300-410 ENARSI Lab Guide 2026: The Six-Node Build
Every objective in the biggest domain starts with the word Troubleshoot. You cannot read your way to that - you have to break things and fix them.
- 300-410Exam
- 90 minTime
- $300Fee
- 4Domains
- CML-PersonalCheapest lab
- 16 GB hostRAM needed
Table of Contents
The minimum lab
Look at the verbs. Eleven of the sub-objectives under Layer 3 Technologies - the 35% domain - begin with Troubleshoot. Not configure, not describe. That single fact decides how you study for ENARSI: you need a topology you can deliberately break, because the exam is written by people who assume you have seen a redistribution loop with your own eyes. This is the CCNP Enterprise exam where lab time has the highest return, and it is also the one where the free tier runs out.
The shape matters more than the count. A different IGP at each end and an MPLS core in the middle gives you redistribution boundaries in two places, which is where ENARSI lives. The internet router hanging off the core is what you overlay DMVPN and IPsec on for the VPN domain, and it doubles as somewhere to practise infrastructure security.
Where to build it
This is where the free tier stops being enough. Six nodes is one more than CML-Free allows, and ENARSI is the exam where you most want room to add a seventh router to reproduce something odd.
| Platform | Good enough? | Cost | What decides it |
|---|---|---|---|
| CML-Free | 5 nodes | $0 | Cisco's own images, but a hard five-node ceiling. Unmanaged switches and external connectors do not count against it. |
| CML-Personal | Yes | $199/yr, 20 nodes | The tier most CCNP candidates end up on. Non-commercial, single named user. |
| EVE-NG Community | Entitlement | $0 + your own images | Technically capable. CML's licence forbids exporting its images into it, so you must be separately entitled to whatever you load. |
| GNS3 | Entitlement | $0 + your own images | Same trade as EVE-NG: the tool is free, the images are the problem. |
| Real hardware | Optional | $300+ used | Only worth it if you want realistic troubleshooting of physical interfaces. Nothing in the blueprint requires it. |
You may not move CML's images into EVE-NG or GNS3. The CML end-user licence, revised April 2026, restricts the bundled images to use inside CML. Both emulators are perfectly capable tools - but you have to be separately entitled to whatever you load into them, and that is the real reason people end up paying for CML rather than the software itself.
Images and horsepower
ENARSI runs on the lightest images Cisco ships, which is why a six-node topology fits inside a normal laptop.
| Component | What it is | Where it comes from |
|---|---|---|
| IOL (IOS XE Router 17.15) | All five routers | CML reference platform, 1 GB and 0 vCPU each |
| IOL-L2 (IOS XE Switch) | Optional access switch | CML reference platform, 1 GB |
| Alpine Linux | Test hosts either end | Bundled, 512 MB |
| IOSv 15.9 | If you want classic IOS output | CML reference platform, 512 MB - older syntax, closer to some study material |
About 8 GB of node memory covers the topology above with room for a couple of extra nodes. Cisco's stated CML host minimum is 8 GB and four physical cores, with an explicit warning that running at the minimum limits how many nodes you can simulate - so plan on a 16 GB host if you want to add routers while chasing a problem.
The build list
Work top to bottom. Each step is a thing you build and then break on purpose, and each one is tagged with the blueprint domain it covers, so by the end you have touched the parts of the syllabus a lab can reach.
Redistribute between EIGRP and OSPF, then build a loopLayer 3 35%
Mutually redistribute at two points and watch the routing loop form. Then fix it three ways - route tags, administrative distance, and a prefix list - because the exam asks which fix applies, not whether you know one.
Break administrative distance on purposeLayer 3 35%
Change AD so the wrong protocol wins, then troubleshoot it from the routing table down. Sub-objective 1.1 is literally 'Troubleshoot administrative distance (all routing protocols)'.
Filter BGP with route maps and communitiesLayer 3 35%
Advertise the same prefix from both PEs and steer it with local preference, AS-path prepending and communities. Get to where you can predict the winner before you look.
Overlay DMVPN, then add IPsecVPN 20%
Build a DMVPN hub and spoke across the internet router, get spoke-to-spoke tunnels forming, then protect it. Break NHRP registration and diagnose it from the tunnel state.
Lock down the control planeInfrastructure Security 20%
Apply control-plane policing, device access control with AAA, and uRPF. Then break your own access and recover - the recovery path teaches more than the config did.
Turn on the things that tell you what brokeInfrastructure Services 25%
SNMP, syslog, NetFlow, IP SLA and object tracking. This domain is a quarter of the paper and it is the cheapest to lab, because every item is a few lines and an immediate visible result.
What you can and cannot lab
Cisco publishes the domain weightings but not the number of items or the passing score, so treat the percentages as how the paper is built rather than as a target. The column that matters here is the last one.
| Domain | Weight | Labbable | Notes |
|---|---|---|---|
| Layer 3 Technologies | 35% | Partly | TODO |
| VPN Technologies | 20% | Partly | TODO |
| Infrastructure Security | 20% | Partly | TODO |
| Infrastructure Services | 25% | Partly | TODO |
The walls you will hit
ENARSI has the fewest walls of any exam in this batch, which is exactly why it rewards lab time. What it cannot show you is behaviour that lives in silicon.
Cannot be labbed at home
- BFD does not work on IOSv. It is a named blueprint item and it cannot be made operational on the cheapest node. Cisco lists it as unsupported alongside OTV, VPLS, Voice and AVC. Use IOL or a Catalyst 8000v if you want it live, or accept that it is a Describe-level topic.
- IPv6 first-hop security is unreliable in emulation. RA Guard, DHCP Guard and ND Inspection are repeatedly reported as accepted-but-not-operational on the virtual Layer 2 switch, and it varies by image version. This is the classic trap: the config is taken, the feature never runs.
- QoS numbers are fiction. Cisco states plainly that its emulated images are rate-limited with no synchronised clock across nodes, so it is good for policy and configuration troubleshooting and not for throughput or timing. Measured single-hop throughput is in the low megabits.
- Hardware forwarding behaviour. IOL and IOSv forward in software, so hardware queueing, shaping and platform-specific punt behaviour do not reproduce.
- Image portability. CML's April 2026 licence keeps its images inside CML, and the personal tiers are licensed to a single named individual - so no exporting to EVE-NG and no sharing with a study group.
None of that touches the logic ENARSI actually tests, and logic reproduces perfectly in software - which is why this is the one exam in the batch where the honest advice is simply to lab more. Just pick your nodes deliberately: IOSv for volume at 512 MB, IOL when you need real IOS-XE behaviour, and a Catalyst 8000v on the one occasion you want NETCONF against something.
A lab proves you can build it. Questions prove you can pass.
The blueprint is only half the exam — the other half is answering under a clock. Start with the free question sets, then $5.99 unlocks the full 300-410 ENARSI bank.
Free 300-410 ENARSI practice test300-410 ENARSI exam pageFAQ
Do I need a lab to pass 300-410 ENARSI?
More than for any other CCNP Enterprise exam. Eleven sub-objectives in the 35% Layer 3 domain begin with the word Troubleshoot, and troubleshooting is a skill you build by breaking things. A six-node emulated topology is enough.
Is the free tier of Cisco Modeling Labs enough for ENARSI?
Not quite. CML-Free caps you at five nodes and a useful ENARSI topology is six, with headroom wanted for a seventh. CML-Personal at $199 a year and 20 nodes is the tier most candidates land on.
Can I build the lab in CML and run it in EVE-NG?
No. Cisco's CML end-user licence, revised April 2026, restricts the bundled images to use within CML. EVE-NG and GNS3 are capable tools, but you must be separately entitled to any image you load into them.
How many questions are on 300-410 and what is the passing score?
Cisco publishes neither. The exam runs 90 minutes and costs $300. Cisco's policy page states that passing scores are not published because they are set by statistical analysis and can change without notice.
Sources
Exam facts come from Cisco. Lab guidance is marked as official or as practitioner consensus where the two differ:
- https://learningcontent.cisco.com/documents/marketing/exam-topics/300-410-ENARSI-v1.1.pdf
- https://www.cisco.com/site/us/en/learn/training-certifications/exams/policies.html
- https://developer.cisco.com/docs/modeling-labs/
- https://www.cisco.com/c/en/us/products/cloud-systems-management/modeling-labs/index.html
Checked September 5, 2026. Cisco revises exam topics and changes image licensing without notice — confirm before you spend anything.