350-401 — Frequently Asked Questions

The primary characteristic of traffic shaping is that it buffers excess traffic that exceeds a defined rate and transmits it later in bursts, creating a smoother, more predictable traffic flow. Unlike traffic policing, which typically drops excess packets, shaping queues them. This is often used at the edge of a network to conform to a contracted rate with a service provider. A key side effect is that it can introduce variable delay (jitter) due to the buffering process.

Cisco vManage is the centralized network management system for the SD-WAN fabric. Its key characteristic is providing a single, unified dashboard to configure, manage, monitor, and troubleshoot all Cisco SD-WAN devices (vEdges, vSmart, vBond). It simplifies operations by abstracting the complexity of individual device configurations and offers features like centralized policy control, real-time monitoring, and analytics.

To terminate idle sessions on VTY lines, you use the exec-timeout command in line configuration mode. The syntax is exec-timeout minutes seconds. For example, the command exec-timeout 5 0 will disconnect any user session that has been idle for 5 minutes and 0 seconds. Setting the value to 0 0 disables the timeout feature, which is generally not recommended for security reasons.

A primary trait shared by Ansible and Chef is that they are both Infrastructure as Code (IaC) and configuration management tools. They allow network and system administrators to define the desired state of their infrastructure in human-readable code (playbooks in Ansible, recipes/manifests in Chef). This enables automation, consistency, version control, and repeatability in deploying and managing network devices and servers.

During a Layer 3 inter-controller roam, the client moves from an access point joined to one Wireless LAN Controller (WLC) to an access point joined to a different WLC in another IP subnet. The key action is that the client's traffic is tunneled from the new (foreign) WLC back to the original (anchor) WLC. This ensures the client retains its original IP address, preventing session disruption for applications.

When traffic matches a 'deny' statement in the Access Control List (ACL) used by a Control Plane Policing (CoPP) policy, that traffic is dropped and not sent to the router's or switch's CPU. CoPP is designed to protect the device's control plane from excessive or malicious traffic (like routing protocol attacks or scanning). The 'deny' action in the ACL effectively filters out unwanted traffic before it can impact the CPU.

The tunnel type used to enable inter-controller roaming is an Ethernet-over-IP (EoIP) tunnel, also known as a mobility tunnel. This tunnel is established between the anchor WLC (where the client originally associated) and the foreign WLC (where the client has roamed). It encapsulates the client's data traffic, allowing it to be forwarded back to the anchor WLC to maintain the client's original IP address and subnet.

Cisco vManage interacts with other SD-WAN devices (vSmart, vBond, and vEdge routers) using secure DTLS or TLS connections. It pushes centralized configurations and policies to the vSmart controllers and vEdge routers. It also receives operational data, telemetry, and logs from these devices for monitoring, troubleshooting, and analytics, acting as the single pane of glass for the entire overlay network.

Two main characteristics of Cisco vManage APIs are that they are RESTful APIs and they use JSON for the data payload. Being RESTful means they use standard HTTP methods (GET, POST, PUT, DELETE) to perform operations on resources. Using JSON makes the data lightweight and easy for external applications and scripts to parse and integrate with for automation and orchestration tasks.

JSON Web Tokens (JWT) are the security feature that supports stateless REST API authentication. In a stateless model, the server does not need to store a session for the client. Instead, after authenticating, the server issues a signed JWT to the client. The client includes this token in the header of subsequent API requests. The server can verify the token's authenticity and extract user information from it without needing to query a database, making it highly scalable.

Two key benefits of Cisco TrustSec are: 1) Simplified Policy Enforcement: It uses Security Group Tags (SGTs) to classify users and devices. Policies are then applied based on these tags, not IP addresses, which simplifies management as users move around the network. 2) Scalable Segmentation: It allows for scalable and consistent segmentation across the entire network (wired, wireless, WAN) from the core to the branch, enforcing access control based on identity rather than complex, IP-based ACLs.

The Layer 2 security mode that supports web-based authentication is WPA+WPA2 (or WPA2) with a Layer 2 security setting. When configured for Web Policy, it allows clients to associate with the WLAN using open authentication and then redirects them to a web portal (captive portal) for authentication. This is commonly used for guest access.

The Northbound APIs of Cisco DNA Center and vManage are characterized as RESTful APIs that allow for integration with external, higher-level applications. They enable network automation, orchestration, and custom application development by providing a programmatic way to retrieve information from the controller (like topology, client health) and push configurations or policies, abstracting the underlying network complexity.

Cisco DNA Center applies configurations from a template when the template is published and deployed to the target devices. The configuration is not applied simply by saving the template. An administrator must explicitly push the configuration, which can be done immediately or scheduled for a later time. The device must be reachable and in a manageable state for the configuration to be successfully applied.

To grant a user access to specific router commands, you use Command Authorization within the AAA configuration. This is typically done by defining a method list for commands and associating it with a privilege level or a TACACS+ server. For example, the command aaa authorization commands 15 MY_LIST group tacacs+ local would authorize all level 15 (privileged EXEC) commands using the TACACS+ server first, then the local database.

The most common resolution for an inter-switch VLAN communication failure is to ensure that the allowed VLAN list is consistent on both ends of the 802.1Q trunk link. If a VLAN is not in the allowed list on one side of the trunk, traffic for that VLAN will be dropped. The switchport trunk allowed vlan command must be checked and corrected on both interfaces to ensure the necessary VLANs can pass through.

A WLC achieves Stateful Switchover (SSO) by maintaining a redundant, hot-standby supervisor or chassis. The active and standby units continuously synchronize their state information, including the client database, AP database, and security credentials. If the active unit fails, the standby unit takes over almost instantly without dropping client connections or requiring access points to rejoin, providing high availability.

A defining characteristic of Wi-Fi channels in the 2.4 GHz band is that they overlap. Each channel is 20 MHz (or 22 MHz) wide, but they are only spaced 5 MHz apart. This means that to avoid co-channel interference, you should only use the three non-overlapping channels, which are channels 1, 6, and 11 (in most regulatory domains). The 5 GHz band, in contrast, has many more non-overlapping channels.

The architectural difference is their function and lookup method. The MAC address table (stored in CAM - Content Addressable Memory) is used for Layer 2 forwarding decisions, mapping MAC addresses to switch ports. The TCAM (Ternary Content Addressable Memory) is a specialized, high-speed memory used for complex, parallel lookups required for Layer 3 routing (the FIB), Access Control Lists (ACLs), and QoS policies. TCAM can match on multiple fields simultaneously using '0', '1', and 'don't care' (ternary) states.

The border node in a Cisco SD-Access fabric acts as the gateway between the SD-Access fabric (the overlay) and networks outside of the fabric, such as the rest of the enterprise network or the Internet (the underlay). It is responsible for advertising external routes into the fabric and internal fabric routes to the external network, performing the necessary encapsulation and de-encapsulation of VXLAN packets.