Level 3 · Professional

Cisco Certified Network Professional (CCNP Enterprise)

The level where you specialize. CCNP = two exams: the ENCOR 350-401 core plus one concentration exam of your choice. Cisco rebranded its DevNet track into Automation at this level — and choosing the automation path puts you in front of a 25% jump in job listings.

Bonus: passing ENCOR alone also earns you a Specialist certification AND qualifies you to attempt the CCIE lab — it's the gateway exam for Level 4.

# Core Exam Syllabus — ENCOR 350-401

The six official ENCOR domains. Infrastructure is the monster at 30% — budget your time accordingly.

My CCNP progress0 / 0
1. Architecture 15%
2. Virtualization 10%
3. Infrastructure 30%
4. Network Assurance 10%
5. Security 20%
6. Automation 10%

# Pick One Concentration Exam

Core + any one of these = CCNP Enterprise. The Automation track is the demand magnet.

ExamTrackBest for
300-435 ENAUTO ⭐Automation (former DevNet)The 25%-demand-spike track: Python, APIs (IOS-XE, DNA Center, SD-WAN), NETCONF/RESTCONF, Ansible. My pick.
300-410 ENARSIAdvanced Routing & ServicesThe classic deep-routing path (BGP, OSPF, EIGRP, VPN, MPLS basics). Best base if CCIE Enterprise is the goal.
300-415 ENSDWISD-WANBranch-connectivity specialists; very hot in large retail/banking.
300-420 ENSLDNetwork DesignPre-architect path; pairs well with the Level 5 goal.
300-425 / 300-430Wireless Design / ImplementationWi-Fi specialists (stadiums, hospitals, campuses).

# Hands-On Labs

CCNP labs outgrow Packet Tracer — this level moves to EVE-NG/CML with realistic multi-site topologies, plus the free Cisco DevNet sandboxes for automation.

LAB 01 — Multi-Area OSPF Enterprise Campus

8+ routers: backbone area 0, two branch areas, summarization at ABRs, a stub area, and route filtering. Then injure it: mismatched area types, missing virtual link — and repair.

Real-world case: A national company with HQ + regional offices — exactly how their routing is structured, including why summarization keeps routing tables sane.
EVE-NG / CMLCampus routing design

LAB 02 — BGP to Two ISPs (Multihoming)

Your edge AS peers with two simulated ISPs. Configure eBGP, influence outbound path with local-preference and inbound with AS-path prepending. Fail ISP-A and watch traffic shift.

Real-world case: Every serious business has two internet providers. Knowing how to steer traffic between them is one of the most valuable skills in networking.
EVE-NG / CMLISP multihoming

LAB 03 — VRF + GRE/IPsec: Two Tenants, One Network

Carry two isolated customer networks (VRFs) across shared routers, then connect sites over an encrypted GRE-over-IPsec tunnel across a simulated internet.

Real-world case: A managed service provider hosting two clients on shared hardware with contractual isolation — VRFs are the answer auditors accept.
EVE-NG / CMLMulti-tenant isolation

LAB 04 — NetFlow + IP SLA: Find the Bandwidth Hog

Enable Flexible NetFlow, export to a collector, generate mixed traffic, identify the top-talker. Add IP SLA probes that alert when latency to a "datacenter" exceeds threshold.

Real-world case: "The network is slow" at month-end close. NetFlow shows it's a backup job running at noon — you reschedule it and look like a hero.
EVE-NG + collectorPerformance forensics

LAB 05 — RESTCONF/NETCONF Against Real IOS-XE

Use the free DevNet always-on IOS-XE sandbox: retrieve interface config via RESTCONF (YANG model), modify a description via NETCONF from Python, verify on-box.

Real-world case: Modern network platforms (and your future employer's tooling) talk YANG models, not screen-scraped CLI.
DevNet SandboxPython + requests/ncclientModel-driven config

LAB 06 — Ansible Configuration Factory

Inventory of 10 lab devices. Playbooks that: deploy standard SNMP/NTP/syslog config, verify compliance, and roll back drift. Store everything in Git with meaningful commits.

Real-world case: Config drift across hundreds of devices causes outages and audit failures. "Network as code" teams exist in every Fortune 500 now.
Ansible + EVE-NGGitConfig compliance

LAB 07 — SD-WAN on the DevNet Sandbox

Use the reservable Cisco SD-WAN sandbox: explore vManage, build a policy, then pull device inventory and stats via the vManage REST API with Python.

Real-world case: A retailer replacing MPLS at 300 stores with SD-WAN — the single most common enterprise WAN project of the decade.
DevNet SD-WAN SandboxBranch transformation

LAB 08 — 802.1X Network Access Control

Configure 802.1X with a RADIUS server: a corporate laptop authenticates onto the staff VLAN, an unknown device lands in a quarantine VLAN via MAB fallback.

Real-world case: Zero-trust initiatives start at the switch port. NAC rollout experience is heavily requested in security-conscious industries.
EVE-NG + FreeRADIUS/ISEZero-trust access

# Tools & Simulators for This Level

EVE-NG (Community)

The CCNP workhorse — big topologies, multiple vendors, snapshots. Needs a decent PC (32 GB RAM recommended) or a cheap dedicated mini-PC.

Free

Cisco Modeling Labs (CML) Personal

Legal, current IOS-XE/NX-OS images straight from Cisco. Worth every dollar at this level.

Cisco DevNet Sandboxes

Free always-on and reservable labs: IOS-XE RESTCONF, DNA Center, SD-WAN. No hardware needed for the entire automation domain.

Free

Python + Netmiko / ncclient / requests

Your automation toolkit. Add pyATS/Genie for parsing — it's Cisco's own test framework.

Free

Ansible

cisco.ios collections for config management. Pairs with Git for the "network as code" workflow employers want.

Free

CBT Nuggets / INE / OCG books

Structured ENCOR video courses + the Official Cert Guide as reference. Boson ExSim again for practice exams.

Reality check: 6–12 months while working a CCNA-level job. The job experience and the cert reinforce each other — don't study this in a vacuum.

# Growth Check — After This Level

Skills I Now Own

  • Design multi-area OSPF and a dual-ISP BGP edge, steering traffic with local-preference and AS-path prepending.
  • Isolate tenants with VRFs and connect sites over GRE/IPsec tunnels.
  • Automate at scale: Ansible playbooks for compliance, RESTCONF/NETCONF with YANG models, all version-controlled in Git.
  • See the network: NetFlow, IP SLA and packet-level evidence instead of guesswork.

Self-Check Before the Exams

  • Can I recite the BGP path-selection order and predict which route wins in a given table?
  • Can I explain SD-WAN's control vs data plane (vManage, vSmart, vBond, OMP) on a whiteboard?
  • Can I write an Ansible playbook from a blank file, without copying an old one?
  • Given a broken 802.1X port, do I know the auth flow well enough to find where it fails?

My Next Growth Step

  • Go deep on my chosen concentration (Automation ⭐) — depth in one track beats shallow coverage of all five.
  • Automate one real, repetitive task in my daily work or home lab — applied learning sticks hardest.
  • Begin Phase 1 technology drilling for CCIE: one protocol at a time, to exhaustion.
← PreviousLevel 2: CCNA