Cisco 350-401: Enterprise Network Architecture and Design — Study Guide

By Laurynas Brazys · 15 August 2026 · #cisco #350-401 #certification #exam-prep #study-guide

Part of the Cisco CCNP Enterprise 350-401 ENCOR — Study Guide. Practice with verified answers in the Cisco exam hub, or take timed practice tests on ExamRoll.io.

Overview

Enterprise network architecture provides the blueprint that aligns connectivity, security, and application delivery with business goals. Sound design decomposes the network into planes and layers, reduces fault impact with clearly defined domains, and balances resiliency, performance, scale, and cost. Modern enterprises span on-premises campuses and data centers, cloud regions, and remote sites, often connected by programmable overlays and governed by intent-based controllers. The following sections detail campus tiered designs, fabric architectures, availability patterns, cloud and virtualization considerations, trade-offs, capacity planning, documentation, controller concepts, and lifecycle practices, with operational reasoning and common failure modes called out.

Campus and Fabric Architecture

Two-tier and three-tier campus designs:

• Two-tier (collapsed core): Combines core and distribution functions. Best suited for small to medium campuses where latency and cost are prioritized and floor distribution is limited. Failure domains expand because aggregation and core are shared; plan redundancy accordingly.
• Three-tier: Distinct core, distribution, and access.
  • Access: Provides user and device connectivity, PoE, edge security, and QoS classification/marking. Prefer routed access (Layer 3 from access to distribution) to shrink Layer 2 domains, eliminate spanning tree in the uplinks, and enable fast ECMP convergence.
  • Distribution: Aggregates access, enforces policy, Layer 3 summarization, isolation of access failures, and provides a control-plane boundary. Dual-homing access to a pair of distribution switches with layer-3 point-to-point links is common.
  • Core: Fast, resilient Layer 3 transport with minimal policy. Best practice is redundant Layer 3 point-to-point links between core devices for predictable, fast convergence and equal-cost multipath. Keep features lean to avoid control-plane churn.

Routed access and migration: Routed access simplifies moving from traditional Layer 2 to programmable fabrics. Anycast default gateways in a fabric can replace FHRPs at distribution, reducing HSRP/VRRP/GLBP complexity. In a traditional model with multivendor routers and dual-stack hosts, VRRPv3 is favored for IPv4/IPv6 gateway redundancy.

Fabric concepts:

• Underlay: Physical IP reachability for fabric nodes (e.g., IS-IS/OSPF/BGP). Design for fast convergence (BFD, point-to-point links, ECMP).
• Overlay: Logical Layer 2 and Layer 3 virtualization and segmentation atop the underlay. In Cisco SD-Access, the overlay provides virtual networks (VRFs) and scalable groups via VXLAN data plane.
• Control plane: Maps endpoint identities to locations. SD-Access uses LISP for endpoint ID-to-location mapping; a fabric control-plane node maintains the global database of endpoints and networks.
• Fabric roles:
  • Edge node: First-hop for wired/wireless clients; enforces policy and encapsulates traffic into the overlay.
  • Border node: Connects the fabric to external networks or other fabrics; performs translation between overlay and non-overlay domains.
  • Control-plane node: Stores and resolves endpoint mappings for the fabric.
  • Fusion router: Leaks routes between fabric virtual networks and shared services, maintaining segmentation while enabling access to common resources.
• Wireless in fabric: RRM executes on the wireless controller. Fabric-enabled wireless integrates APs and WLCs with the overlay, preserving segmentation and policy.

Plane separation:

• Data plane: Actual packet forwarding (ASIC-driven, FIB-based).
• Control plane: Topology, reachability, and mapping protocols (e.g., OSPF/BGP/LISP). The RIB feeds the FIB; the RIB stores routing prefixes, the FIB holds egress-forwarding information built from the RIB.
• Management plane: Configuration, telemetry, assurance (e.g., DNAC, vManage, SNMP, model-driven telemetry). Strong RBAC and API governance are required.

Common failure modes and mitigations:

• Layer 2 loops/broadcast storms: Minimize Layer 2 blast radius; use storm control and UDLD. Routed access reduces risk.
• Default-gateway contention: FHRP tuning or anycast gateways in fabric. Track upstream reachability to avoid asymmetric black holes.
• Control-plane overload: Keep core lean; summarize at distribution; avoid excessive policy or TCAM usage in the core.

High Availability, Redundancy, and Failure-Domain Design

Design principles:

• Redundancy patterns: Device redundancy (dual supervisors, switch stacks, StackWise Virtual), link redundancy (port-channels), and path redundancy (ECMP). StackWise Virtual’s Link Management Protocol rejects unidirectional link traffic forwarding, preventing half-up aggregates.
• Fast convergence: Bidirectional Forwarding Detection (BFD), tuned IGP timers, NSF/SSO on capable platforms, and constrained failure domains (hierarchical summarization). Prefer point-to-point routed links for deterministic reconvergence.
• Fault-domain boundaries: Contain impact by isolating access VLANs per floor/building, using VRF-based segmentation, and placing shared services behind dedicated route-leaking points (fusion). Use maintenance domains aligned to business-criticality.

FHRPs and default gateways:

• Use VRRPv3 when dual-stack and multivendor interoperability are required. Anycast gateways in a fabric can supersede FHRPs while preserving first-hop redundancy with fabric-wide consistency.

Example VRRPv3 for IPv4/IPv6 on a distribution SVI: interface Vlan20 ip address 10.20.0.2 255.255.255.0 vrrp 20 address-family ipv4 address 10.20.0.1 ! ipv6 address 2001:db8:20::2/64 vrrp 20 address-family ipv6 address 2001:db8:20::1

Trade-offs:

• Active/active stacks and MLAGs maximize utilization but add complexity to operations and failure isolation.
• Summarization reduces control-plane churn but can mask reachability loss; use discontiguous summaries cautiously.
• Larger failure domains minimize hardware cost but increase blast radius; right-size domains to application criticality.

Cloud, Virtualization, and Service Delivery

Enterprise architectures:

• On-premises: Full control of physical and logical design; latency-sensitive services; typically three-tier campus and fabric-enabled segmentation.
• Cloud: IaaS/PaaS/SaaS models shift operational boundaries. The provider handles the physical underlay; you design overlays, routing, and security in virtual networks.
• Hybrid: Securely interconnect on-prem and cloud via IPsec/GRE, direct connects, or SD-WAN. Normalize policy and segmentation across sites.
• Multi-cloud: Consistent connectivity and security across providers. Cloud routers/virtual appliances or SD-WAN act as transit with unified policy.

Controller-based WAN:

• Cisco SD-WAN uses vSmart to manage the control plane and OMP between edge routers, vManage as the single plane of management, and vBond for orchestration. Centralized intent drives consistent routing, segmentation, and security. Policy is distributed; data-plane is direct between sites.

Virtualization:

• Hypervisors (KVM/ESXi/Hyper-V) host virtual switches that provide Layer 2 between VMs. Controlled Layer 2 connectivity is achieved using the hypervisor-provided vSwitch or a VM-based soft switch. Benefits include reduced rack space, power, and cooling, and rapid provisioning.
• Failure modes: Large Layer 2 domains and ARP/ND traffic can cause broadcast amplification, especially with chatty VMs. Mitigate with smaller subnets, ARP suppression in overlays, and robust control-plane policing.
• Containers: Lightweight workloads with overlay networking (e.g., VXLAN/Geneve via CNI). Plan for ephemeral endpoints, east-west flows, and service meshes; enforce microsegmentation at the host, vSwitch, and fabric levels.
• Service delivery models:
  • IaaS: You manage guest OS, networking within VPC/VNet, and security controls.
  • PaaS: Constrained network control; focus on secure connectivity, private endpoints, and policy-based egress.
  • SaaS: Optimize DNS, latency, and secure access; SD-WAN local breakouts and CASB/SASE integrations are common.

SD-Access and external connectivity:

• Border nodes connect fabrics to outside networks. Fusion routers perform route leaking between virtual networks and shared services to preserve segmentation while enabling necessary access.

Design Trade-offs, Capacity Planning, Documentation, and Lifecycle

Trade-offs among scale, resiliency, performance, and cost:

• Scale: More overlays, VRFs, and policies require TCAM/CPU; plan hardware accordingly. ECMP scales performance but increases troubleshooting complexity.
• Resiliency: Dual fabrics and diverse paths reduce risk but raise cost. Decide acceptable MTTD/MTTR and align redundancy depth.
• Performance: Low-latency cores avoid service-policy processing; push ACL/QoS to edges. Shared services may need high-bandwidth paths or caching.
• Cost: Oversubscription ratios (e.g., 4:1 at access, 2:1 at distribution) balance budget and throughput; validate against actual traffic patterns.

Capacity planning and traffic-flow analysis:

• Measure before sizing: Use NetFlow/IPFIX, sFlow, SPAN sampling, and controller telemetry. Analyze 95th-percentile bandwidth, pps, flow counts, and microbursts.
• Headroom: Reserve 20–30% capacity to absorb bursts, maintenance, and growth.
• WAN QoS: Traffic shaping mitigates congestion by buffering and queuing packets above the committed rate. Use hierarchical QoS to prioritize voice and control traffic, reducing jitter and bandwidth-related loss.
• Example WAN shaping policy: class-map match-any REALTIME match dscp ef ! policy-map WAN-QOS class REALTIME priority percent 20 class class-default fair-queue random-detect ! policy-map WAN-SHAPER class class-default shape average 100000000 service-policy WAN-QOS ! interface GigabitEthernet0/0 service-policy output WAN-SHAPER

Documentation, topology models, and validation:

• High-level design (HLD): Logical topology, fault domains, routing, security, and segmentation strategy.
• Low-level design (LLD): IP/VLAN plans, underlay/overlay parameters, QoS, device roles, and templates. Maintain a source of truth for automation.
• Topology models: Layered (core/distribution/access), fabric roles (edge/border/control-plane), and service insertion points (firewalls, proxies, telemetry).
• Validation: Lab emulate underlay/overlay; run path and failure simulations; verify scale (routes, endpoints, policies) against platform limits; perform change dry-runs and rollback testing. Continuously validate with assurance tools that compare intent vs. state.

Controller-based and intent-driven design:

• Define desired outcomes (segmentation, SLAs, security posture). Controllers translate intent into device configurations and validate compliance via telemetry. Closed-loop assurance highlights drift and anomalies for remediation. Identity Services Engine (ISE) integrates with SD-Access to authorize wired/wireless clients based on identity and posture.

Lifecycle from requirements through operations:

• Gather requirements: Business drivers, compliance, applications, SLAs, growth.
• Translate to architecture: Choose tiers, fabrics, controllers, and security model.
• Detailed design: Addressing, routing, QoS, segmentation, device/platform selection.
• Build and validate: Staging, automated provisioning, baseline tests, failure drills.
• Operate and optimize: Monitoring, capacity management, SLO reporting, incident response, and periodic design reviews. Iterate intent policies based on assurance findings.

Practical Problem Scenario

Northwind Manufacturing is consolidating two aging campuses and extending workloads into two public clouds. Objectives: collapse legacy Layer 2 domains, enable identity-based segmentation, provide deterministic WAN performance, and ensure seamless access to shared services.

Approach:

1. Adopt a three-tier routed campus with fabric-ready access

• Rationale: Routed access removes spanning-tree dependencies and shrinks failure domains. Point-to-point Layer 3 uplinks to distribution enable ECMP and fast convergence. Keeping the core feature-light ensures predictable performance.

2. Deploy SD-Access for identity-based segmentation

• Rationale: Fabric edge nodes provide anycast gateways and enforce group-based policies. A control-plane node maintains endpoint mappings via LISP, and the overlay (VXLAN) delivers logical L2/L3 segments across the campus with consistent policy for wired and wireless. ISE decides whether a wired client is allowed access when connecting to an edge switch.

3. Connect the fabric to shared services via border and fusion

• Rationale: Border nodes interface with external routed domains. A fusion router cleanly leaks routes between user virtual networks and shared services (DNS/AD/printing), preserving segmentation while enabling controlled access.

4. Implement SD-WAN to interconnect sites and clouds

• Rationale: Cisco SD-WAN provides centralized intent. vSmart manages the control plane using OMP; vManage offers the single plane of management. Policies steer traffic to SaaS and between sites, enabling local internet breakouts with security and deterministic path selection.

5. Right-size redundancy and fault domains

• Rationale: Dual distribution pairs per building and stacked access switches limit the blast radius. StackWise Virtual provides chassis redundancy; its LMP rejects unidirectional link forwarding, preventing asymmetric failures. Summarization at distribution reduces control-plane churn while preserving accurate failure visibility.

6. Engineer QoS for WAN and campus edge

• Rationale: Shaping on WAN links buffers packets above the committed rate to mitigate congestion. Priority queuing for voice/video reduces excess jitter; WRED on default classes avoids tail drop for elastic flows. Marking is enforced at access to maintain trust boundaries.

7. Plan capacity with empirical traffic data

• Rationale: Collect NetFlow/IPFIX and controller telemetry to profile 95th-percentile utilization, pps, and top talkers. Size uplinks and WAN circuits with 30% headroom, validate ECMP hashing for elephant flows, and ensure TCAM scale for VRFs and policies.

8. Validate and automate operations

• Rationale: Build HLD/LLD, use a source of truth to generate configs, and stage deployment in a lab mirroring underlay/overlay. Execute failure drills (link, node, controller loss), verify reconvergence targets, and baseline latency/jitter. Post-deployment, use assurance to detect intent drift and feed continuous improvement into change management.

This design meets Northwind’s goals by constraining failure domains, enforcing identity-based policy end-to-end, assuring predictable WAN performance, and enabling multi-cloud expansion with consistent governance and operations.

All domains · Campus Layer 2 Switching and Segmentation →

Practice these questions → · Timed practice on ExamRoll.io →