3.1 Device Virtualization: Type 1/2 Hypervisors, Virtual Machines, and Virtual Switching

Cisco ENCOR 350-401 CCNP Enterprise Core

Track your progress as you read

Finished sections get a check mark.

1 Introduction & Exam Overview

0.1 Cisco 350-401 ENCOR Exam Logistics, Blueprint Structure, and Certification Paths 0.2 Preparation Strategy, Lab Environment Setup, and Practical Test Pacing

2 Enterprise Campus Architecture and High Availability

1.1 Enterprise Network Design: Two-Tier, Three-Tier, Fabric, and Cloud Architectures 1.2 High Availability Architecture: Device Redundancy, FHRPs, and Stateful Switchover (SSO) 1.3 Quality of Service (QoS) Architecture, Classification, Queuing, and Configuration Interpretation

3 Cisco Software-Defined Architecture: SD-WAN and SD-Access

2.1 Cisco Catalyst SD-WAN: Control, Management, and Data Planes 2.2 Cisco SD-Access Architecture: Control Plane, Data Plane, and Fabric Node Roles 2.3 SD-Access Campus Interoperability: Integrating Traditional Networks with Fabric

4 Device and Network Virtualization Technologies

3.1 Device Virtualization: Type 1/2 Hypervisors, Virtual Machines, and Virtual Switching 3.2 Data Path Virtualization: VRF-Lite, GRE Tunneling, and IPsec VPN Fundamentals 3.3 Network Virtualization Overlays: LISP and VXLAN Encapsulation Mechanics

5 Layer 2 Infrastructure: Trunking, EtherChannel, and Spanning Tree

4.1 802.1Q Trunking, Native VLAN, and Dynamic Trunking Protocol Troubleshooting 4.2 EtherChannel Bundling: Static, LACP, and PAgP Implementation and Verification 4.3 Spanning Tree Architecture: RSTP, MST, and STP Protection Mechanisms

6 Layer 3 Routing: OSPF Multi-Area and Protocol Comparison

5.1 Enterprise Routing Principles: Distance Vector vs. Link-State, EIGRP, and OSPF 5.2 OSPFv2 and OSPFv3 Multi-Area Architecture: LSAs, Area Types, and Summarization 5.3 Policy-Based Routing (PBR) Architecture, Configuration, and Route-Maps

7 Exterior Routing: BGP Peering and Path Selection

6.1 External BGP (eBGP) Peering, States, Neighbor Adjacencies, and Timers 6.2 BGP Path Attributes and the Step-by-Step Best Path Selection Algorithm

8 IP Services and First-Hop Redundancy

7.1 Time Synchronization: Network Time Protocol (NTP) and Precision Time Protocol (PTP) 7.2 Network Address Translation: Static NAT, Dynamic NAT, and PAT/Overload 7.3 First Hop Redundancy Protocols: HSRP and VRRP Implementation and Failover

9 IP Multicast Architecture and Protocols

8.1 Multicast Addressing, IGMPv2/v3 Host Membership, and the RPF Check 8.2 Protocol Independent Multicast Sparse Mode (PIM-SM) and Rendezvous Point Discovery 8.3 Anycast RP with MSDP, Source-Specific Multicast (SSM), and Bidirectional PIM

10 Network Diagnostics, Monitoring, and Telemetry

9.1 Network Diagnostic Tools: Conditional Debugging, Traceroute, SNMPv3, and Syslog Logging 9.2 Flexible NetFlow (FNF) Architecture: Flow Records, Exporters, and Monitors 9.3 Switched Port Analyzer: Local SPAN, Remote SPAN (RSPAN), and Encapsulated RSPAN (ERSPAN)

11 Performance Monitoring and Model-Driven Assurance

10.1 IP Service Level Agreements (IP SLA) Probes, Responder, and Route Tracking 10.2 Cisco Catalyst Center: Assurance Dashboards, AI Analytics, and Machine Reasoning Workflows 10.3 Model-Driven Telemetry and Programmable Interfaces: NETCONF and RESTCONF Verification

12 Device Access Control and AAA Architecture

11.1 Device Line Protection: Console, Aux, VTY, Local Authentication, and Privilege Levels 11.2 AAA Architecture: Comparing RADIUS vs. TACACS+ and Method List Configuration

13 Infrastructure Security: ACLs, CoPP, and API Security

12.1 IPv4 and IPv6 Access Control Lists (ACLs): Standard, Extended, and Named Rules 12.2 Control Plane Policing (CoPP): Protecting the Route Processor with MQC 12.3 REST API Security: Token Authentication, TLS Transport, and Rate Limiting

14 Enterprise Network Security Design: ISE, TrustSec, and MACsec

13.1 Endpoint Security Architecture: 802.1X, Cisco ISE Posture, and Profiling 13.2 Next-Generation Firewalls (FTD) and Enterprise Threat Defense Design 13.3 Cisco TrustSec (Security Group Tags) and MACsec (802.1AE) Layer 2 Encryption

15 Network Automation Fundamentals: Python, JSON, and YANG

14.1 Python Fundamentals for Network Engineers: Data Types, Control Flow, and Libraries 14.2 JSON Data Encoding: Syntax, Formatting Rules, and Python Serialization 14.3 YANG Data Modeling: Modules, Tree Structures, and Data Representation

16 Controller REST APIs and RESTCONF Implementation

15.1 Cisco Catalyst Center Intent APIs and Authentication Workflows 15.2 Cisco Catalyst SD-WAN Manager (vManage) REST APIs and Device Interaction 15.3 RESTCONF Protocol Operations: HTTP Verbs, Datastores, and Response Codes

17 Event-Driven Automation and Infrastructure Orchestration

16.1 Cisco Embedded Event Manager (EEM) Applet Architecture and Event Detectors 16.2 Configuration Management: Comparing Ansible, Puppet, Chef, and SaltStack 16.3 Infrastructure as Code (IaC) Principles with Terraform in Enterprise Networks

3.1 Device Virtualization: Type 1/2 Hypervisors, Virtual Machines, and Virtual Switching

Key Takeaways Explain This Topic AI

Type 1 hypervisors execute directly on physical server hardware with bare-metal efficiency, whereas Type 2 hypervisors run as software applications on top of a host operating system.

Virtual switches (vSwitch and Distributed Virtual Switch) replicate Layer 2 bridge forwarding without Spanning Tree Protocol, relying instead on split-horizon loop prevention rules.

Virtual switch VLAN tagging modes dictate the frame handling boundary: EST offloads tagging to physical switches, VST tags and untags at the hypervisor port group, and VGT passes 802.1Q tagged frames straight into guest VMs.

Single Root I/O Virtualization (SR-IOV) partitions a physical PCIe network adapter into Virtual Functions (VFs), allowing guest VMs direct hardware access to bypass hypervisor virtual switch latency.

Network Functions Virtualization (NFV) transitions proprietary hardware appliances into software instances, illustrated by enterprise virtual routers such as the Cisco Catalyst 8000v and CSR 1000v.

Last updated: October 2026

Device Virtualization: Type 1/2 Hypervisors, Virtual Machines, and Virtual Switching

Virtualization abstracts physical computing, storage, and networking hardware into logical software instances. By decoupling operating systems and network functions from underlying hardware, enterprise architectures achieve higher hardware utilization, agile provisioning, and simplified disaster recovery.

Hypervisor Architecture: Type 1 vs. Type 2

A hypervisor, or Virtual Machine Monitor (VMM), abstracts server hardware and allocates compute resources across isolated virtual machines. Hypervisors fall into two primary categories:

Type 1 Hypervisors (Bare-Metal): Install directly onto physical server hardware without an underlying general-purpose operating system. The hypervisor kernel directly controls CPU scheduling, memory management, and physical I/O devices. Type 1 hypervisors provide near-native execution speed, low latency, and small memory footprints. They are the enterprise standard for data centers, private clouds, and Network Functions Virtualization (NFV). Examples include VMware ESXi, Linux KVM, and Microsoft Hyper-V.

Type 2 Hypervisors (Hosted): Execute as user-space applications on top of an existing host operating system (e.g., Windows, macOS, or Linux). Guest VM requests must traverse the hypervisor application, host operating system kernel, and host drivers before reaching hardware. This dual-layer architecture introduces latency and scheduling overhead, making Type 2 hypervisors best suited for engineering labs, testing, and client desktop virtualization. Examples include VMware Workstation, Oracle VirtualBox, and VMware Fusion.

Hypervisor Comparison

• Architectural Dimension Type 1 Hypervisor (Bare-Metal) Type 2 Hypervisor (Hosted)
• Execution Layer Directly on bare-metal server hardware On top of a pre-existing host operating system

Kernel Overhead Minimal; dedicated, streamlined hypervisor kernel High; burdened by host OS background services

I/O Latency Low and deterministic; near bare-metal performance Higher; subject to host OS scheduling and drivers

Hardware Access Direct access to hardware virtualization (VT-x, AMD-V) Mediated through host OS system calls and API layers

Enterprise Role Production data centers, private clouds, carrier NFV Engineering labs, software development, client testing

• Common Platforms VMware ESXi, Linux KVM, Microsoft Hyper-V VMware Workstation, Oracle VirtualBox, Parallels
• Virtual Machine Components

A Virtual Machine (VM) represents an isolated software container running an independent guest operating system. The hypervisor provides virtualized hardware representations:

vCPU (Virtual CPU): Represents an assignable thread of execution mapped to physical CPU cores or hyper-threads. Modern hypervisors utilize Non-Uniform Memory Access (NUMA) node pinning to keep vCPU execution and memory access within the same physical processor socket.

vRAM (Virtual RAM): Hypervisors allocate physical host memory to guest VMs using dynamic reclamation techniques such as memory ballooning, transparent page sharing, and compression to permit safe memory overcommitment.

vNIC (Virtual NIC): Emulated adapters (e.g., Intel e1000) or paravirtualized network drivers (e.g., VMware VMXNET3, Linux virtio-net) assigned to a VM. Paravirtualized drivers bypass legacy hardware register emulation, interacting directly with the virtual switch for higher packet throughput.

Virtual Storage: Virtual disks (VMDK, QCOW2) attach via virtual SCSI or NVMe controllers, backed by SAN, NAS, or distributed software-defined storage solutions (such as VMware vSAN or Ceph).

Virtual Switching Architecture and Port Groups

Virtual switches replicate Layer 2 Ethernet bridging in software, interconnecting virtual machines and bridging them to physical network adapters.

Virtual Standard Switch (vSwitch): Managed locally on an individual hypervisor host. Configuration must be manually replicated across each host in a server cluster.

Distributed Virtual Switch (vDS / DVS): Centrally managed across an entire server cluster by a management controller (such as VMware vCenter). The DVS enforces consistent port profiles, QoS policies, Private VLANs, NetFlow, and port mirroring (ERSPAN) across all hosts, simplifying VM live migration.

Port Groups: Logical groupings of virtual ports sharing common configuration parameters, such as VLAN tagging and security rules:

Promiscuous Mode: When enabled, permits a VM vNIC to capture all traffic transiting the port group (useful for intrusion detection appliances).

MAC Address Changes: Permits or denies VMs changing their effective MAC address away from their assigned address.

Forged Transmits: When set to Reject, drops outgoing frames whose source MAC address does not match the VM adapter's assigned address.

Loop Prevention Without STP: Virtual switches do not run Spanning Tree Protocol (STP). To prevent Layer 2 forwarding loops between redundant physical uplinks, virtual switches enforce a strict split-horizon rule : a frame received on an external physical uplink is never forwarded back out another physical uplink.

Virtual Switch VLAN Tagging Modes

Virtual switches implement IEEE 802.1Q tagging across three standardized operational modes:

External Switch Tagging (EST): The upstream physical switch port operates in access mode. All frames leaving the hypervisor physical uplink are untagged, and tagging occurs entirely on the physical switch. The virtual switch and guest VMs operate without VLAN awareness.

Virtual Switch Tagging (VST): The upstream physical switch port is an 802.1Q trunk. The hypervisor port group is assigned a specific VLAN ID (1–4094). The virtual switch inserts the 802.1Q tag on egress traffic and strips tags before delivering frames to guest VMs. This is the standard enterprise design.

Virtual Guest Tagging (VGT): The upstream physical switch port is an 802.1Q trunk, and the virtual port group is configured with VLAN 4095 (in VMware) to pass all tagged frames unmodified. The guest VM operating system must maintain an 802.1Q trunk driver to process and insert VLAN tags. VGT is commonly used for virtual routers and multi-tenant firewalls that need many VLANs on one vNIC.

VLAN Tagging Mode Comparison

• Mode Tagging Entity Port Group Setting Physical Switch Port Typical Use Case
• EST Physical switch VLAN 0 / None Access mode Legacy single-VLAN servers, dedicated physical NICs
• VST Hypervisor vSwitch VLAN 1–4094 802.1Q Trunk Standard enterprise VMs; offloads tagging from guest OS

VGT Guest VM operating system VLAN 4095 (All) 802.1Q Trunk Virtual routers (C8000v), multi-tenant virtual firewalls

High-Performance I/O: SR-IOV

Standard virtual switching incurs CPU processing overhead for every packet processed by the hypervisor network stack. Single Root I/O Virtualization (SR-IOV) is a PCI-SIG hardware standard that enables a single physical PCIe network adapter to partition itself into multiple distinct virtual PCIe devices:

Physical Function (PF): The primary PCIe function representing the physical NIC, managed by the hypervisor host driver.

Virtual Function (VF): Lightweight PCIe functions associated with a PF, presenting dedicated transmit/receive queues and DMA channels.

By assigning a Virtual Function directly to a guest VM via PCIe passthrough, network traffic travels straight between the physical adapter and VM memory. This bypasses the hypervisor kernel and vSwitch, achieving near-native throughput and latency. However, SR-IOV prevents hypervisor-level features such as vMotion live migration and software traffic inspection.

Network Functions Virtualization (NFV) and Virtual Routers

Network Functions Virtualization (NFV) replaces proprietary hardware appliances with software-based Virtual Network Functions (VNFs) running on standard commercial off-the-shelf (COTS) x86 servers:

NFV Framework: Comprises the NFV Infrastructure (NFVI compute, storage, and virtualization layer), VNFs (routing, security, and load-balancing applications), and Management and Orchestration (MANO).

Cisco Cloud Services Router 1000v (CSR 1000v): Pioneer enterprise virtual router running IOS-XE across VMware ESXi, KVM, AWS, Azure, and Google Cloud, supporting BGP, OSPF, VRF-Lite, and DMVPN.

Cisco Catalyst 8000v (C8000v): The modern virtual routing platform succeeding the CSR 1000v. Designed for multi-cloud enterprise routing and SD-WAN fabrics, the C8000v uses a DPDK-based data plane for high packet throughput, zero-touch provisioning, and complete support for Catalyst SD-WAN, IPsec VPNs, and telemetry APIs.