CCNP ENARSI 300-410 Study Guide (v1.1): Domains, Labs and a 12-Week Plan

ENARSI (300-410, Implementing Cisco Enterprise Advanced Routing and Services) is a 90-minute Cisco exam, currently version 1.1, that tests whether you can troubleshoot enterprise routing and the services around it: EIGRP, OSPF, BGP, redistribution, DMVPN, router security and IP services such as SNMP, DHCP, IP SLA and NetFlow. It is a concentration exam for CCNP Enterprise: pass it together with the ENCOR (350-401) core exam and you hold CCNP Enterprise. On its own, it earns the Cisco Certified Specialist – Enterprise Advanced Infrastructure Implementation certification.

This guide follows the official v1.1 exam topics. I go through what each domain actually asks of you, how ENARSI differs from ENCOR, a 12-week plan and the labs worth building. Before you book, read Cisco's official ENARSI exam topics. Cisco revises blueprints, and that page is the only source that counts.

ENARSI 300-410 at a glance

What is on the ENARSI exam?

Four domains. The weights tell you roughly how much of the exam each one takes:

Look at the verbs in the official list. Most items start with "troubleshoot", a few with "configure and verify", and only a handful with "describe" (BFD, MPLS, L3VPN and IPv6 first-hop security). That tells you the shape of the exam: it wants you to find what is broken in output you didn't write, not to recite definitions.

Redistribution is the heart of this domain. A route redistributed at two points between OSPF and EIGRP can come back into the protocol it started from with a better administrative distance, giving you suboptimal routing or a loop. You fix it with tags (tag routes in one direction, deny that tag on the way back) or by adjusting distance. Know the seed metrics: OSPF uses 20 by default (1 for routes from BGP), while EIGRP needs one for routes from OSPF or BGP or it won't advertise them. Redistributing BGP into an IGP takes only eBGP-learned routes unless you add bgp redistribute-internal.

For OSPF, the classic adjacency faults are mismatched area, timers, authentication, area type and MTU (neighbors stuck in EXSTART or EXCHANGE). A network type mismatch is nastier: the adjacency can come up while routes still go missing. For BGP, most broken sessions come down to loopback peering without update-source, eBGP between loopbacks without ebgp-multihop, or iBGP routes never installed because nobody set next-hop-self.

MPLS is describe level, so you need the mechanics, not a provider configuration: what LDP does, the two labels on an L3VPN packet (transport and VPN), and why the route distinguisher only makes prefixes unique while the route target decides which VRF imports them. DMVPN is configure and verify, so lab it until you can build it without notes. Phase 1 sends everything through the hub. Phase 2 lets spokes tunnel to each other directly, so the hub must not change the next hop (for EIGRP: split horizon and next-hop-self off on the hub tunnel). Phase 3 adds NHRP redirect on the hub and NHRP shortcut on the spokes, which lets the hub summarize. With OSPF's broadcast network type over the tunnel, the hub must be the DR, so spokes get priority 0.

The AAA trap worth knowing: aaa authentication login default group tacacs+ local falls back to the local database only when the server does not answer. If the server rejects you, the router does not try the next method. With CoPP, a permit in the ACL behind a class map means "this traffic belongs to the class", not "allow it"; the policy map decides what happens. A CoPP policy that forgets to classify OSPF or BGP drops them into a tightly policed default class, and adjacencies start flapping. uRPF strict mode breaks under asymmetric routing; loose mode only checks that some route to the source exists. And IPv6 ACLs carry implicit permits for neighbor discovery, so ending your own ACL with deny ipv6 any any breaks ND.

This domain is a quarter of the exam, and people under-study it because each topic looks small. Things worth knowing cold: SSH needs a hostname, a domain name and an RSA key, and an access-class on the VTY lines can silently block you. Conditional debugging lets you debug one interface or peer on a busy router. A DHCP relay needs ip helper-address on the interface facing the clients. IP SLA plus a track object on a static route is the standard failover pattern, and UDP jitter needs ip sla responder on the far end. Flexible NetFlow is a flow record, a flow exporter and a flow monitor applied to an interface.

Catalyst Center Assurance is the odd one out, because you can't run it in a typical home lab. Learn its health views and how it reports issues from Cisco's documentation, and use a Cisco DevNet sandbox if you can get access to one.

How hard is ENARSI?

Cisco doesn't publish pass rates or a passing score, so any number you see on a forum is a guess. What the blueprint does tell you: ENARSI is narrower than ENCOR but much deeper. ENCOR asks you to know OSPF; ENARSI shows you output from three routers and asks why one route is missing. In 90 minutes you can't reason slowly through every output, so you need to have seen most failure patterns in a lab already. If you work with WAN edges and BGP to a provider, much will feel familiar; coming straight from CCNA, BGP and redistribution will take most of your time.

One lesson from failing my first CCNA attempt with 58%: knowing the material when you read it is not the same as answering correctly against a clock. Do timed practice before you book the exam, not after.

ENARSI vs ENCOR: what's the difference?

The overlap is real: OSPF, EIGRP, BGP, VRFs, AAA, CoPP, SNMP, syslog, NetFlow, IP SLA and Catalyst Center appear in both, at configure-and-verify depth in ENCOR and troubleshooting depth in ENARSI. That's why I'd take the two close together. There's no required order: ENCOR first gives you breadth before depth; ENARSI first works if routing is already your daily work.

If you're still on the core exam, my CCNP ENCOR study guide covers it, and the ENCOR practice test is a good check of the routing topics the two exams share.

How long should you study for ENARSI?

A realistic range is 10 to 16 weeks at 8 to 10 hours a week: the short end if you passed ENCOR recently and configure routers at work, the long end if BGP is new to you. The plan below is 12 weeks and assumes ENCOR-level protocol knowledge. Every week has a lab from the list below; skip the lab and the week doesn't count.

Which labs should you build for ENARSI?

Packet Tracer only simulates a subset of IOS, and at this level you'll keep hitting commands it doesn't have. Use Cisco Modeling Labs (CML), EVE-NG or GNS3 with legally obtained IOSv or Catalyst 8000v images. Most labs below need 4 to 8 routers.

1. Redistribution loop. OSPF on one side, EIGRP on the other, mutual redistribution on two routers. Leave the tags out and watch the suboptimal path appear in show ip route and traceroute. Fix it with tags, then again with distance, and compare.
2. EIGRP dual-stack. Named mode at the hub, classic mode at a branch, a stub, and unequal-cost load balancing with variance. Break it with mismatched K values, a wrong key chain and a wrong AS number.
3. OSPF multi-area. Backbone, a totally stubby area, an NSSA with an ASBR, and a virtual link. Break MTU, timers, area type, network type and router ID, then rebuild it in OSPFv3.
4. BGP with policy. iBGP over loopbacks with a route reflector, eBGP to a second AS. Break update-source, ebgp-multihop, next-hop-self and the password. Then steer traffic with local preference, AS-path prepending and MED, and filter with prefix lists.
5. VRF-Lite and PBR. Two customers with the same 10.0.0.0/24 on one router, a different IGP in each VRF, then a route map that sends one source subnet over a backup link.
6. MPLS L3VPN. Two PEs and a P router, LDP in the core, MP-BGP VPNv4 between the PEs, one customer VRF. It's describe level on the exam, but after building it once, RDs, RTs and the label stack stop being abstract.
7. DMVPN. One hub and three spokes across an "internet" router: Phase 2, then Phase 3, an IPsec profile, EIGRP and then OSPF over the tunnel. Break it with a wrong NHRP server address, mismatched IPsec settings and a spoke that wins the DR election.
8. Infrastructure security. FreeRADIUS or a TACACS+ server on a Linux node with local fallback (shut the server down and see what happens), a CoPP policy that doesn't break routing, uRPF strict mode with an asymmetric return path, and an IPv6 traffic filter.
9. Infrastructure services. DHCP server and relay, stateless DHCPv6, IP SLA tracking a default route with a floating static backup, Flexible NetFlow to a free collector, SNMPv3 authPriv, and syslog plus a conditional debug.

How to study for ENARSI

• Mark up the exam topics. Rate each official item: can't do it, can do it with notes, can do it without notes. Re-rate every two weeks.
• Learn the show commands, not just the configuration. show ip protocols, show ip eigrp topology, show ip ospf database, show ip bgp, show dmvpn, show policy-map control-plane. On this exam, reading output is most of the work.
• Use a fixed troubleshooting order. Is the neighbor up? Is the route in the protocol's database? In the routing table? Advertised? Filtered or overridden somewhere?
• Pair a structured source with labs. The Cisco Press ENARSI Official Cert Guide (check that your edition matches v1.1) or the Cisco U. ENARSI learning path gives you structure; labs give you speed.

ENARSI FAQ

CertAce is not affiliated with or endorsed by Cisco Systems. Cisco, CCNP and CCIE are trademarks of Cisco Systems, Inc. Exam facts on this page come from Cisco's published exam topics for 300-410 ENARSI v1.1; check that page for changes before you book.