4.0 Network Assurance

What this domain tests

Domain 4 is 10% of the ENCOR exam. It has six topics: diagnosis tools, Flexible NetFlow, SPAN/RSPAN/ERSPAN, IP SLA, Catalyst Center, and NETCONF/RESTCONF.

Each topic asks the same question: how do you prove what the network is doing? For each tool, learn to name three things:

• Evidence: the data the tool gives you (packets, flows, events, or probe results).
• Control point: the device that collects or sends the evidence.
• Proof: the command that shows the tool works.

Note: Do not memorize command syntax first. Learn what evidence each tool produces first. Syntax becomes easy after that.

The six topics

• Diagnose network problems: ping proves reachability. Traceroute shows the path. Debugs show live behavior. Syslog records events. SNMP polls counters. Proof: matching symptoms to the correct tool.
• Flexible NetFlow: summarizes who talked to whom, on which ports, with how many bytes. Control point: the router or switch cache. Proof: show flow monitor ... cache.
• SPAN, RSPAN, ERSPAN: copies packets to an analyzer. Local, Layer 2 remote, or Layer 3 remote. Proof: show monitor session all.
• IP SLA: sends synthetic probes and records reachability, delay, jitter, and loss. Control point: the track object. Proof: show ip sla statistics and show track.
• Catalyst Center: manages the network as a system. Assurance shows health. Workflows apply and verify change. Proof: health scores and guided issues in the controller.
• NETCONF and RESTCONF: model-driven management. Software reads and changes state with structured data. Proof: a successful GET reply in JSON or XML.

Articles

• 4.1 Diagnose network problems
• 4.2 Configure and verify Flexible NetFlow
• 4.3 Configure SPAN, RSPAN, and ERSPAN
• 4.4 Configure and verify IP SLA
• 4.5 Cisco Catalyst Center assurance workflows
• 4.6 Configure and verify NETCONF and RESTCONF

Study plan

Read one article, then do the lab. These topics are hard because students mix up the purpose of each tool. NetFlow is not a packet capture. SPAN is not a trend tool. IP SLA is not a controller. NETCONF and RESTCONF are not screen-scraping.

Keep the tool-to-evidence mapping tight and the exam questions get easier.

Pass check

You are ready for Domain 4 when you can do these things:

• Name the correct tool for a symptom: reachability, path, live behavior, event history, or counters.
• Explain why NetFlow answers "what traffic" and SPAN answers "what is inside the packets."
• Explain why IP SLA needs a schedule and a track object before routing can react.
• Explain why Catalyst Center helps you find a problem but does not replace network fundamentals.
• Explain why NETCONF and RESTCONF use YANG models instead of parsed CLI text.