Overview
Virtualization is 10% of ENCOR and has three exam topics: describing device virtualization (type 1 and type 2 hypervisors, virtual machines and virtual switching), configuring and verifying data path virtualization (VRF, GRE and IPsec tunneling), and describing network virtualization concepts (LISP and VXLAN). Only the middle topic is a configure-and-verify item, so that is where command-level detail matters most.
Every technology here answers the same design question: how do you share one physical network between separate traffic sets? VRFs split the routing table, tunnels carry one network across another, and LISP and VXLAN separate identity from location. Those ideas reappear in Architecture, where SD-Access combines LISP and VXLAN, and in Security, where IPsec and segmentation protect traffic.
How it's tested
Expect a mix of concept questions (which hypervisor type, which protocol separates identity from location, which header VXLAN uses) and configuration exhibits for VRF and tunnels. Exhibit questions usually show a broken state, such as a tunnel that goes up and down or a VRF ping that fails, and ask for the cause or fix.
-
Fix the tunnel
An exhibit shows GRE or IPsec configuration and a symptom such as a flapping tunnel or failed traffic, and you identify the misconfiguration.
-
Verify inside the VRF
A VRF is configured but a test fails, and you pick the command or step that tests or restores reachability within the right routing table.
-
Match the overlay concept
A description of a function, such as mapping endpoint identifiers to locators or extending Layer 2 over Layer 3, is matched to LISP or VXLAN components.
An exhibit shows a GRE tunnel that comes up, then logs 'temporarily disabled due to recursive routing'. Ask how the router reaches the tunnel destination. If the routing protocol running over the tunnel advertises the destination's address, the best path to the tunnel endpoint points into the tunnel itself. The fix is to keep the transport address out of the overlay routing, for example with a static route or filtering.
Exam topics 3
Official exam topics from the Cisco outline, in outline order.
2.1 Describe device virtualization technologiesType 1 and type 2 hypervisors, virtual machines and virtual switching.
- What it means
- This topic covers how one physical server runs many isolated operating systems: type 1 (bare-metal) hypervisors such as VMware ESXi run directly on hardware, type 2 (hosted) hypervisors such as VirtualBox run on a host operating system, and virtual switches connect virtual machine NICs to each other and to physical uplinks.
- What to understand
- A virtual machine is a set of files plus virtual hardware (vCPU, memory, vNICs and disks) that can be moved, cloned or snapshotted. A virtual switch forwards between VMs on the same host without touching the physical network, and a distributed virtual switch keeps one configuration across many hosts so port policies follow a VM when it migrates.
- How it shows up
- A scenario asks which hypervisor type suits production data center consolidation, or why traffic between two VMs on the same host never appears on the physical switch.
- Common confusion
- Calling any hypervisor installed on a laptop type 2 regardless of design; the distinction is whether a host operating system sits between the hypervisor and the hardware.
2.2 Configure and verify data path virtualization technologiesVRFs and GRE and IPsec tunnels, configured and verified on IOS XE.
- What it means
- This topic covers creating VRFs (vrf definition with an address family, then vrf forwarding on interfaces) to keep separate routing tables on one router, and building GRE tunnels, IPsec-protected tunnels and GRE over IPsec to carry traffic between sites.
- What to understand
- Applying vrf forwarding to an interface removes its IP address, which must be re-entered, and every verification command needs the vrf keyword, such as show ip route vrf RED and ping vrf RED. GRE (IP protocol 47) adds 24 bytes and carries multicast and routing protocols but provides no encryption, while IPsec ESP (IP protocol 50) encrypts but on its own does not carry multicast, which is why GRE over IPsec or an IPsec virtual tunnel interface is used for routed site-to-site VPNs.
- How it shows up
- An exhibit shows a ping failing between VRF interfaces or a tunnel flapping, and you choose the missing command, the wrong source or destination, or the recursive routing cause.
- Common confusion
- Testing a VRF with a plain ping, which uses the global routing table and fails even when the VRF is working.
2.3 Describe network virtualization conceptsLISP and VXLAN: separating identity from location and extending Layer 2 over Layer 3.
- What it means
- This topic covers the Locator/ID Separation Protocol, which splits an endpoint identifier (EID) from its routing locator (RLOC) and uses a map server and map resolver to look up mappings, and Virtual Extensible LAN, which encapsulates Layer 2 frames in UDP so segments can stretch across a routed network.
- What to understand
- In LISP, an ingress tunnel router asks the map resolver where an EID lives, then encapsulates traffic to the egress tunnel router's RLOC; endpoints can move without renumbering because only the mapping changes. VXLAN uses a 24-bit VNI (about 16 million segments versus 4,094 usable VLANs), UDP port 4789 and VTEPs that encapsulate and decapsulate; it needs a control plane such as flood-and-learn, BGP EVPN or, in SD-Access, LISP.
- How it shows up
- A question names a function, such as 'answers which RLOC an EID is behind' or 'identifies the segment in the encapsulation header', and asks which component or field performs it.
- Common confusion
- Treating VXLAN as a complete solution with its own control plane; on its own it defines only the encapsulation and data plane.
High-yield concepts
The terms, rules and formulas this domain turns into questions most often.
-
Type 1 vs. type 2 hypervisor
A type 1 hypervisor runs directly on server hardware, while a type 2 hypervisor runs as an application on a host operating system.
- Remember
- Type 1 suits production consolidation because it avoids the host OS overhead and attack surface; type 2 suits labs and desktops.
- Tested as
- Basic identification questions in topic 2.1 ask you to classify a described platform.
- Trap
- Classifying by product popularity instead of by whether a host operating system is present underneath.
-
Virtual switch
A software switch inside the hypervisor that connects VM vNICs to port groups and to physical uplinks.
- Remember
- VM-to-VM traffic on the same host and port group stays inside the host, so physical SPAN or ACLs do not see it.
- Tested as
- Explains visibility and policy questions about traffic between VMs.
- Trap
- Expecting a physical switch port mirror to capture traffic between VMs on one host.
-
VRF-lite
VRFs on a router or Layer 3 switch without MPLS, giving each VRF its own routing and forwarding table and its own interfaces.
- Remember
- IP addresses can overlap between VRFs, and an interface belongs to exactly one VRF or the global table.
- Tested as
- The configure-and-verify part of topic 2.2 is built around this.
- Trap
- Assuming two VRFs on the same router can reach each other by default; they cannot without route leaking.
-
vrf forwarding removes the IP address
When vrf forwarding is applied to an interface on IOS XE, any IP address already configured on it is removed.
- Remember
- Assign the VRF first, then configure the IP address; verify with show ip vrf interfaces or show vrf.
- Tested as
- A common reason an exhibit's VRF interface has no address or is unreachable.
- Trap
- Looking for a routing problem when the interface simply lost its address.
-
GRE overhead and MTU
GRE adds a 20-byte outer IPv4 header and a 4-byte GRE header, 24 bytes in total, so a tunnel over a 1500-byte path has an effective IP MTU of 1476.
- Remember
- Adjust ip mtu and ip tcp adjust-mss on the tunnel when large packets fail; IPsec adds further overhead on top.
- Tested as
- Appears when small pings succeed but large transfers stall across a tunnel.
- Trap
- Blaming the routing protocol when the symptom is size-dependent.
-
Recursive routing
A tunnel goes down when the best route to its own destination address is learned through the tunnel.
- Remember
- Keep the tunnel destination reachable through the underlay, for example with a static route or by not advertising the transport address into the overlay routing protocol.
- Tested as
- A classic exhibit symptom: the tunnel flaps with a recursive routing log message.
- Trap
- Changing tunnel keepalives or timers instead of fixing the route to the destination.
-
IPsec protocols and ports
ESP (IP protocol 50) provides confidentiality and integrity, AH (IP protocol 51) provides integrity only, IKE uses UDP 500, and NAT traversal moves ESP into UDP 4500.
- Remember
- AH cannot pass through NAT because it authenticates the outer IP header; ESP with NAT-T can.
- Tested as
- Firewall and NAT scenarios test which ports must be permitted for a tunnel to come up.
- Trap
- Opening only UDP 500 and expecting traffic to flow when NAT is in the path.
-
GRE over IPsec vs. IPsec VTI
GRE over IPsec encrypts a GRE tunnel so routing protocols and multicast can run securely; a static IPsec virtual tunnel interface (tunnel mode ipsec ipv4) gives a routable interface without the GRE header.
- Remember
- Both support dynamic routing over an encrypted tunnel; a VTI saves the 4-byte GRE header but carries only the protected IP family.
- Tested as
- Design questions ask how to run OSPF securely between two sites over the internet.
- Trap
- Choosing plain crypto-map IPsec, which does not create a routable interface for a routing protocol adjacency.
-
LISP EID and RLOC
An endpoint identifier is the address of the host, while a routing locator is the address of the LISP router where that host currently attaches.
- Remember
- Mobility works because the EID stays the same and only its EID-to-RLOC mapping is updated in the map server.
- Tested as
- Topic 2.3 and SD-Access questions both use this vocabulary.
- Trap
- Thinking LISP changes the host's IP address when it moves.
-
LISP map server and map resolver
Egress tunnel routers register EID prefixes with the map server, and ingress tunnel routers query the map resolver to learn which RLOC serves a destination EID.
- Remember
- The functions are often combined on one device (MS/MR); LISP control messages use UDP 4342 and data encapsulation uses UDP 4341.
- Tested as
- Asked as 'which component answers mapping requests' or 'where do ETRs register'.
- Trap
- Swapping the roles of map server and map resolver.
-
VXLAN VNI and VTEP
The VXLAN header carries a 24-bit VXLAN network identifier, and VTEPs encapsulate frames in UDP port 4789 for transport across the IP underlay.
- Remember
- VXLAN adds about 50 bytes of overhead, so the underlay MTU must be raised to avoid fragmentation.
- Tested as
- Questions on scale (16 million segments) and on which device encapsulates traffic.
- Trap
- Remembering the VLAN limit of 4,094 and applying it to VXLAN segments.
-
VXLAN control plane options
VXLAN can learn remote MAC addresses by flood-and-learn using multicast or ingress replication, or through a control plane such as BGP EVPN or LISP.
- Remember
- SD-Access pairs a VXLAN data plane with a LISP control plane, while many data center fabrics pair VXLAN with BGP EVPN.
- Tested as
- Links topic 2.3 to the SD-Access architecture topic.
- Trap
- Saying VXLAN needs no control plane because it is 'just encapsulation'.
Side by side
Concepts candidates mix up, compared on the point that decides the answer.
Type 1 vs. type 2 hypervisor
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Type 1 (bare metal) | Hypervisor installed directly on server hardware, such as ESXi | No host operating system; direct hardware access and lower overhead | Labeling it type 2 because it has a management GUI |
| Type 2 (hosted) | Hypervisor running as an application on Windows, macOS or Linux, such as VirtualBox | Depends on the host OS for drivers and scheduling | Choosing it for production server consolidation |
GRE vs. IPsec vs. GRE over IPsec
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| GRE | Generic encapsulation, IP protocol 47 | Carries multicast, broadcast and routing protocols; no encryption | Assuming it protects data confidentiality |
| IPsec (crypto map or ESP tunnel) | Encryption and integrity for unicast IP traffic | Secure, but a policy-based crypto map does not carry routing protocol multicast | Expecting OSPF hellos to cross a policy-based IPsec tunnel |
| GRE over IPsec | GRE tunnel whose packets are encrypted by IPsec | Combines routing protocol support with encryption at the cost of extra overhead | Forgetting to lower the MTU for the combined headers |
LISP vs. VXLAN
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| LISP | Locator/ID Separation Protocol | Mapping system that answers where an endpoint lives; acts as control plane in SD-Access | Thinking it is only a data encapsulation |
| VXLAN | Virtual Extensible LAN, MAC-in-UDP encapsulation | Data plane that carries Layer 2 frames over Layer 3 with a 24-bit segment ID | Calling it the SD-Access control plane |
Exam traps
Each trap is an answer that looks right. Learn the clue that should change your mind.
-
Global ping for VRF test
- What candidates pick
- Conclude the VRF configuration is broken because a ping to the neighbor fails.
- Why it looks right
- Ping is the default first troubleshooting step.
- Why it's wrong
- Without the vrf keyword, ping uses the global routing table, where the VRF neighbor does not exist; ping vrf NAME is the correct test.
Clue to watch for The interfaces in the exhibit show vrf forwarding, but the test command has no VRF name.
-
Timers for a flapping tunnel
- What candidates pick
- Adjust tunnel keepalives or OSPF timers to stop the tunnel from flapping.
- Why it looks right
- Flapping looks like a timing problem.
- Why it's wrong
- A recursive routing condition makes the route to the tunnel destination point into the tunnel; timers do not change that.
Clue to watch for A log message mentions recursive routing, or the overlay routing protocol advertises the transport subnet.
-
GRE as a security control
- What candidates pick
- Use a GRE tunnel to protect sensitive traffic across the internet.
- Why it looks right
- Tunnels sound private.
- Why it's wrong
- GRE only encapsulates; payloads are readable in transit unless IPsec protects the tunnel.
Clue to watch for The requirement includes confidentiality or encryption.
-
Only UDP 500 permitted
- What candidates pick
- Allowing IKE on UDP 500 is enough for an IPsec tunnel through a NAT device.
- Why it looks right
- IKE is the visible negotiation protocol.
- Why it's wrong
- With NAT in the path, NAT traversal switches to UDP 4500 and ESP is carried inside it, so UDP 4500 must also be permitted.
Clue to watch for The scenario mentions a NAT device or a branch behind a home router.
-
VXLAN equals VLAN scale
- What candidates pick
- VXLAN supports up to 4,094 segments like 802.1Q.
- Why it looks right
- Both names include 'LAN' and both identify segments.
- Why it's wrong
- VXLAN uses a 24-bit VNI, giving about 16 million segments; the 12-bit VLAN ID is what limits 802.1Q.
Clue to watch for The question asks about multi-tenant scale beyond the VLAN limit.
-
Map resolver registration
- What candidates pick
- Egress tunnel routers register EIDs with the map resolver.
- Why it looks right
- Resolver sounds like the database.
- Why it's wrong
- ETRs register with the map server; ITRs send map requests to the map resolver.
Clue to watch for The wording separates 'register' from 'request' or 'query'.
Answer framework
Apply these steps when a Virtualization question shows a configuration or describes a separation requirement.
- Decide whether the requirement is separating routing tables (VRF), carrying traffic across another network (tunnel) or separating identity from location (LISP or VXLAN).
- For VRF exhibits, confirm each interface's VRF membership and address, and make sure every verification command includes the VRF name.
- For tunnels, check source, destination and how the router reaches the destination through the underlay, watching for recursive routing.
- Add IPsec whenever the scenario requires confidentiality, and confirm UDP 500, UDP 4500 and ESP are allowed through firewalls and NAT.
- For overlay concepts, name the plane first: LISP maps identifiers to locators, while VXLAN encapsulates frames with a VNI between VTEPs.
Practice question
Want more like this? The CCNP ENCOR practice test has questions for every domain.
Checklist
0 of 13
Tick each one you can do without notes. Your ticks stay in this browser.
Study strategy
Begin with topic 2.2 because it is the configure-and-verify item in this domain. In a lab, build two VRFs with overlapping addresses on one router, then a GRE tunnel between two routers, then protect it with IPsec. Break each one on purpose: apply vrf forwarding after the address, advertise the tunnel destination into OSPF, block UDP 4500. Seeing the error messages yourself makes exhibit questions quick.
Next, study LISP and VXLAN as two halves of one design, using a single diagram that shows an ITR querying the map resolver and a VTEP encapsulating with a VNI. Hypervisor and virtual switch concepts in topic 2.1 need the least time; one comparison table is usually enough.
Candidates often underestimate MTU and NAT traversal details, which turn simple tunnel scenarios into trick questions. Afterwards, revisit SD-Access in the Architecture domain, where this LISP and VXLAN knowledge becomes the fabric, then practise timed exhibit questions on VRFs and tunnels.
FAQ
How much is Virtualization worth on ENCOR?
Cisco weights it at 10% of the v1.2 exam, the same as Network Assurance and the smallest weighting on the blueprint.
Which Virtualization topics need hands-on practice?
Topic 2.2, configure and verify data path virtualization, is the hands-on item. VRF, GRE and IPsec configuration and verification commands should be practised in a lab.
Do I need MPLS for VRFs on ENCOR?
No. The topic covers VRFs on a single device or between devices without MPLS, which is VRF-lite. Route distinguishers and route targets matter for MPLS VPNs, not for VRF-lite.
Is GRE secure on its own?
No. GRE encapsulates packets but does not encrypt them. Combine it with IPsec when the scenario requires confidentiality.
What is the difference between LISP and VXLAN?
LISP is a mapping system that tells routers where an endpoint identifier lives, while VXLAN is an encapsulation that carries Layer 2 frames across a Layer 3 network. SD-Access uses LISP for the control plane and VXLAN for the data plane.
How deep do hypervisor questions go?
The topic says describe, so expect to classify hypervisor types and explain virtual machines and virtual switching, not to configure a specific hypervisor product.
Other Networking certifications
Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.
Test your Domain 2 knowledge
You have worked through VRF verification, tunnel failures such as recursive routing, and the split between LISP and VXLAN. Test whether you can spot those issues in exhibits.
Keep going
- Training Training Built on your Weak areas
- Practice test Questions by domain, with explanations
- Mock exam Full length, timed like the real exam
- Readiness test Find your weakest domain in minutes
- Cheat sheet Key terms and formulas on one page
- Ask the CCNP ENCOR AI tutor Get any concept explained your way