CCNP-level topics
Topics beyond the CCNA blueprint — deeper routing, advanced security, modern automation. Not full CCNP curriculum coverage. The topics that pair naturally with CCNA learning and round out a working network engineer's toolkit.
Free: CCNP Interview Bank — 40 Questions Routing · security · automation · design · troubleshooting — with talking points Open →Network Fundamentals
Deeper protocol behavior.
Network Access
Advanced Layer-2.
SPAN, RSPAN & ERSPAN — Port Mirroring
How to copy traffic from one switch port to another for analysis. Covers local SPAN, RSPAN across switches via VLAN, ERSPAN over GRE for remote sites, and when each one is the right call.
VXLAN Basics — VNI, VTEP, and Why Modern DCs Use It
The Layer-2-over-Layer-3 overlay every modern data center runs. VXLAN encapsulation, VNI, VTEP roles, unicast vs multicast flood-and-learn vs BGP EVPN — the CCNP ENCOR essentials.
Cisco StackWise Virtual (SVL) — Two Chassis as One Logical Switch
How StackWise Virtual makes a pair of Catalyst 9500/9600 chassis behave as a single logical switch. SVL links, DAD (dual-active detection), and why SVL replaced legacy VSS.
IP Connectivity
Advanced routing — BGP, multi-area OSPF, EIGRP, IPv6.
GRE Tunnels
How to make two distant routers feel directly connected by wrapping IP inside IP. Covers tunnel interface config, MTU caveats, why GRE itself isn't encrypted, and the standard 'GRE over IPsec' combination.
EIGRP
Cisco's hybrid routing protocol — distance-vector smarts with link-state speed. Covers the DUAL algorithm, successor vs feasible successor, the metric formula, and why EIGRP recovers from failures in milliseconds.
OSPF Multi-Area
Why a single OSPF area stops working past ~50 routers, and how multi-area design fixes it. Covers ABRs, ASBRs, area 0 backbone rules, LSA types, and the area design decisions that scale OSPF to thousands of routers.
IPv6 Routing — Static & OSPFv3
How routing works in an IPv6-only or dual-stack network. Covers IPv6 static routes, OSPFv3 (OSPF for IPv6), default routes, and the differences from IPv4 routing you need to know.
BGP Basics
Definitive CCNP-level BGP guide — autonomous systems, eBGP vs iBGP, path-vector routing, neighbor states, full best-path selection process, attributes deep dive (AS_PATH, LOCAL_PREF, MED, communities), route reflectors, RPKI, 8 worked scenarios, and the BGP debug workflow.
MPLS Basics
Multi-Protocol Label Switching demystified — labels instead of IP lookups, label distribution (LDP), the P/PE/CE model, MPLS L3VPN, and why MPLS still dominates the WAN backbone.
VRF Basics — Virtual Routing and Forwarding
How a router can pretend to be multiple separate routers with isolated routing tables — VRF-lite vs MPLS-VPN VRFs, RDs/RTs, and the use cases (multi-tenant, management plane, lab isolation).
BGP Best-Path Selection — The Full 13-Step Order
The complete BGP path-selection algorithm CCNP ENCOR expects you to recite. Every step in order, with the tie-breaker mnemonic and a worked example for the top three most-common decision points.
BFD — Bidirectional Forwarding Detection for Fast Failover
How BFD detects link and neighbor failures in under a second, why routing protocols alone can't, and how to enable BFD for OSPF, BGP, EIGRP, and HSRP on Cisco IOS.
LISP Basics — Locator/ID Separation Protocol
How LISP splits 'who you are' (EID) from 'where you are' (RLOC), enabling seamless mobility and BGP-alternative overlays. The four LISP roles CCNP ENCOR expects: ITR, ETR, MS, MR.
BGP Communities — Tags for Traffic Engineering + Well-Known Values
How BGP communities tag prefixes with metadata that policy uses across ASes. Standard vs extended communities, the four well-known values (no-export, no-advertise, no-export-subconfed, internet), and typical ISP tag patterns.
BGP Route Reflectors — Scaling iBGP Beyond Full-Mesh
How Route Reflectors break the iBGP full-mesh requirement, letting one router re-advertise iBGP routes to clients. Cluster-id, hierarchical RRs, redundant RR design, and the loop-prevention attributes ORIGINATOR_ID and CLUSTER_LIST.
IP Services
Advanced services.
NetFlow & Flow-Based Monitoring
How NetFlow / IPFIX / sFlow turn raw traffic into queryable records — flow definition, exports, collectors, and the operational use cases (capacity, security, billing) that SNMP can't answer.
QoS Marking & Queuing — DSCP, Trust Boundaries, LLQ, CBWFQ
The CCNP ENCOR QoS chapter, distilled: classification, marking with DSCP, trust boundaries, and queuing with LLQ and CBWFQ. Where to mark, where to trust, and how the router services the queues.
IP SLA — Cisco's Active Network Measurement + Track Object Integration
How Cisco IP SLA sends synthetic probes (ICMP, TCP, UDP, HTTP, jitter) to measure availability, latency, and jitter — and how track objects plug those measurements into HSRP, static routes, and PBR for smart failover.
IP Multicast Basics — Groups, IGMP, PIM Sparse Mode, RP
The multicast fundamentals CCNP ENCOR expects — multicast group addresses, IGMP for host-router join, PIM Sparse Mode for router-router distribution, Rendezvous Point (RP) design, and IGMP snooping on switches.
Security Fundamentals
Deeper security.
Cisco AnyConnect / Remote Access VPN
How a remote user's laptop gets put 'on the corporate LAN' over the internet. Covers AnyConnect client, SSL/TLS vs IKEv2, split tunneling, authentication options, and where it fits alongside ZTNA in 2026.
Cisco ISE Basics
Cisco Identity Services Engine — the RADIUS/TACACS+ + posture + profiling brain behind enterprise wired/wireless network access. What ISE does, where it sits, and the deployment model behind 802.1X-everywhere.
MACsec (IEEE 802.1AE) — Layer-2 Wire-Speed Encryption
How MACsec encrypts every Ethernet frame between two neighbors at line rate. AES-GCM, MKA key agreement, MACsec vs IPsec, and the CCNP ENCOR config on a Cat 9K.
CoPP — Control Plane Policing
Why routers need CoPP, how it rate-limits traffic destined to the CPU (routing protocols, SNMP, SSH, ARP), and the classify/police policy shape CCNP ENCOR tests.
IPv6 First-Hop Security — RA Guard, DHCPv6 Guard, ND Inspection
The four Layer-2 security features every enterprise needs when it enables IPv6: RA Guard blocks rogue Router Advertisements, DHCPv6 Guard blocks rogue DHCPv6 servers, ND Inspection validates Neighbor Discovery, IPv6 Source Guard binds addresses to ports.
Cisco Zone-Based Firewall (ZBFW) — Zones, Zone-Pairs, Policy-Maps
How Cisco's Zone-Based Firewall models a router as a set of security zones with policy-maps controlling traffic between them. Zone-pairs, class-based policy, the self zone, and typical enterprise deployments.
Automation & Programmability
Modern automation — streaming telemetry, intent-based.
gRPC & gNMI — Streaming Telemetry
The modern alternative to SNMP polling. Devices stream structured data continuously to a collector over gRPC. Covers gNMI for config and monitoring, why streaming beats polling, and what's replacing SNMP in real networks.
SD-WAN Concepts
Software-Defined WAN explained — separating control plane from data plane, overlay tunnels across any underlay (MPLS, internet, LTE), centralized policy via vManage/vSmart, and why the WAN is finally getting the SDN treatment.
Cisco DNA Center / Catalyst Center
Cisco's centralized network controller for enterprise campus + branch. What it does (assurance, automation, SD-Access), how it sits relative to traditional CLI, and what a CCNA candidate needs to recognize.
EEM — Embedded Event Manager Applets and Scripts
How EEM lets a Cisco router react to on-box events automatically: syslog triggers, SNMP thresholds, timers, interface state — all handled with tiny applets or Tcl scripts. The CCNP ENCOR automation you can enable without any external tool.
NETCONF and RESTCONF — Model-Driven Network APIs
How NETCONF (XML over SSH) and RESTCONF (JSON/XML over HTTPS) let you configure Cisco IOS-XE / NX-OS programmatically using YANG models. Config datastores, capabilities, and where each fits.
Need the basics first? Browse CCNA topics →