CCIE-level material for engineers past the CCNP line. Articles tagged CCIE cover expert-track routing, overlays, security and automation, with full configs and real device output from CML.
In SD-WAN you do not configure routing policy on the routers. Centralized control policy is one document on the Controller that shapes topology, path preference, and reachability for the entire overlay.
OMP carries everything in Catalyst SD-WAN: routes, TLOCs, service routes, keys, and policy. This deep dive walks each advertisement type and the path selection logic, with WAN Edge CLI drawn from Cisco's current 20.x documentation.
CLI templates, feature templates, and configuration groups arrived in three different eras of Catalyst SD-WAN. This article explains what each provisioning model is, why it exists, and which one to use in 2026.
Not every network should be a fabric. This article covers where SD-Access earns its controller, identity service, and hardware requirements, and where a senior engineer should say no to deploying it.
SD-Access segments in two layers: virtual networks for macro-segmentation and SGTs for micro-segmentation. This post explains what each layer isolates, how they combine, and where the policy is actually enforced.
The border node is where an SD-Access fabric meets everything else, and where IP transit, SDA transit, and Layer 2 handoff get confused. Untangle all three and see how VRF-lite, BGP, and LISP carry traffic out of the fabric.
An endpoint plugs in and seconds later it is in the right virtual network with the right SGT and policy. This article walks SD-Access host onboarding from physical port to enforced policy: 802.1X, SGT assignment, and LISP registration.
An SD-Access fabric is a set of roles: edge, border, control plane, and fabric in a box. This guide explains what each role runs (LISP, VXLAN) and which pieces you can verify standalone versus what needs Catalyst Center.
The SD-Access underlay is just a well-built IGP giving every fabric node loopback reachability. Compare building it manually vs with LAN Automation, and see what truly needs Catalyst Center.
Five MPLS L3VPN and DMVPN ticket scenarios, each isolated layer by layer: IGP, LDP, MP-BGP, NHRP, IPsec, and the routing on top. The faults and diagnostic commands come from real lab builds.
MPLS gives you a private SLA-backed core; DMVPN gives you cheap encrypted connectivity over any internet link. This article compares the two honestly and shows the standard hybrid designs most enterprise WANs end up running.
IKEv1 and IKEv2 configured on the same DMVPN in a CML lab, with real SA output shown side by side. The migration turns out to be a single-line profile swap, and you see exactly why IKEv2 negotiates faster.