CCNP-level topics
Topics beyond the CCNA blueprint, deeper routing, advanced security, modern automation. Not full CCNP curriculum coverage. The topics that pair naturally with CCNA learning and round out a working network engineer's toolkit.
Free: CCNP Interview Bank: 40 Questions Routing · security · automation · design · troubleshooting, with talking points Open →Network Fundamentals
Deeper protocol behavior.
Network Access
Advanced Layer-2.
SPAN, RSPAN & ERSPAN: Port Mirroring
How to copy traffic from one switch port to another for analysis. Covers local SPAN, RSPAN across switches via VLAN, ERSPAN over GRE for remote sites, and when each one is the right call.
VXLAN Basics: VNI, VTEP, and Why Modern DCs Use It
The Layer-2-over-Layer-3 overlay every modern data center runs. CCNP ENCOR essentials: VXLAN encapsulation, VNI, VTEP roles, and flood-and-learn vs BGP EVPN.
Cisco StackWise Virtual (SVL): Two Chassis as One Logical Switch
How StackWise Virtual makes a pair of Catalyst 9500/9600 chassis behave as a single logical switch. SVL links, DAD (dual-active detection), and why SVL replaced legacy VSS.
IP Connectivity
Advanced routing: BGP, multi-area OSPF, EIGRP, IPv6.
GRE Tunnels
How to make two distant routers feel directly connected by wrapping IP inside IP. Covers tunnel interface config, MTU caveats, why GRE itself isn't encrypted, and the standard 'GRE over IPsec' combination.
EIGRP
EIGRP, Cisco's hybrid routing protocol: DUAL, successor vs feasible successor, the metric formula, and why EIGRP recovers from failures in milliseconds.
OSPF Multi-Area
Why a single OSPF area stops working past ~50 routers, and how multi-area design fixes it. Covers ABRs, ASBRs, area 0 backbone rules, LSA types, and the area design decisions that scale OSPF to thousands of routers.
IPv6 Routing: Static & OSPFv3
How routing works in an IPv6-only or dual-stack network. Covers IPv6 static routes, OSPFv3 (OSPF for IPv6), default routes, and the differences from IPv4 routing you need to know.
BGP Basics
CCNP BGP guide: eBGP vs iBGP, neighbor states, best-path selection, AS_PATH, LOCAL_PREF, MED, communities, route reflectors, RPKI and 8 worked scenarios.
MPLS Basics
MPLS explained: labels instead of IP lookups, LDP label distribution, the P/PE/CE model, MPLS L3VPN, and why MPLS still dominates the WAN backbone.
VRF Basics: Virtual Routing and Forwarding
How one router acts as several with isolated routing tables: VRF-lite vs MPLS VPN VRFs, RDs and RTs, and multi-tenant, management and lab isolation use cases.
BGP Best-Path Selection: The Full 13-Step Order
The complete BGP path-selection algorithm CCNP ENCOR expects you to recite. Every step in order, with the tie-breaker mnemonic and a worked example for the top three most-common decision points.
BFD: Bidirectional Forwarding Detection for Fast Failover
How BFD detects link and neighbor failures in under a second, why routing protocols alone can't, and how to enable BFD for OSPF, BGP, EIGRP, and HSRP on Cisco IOS.
LISP Basics: Locator/ID Separation Protocol
How LISP splits 'who you are' (EID) from 'where you are' (RLOC), enabling seamless mobility and BGP-alternative overlays. The four LISP roles CCNP ENCOR expects: ITR, ETR, MS, MR.
BGP Communities: Tags for Traffic Engineering + Well-Known Values
How BGP communities tag prefixes with metadata that policy uses across ASes. Standard vs extended communities, the four well-known values (no-export, no-advertise, no-export-subconfed, internet), and typical ISP tag patterns.
BGP Route Reflectors: Scaling iBGP Beyond Full-Mesh
How Route Reflectors break the iBGP full-mesh requirement, letting one router re-advertise iBGP routes to clients. Cluster-id, hierarchical RRs, redundant RR design, and the loop-prevention attributes ORIGINATOR_ID and CLUSTER_LIST.
IP Services
Advanced services.
NetFlow & Flow-Based Monitoring
How NetFlow, IPFIX and sFlow turn raw traffic into queryable records: flows, exports, collectors, and capacity, security and billing answers SNMP can't give.
QoS Marking & Queuing: DSCP, Trust Boundaries, LLQ, CBWFQ
The CCNP ENCOR QoS chapter, distilled: classification, marking with DSCP, trust boundaries, and queuing with LLQ and CBWFQ. Where to mark, where to trust, and how the router services the queues.
IP SLA: Cisco's Active Network Measurement + Track Object Integration
How Cisco IP SLA probes (ICMP, TCP, UDP, HTTP, jitter) measure availability, latency and jitter, and how track objects drive HSRP, static and PBR failover.
IP Multicast Basics: Groups, IGMP, PIM Sparse Mode, RP
Multicast fundamentals for CCNP ENCOR: group addresses, IGMP host joins, PIM Sparse Mode, Rendezvous Point (RP) design and IGMP snooping on switches.
Security Fundamentals
Deeper security.
Cisco AnyConnect / Remote Access VPN
How a remote user's laptop gets put 'on the corporate LAN' over the internet. Covers AnyConnect client, SSL/TLS vs IKEv2, split tunneling, authentication options, and where it fits alongside ZTNA in 2026.
Cisco ISE Basics
Cisco ISE (Identity Services Engine): the RADIUS/TACACS+, posture and profiling brain behind enterprise network access, where it sits and how it enables 802.1X.
MACsec (IEEE 802.1AE): Layer-2 Wire-Speed Encryption
How MACsec encrypts every Ethernet frame between two neighbors at line rate. AES-GCM, MKA key agreement, MACsec vs IPsec, and the CCNP ENCOR config on a Cat 9K.
CoPP: Control Plane Policing
Why routers need CoPP, how it rate-limits traffic destined to the CPU (routing protocols, SNMP, SSH, ARP), and the classify/police policy shape CCNP ENCOR tests.
IPv6 First-Hop Security: RA Guard, DHCPv6 Guard, ND Inspection
The four Layer-2 security features every enterprise needs when it enables IPv6: RA Guard blocks rogue Router Advertisements, DHCPv6 Guard blocks rogue DHCPv6 servers, ND Inspection validates Neighbor Discovery, IPv6 Source Guard binds addresses to ports.
Cisco Zone-Based Firewall (ZBFW): Zones, Zone-Pairs, Policy-Maps
How Cisco's Zone-Based Firewall models a router as a set of security zones with policy-maps controlling traffic between them. Zone-pairs, class-based policy, the self zone, and typical enterprise deployments.
Automation & Programmability
Modern automation: streaming telemetry, intent-based.
gRPC & gNMI: Streaming Telemetry
The modern alternative to SNMP polling. Devices stream structured data continuously to a collector over gRPC. Covers gNMI for config and monitoring, why streaming beats polling, and what's replacing SNMP in real networks.
SD-WAN Concepts
SD-WAN explained: control plane vs data plane, overlay tunnels over any underlay (MPLS, internet, LTE), and centralized policy with vManage and vSmart.
Cisco DNA Center / Catalyst Center
Cisco's centralized network controller for enterprise campus + branch. What it does (assurance, automation, SD-Access), how it sits relative to traditional CLI, and what a CCNA candidate needs to recognize.
EEM: Embedded Event Manager Applets and Scripts
How Cisco EEM reacts to on-box events (syslog, SNMP thresholds, timers, interface state) with applets or Tcl scripts: CCNP ENCOR automation, no external tool.
NETCONF and RESTCONF: Model-Driven Network APIs
How NETCONF (XML over SSH) and RESTCONF (JSON/XML over HTTPS) let you configure Cisco IOS-XE / NX-OS programmatically using YANG models. Config datastores, capabilities, and where each fits.
Need the basics first? Browse CCNA topics →