2.0 Virtualization

4 min read ENCOR 350-401 v1.2 Updated Jul 19, 2026

Aligned to Cisco's 350-401 ENCOR v1.2 exam topics.

On this page

What this domain tests

Domain 2 is 10% of the ENCOR exam. It has three topics: device virtualization, data path virtualization, and network virtualization concepts.

Virtualization makes one physical system behave like many logical systems. A normal router forwards traffic with one routing table. Virtualization adds a layer between the traffic and the transport.

For each technology in this domain, learn to name three things:

Control point: the device, table, or mapping system that makes the decision.
Boundary: the place where the physical path ends and the virtual path starts.
Proof: the command that shows the virtual path works.

Note: Topic 2.2 is configure-and-verify. Topics 2.1 and 2.3 are describe topics. Spend your lab time on VRF and GRE/IPsec.

The three topics

2.1 Device Virtualization Technologies: hypervisors, virtual machines, and virtual switching. Describe level.
2.2 Data Path Virtualization Technologies: VRF and GRE/IPsec tunneling. Configure and verify level.
2.3 Network Virtualization Concepts: LISP and VXLAN. Describe level.

The two questions that organize everything

Every virtualization technology in this domain answers the same two questions:

What is the inner traffic?
What is the outer transport?

GRE carries an inner packet across an outer IP path. VXLAN carries an inner Ethernet frame across an outer IP/UDP path. LISP carries endpoint traffic by mapping endpoint identifiers to routing locators. A VRF keeps inner traffic separate by using a separate routing table on the same device.

The outer transport only delivers the outer packet. It does not need to know the inner traffic. That is why overlays can cross networks that know nothing about the tenants.

High-yield comparison

Technology	What it virtualizes	Control point	Proof command
Type 1 hypervisor	Server hardware	Hypervisor on bare metal	VM and port group settings
Type 2 hypervisor	Host OS resources	Hypervisor app plus host OS	VM network mode
Virtual machine	Compute instance	Guest OS plus hypervisor	`show ip interface brief` in guest
Virtual switch	Switching inside a host	Port group policy	MAC table on physical switch
VRF	Routing table	Per-VRF routing table	`show ip route vrf NAME`
GRE	Path	Tunnel source and destination	`show interfaces tunnel0`
IPsec	Protection	IKE and IPsec SAs	`show crypto ipsec sa` counters
LISP	Endpoint identity vs location	Map server and map resolver	`show lisp map-cache`
VXLAN	Layer 2 segment	VTEP plus VNI mapping	`show nve peers`

Verification method

Do not start with memorized commands. Start by finding the boundary.

Original endpoint traffic
-> logical boundary: VM, VRF, tunnel, VNI, EID
-> outer forwarding system: host uplink, underlay route, WAN path, RLOC, VTEP
-> destination logical boundary
-> original endpoint traffic again

Then verify both layers. Prove the outer network first. Prove the virtual path second.

For a tunnel:

show interfaces tunnel0
show ip route 198.51.100.2
ping 172.16.12.2 source 172.16.12.1

For a VRF:

show ip vrf
show ip route vrf BLUE
ping vrf BLUE 10.10.10.2

For an overlay:

show ip route 192.0.2.2
show lisp map-cache
show nve peers
show nve vni

Commands vary by platform. The method does not vary: prove the underlay, then prove the overlay.

Lab: draw the inner and outer packet

This is a paper lab. No devices are necessary.

Topology:

Host-A -> R1 -> Underlay / WAN -> R2 -> Host-B

Do these steps:

Name the inner traffic for a GRE tunnel from R1 to R2. (Answer: the original packet from Host-A to Host-B.)
Name the outer transport for the same GRE tunnel. (Answer: a GRE packet between the public tunnel endpoints of R1 and R2.)
Name the inner traffic for VXLAN. (Answer: an Ethernet frame in a VNI.)
Name the outer transport for VXLAN. (Answer: a UDP/IP packet between VTEP addresses, destination UDP port 4789.)
Name the control point that separates BLUE traffic from RED traffic on one router. (Answer: a per-VRF routing table.)
Name the mapping a LISP xTR must learn before it encapsulates. (Answer: the EID-to-RLOC mapping.)

If you can do these six steps for any scenario, you have the correct habit for Domain 2.

Exam traps

A VRF is not a VLAN. A VLAN separates Layer 2 broadcast domains. A VRF separates Layer 3 routing tables.
GRE does not encrypt. GRE gives encapsulation. IPsec gives protection.
A tunnel interface can show up/up while the inner route is wrong.
VXLAN is not a bigger VLAN. It is an overlay with VTEPs and VNIs over an IP underlay.
LISP does not replace routing. It adds a mapping system between EIDs and RLOCs.
Always verify the underlay before you troubleshoot the overlay.

Pass check

You are ready for Domain 2 when you can do these things:

Name the inner traffic and outer transport for GRE, VXLAN, and LISP.
Explain why the underlay can be unaware of tenant traffic.
Explain the difference between VRF separation and tunnel encapsulation.
Choose the correct verification command for a tunnel, a VRF, and an overlay.
Explain why you verify the underlay first in every virtualization problem.