Overview
Infrastructure is 30% of ENCOR, the heaviest domain, and Cisco groups it into three exam topics: Layer 2 (802.1Q trunking, EtherChannels, RSTP, MST and spanning tree enhancements), Layer 3 (comparing EIGRP and OSPF, configuring OSPFv2 and OSPFv3, configuring eBGP between directly connected neighbors, and describing policy-based routing) and IP Services (NTP and PTP, NAT and PAT, HSRP and VRRP, and multicast protocols). Each topic bundles several sub-items, so the topic count understates the content.
The verbs matter: trunking and EtherChannels are troubleshoot items, spanning tree, OSPF, eBGP, NAT and FHRPs are configure items, and multicast and PBR are describe items. This domain is the foundation for Virtualization, Network Assurance and Security, which all assume these protocols already work.
How it's tested
Infrastructure questions are mostly exhibits: show command output, a partial configuration or a topology with a symptom. You are asked for the cause, the missing command or the resulting path. Some items are comparisons, such as EIGRP versus OSPF behavior, and multicast items are conceptual. Work from protocol rules rather than from command memory alone.
-
Find the negotiation mismatch
Trunk, EtherChannel or neighbor output shows a link or adjacency that will not form, and you identify the mismatched mode, parameter or setting.
-
Predict the chosen path
A routing table, BGP table or spanning tree output is shown, and you determine which path, root bridge or port role results from metrics and attributes.
-
Complete the service
A NAT, HSRP, VRRP or NTP configuration is incomplete or wrong, and you pick the command that makes it work or explain its current behavior.
An exhibit shows two eBGP paths to the same prefix, one with AS path length 2 and MED 50, the other with AS path length 3 and MED 0, both with default weight and local preference. Walk the best-path order: weight and local preference tie, neither is locally originated, so AS path length decides before MED is ever compared. The shorter AS path wins despite its higher MED.
Exam topics 3
Official exam topics from the Cisco outline, in outline order.
3.1 Layer 2Troubleshooting 802.1Q trunks and EtherChannels; configuring RSTP, MST, root guard and BPDU guard.
- What it means
- This topic covers troubleshooting static and dynamic 802.1Q trunking (including DTP negotiation), troubleshooting static and dynamic EtherChannels (PAgP and LACP), and configuring and verifying RSTP, MST and spanning tree enhancements such as root guard and BPDU guard.
- What to understand
- DTP forms a trunk when at least one side is trunk or dynamic desirable; two dynamic auto ports stay access, and native VLAN or allowed-VLAN mismatches break traffic even on a working trunk. An EtherChannel forms only with compatible modes (LACP active with active or passive, PAgP desirable with desirable or auto, on only with on) and matching speed, duplex, trunk mode, native and allowed VLANs. MST instances work only when region name, revision number and VLAN-to-instance mapping match on every switch in the region.
- How it shows up
- Output shows a port-channel member as suspended or a trunk carrying no traffic for one VLAN, and you identify the mode or VLAN mismatch; or a guard feature is described and you predict whether the port goes err-disabled or root-inconsistent.
- Common confusion
- Treating root guard and BPDU guard as the same: BPDU guard err-disables a PortFast edge port that receives any BPDU, while root guard blocks a port only while it receives superior BPDUs and recovers automatically.
3.2 Layer 3EIGRP versus OSPF concepts, OSPFv2 and OSPFv3 configuration, directly connected eBGP and policy-based routing.
- What it means
- This topic covers comparing EIGRP and OSPF (advanced distance vector versus link state, load balancing, path selection, metrics and area types), configuring simple multi-area OSPFv2 and OSPFv3 with summarization, filtering, network types and passive interfaces, configuring and verifying eBGP between directly connected neighbors including best-path selection, and describing policy-based routing.
- What to understand
- EIGRP uses DUAL with successors and feasible successors and can load-balance across unequal-cost paths with variance; OSPF floods LSAs, runs SPF, uses cost (reference bandwidth divided by interface bandwidth) and balances only equal-cost paths. OSPF adjacencies need matching area, hello and dead timers, subnet, authentication, stub flags and MTU, and summarization happens only on ABRs (area range) and ASBRs (summary-address). eBGP runs over TCP 179 with a TTL of 1 by default, advertises a prefix with the network command only when an exact match exists in the routing table, and selects paths by weight, local preference, locally originated, AS path length, origin, MED and then eBGP over iBGP.
- How it shows up
- Exhibits show neighbors stuck in a state (EXSTART, Active), missing routes after filtering, or competing BGP paths, and you identify the cause or the winning path.
- Common confusion
- Expecting PBR to affect traffic the router generates itself or traffic leaving an interface; ip policy route-map applies to packets arriving on the interface, and locally generated traffic needs ip local policy.
3.3 IP ServicesNTP and PTP, NAT and PAT, HSRP and VRRP, and multicast protocols.
- What it means
- This topic covers interpreting NTP and PTP configurations, configuring NAT and PAT, configuring the first hop redundancy protocols HSRP and VRRP, and describing multicast protocols such as the RPF check, PIM sparse mode, IGMPv2 and v3, SSM, bidirectional PIM and MSDP.
- What to understand
- NTP builds a stratum hierarchy and needs authenticate, authentication-key and trusted-key together for authentication to work, while PTP (IEEE 1588) reaches sub-microsecond accuracy with grandmaster, boundary and transparent clocks. NAT needs ip nat inside and outside on the right interfaces plus an ACL that matches the traffic, and the overload keyword makes it PAT. HSRP preemption is off by default and its default priority is 100, while VRRP preempts by default, is an open standard and can use a real interface address as the virtual IP.
- How it shows up
- A NAT translation table is empty, an HSRP router with higher priority does not become active, or a multicast stream is dropped, and you identify the missing setting or the protocol behavior responsible.
- Common confusion
- Expecting a higher HSRP priority to take over immediately; without preempt configured, the existing active router keeps the role until it fails.
High-yield concepts
The terms, rules and formulas this domain turns into questions most often.
-
DTP mode combinations
Dynamic Trunking Protocol forms a trunk when one side is trunk or dynamic desirable and the other is trunk, desirable or auto.
- Remember
- Auto with auto produces an access link, and switchport nonegotiate disables DTP so only a statically configured trunk works on both ends.
- Tested as
- Topic 3.1 asks you to troubleshoot dynamic trunking from show interfaces trunk output.
- Trap
- Assuming auto on both ends negotiates a trunk because both sides are 'willing'.
-
EtherChannel negotiation modes
LACP uses active and passive, PAgP uses desirable and auto, and on forces a channel with no negotiation protocol.
- Remember
- At least one side must actively negotiate; on works only with on, and member ports must match speed, duplex, trunk mode and VLAN settings.
- Tested as
- Exhibits show members as suspended or standalone and ask for the cause.
- Trap
- Pairing on with LACP active, which does not form a negotiated bundle.
-
RSTP port roles and states
RSTP (802.1w) uses root, designated, alternate and backup roles with discarding, learning and forwarding states, and converges with a proposal and agreement handshake on point-to-point links.
- Remember
- Alternate ports give a precomputed backup path to the root, so a root port failure is recovered almost immediately.
- Tested as
- show spanning-tree output questions ask which port blocks and why.
- Trap
- Using the legacy 802.1D blocking and listening states when describing RSTP.
-
MST region consistency
Multiple Spanning Tree (802.1s) maps many VLANs to a few instances, and switches belong to the same region only when name, revision and VLAN-to-instance mappings all match.
- Remember
- Instance 0 (the IST) carries BPDUs for the region; a mismatch puts switches in different regions and changes the topology.
- Tested as
- Configure-and-verify questions show an MST region with one switch behaving differently.
- Trap
- Changing the VLAN mapping on one switch and expecting the region to stay intact.
-
Root guard vs. BPDU guard
BPDU guard shuts a PortFast port into err-disabled when any BPDU arrives, while root guard places a designated port into root-inconsistent state when a superior BPDU arrives.
- Remember
- BPDU guard protects access ports from rogue switches; root guard protects the chosen root bridge placement on distribution links.
- Tested as
- A rogue switch scenario asks which feature fits a given port.
- Trap
- Expecting root guard to err-disable the port; it recovers on its own when superior BPDUs stop.
-
EIGRP feasibility condition
A neighbor becomes a feasible successor when its reported distance is lower than the current feasible distance of the successor route.
- Remember
- Feasible successors allow loop-free instant failover, and variance lets EIGRP load-balance across feasible successors with unequal metrics.
- Tested as
- Topic 3.2.a compares EIGRP and OSPF load balancing and path operations.
- Trap
- Thinking variance can include a path that fails the feasibility condition.
-
OSPF adjacency requirements
OSPF neighbors must agree on area ID, hello and dead intervals, subnet and mask on broadcast links, authentication, stub area flags, and they must have unique router IDs.
- Remember
- An MTU mismatch lets neighbors see each other but leaves them stuck in EXSTART or EXCHANGE during database exchange.
- Tested as
- Adjacency troubleshooting is the most common OSPF exhibit type.
- Trap
- Looking for a timer mismatch when neighbors are visible but stuck in EXSTART.
-
OSPF network types
Broadcast networks elect a DR and BDR and use a 10-second hello, while point-to-point networks form an adjacency directly with no DR election.
- Remember
- Configuring ip ospf network point-to-point on Ethernet links between two routers removes DR election and type 2 LSAs.
- Tested as
- Topic 3.2.b lists point-to-point and broadcast network types and passive-interface.
- Trap
- Mixing network types on two ends of a link, which can form an adjacency but break route calculation.
-
OSPF summarization and filtering
Inter-area summarization is configured on an ABR with area range, external summarization on an ASBR with summary-address, and type 3 filtering on an ABR with area filter-list.
- Remember
- A distribute-list in filters routes from the local routing table only; it does not stop LSAs from flooding to other routers.
- Tested as
- Configuration items ask where and how to summarize or filter.
- Trap
- Trying to summarize intra-area routes on an internal router.
-
eBGP neighbor states
BGP moves through Idle, Connect, Active, OpenSent, OpenConfirm and Established.
- Remember
- A neighbor stuck in Active means the TCP session on port 179 is not completing, often due to a wrong neighbor address, wrong remote-as, ACL or unreachable peer.
- Tested as
- show ip bgp summary exhibits test whether you can read the state column.
- Trap
- Reading Active as 'working', when Established is the only state that exchanges routes.
-
BGP best-path order
Cisco compares highest weight, highest local preference, locally originated, shortest AS path, lowest origin code, lowest MED, eBGP over iBGP, lowest IGP metric to next hop, oldest eBGP path, then lowest router ID.
- Remember
- Weight is Cisco-specific and local to the router; local preference is shared inside the AS; MED is a hint to a neighboring AS.
- Tested as
- Topic 3.2.c names the best path selection algorithm explicitly.
- Trap
- Comparing MED before AS path length.
-
NAT address terms
Inside local is the private host address, inside global is its translated public address, outside global is the real remote address, and outside local is how the remote host appears inside.
- Remember
- PAT adds overload so many inside hosts share one global address using different ports.
- Tested as
- show ip nat translations exhibits label columns with these terms.
- Trap
- Swapping inside global and outside global when reading the translation table.
-
HSRP vs. VRRP defaults
HSRP is Cisco proprietary with active and standby routers, default priority 100 and preemption disabled; VRRP is an IETF standard with master and backup routers and preemption enabled.
- Remember
- HSRPv2 uses 224.0.0.102 and virtual MAC 0000.0c9f.fxxx; VRRP uses IP protocol 112 to 224.0.0.18 and virtual MAC 0000.5e00.01xx.
- Tested as
- Topic 3.3.c is a configure item with exhibits about which router is active.
- Trap
- Assuming HSRP preempts by default, as VRRP does.
-
Multicast RPF check
A router accepts a multicast packet only if it arrives on the interface the unicast routing table uses to reach the source (or the RP for shared-tree traffic).
- Remember
- RPF failures drop multicast silently even though unicast to the source works, typically when unicast routing and the multicast path are asymmetric.
- Tested as
- Topic 3.3.d lists the RPF check first among multicast protocols.
- Trap
- Troubleshooting IGMP on the receiver LAN when the drop is an RPF failure upstream.
-
PIM-SM, SSM, bidir and MSDP
PIM-SM builds a shared tree through a rendezvous point and can switch to a source tree; SSM uses IGMPv3 and the 232.0.0.0/8 range with no RP; bidirectional PIM uses only shared trees for many-to-many groups; MSDP shares active-source information between RPs.
- Remember
- SSM needs IGMPv3 because the receiver must name the source; MSDP runs between RPs over TCP 639.
- Tested as
- Describe-level questions ask which protocol fits a described multicast application.
- Trap
- Choosing SSM for a receiver that only supports IGMPv2.
Side by side
Concepts candidates mix up, compared on the point that decides the answer.
EIGRP vs. OSPF
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| EIGRP | Advanced distance vector protocol using DUAL | Composite metric from bandwidth and delay by default; unequal-cost load balancing with variance; no areas | Describing it as link state because it keeps a topology table |
| OSPF | Link-state protocol using SPF | Cost metric from reference bandwidth; equal-cost load balancing only; hierarchical areas around area 0 | Expecting unequal-cost load balancing to work with variance |
LACP vs. PAgP vs. static on
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| LACP (802.3ad) | Standard EtherChannel negotiation | active and passive modes; at least one side active; works between vendors | passive on both ends never forms the bundle |
| PAgP | Cisco proprietary EtherChannel negotiation | desirable and auto modes; at least one side desirable | auto on both ends never forms the bundle |
| Static on | Forced bundling without negotiation | Works only with on at the far end; no checks for misconfiguration | Pairing on with active or desirable |
HSRP vs. VRRP
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| HSRP | Cisco first hop redundancy protocol | Active and standby roles; preemption off by default; virtual IP must differ from interface addresses | Expecting the higher-priority router to take over without preempt |
| VRRP | IETF standard first hop redundancy protocol | Master and backup roles; preemption on by default; the owner of the real address gets priority 255 | Assuming it is Cisco-only or uses the HSRP virtual MAC |
PIM-SM vs. SSM vs. bidirectional PIM
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| PIM sparse mode | Explicit-join multicast using a rendezvous point | Builds (*,G) shared trees through the RP, then can switch to (S,G) source trees | Forgetting that every router must agree on the RP |
| Source-specific multicast | Receivers join a specific source and group | No RP; uses (S,G) only; requires IGMPv3 and the 232.0.0.0/8 range by default | Expecting it to work with IGMPv2 hosts |
| Bidirectional PIM | Shared-tree-only PIM for many-to-many groups | Traffic flows up and down one shared tree with no source-tree state | Expecting (S,G) entries to appear for bidir groups |
Exam traps
Each trap is an answer that looks right. Learn the clue that should change your mind.
-
Network statement without a matching route
- What candidates pick
- The eBGP network statement advertises 10.10.0.0/16 because the command is configured.
- Why it looks right
- In IGPs a network statement enables the interface and advertises it.
- Why it's wrong
- BGP originates a prefix with network only when an exact match, including the mask, exists in the routing table.
Clue to watch for The routing table holds only more-specific /24 routes, and no static route to Null0 or aggregate exists.
-
BGP Active means up
- What candidates pick
- The neighbor is working because show ip bgp summary shows Active.
- Why it looks right
- The word sounds positive.
- Why it's wrong
- Active means the router is trying to open a TCP connection and failing; only Established exchanges prefixes, and an established session shows a prefix count instead of a state.
Clue to watch for The State/PfxRcd column shows a word instead of a number.
-
Distribute-list stops flooding
- What candidates pick
- A distribute-list in on one OSPF router hides the route from the whole area.
- Why it looks right
- Distribute-lists filter routes in distance vector protocols.
- Why it's wrong
- OSPF routers in an area must share an identical LSDB, so the distribute-list only keeps the route out of that router's own routing table.
Clue to watch for The requirement is to stop a route from reaching other routers or other areas, which needs ABR filtering or summarization.
-
Higher HSRP priority wins immediately
- What candidates pick
- R2 with priority 110 is active because it has the highest priority.
- Why it looks right
- Priority is the documented election criterion.
- Why it's wrong
- Without standby preempt, the router that became active first keeps the role; priority only matters at election time or with preemption.
Clue to watch for The exhibit shows priority changes but no preempt keyword.
-
PBR for router-generated traffic
- What candidates pick
- ip policy route-map on the LAN interface redirects the router's own pings and syslog traffic.
- Why it looks right
- The route-map matches the right destinations.
- Why it's wrong
- Interface PBR applies only to packets received on that interface; locally generated traffic requires ip local policy route-map.
Clue to watch for The traffic in question originates from the router itself.
-
NAT without interface roles
- What candidates pick
- The ip nat inside source list command with overload is enough for PAT.
- Why it looks right
- That command defines the translation.
- Why it's wrong
- Translation happens only for traffic moving between interfaces marked ip nat inside and ip nat outside, and the ACL must match the inside local addresses.
Clue to watch for show ip nat translations is empty and interface configuration lacks the inside or outside keyword.
-
BPDU guard on a trunk to distribution
- What candidates pick
- Enable BPDU guard on the uplink to stop a rogue switch from becoming root.
- Why it looks right
- BPDU guard is the best-known spanning tree protection.
- Why it's wrong
- Uplinks legitimately receive BPDUs, so BPDU guard would err-disable them; root guard on designated ports blocks only superior BPDUs.
Clue to watch for The port connects to other switches that must keep participating in spanning tree.
Answer framework
Use this order for Infrastructure exhibits, which usually hide one mismatched parameter or one rule.
- Identify the protocol and the exam verb, troubleshoot, configure or describe, so you know whether syntax or behavior is being tested.
- List the parameters both sides must agree on, such as modes, VLANs, area, timers, MTU, remote-as or region name, and compare them in the exhibit.
- Read the state or role in the output, such as suspended, EXSTART, Active or root-inconsistent, and map it to the known causes for that state.
- For path questions, apply the protocol's decision order step by step and stop at the first attribute that differs.
- Check defaults that change outcomes, such as HSRP preemption, OSPF reference bandwidth, eBGP TTL and match-all versus match-any, before selecting an answer.
Practice question
Want more like this? The CCNP ENCOR practice test has questions for every domain.
Checklist
0 of 14
Tick each one you can do without notes. Your ticks stay in this browser.
Study strategy
Spend the largest share of your ENCOR time here, in three blocks that match the topics. Start with Layer 2 because spanning tree and EtherChannel faults also break the labs you will build for Layer 3. Configure trunks and EtherChannels with every mode combination, then deliberately break them and read show etherchannel summary and show interfaces trunk until the failure is obvious.
Next, move to Layer 3, which carries the most exam weight inside this domain. Build multi-area OSPFv2 and OSPFv3 with summarization and filtering, then add eBGP to a neighbor and practise the best-path order with weight, local preference, AS path prepending and MED until you can decide a path without notes. Learn EIGRP conceptually through comparison with OSPF.
Finish with IP Services: NAT, HSRP and VRRP are quick lab wins, while NTP and PTP need only configuration reading. Candidates often underestimate multicast, since the v1.2 topic now includes SSM, bidirectional PIM and MSDP; learn it from diagrams of trees and RPF checks. Afterwards, practise mixed timed exhibits, because speed at reading output is what this domain rewards.
FAQ
Why does Infrastructure have only three exam topics?
Cisco groups this domain into Layer 2, Layer 3 and IP Services, each with several lettered sub-items. With 30% of the weight, the content is far broader than the topic count suggests.
Is EIGRP configuration tested on ENCOR v1.2?
Topic 3.2.a asks you to compare routing concepts of EIGRP and OSPF, so focus on EIGRP behavior. The configure items in Layer 3 are OSPFv2 and OSPFv3 and eBGP.
Does ENCOR cover iBGP?
The topic names eBGP between directly connected neighbors, including best-path selection and neighbor relationships. iBGP appears only where best-path rules compare eBGP and iBGP paths; route reflection and advanced BGP belong to the ENARSI concentration exam.
How deep does multicast go?
Multicast is a describe item, so expect concept questions on the RPF check, PIM sparse mode, IGMPv2 and v3, SSM, bidirectional PIM and MSDP rather than full configuration.
Is VTP or GLBP on the v1.2 blueprint?
No. The v1.2 topics list 802.1Q trunking, EtherChannels, RSTP, MST and spanning tree enhancements, and name HSRP and VRRP as the first hop redundancy protocols.
How long should I study this domain?
As the largest domain, it deserves the most time. The estimate on this page applies its 30% weight to a 200-hour plan, and candidates with weaker routing labs should add more.
How does Infrastructure connect to Network Assurance?
Network Assurance tools such as IP SLA, NetFlow and SPAN observe and verify the protocols covered here. IP SLA tracking, for example, often controls a static route or an FHRP priority.
Other Networking certifications
Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.
Test your Domain 3 knowledge
You have reviewed negotiation modes, OSPF adjacency rules, the BGP best-path order and FHRP and multicast behavior. Practise reading those exhibits against the clock.
Keep going
- Training Training Built on your Weak areas
- Practice test Questions by domain, with explanations
- Mock exam Full length, timed like the real exam
- Readiness test Find your weakest domain in minutes
- Cheat sheet Key terms and formulas on one page
- Ask the CCNP ENCOR AI tutor Get any concept explained your way