Cisco 350-401: Network Virtualization, Overlays and Fabric Technologies — Study Guide

By Laurynas Brazys · 15 August 2026 · #cisco #350-401 #certification #exam-prep #study-guide

Part of the Cisco CCNP Enterprise 350-401 ENCOR — Study Guide. Practice with verified answers in the Cisco exam hub, or take timed practice tests on ExamRoll.io.

Overview

Modern enterprise networks rely on virtualization and fabric overlays to scale, segment, and automate services across campus, data center, and WAN domains. An IP-routed underlay provides reachability and entropy for ECMP, while the overlay supplies tenant isolation, mobility, and policy. Control-plane separation decouples endpoint discovery and route distribution from data forwarding, enabling fast convergence, consistent security, and deterministic operations. This section examines the building blocks—VRFs, VXLAN, EVPN, LISP, and Cisco SD-Access—along with design trade-offs, operational practices, and migration patterns from traditional VLAN-based networks.

Underlays, Overlays, and Encapsulation

An underlay is the physical or logical IP transport fabric. Its goals are simple, fast, and highly available connectivity using equal-cost multipath. Design guidance:

• Routed access and spine–leaf designs minimize L2 fault domains, avoid STP, and accelerate convergence.
• Use consistent loopback addressing for control-plane adjacencies and VTEP source IPs.
• Provision MTU headroom for overlay encapsulation (for SD-Access, 9100 is recommended).

The overlay provides logical networks (L2 and L3 segments) independent of the underlay topology. Benefits include tenant isolation, any-to-any connectivity, and mobility without subnet renumbering. Overlays require:

• Encapsulation (e.g., VXLAN over UDP 4789) to carry virtual identifiers and extend segments.
• A control plane to distribute endpoint-to-tunnel bindings (e.g., BGP EVPN or LISP).

Control-plane separation trades state dissemination for scalability:

• Without a dedicated control plane, flood-and-learn consumes bandwidth and can age out critical state unpredictably.
• With EVPN or LISP, state is signaled precisely, lowering broadcast, unknown unicast, and multicast (BUM) load and enabling features like ARP/ND suppression.

Encapsulation trade-offs:

• VXLAN over UDP: ubiquitous ECMP, NIC offload support; requires underlay MTU increase and hashing awareness of outer headers.
• GRE/NVGRE: simpler header but weaker entropy for ECMP and less hardware offload.
• MPLS-based overlays: mature QoS and OAM; requires MPLS-capable infrastructure and operational expertise.

Common failure modes:

• MTU mismatch causing silent drops of encapsulated frames—validate with DF-bit pings sized for overlay headroom.
• Asymmetric underlay routing leading to stateful firewalls dropping return traffic—place policy at overlay edges or ensure symmetry.
• Hash polarization on underlay links—enable per-flow hashing on outer headers and verify ECMP paths.

Segmentation and VXLAN/EVPN

VRFs and scalable segmentation:

• VRF instances create independent routing tables, isolating tenants, business domains, or environments (Prod/Dev/Guest).
• Combine VRFs (macro-segmentation) with micro-segmentation (e.g., scalable group tags and policy) for least-privilege access across VRFs and segments.

VXLAN components:

• VTEP: edge device encapsulating/decapsulating VXLAN. Hardware VTEPs (switches/routers) and software VTEPs (hypervisors) terminate logical segments at the fabric edge.
• VNI: 24-bit identifier mapping a segment. Use L2 VNIs for bridged segments and an L3VNI bound to a VRF for routed reachability across the fabric.
• BUM handling: flood-and-learn can use multicast in the underlay or head-end replication. Control-plane learning with EVPN eliminates most flooding via selective advertisement and ARP/ND suppression.

BGP EVPN concepts for VXLAN:

• Route types:
  • Type 2 (MAC/IP): advertises host MAC and optional IP, enabling integrated bridging and routing (IRB) and ARP/ND suppression.
  • Type 3 (IMET): signals inclusive multicast/ingress-replication for BUM.
  • Type 5 (IP Prefix): carries IP prefixes per VRF/L3VNI, enabling inter-subnet routing without host-specific Type 2 routes.
• Anycast gateway: identical SVI IP/MAC at all VTEPs; hosts keep the same default gateway while moving.
• Route targets: per-VRF and per-VNI import/export control tenant isolation and selective leaking.
• Convergence and mobility: sequence numbers on Type 2 detect mobility; stale entries are suppressed quickly.

Key trade-offs and failure modes:

• Pure flood-and-learn is simple but chatty; EVPN adds complexity but scales and reduces BUM.
• Misaligned route targets cause traffic blackholes or leakage—standardize policy templates.
• Duplicate MAC detection can quarantine endpoints if a hypervisor performs MAC spoofing; tune thresholds for VDI or clustered services.
• Type 3 missing or mismatched replication settings lead to orphaned BUM frames—validate IMET entries and replication lists.

Minimal examples (NX-OS style): vrf context TENANT_A vni 100100 rd auto address-family ipv4 unicast route-target import 65000:100100 route-target export 65000:100100

interface nve1 source-interface loopback1 host-reachability protocol bgp member vni 10010 ingress-replication protocol bgp

router bgp 65000 address-family l2vpn evpn neighbor 10.10.10.10 remote-as 65000 neighbor 10.10.10.10 update-source loopback0

LISP and Cisco SD-Access Fabrics

LISP fundamentals:

• EID: endpoint ID, typically the host IP within a virtual network.
• RLOC: routing locator, the underlay-reachable address of the xTR (edge tunnel router or VTEP).
• Map-Server/Map-Resolver: centralized database and query point. ETRs register EID-to-RLOC mappings; ITRs query to resolve mappings.
• Locator reachability: RLOC-probes monitor xTR liveliness; SMR (solicit-map-request) triggers cache updates upon mobility.
• Failure modes: stale map-cache causing suboptimal paths; MS/MR unreachability blocking new flows; NAT between xTRs hiding RLOCs—plan for RLOC transparency or NAT traversal.

Cisco SD-Access applies LISP for the campus control plane and VXLAN for the data plane:

• Fabric roles:
  • Edge node: connects wired endpoints and encapsulates traffic into VXLAN.
  • Border node: connects the fabric to external L3 networks or other fabrics; performs handoff per VRF and policy.
  • Control plane node: hosts LISP MS/MR, maintaining endpoint-to-edge bindings.
  • Wireless: APs are part of the overlay; a fabric wireless controller handles CAPWAP, RRM, and fabric integration. Roaming across edge switches uses inter-xTR procedures.
• Policy and segmentation:
  • Virtual networks map to VRFs for macro-segmentation.
  • Micro-segmentation uses scalable group tags with SGACL enforcement at fabric edges.
  • Identity Services Engine determines access upon onboarding (802.1X/MAB/webauth), then issues VN and SGT assignments, enabling consistent policy regardless of location.
• Border and fusion:
  • Border nodes provide Layer 3 handoff per VRF; a fusion router leaks routes between user VRFs and shared services using VRF-Lite or MP-BGP policy.
  • Misconfigured fusion policies can cause asymmetric routing or over-permissive access—validate route leaking and SGACL intent.
• Operational notes:
  • Use a fabric MTU of 9100 to accommodate VXLAN and policy headers.
  • Overlay network provides logical L2 and L3 services; ARP/ND suppression reduces noise.
  • Wireless fabric APs operate in fabric mode and connect directly to edge switches.

Sample checks: show lisp session show lisp eid-table vrf TENANT_A show fabric edge neighbors show ip vrf

Operations, Hypervisor Networking, Troubleshooting, and Migration

Virtual switch and hypervisor networking:

• vSwitch constructs (port groups, uplink teaming, VLAN tagging) attach workloads to physical ToR switches. Ensure consistent VLAN-to-VNI mapping when hypervisors act as VTEPs.
• Software VTEPs in hypervisors (e.g., based on OVS) extend overlays to workloads; hardware offloads (VXLAN checksum/TSO) improve performance.
• SR-IOV or accelerated NIC bypass can limit visibility and policy enforcement; ensure telemetry and security controls remain effective, or terminate SR-IOV flows at policy-aware nodes.
• LAG/LACP from hypervisors to ToR must be configured uniformly; MTU consistency across virtual and physical domains is mandatory.

Overlay troubleshooting workflow:

1. Underlay verification

• Ensure IP reachability and ECMP between loopbacks. Validate MTU: ping 192.0.2.10 size 8972 df-bit
• Check IGP/BGP stability, route recursion, and CPU on routing processes.

2. Tunnel adjacency and state

• VXLAN: verify NVE peers and VNI membership; confirm UDP 4789 reachability and TTL.
• LISP: check xTR registration to MS/MR and map-cache entries; ensure RLOC-probe success.

3. Control-plane routes

• EVPN: confirm BGP sessions and route types (2, 3, 5) per VNI/VRF; validate route-targets align with design. show bgp l2vpn evpn route-type 2
• Inspect ARP/ND suppression tables and mobility sequence numbers.

4. Endpoint identity and policy

• Confirm client authentication/authorization with ISE. Verify SGT assignment and SGACL counters to detect policy drops.

5. Data-plane validation

• Use extended pings across VNIs/VRFs. Capture at VTEP ingress/egress to confirm encapsulation and decapsulation. Check hardware ACL counters and policers.

6. Common fault isolation

• Blackhole within a VNI: missing Type 2 host route or stale entry—clear selective EVPN routes or flush ARP/ND on the affected VTEP.
• Excess flooding: IMET/replication mismatch—audit Type 3 routes and replication lists.
• Mobility issues: inconsistent anycast-gateway MAC/IP—standardize SVI virtual MAC and verify FHRP is not active on any VTEP.

Migration strategies from VLANs to fabric architectures:

• Prepare the underlay: move to routed access or spine–leaf. Eliminate L2 loops and STP dependencies wherever possible.
• Introduce VRFs and anycast gateways: migrate SVIs from distribution HSRP/VRRP to fabric anycast gateways. During transition, use first-hop redundancy only on legacy segments; do not run FHRP on fabric gateway SVIs.
• Staged VNI enablement: map existing VLANs to VNIs, then enable L3VNI per VRF. Start with low-risk segments (Guest), then critical ones (Prod).
• Border and fusion design: define per-VRF Layer 3 handoffs, deploy a fusion router to leak routes between user VRFs and shared services using explicit import/export policy.
• Wireless cutover: convert APs to fabric mode and home them to edge switches; ensure the wireless controller is integrated with the fabric control plane. Roaming across edges uses inter-xTR procedures seamlessly.
• Policy-first onboarding: integrate ISE early for identity-based VN/SGT assignment to avoid rework.
• Coexistence and rollback: maintain parallel paths with clearly defined demarcations. Validate MTU, QoS, and monitoring end-to-end before expanding scope.

Practical Problem Scenario

Contoso Health is consolidating hospitals onto a programmable campus fabric while maintaining strict separation of Clinical, Guest, and IoT domains and preserving connectivity to shared services (EHR, DNS, Internet).

1. Build a routed underlay with ECMP and MTU 9100

• Rationale: A simple IP underlay with consistent loopbacks and jumbo MTU provides predictable reachability and entropy for VXLAN hashing, ensuring high availability and headroom for encapsulation.

2. Define VRFs and map to virtual networks

• Rationale: Create VRFs Clinical, Guest, and IoT. This macro-segmentation enforces traffic isolation within the campus and aligns with compliance requirements.

3. Deploy fabric control plane nodes and edge nodes

• Rationale: Control plane nodes host LISP MS/MR for endpoint-to-edge mapping. Edge nodes attach wired users and encap/decap VXLAN, providing anycast gateways per subnet so endpoints can roam without gateway changes.

4. Integrate ISE for identity-based onboarding

• Rationale: ISE evaluates wired and wireless clients via 802.1X/MAB and assigns VN and scalable group tags. This enables uniform policy irrespective of location and device type, with SGACL enforcement at edges.

5. Enable VXLAN with EVPN on data center aggregation and campus cores

• Rationale: EVPN distributes Type 2, 3, and 5 routes for host and prefix reachability, enabling ARP/ND suppression and integrated routing/bridging. This reduces BUM and accelerates convergence for clinical applications.

6. Stand up border nodes with a fusion router for shared services

• Rationale: Border nodes connect per-VRF to the core/Internet edge. A fusion router leaks select routes between Clinical/IoT and the Shared-Services VRF using explicit import/export and SGACLs, preventing overexposure of clinical systems.

7. Migrate VLANs to VNIs in phases

• Rationale: Map existing VLANs to VNIs and cut subnets to fabric anycast gateways incrementally. This limits blast radius and enables validation of each segment’s reachability and policy before proceeding.

8. Convert APs to fabric mode and attach directly to edge switches

• Rationale: Fabric-mode APs become overlay participants, extending VNIs to wireless clients. The wireless controller continues to manage RRM and mobility; inter-xTR roaming preserves session continuity across edges.

9. Validate control-plane and data-plane health

• Rationale: Verify LISP registrations, EVPN route types per VNI/VRF, and NVE peerings. Test with DF-bit pings near 8972 bytes to ensure MTU sufficiency. Confirm SGACL counters to ensure intended micro-segmentation.

10. Establish operations runbooks and rollback plans

• Rationale: Document “underlay first, then overlay” troubleshooting, including commands to check map-caches, EVPN routes, and VXLAN peers. Maintain coexistence paths and clear demarcations to enable fast rollback if needed.

← Wireless Infrastructure and Mobility · All domains · WAN →

Practice these questions → · Timed practice on ExamRoll.io →