Comprehensive references for working network engineers and CCNP/CCIE candidates. Each guide covers fundamentals, configuration, troubleshooting, and real Cisco IOS XE and NX-OS lab output. The kind of depth you can keep open during change windows.
Fundamentals
The foundation everything else stands on.
Routing Protocols
How packets find their way across networks of every scale.
IP Routing
How routers choose routes: reading the routing table, administrative distance, longest prefix match, and static routing on Cisco IOS XE.
Read the guide →OSPF
Fundamentals, neighbor states, LSA types, areas, DR/BDR election, and Cisco IOS XE configuration.
Read the guide →BGP
Fundamentals, path attributes, traffic engineering, and security, with Cisco IOS XE lab output.
Read the guide →EIGRP
Fundamentals, the DUAL algorithm, K values, stub routing, and EIGRP vs OSPF on Cisco IOS XE.
Read the guide →IP Multicast
PIM sparse mode, IGMP v2/v3, SSM, MSDP, RPF, and troubleshooting, with real IOS XE captures and a real Linux receiver.
Read the guide →IPv6
128-bit address format, address types, simplified header, Neighbor Discovery, SLAAC, and Cisco IOS XE configuration.
Read the guide →Switching & VLANs
Layer 2 fundamentals and the protocols that keep a campus stable.
VLANs & Layer 2 Switching
A 22-article series on VLAN fundamentals, trunking, inter-VLAN routing, EtherChannel, and troubleshooting.
Read the guide →Spanning Tree Protocol
Port roles and states, RSTP and MST, root bridge config, BPDU Guard, Root Guard, and Catalyst troubleshooting.
Read the guide →WAN & Tunneling
Wide-area technologies, from labels to overlays to tunnels.
Network Virtualization & Overlays
LISP, VXLAN, BGP EVPN, and SD-Access. Overlay encapsulation, fabric control planes, and choosing the right segmentation layer.
Read the guide →MPLS
Labels and the label stack, LDP, L3VPN configuration with VRF/RD/RT and MP-BGP VPNv4, PE-CE routing, troubleshooting, and segment routing.
Read the guide →SD-WAN
Architecture, MPLS comparison, Cisco Catalyst SD-WAN (Viptela), SASE convergence, and operational realities.
Read the guide →GRE Tunnels
How GRE works, packet format, Cisco IOS XE config, keepalives, MTU, and GRE over IPsec.
Read the guide →DMVPN
mGRE, NHRP, Phase 1 vs 2 vs 3, Phase 3 config on IOS XE, IKEv2 IPsec, and troubleshooting.
Read the guide →Data Center
Spine-leaf fabrics, NX-OS, and the overlay that runs the modern data center.
Wireless & Access Control
Who and what gets onto the network, wired and wireless.
Cisco Wireless
Catalyst 9800 configuration model, AP join, WPA3, FlexConnect, RRM, fast roaming, and SSO HA.
Read the guide →802.1X
Supplicant, authenticator, RADIUS, EAP methods, Cisco ISE, dynamic VLANs, and phased deployment.
Read the guide →Infrastructure Security
AAA (TACACS+/RADIUS), CoPP, uRPF, IPv6 first-hop security, advanced ACLs, MACsec, and management-plane hardening on Cisco IOS XE.
Read the guide →Service Quality & Resilience
Keeping traffic flowing predictably and the network up.
Quality of Service
Classification, DSCP/CoS marking, MQC, LLQ/CBWFQ, WRED, hierarchical QoS, policing, shaping, interpreting policies, plus enterprise design and high availability.
Read the guide →FHRP
HSRP, VRRP, GLBP. The three protocols compared, configuration patterns, and IOS XE walkthroughs.
Read the guide →Network Services
The day-2 services every production network depends on.
Security & Firewall
Perimeter security, stateful inspection, and the platforms that gate the trust boundary.
Cisco ASA
Stateful firewall fundamentals, ACLs and NAT 8.3+, dynamic routing, AnyConnect VPN, failover, packet-tracer, and 40 articles built on real ASAv 9.23 lab captures.
Read the guide →IPsec VPN
Site-to-site VPNs on Cisco IOS XE: IKE phases, crypto maps, GRE over IPsec, SVTI, NAT traversal, and troubleshooting, all built on real lab captures.
Read the guide →Network Tools & Analysis
Command-line tools for scanning, capturing, and tracing what is really on the wire.
Ping
ICMP echo end to end: how ping works, reading TTL and RTT, decoding every failure message, Cisco extended ping, DF-bit MTU testing, and subnet sweeps, built on real Cisco IOS XE and Linux lab captures.
Read the guide →iPerf
Throughput testing end to end: TCP and UDP tests, jitter and packet loss, window tuning and parallel streams, server daemons, and slow-path troubleshooting, built on real Cisco IOS XE lab captures.
Read the guide →Nmap
Network scanning end to end: host discovery, port scans, version and OS detection, NSE scripts, firewall evasion, and output parsing, built on real Cisco and Linux lab captures.
Read the guide →Packet Analysis
Capture and read the packets themselves: tcpdump and BPF filters, where to tap, embedded capture on IOS XE, crafting frames with Scapy against live Layer 2 defenses, and reading a port scan from the defender's side, built on real Cisco and Linux lab captures.
Read the guide →Linux Networking Commands
The Linux side of the network, end to end: the ip command and its objects, the routing and neighbor tables, ethtool and NIC offloads, the net-tools to iproute2 migration, path testing with traceroute, mtr and tracepath, socket state with ss, the DNS client toolset (dig, host, nslookup and how Linux actually resolves a name), the transfer and swiss-army tools (curl, wget, netcat, socat and SSH tunneling), watching the wire with tcpdump, tshark, ngrep, the live bandwidth monitors and the /proc/net counters underneath them all, and host firewalling with iptables, nftables and ufw, built on real Debian and Cisco IOS XE lab captures. Twenty nine articles, a single-page field reference and a free ten-page printable PDF.
Read the guide →Monitoring & Observability
Standing up the platforms that watch the network, on real hardware you can rebuild.
Grafana on Ubuntu Server
Standing up the dashboard layer: the APT repository and signing key done the modern way, the systemd service the package deliberately leaves stopped, why the port stays closed for twenty seconds after systemd calls it running, proving you got the Enterprise build, and first login with the admin password change, built on a real Ubuntu 26.04 install.
Read the walkthrough →Zabbix 7.0 LTS in Docker
The polling engine underneath the dashboards: why the distro packages were not an option, picking the LTS track over the higher version number, a four service Compose stack with its own MySQL, planning ports so two monitoring platforms share one host without collision, the schema import, and the built-in host that cannot reach its own agent.
Read the walkthrough →Automation & Programmability
Controllers, APIs, and the tooling that configures networks at scale.
CCIE Enterprise Infrastructure
Expert-tier depth across every EI v1.1 blueprint domain - 58 articles, all on real Cisco output, plus four integration Super Labs.
CCIE EI Study Hub
Every EI v1.1 blueprint line mapped to an expert article built on real Cisco IOS XE output: BGP/OSPF/EIGRP at expert depth, switched-campus closure, MPLS and DMVPN transport, SD-Access and SD-WAN, services, and automation. The complete CCNP-to-CCIE study path.
Open the study hub →CCIE Super Lab Library
Four full-scale integration labs plus a twelve-fault ticket gauntlet: the Enterprise Core, the Service Provider Handoff, the Ticket Gauntlet, and Overlay + Automation. Built on real CML topologies - the gap the CCIE lab actually tests.
Open the Super Labs →CCIE Security
Expert-tier security depth mapped to the CCIE Security v6.1 blueprint, all on real Cisco IOS XE output. Firepower Threat Defense coverage is on the way.
More coming
New guides land regularly. Want to know when the next one drops? Subscribe to the newsletter. One email per guide, no fluff, unsubscribe whenever.