shows the forwarding entry that Cisco Express Forwarding will use.
EIGRP troubleshooting
Study neighbour formation, autonomous system mismatches, K-values, passive interfaces, feasible successors, summarisation, stub routing and named versus classic configuration. Always separate a neighbour problem from a route-advertisement problem.
router eigrp 100
network 10.0.0.0 0.0.0.255
passive-interface default
no passive-interface GigabitEthernet0/0
show ip eigrp neighbors
show ip eigrp topology
show ip eigrp interfaces detail
show ip protocolsIf a neighbour is missing, check Layer 3 reachability, interface status, autonomous system numbers, authentication, K-values and whether the interface is passive. If the neighbour is present but a route is absent, inspect the topology table, filtering, summarisation and stub settings.
OSPF and OSPFv3 troubleshooting
Practise neighbour states, router IDs, area mismatches, timers, authentication, MTU problems, network types, designated router elections, LSA behaviour, area types, summarisation and route filtering. Do not treat every state below FULL as a fault: on a broadcast network, two DROTHER routers can remain in the 2-WAY state.
router ospf 10
router-id 1.1.1.1
network 10.0.12.0 0.0.0.255 area 0
show ip ospf neighbor
show ip ospf interface GigabitEthernet0/0
show ip ospf database
show ip route ospfA neighbour stuck in EXSTART or EXCHANGE often indicates an MTU or database-exchange issue. INIT commonly means the local router receives hellos but does not see its own router ID in the neighbour's hello packets.
BGP operation and policy
Learn eBGP and iBGP neighbour formation, next-hop processing, path attributes, best-path selection, route maps, prefix lists and inbound versus outbound policy. Build a small multi-AS lab rather than memorising attributes in isolation.
router bgp 65001
neighbor 192.0.2.2 remote-as 65002
network 10.10.10.0 mask 255.255.255.0
show ip bgp summary
show ip bgp
show ip bgp 10.10.10.0/24
show ip route bgpThe network command does not create a route. An exact matching route must already exist in the routing table. For a focused explanation, review BGP eBGP, iBGP and path selection.
Redistribution, filtering and policy routing
Redistribution is a frequent source of loops, suboptimal paths and missing routes. Practise seed metrics, route tagging, prefix filtering and route maps in both directions.
ip prefix-list BRANCHES permit 10.20.0.0/16 le 24
route-map OSPF-TO-EIGRP permit 10
match ip address prefix-list BRANCHES
set tag 110
router eigrp 100
redistribute ospf 10 metric 100000 100 255 1 1500 route-map OSPF-TO-EIGRPPolicy-Based Routing, or PBR, changes forwarding based on policy rather than only the destination routing table:
access-list 101 permit ip 10.10.10.0 0.0.0.255 any
route-map BRANCH-PBR permit 10
match ip address 101
set ip next-hop 192.0.2.2
interface GigabitEthernet0/1
ip policy route-map BRANCH-PBR
show route-map
show ip policyVerify that the access list matches the intended source traffic and that the next hop is reachable. Remember that interface PBR is applied to packets entering that interface.
VRF-Lite
VRF-Lite creates separate routing tables on one router without requiring MPLS. It is useful for tenant, department or security-zone separation.
vrf definition CUSTOMER-A
address-family ipv4
exit-address-family
interface GigabitEthernet0/2
vrf forwarding CUSTOMER-A
ip address 10.50.0.1 255.255.255.0
show vrf
show ip route vrf CUSTOMER-A
ping vrf CUSTOMER-A 10.50.0.10Applying vrf forwarding removes the existing IP address from an interface, so configure the VRF before assigning the address.
How should you study ENARSI VPN technologies?
Learn the packet path first, followed by GRE and NHRP, DMVPN behaviour, IPsec protection and MPLS Layer 3 VPN concepts. VPN troubleshooting becomes easier when you can identify the underlay, tunnel and overlay routes separately.
Diagram in words: a spoke LAN packet enters the spoke router, matches a route through Tunnel0, receives a GRE header, is optionally encrypted by IPsec, and then crosses the provider underlay to the hub or another spoke.
A basic DMVPN hub includes a multipoint GRE tunnel and dynamic NHRP mapping:
interface Tunnel0
ip address 172.16.0.1 255.255.255.0
tunnel source GigabitEthernet0/0
tunnel mode gre multipoint
ip nhrp network-id 100
ip nhrp map multicast dynamic
show dmvpn
show ip nhrp
show interface Tunnel0
show crypto sessionTroubleshoot from the bottom upward:
- Confirm that the physical underlay addresses can reach each other.
- Check tunnel source and destination-related configuration.
- Verify NHRP registration and mappings.
- Confirm the overlay routing protocol has formed neighbours.
- If IPsec is used, inspect IKE and IPsec security associations.
- Test spoke-to-spoke traffic and observe whether the expected dynamic tunnel forms.
For the service-provider side of the syllabus, study provider edge and customer edge roles, route distinguishers, route targets, MP-BGP VPN routes and label forwarding. The article on MPLS labels, LSPs and provider networks provides additional background.
What infrastructure security topics appear in ENARSI?
ENARSI security topics focus on operating and troubleshooting router-based controls rather than designing an entire security programme. You should be able to diagnose AAA failures, incorrect traffic filters, uRPF drops, control-plane policy problems and IPv6 first-hop threats.
AAA and management access
A safe AAA configuration normally includes a local fallback account so that an unavailable external server does not cause a complete administrative lockout.
username netadmin privilege 15 secret StrongLocalSecret
aaa new-model
aaa authentication login VTY group tacacs+ local
aaa authorization exec VTY group tacacs+ local if-authenticated
line vty 0 4
login authentication VTY
transport input ssh
show aaa servers
show users
test aaa group tacacs+ labuser LabPassword legacyTACACS+ commonly separates authentication, authorisation and accounting and encrypts the packet body. RADIUS combines some AAA functions and encrypts the password rather than the complete packet body.
ACLs, uRPF and CoPP
Verify ACL direction, address logic and counters before changing a rule:
show access-lists
show ip interface GigabitEthernet0/0
show ipv6 interface GigabitEthernet0/0Unicast Reverse Path Forwarding checks whether a valid return path exists for a packet's source. Strict mode can reject legitimate traffic in an asymmetrically routed network, so topology matters when diagnosing uRPF drops.
Control Plane Policing protects traffic sent to the router's CPU. A policy that is too restrictive can disrupt routing protocols or management traffic.
show policy-map control-plane
show control-planeAlso understand IPv6 RA Guard, DHCPv6 Guard, neighbour discovery inspection and source guard. These features reduce the risk from unauthorised or spoofed first-hop messages on access networks.
Which infrastructure services require hands-on practice?
Practise services that help routers deliver addresses, monitor reachability, export telemetry and generate diagnostic evidence. ENARSI questions often combine a service failure with an underlying routing or filtering problem.
| Service | What to verify | Useful commands |
|---|---|---|
| DHCP | Pool, exclusions, relay address and UDP reachability | show ip dhcp binding, show ip dhcp pool |
| IP SLA | Operation state, frequency and target reachability | show ip sla statistics, show ip sla configuration |
| Object tracking | Tracked state and dependent static route | show track, show ip route |
| SNMP | Version, community or user, ACL and destination | show snmp, show snmp user |
| Syslog | Severity, timestamps and server reachability | show logging |
| NetFlow | Monitor, exporter, interface direction and cache | show flow monitor, show flow exporter |
A tracked default route is a useful integrated lab:
ip sla 10
icmp-echo 203.0.113.1 source-interface GigabitEthernet0/0
frequency 5
ip sla schedule 10 life forever start-time now
track 10 ip sla 10 reachability
ip route 0.0.0.0 0.0.0.0 192.0.2.1 track 10
ip route 0.0.0.0 0.0.0.0 198.51.100.1 200
show ip sla statistics 10
show track 10
show ip route 0.0.0.0The first default route remains installed while the tracked operation succeeds. If tracking fails, the router removes it and can use the floating static route with administrative distance 200.
What is the most practical ENARSI study order?
Build skills in dependency order rather than following the blueprint line by line. Begin with routing-table logic, progress through individual protocols, and leave mixed troubleshooting labs until the supporting technologies are familiar.
| Stage | Study focus | Practical outcome |
|---|---|---|
| 1 | Prefix matching, administrative distance, metrics and CEF | Explain the chosen forwarding path |
| 2 | EIGRP and OSPF/OSPFv3 | Form neighbours and diagnose missing routes |
| 3 | BGP | Troubleshoot sessions, advertisements and path policy |
| 4 | Filtering, summarisation, redistribution, PBR and VRF-Lite | Control routes without creating loops |
| 5 | GRE, NHRP, DMVPN, IPsec and MPLS VPN concepts | Separate underlay, tunnel and overlay faults |
| 6 | AAA, ACLs, uRPF, CoPP and IPv6 security | Protect access and the control plane |
| 7 | DHCP, IP SLA, tracking, SNMP, syslog and NetFlow | Operate and monitor network services |
| 8 | Multi-fault timed labs | Diagnose incidents without relying on hints |
For every lab, record the baseline output before introducing a fault. Then change one item, predict the symptom, run verification commands and document the root cause. Useful faults include an OSPF area mismatch, incorrect EIGRP AS number, missing BGP route, blocked TCP port 179, wrong NHRP mapping, reversed ACL direction and failed IP SLA target.
How should you approach an ENARSI troubleshooting lab?
Start by defining the expected packet path and identifying where the observed state first differs from the baseline. Avoid making configuration changes until show commands provide evidence of the failing layer or protocol.
Use this repeatable workflow:
- Read the requirement and identify the source, destination and expected protocol.
- Check interface status, addressing and direct reachability.
- Inspect neighbour or peer state.
- Confirm that the route exists in the protocol database.
- Confirm that it was installed in the routing table and CEF table.
- Check filtering, policy, security and service dependencies.
- Apply the smallest correction and verify end-to-end traffic.
- Save the configuration only after confirming that the fix has no unwanted effect.
Use debug selectively. Broad debugging on a busy router can consume CPU and produce excessive output; prefer targeted show commands, conditional debugging and terminal monitoring in a controlled lab.
Summary
The CCNP ENARSI syllabus combines advanced routing with VPNs, router security and infrastructure services. The most effective study sequence is route selection, EIGRP and OSPF, BGP, routing policy, VPNs, security, services and finally mixed troubleshooting.
Build small labs first, verify them in a healthy state and then introduce controlled faults. To enquire about practical labs and upcoming batches, visit the CCNP Enterprise course.
Reviewed by Network Rhinos networking trainers.