CCIE Enterprise Infrastructure

Course at a glance

• 326 lessons in 6 units: a blueprint overview plus one unit for each lab exam domain.
• Exams: 350-401 ENCOR v1.2 (qualifying) and the CCIE Enterprise Infrastructure v1.1 lab
• Format: self-paced lessons with Cisco IOS and IOS XE configurations, packet captures, and video.
• Last updated: October 2026.

About the CCIE Enterprise Infrastructure lab exam

To become CCIE Enterprise Infrastructure certified, you first pass the 350-401 ENCOR exam, which qualifies you for the lab. The lab is an 8-hour practical exam where you plan, design, deploy, operate, and optimize dual-stack (IPv4 and IPv6) enterprise networks. You are also expected to program and automate the network.

CCIE EI v1.1 lab exam topics and weights

Cisco has announced a new one-hour AI Deploy, Operate, and Optimize module for the CCIE lab exams. The Design module then becomes 2 hours, and the 5-hour Deploy, Operate and Optimize module stays. CCIE Data Center gets the new module first, in 2027. Cisco hasn’t announced a date for CCIE Enterprise Infrastructure yet.

Preparing for the qualifying exam? Take a look at our CCNP ENCOR 350-401 course.

Source: Cisco’s CCIE Enterprise Infrastructure exam topics, the CCIE Enterprise Infrastructure exams and training page, and the Cisco Learning blog announcement of the AI module.

What is CCIE Enterprise Infrastructure?

CCIE Enterprise Infrastructure (CCIE EI) is Cisco’s expert level certification for enterprise networks. Where the CCNA and CCNP exams test whether you understand a technology, the CCIE lab tests whether you can design, build, and fix a complete enterprise network under time pressure.

The certification has two steps. First, you pass the 350-401 ENCOR exam, the same core exam you take for CCNP Enterprise. Then you take the 8-hour lab exam. It starts with a 3-hour Design module where you answer scenario-based questions without access to the devices. After that, you get 5 hours of hands-on work where you deploy, operate, and optimize a dual-stack network that combines everything on the blueprint: switching, IGPs, BGP, multicast, SD-Access, SD-WAN, MPLS, DMVPN, security, services, and automation.

Who is it for? Network engineers who already work with these technologies and want to prove they know them at expert level. You won’t pass the lab by memorizing commands. You need to understand how the protocols work and interact, so you can spot why a route is missing or a policy doesn’t work and fix it quickly. That’s how this course is built: we explain how each technology works, then configure and verify it step by step.

CCIE Enterprise Infrastructure Learning Roadmap

This roadmap follows the CCIE Enterprise Infrastructure lab exam domains. Each section has a short explanation and links to key lessons; the course menu above has the complete list. If you prefer to study item by item from the official blueprint, take a look at our blueprint to lesson overview.

Network Infrastructure (30%): Switched Campus

We start at layer 2. You’ll learn how switches learn MAC addresses, how 802.1Q trunks carry VLANs, and how Q-in-Q tunneling adds a second tag. EtherChannel bundles links at layer 2 or layer 3. Spanning tree is a big topic: we cover PVST+, Rapid Spanning Tree, MST and its PVST+ interoperability, and the protection features like BPDU guard, root guard, loop guard, and UDLD.

Network Infrastructure: Routing Concepts, EIGRP and OSPF

We start with the tools that work with any of them: VRF Lite, policy based routing, route filtering, redistribution, authentication, and BFD for fast failure detection. Then we look at EIGRP in depth, including named mode, stub routing, and unequal cost load balancing. For OSPF, you’ll learn every LSA type, the network types, stub and NSSA areas, and how to tune convergence.

Network Infrastructure: BGP

BGP is everywhere on the blueprint: on its own, in MPLS VPNs, and in SD-WAN. You’ll learn how iBGP and eBGP neighbors form, and how BGP selects the best path with attributes like weight, local preference, AS path, and MED. We use communities and regular expressions for routing policies, manipulate the AS path, remove private AS numbers, scale iBGP with route reflectors, and advertise additional paths for faster convergence. Our BGP course covers all of this in depth.

Network Infrastructure: Multicast

Multicast sends one stream to many receivers. Hosts join groups with IGMP, and IGMP snooping keeps multicast traffic away from switch ports that don’t need it. Routers use PIM to build the multicast tree and RPF checks to prevent loops. You’ll configure PIM dense and sparse mode, learn the different ways to find the RP (static, Auto-RP, BSR, and anycast RP), and work with bidirectional PIM and SSM. You’ll find every lesson in our multicast course.

Software Defined Infrastructure (25%): SD-Access and SD-WAN

Cisco SD-Access automates the campus network. It uses LISP on the control plane, a modified version of VXLAN on the data plane, and Cisco TrustSec with scalable group tags on the policy plane. Cisco SD-WAN builds an overlay over any transport, with vManage for management, vSmart as the controller, vBond as the orchestrator, and WAN edge routers at the sites. You’ll install the controllers, onboard WAN edges, and configure templates, centralized and localized policies, and application-aware routing. Our Cisco SD-WAN course walks through each step.

Transport Technologies and Solutions (15%): MPLS and DMVPN

MPLS forwards packets based on labels, and LDP distributes those labels. With MPLS Layer 3 VPNs, a provider keeps customer routes apart in VRFs and carries them with MP-BGP, using route distinguishers and route targets. You’ll configure PE-CE routing with BGP, EIGRP, and OSPF, including the OSPF sham link; our MPLS course has the complete set of lessons. DMVPN uses multipoint GRE and NHRP to build hub and spoke VPNs with dynamic spoke-to-spoke tunnels; we cover all three phases, from phase 1 to phase 3, with every routing protocol, and DMVPN over IPsec to encrypt the traffic.

Infrastructure Security and Services (15%)

This domain covers a lot of ground. On the security side, you’ll protect the device itself with CoPP and Management Plane Protection, secure switches with DHCP snooping, dynamic ARP inspection, and 802.1X, and protect IPv6 hosts with first hop security features like RA guard. On the services side, we cover QoS with the MQC and low latency queueing, first hop redundancy with HSRP, VRRP, and GLBP, NAT, DHCP, NTP, IP SLA, and traffic capture with SPAN, RSPAN, and ERSPAN.

Infrastructure Automation and Programmability (15%)

In the lab, you are expected to program and automate the network. We start with the difference between automation and orchestration, then look at data formats like XML and JSON and YANG data models. You’ll learn how NETCONF and RESTCONF use those models to configure Cisco IOS XE devices through an API instead of the CLI, which is what we mean by device programmability. Embedded Event Manager runs commands on the device itself when an event happens. Our network automation and Python courses go further.

Ready to become a CCIE?

Get access to all 326 CCIE Enterprise Infrastructure lessons and every other course on NetworkLessons.com.

Sign up