Level 4 · Expert

Cisco Certified Internetwork Expert (CCIE Enterprise Infrastructure)

The "fighter jet pilot" of the networking world. Two stages: the ENCOR 350-401 written (already done at Level 3) qualifies you for the legendary 8-hour hands-on lab exam — which fewer than 3% of network engineers ever pass. More than a certificate, this level is a way of thinking: predict the network's state before touching it. A CCIE number, once earned, is yours for life.

Choose your track: CCIE comes in flavors — Enterprise Infrastructure, Enterprise Wireless, Security, Service Provider, Data Center, Collaboration. This page maps Enterprise Infrastructure, the natural continuation of this roadmap; the study method is identical for all tracks.

# Lab Exam Blueprint — CCIE Enterprise Infrastructure

The 8-hour lab has two modules: Design (3 hrs) — scenario-based, no device access — and Deploy, Operate & Optimize (5 hrs) — hands-on against a large virtual topology. These five domains are tested across both.

My CCIE progress0 / 0

1. Network Infrastructure 30%

Switched campus: advanced STP (MST), L2 multicast (IGMP snooping), tuning & protection (BPDU guard, root guard, storm control)

OSPF at expert depth: all LSA types, all area types, filtering, summarization at scale, fast convergence (BFD, timers, LFA) Expert bar: you must predict the LSDB contents before typing "show".

EIGRP: named mode, stub, summarization, query boundaries, wide metrics

BGP at expert depth: full path-selection algorithm, route reflectors, confederations, communities, dual-stack, dampening, convergence tuning Expert bar: design questions assume you can reason about 10+ AS topologies on paper.

IPv6 routing & transition at scale; first-hop security (RA guard, DHCPv6 guard)

Multicast routing: PIM sparse mode, RP design (static, BSR, Auto-RP), MSDP, SSM

2. Software-Defined Infrastructure 25%

Cisco SD-Access: design and deploy fabric (LISP control plane, VXLAN data plane), policy (SGTs), fusion routers, multi-site

DNA/Catalyst Center: device provisioning, policy, assurance workflows

Cisco SD-WAN: controller deployment, OMP, TLOCs, control & data policies, app-aware routing, Direct Internet Access Expert bar: the lab gives you broken SD-WAN policies to fix under time pressure.

QoS in SD architectures end-to-end

3. Transport Technologies & Solutions 15%

MPLS: LDP, L3VPN (VRF, RD/RT, MP-BGP VPNv4), inter-AS basics Real world: understanding the provider side makes you the person who can debug the WAN circuit, not just open a ticket about it.

DMVPN: all phases, NHRP, with IPsec profiles; spoke-to-spoke tunnels

GRE, mGRE, IPsec (IKEv2), FlexVPN fundamentals

4. Infrastructure Security & Services 15%

Device security: CoPP, MPP, uRPF; AAA at depth

802.1X/MAB/WebAuth with ISE concepts; TrustSec/SGT enforcement

System management: SNMPv3, logging architecture, NetFlow/IPFIX at scale

QoS end-to-end: classification/marking/queuing/shaping/policing across a full enterprise path

Network services at depth: FHRP edge cases, NAT (including VRF-aware), PTP/NTP design

5. Infrastructure Automation & Programmability 15%

Data formats and models: JSON, XML, YAML, YANG (openconfig vs native)

NETCONF/RESTCONF operations against IOS-XE; gNMI awareness

Python scripting for deploy/verify; pyATS/Genie for testing Expert bar: the lab includes automation tasks — they are gift points if prepared, fatal if not.

Ansible playbooks for IOS-XE; model-driven telemetry concepts

EEM advanced applets; guest shell

# Lab Strategy — How CCIEs Actually Train

At this level "labs" stop being exercises and become a training regimen, like an athlete's. The pattern below is how successful candidates structure 12–18 months.

PHASE 1 — Technology Labs (months 1–6)

One technology at a time, to exhaustion: every OSPF area type, every BGP attribute, every DMVPN phase. Small focused topologies (4–8 devices), repeated until configs flow without thinking.

Real-world payoff: this is the depth that lets you debug a production BGP meltdown calmly while everyone else panics.

CML / EVE-NG ProDepth drilling

PHASE 2 — Full-Scale Topologies (months 6–12)

20–30 device enterprise topologies combining everything: campus + SD-Access + SD-WAN + MPLS WAN + DMVPN backup + multicast + QoS + automation. Build, break, rebuild weekly.

Real-world payoff: indistinguishable from a real Fortune 500 network. You are literally rehearsing the day job of a principal engineer.

CML (lab exam runs on it)INE / CCIE workbooksEnterprise scale

PHASE 3 — Mock Labs Under the Clock (months 12+)

Full 8-hour timed mock labs: 3-hour design module (paper-based scenarios, no CLI) + 5-hour deploy/operate module. Grade yourself ruthlessly; track points-per-hour.

Real-world payoff: the discipline of working a structured method under brutal time pressure — exactly what major-incident response requires.

Graded mock labsExam simulation

ONGOING — Troubleshooting Gauntlets

Take working topologies and have a study partner (or a script) plant 10 faults. Diagnose with a strict method: verify L1→L2→L3, control plane before data plane, never guess.

Real-world payoff: the trouble-ticket discipline that makes CCIEs the people airlines and banks call at 3 AM — and pay accordingly.

CML / EVE-NGFault injection

# Tools for This Level

Cisco Modeling Labs (CML)

Non-negotiable now — the actual lab exam runs on CML-based virtual gear. Train on what you'll be tested on.

Paid (Personal)

EVE-NG Professional

For monster 30+ node topologies; many published CCIE workbook topologies ship as EVE-NG files. Needs a beefy server (64–128 GB RAM) or cloud instance.

Paid (+ server)

INE / CCIE-specific workbooks

Structured expert-level lab workbooks and graded mock labs. The de-facto standard CCIE training vendors.

Paid (significant)

pyATS / Genie

Cisco's own network test framework — automate the verification of your own labs, and cover the automation domain at the same time.

Free

A study group

Online CCIE communities (Discord/forums) for mock-lab exchanges and fault-planting partners. Nobody passes this alone.

Free

A budget plan

Lab attempts, training content and lab infrastructure all add up — most candidates need two attempts. Plan ahead, and note that many employers fund CCIE preparation; ask.

Plan ahead

Reality check: 12–18 months of 15–20 hrs/week on top of a CCNP-level day job. It's a marathon — but the payoff is true expert mastery and a lifetime CCIE number.

# Growth Check — After This Level

What Mastery Looks Like

I can predict the LSDB and BGP table before typing a show command — the network model runs in my head.
I can build a 20–30 device enterprise topology from memory, then break and repair it methodically.
Under an 8-hour clock, I stay calm and work a structured method — the same discipline a real 3 AM major incident demands.

Self-Check Before the Lab

Have I scored a passing grade on a full timed mock lab — twice in a row?
Can I explain every blueprint technology to a junior engineer in plain words?
Given 10 planted faults, do I diagnose layer by layer — control plane before data plane — without guessing?
Are the automation tasks gift points for me, or a gamble?

Growth Beyond the Number

Teach and mentor — guiding others through CCNA/CCNP cements expert knowledge permanently.
Write up the journey (what worked, what didn't) — reflection is how experience becomes wisdom.
Start shifting from "how do I configure it?" to "why this design?" — the design thinking that leads to CCDE and Level 5.