CCIE DevNet Lab Readiness Assessment

The Domus Digitalis home enterprise provides a production-grade lab environment that meets or exceeds CCIE DevNet Expert lab requirements. This assessment maps existing infrastructure, credentials, and automation surface to the certification’s practical exam domains.

Verdict

Yes — the lab supports CCIE-level automation labs. Two Supermicro hypervisors with 128GB ECC total, real Cisco Catalyst hardware, ISE, WLC HA, Vault PKI, k3s with BGP, and VyOS HA provide a platform that exceeds what most candidates build. CML can run on existing compute with headroom to spare.

Credential Foundation

Current certifications that underpin the CCIE DevNet path:

Certification	Level	Status	CCIE Relevance
CCNP Enterprise	Professional	Active (Nov 2027)	Core routing/switching programmability
CCNP Security	Professional	Active (Nov 2027)	ISE, Firepower, VPN API automation
8x Cisco Specialists	Specialist	Active (Feb 2029)	Breadth across enterprise + security domains
LPIC-1/2 + Linux+	Advanced	Active	Linux automation targets — most candidates are weak here
CCNA	Associate	Active (Feb 2029)	Network fundamentals baseline
CompTIA Security+	Associate	Active (Nov 2029)	Security concepts baseline

Certification

Level

Status

CCIE Relevance

CCNP Enterprise

Professional

Active (Nov 2027)

Core routing/switching programmability

CCNP Security

Professional

Active (Nov 2027)

ISE, Firepower, VPN API automation

8x Cisco Specialists

Specialist

Active (Feb 2029)

Breadth across enterprise + security domains

LPIC-1/2 + Linux+

Advanced

Active

Linux automation targets — most candidates are weak here

CCNA

Associate

Active (Feb 2029)

Network fundamentals baseline

CompTIA Security+

Associate

Active (Nov 2029)

Security concepts baseline

Certification Path to CCIE DevNet Expert

DevNet Associate (200-901)     ← validates fundamentals already demonstrated
        │
        ▼
DevNet Professional (350-901)  ← core exam covers daily work surface
        │
        ▼
CCIE DevNet Expert             ← 8-hour practical lab exam

DevNet Professional core exam (350-901 DEVCOR) also renews CCNP Enterprise and CCNP Security. Single exam, triple renewal.

Infrastructure Assessment

Compute Capacity

Host	Processor	RAM	Storage	CCIE Lab Role
kvm-01.inside.domusdigitalis.dev	Xeon D-2146NT	64GB ECC	2x 2TB NVMe	CML host + production VMs
kvm-02.inside.domusdigitalis.dev	Xeon D-2146NT	64GB ECC	1.5TB NVMe	DR/secondary + ISE 3.5
ThinkPad P16g Gen 3	Intel Ultra 9 275HX (24 cores)	64GB	2TB NVMe	Development workstation + overflow CML

Host

Processor

RAM

Storage

CCIE Lab Role

kvm-01.inside.domusdigitalis.dev

Xeon D-2146NT

64GB ECC

2x 2TB NVMe

CML host + production VMs

kvm-02.inside.domusdigitalis.dev

Xeon D-2146NT

64GB ECC

1.5TB NVMe

DR/secondary + ISE 3.5

ThinkPad P16g Gen 3

Intel Ultra 9 275HX (24 cores)

64GB

2TB NVMe

Development workstation + overflow CML

Total compute: ~190GB RAM, 40+ cores across 3 machines. CML requires ~32GB for complex topologies — 6x headroom available on any single host.

Network Hardware

Equipment	Model	CCIE Relevance
Access Switch	Cisco Catalyst 3560-CX (10.50.1.10)	Real IOS-XE NETCONF/RESTCONF target, 802.1X
Distribution Switch	Cisco Catalyst 9300-24P	Production-grade IOS-XE platform — the same hardware in enterprise deployments and CCIE labs
Wireless LAN Controller	Cisco C9800-CL HA pair (10.50.1.40)	RESTCONF/YANG programmable wireless — HA pair for failover testing
WiFi 6E AP	Cisco CW9166I-B	Real wireless endpoint for WLC automation validation
Gateway/Firewall	VyOS HA pair (10.50.1.2)	Programmable routing with VRRP failover and BGP (Cilium peering)

Equipment

Model

CCIE Relevance

Access Switch

Cisco Catalyst 3560-CX (10.50.1.10)

Real IOS-XE NETCONF/RESTCONF target, 802.1X

Distribution Switch

Cisco Catalyst 9300-24P

Production-grade IOS-XE platform — the same hardware in enterprise deployments and CCIE labs

Wireless LAN Controller

Cisco C9800-CL HA pair (10.50.1.40)

RESTCONF/YANG programmable wireless — HA pair for failover testing

WiFi 6E AP

Cisco CW9166I-B

Real wireless endpoint for WLC automation validation

Gateway/Firewall

VyOS HA pair (10.50.1.2)

Programmable routing with VRRP failover and BGP (Cilium peering)

Identity & Security Services

Service	Deployment	CCIE Relevance
Cisco ISE	3.4 (10.50.1.20) + 3.5 (ise-02)	ERS API, DataConnect, pxGrid — all tested in CCIE DevNet lab
HashiCorp Vault	3-node HA (10.50.1.60, 10.50.1.61, 10.50.1.62)	PKI automation, SSH-CA, secrets management as infrastructure-as-code
Active Directory	Windows Server 2025 Core (HOME-DC01)	RADIUS/802.1X backend for ISE policy testing
BIND DNS	HA pair ({home-dns-primary})	DNS automation target
k3s + Cilium	Single master (10.50.1.120), BGP peering	Container networking, service mesh — CCIE DevNet v1.1 topic
FreeIPA	ipa-01	Linux identity management automation

Service

Deployment

CCIE Relevance

Cisco ISE

3.4 (10.50.1.20) + 3.5 (ise-02)

ERS API, DataConnect, pxGrid — all tested in CCIE DevNet lab

HashiCorp Vault

3-node HA (10.50.1.60, 10.50.1.61, 10.50.1.62)

PKI automation, SSH-CA, secrets management as infrastructure-as-code

Active Directory

Windows Server 2025 Core (HOME-DC01)

RADIUS/802.1X backend for ISE policy testing

BIND DNS

HA pair ({home-dns-primary})

DNS automation target

k3s + Cilium

Single master (10.50.1.120), BGP peering

Container networking, service mesh — CCIE DevNet v1.1 topic

FreeIPA

ipa-01

Linux identity management automation

VLAN Segmentation

VLAN	Purpose	Automation Value
100 (INFRA)	Hypervisors, BMC/IPMI, k3s	Infrastructure management plane
110 (SECURITY)	Vault, ISE, secrets	Security automation targets
120 (SERVICES)	Keycloak, Gitea, FreeIPA, BIND	Service provisioning automation
10 (DATA)	Corporate wired/wireless	802.1X policy testing
30 (GUEST)	Guest portal (internet-only)	ISE guest flow automation
40 (IOT)	IoT devices	Profiling and segmentation automation

VLAN

Purpose

Automation Value

100 (INFRA)

Hypervisors, BMC/IPMI, k3s

Infrastructure management plane

110 (SECURITY)

Vault, ISE, secrets

Security automation targets

120 (SERVICES)

Keycloak, Gitea, FreeIPA, BIND

Service provisioning automation

10 (DATA)

Corporate wired/wireless

802.1X policy testing

30 (GUEST)

Guest portal (internet-only)

ISE guest flow automation

40 (IOT)

IoT devices

Profiling and segmentation automation

Existing Automation Surface

Work already completed that maps directly to CCIE DevNet domains:

Asset	Technologies	Depth
netapi CLI	Python, FastAPI, ISE ERS (199+ endpoints), WLC RESTCONF, httpx async	Advanced
WLC RESTCONF Scripts	15+ operational scripts against C9800 (AAA, clients, APs, policies, RF)	Advanced
Vault PKI Automation	certbot → Vault → ISE certificate pipeline	Advanced
ISE DataConnect	SQL queries via dc-run-sql, ise_dc_query	Intermediate
Antora CI/CD	Git → GitHub → Cloudflare Pages (20+ repos)	Advanced
k3s + Cilium	Container orchestration with BGP peering to VyOS	Intermediate

Asset

Technologies

Depth

netapi CLI

Python, FastAPI, ISE ERS (199+ endpoints), WLC RESTCONF, httpx async

Advanced

WLC RESTCONF Scripts

15+ operational scripts against C9800 (AAA, clients, APs, policies, RF)

Advanced

Vault PKI Automation

certbot → Vault → ISE certificate pipeline

Advanced

ISE DataConnect

SQL queries via dc-run-sql, ise_dc_query

Intermediate

Antora CI/CD

Git → GitHub → Cloudflare Pages (20+ repos)

Advanced

k3s + Cilium

Container orchestration with BGP peering to VyOS

Intermediate

CCIE DevNet Lab Domain Mapping

Domain Coverage

CCIE DevNet Domain	Ready?	Evidence / Gap
Network Programmability (NETCONF/RESTCONF/YANG)	■■■■■□□□□□ 5/10	WLC RESTCONF operational. Gap: IOS-XE NETCONF on C9300, model-driven telemetry
ISE API Automation (ERS, pxGrid)	■■■■■□□□□□ 5/10	netapi covers ERS extensively. Gap: pxGrid integration
pyATS/Genie	□□□□□□□□□□ 0/10	Listed in project plan. Major gap — heavily weighted in lab exam
Ansible Networking	□□□□□□□□□□ 0/10	Tracker exists. Major gap — ios_config, ise_device modules
NSO (Network Services Orchestrator)	□□□□□□□□□□ 0/10	Not present. Free download from DevNet. Runs on Linux
CI/CD for Network	■■■■■□□□□□ 5/10	Antora pipeline operational. Gap: network config deployment pipeline
Cisco Catalyst Center / DNA Center	□□□□□□□□□□ 0/10	SDK/API automation. Requires CML virtual appliance or DevNet Sandbox
Docker/K8s for Network Services	■■■■■■■■■■ 10/10	k3s operational with Cilium BGP, MetalLB, Traefik ingress
Python Networking (Netmiko, Nornir, Scrapli)	■■■■■□□□□□ 5/10	netapi demonstrates depth. Gap: Nornir multi-device orchestration
Model-Driven Telemetry	□□□□□□□□□□ 0/10	gRPC dial-in/dial-out on C9300 needed

CCIE DevNet Domain

Ready?

Evidence / Gap

Network Programmability (NETCONF/RESTCONF/YANG)

■■■■■□□□□□ 5/10

WLC RESTCONF operational. Gap: IOS-XE NETCONF on C9300, model-driven telemetry

ISE API Automation (ERS, pxGrid)

■■■■■□□□□□ 5/10

netapi covers ERS extensively. Gap: pxGrid integration

pyATS/Genie

□□□□□□□□□□ 0/10

Listed in project plan. Major gap — heavily weighted in lab exam

Ansible Networking

□□□□□□□□□□ 0/10

Tracker exists. Major gap — ios_config, ise_device modules

NSO (Network Services Orchestrator)

□□□□□□□□□□ 0/10

Not present. Free download from DevNet. Runs on Linux

CI/CD for Network

■■■■■□□□□□ 5/10

Antora pipeline operational. Gap: network config deployment pipeline

Cisco Catalyst Center / DNA Center

□□□□□□□□□□ 0/10

SDK/API automation. Requires CML virtual appliance or DevNet Sandbox

Docker/K8s for Network Services

■■■■■■■■■■ 10/10

k3s operational with Cilium BGP, MetalLB, Traefik ingress

Python Networking (Netmiko, Nornir, Scrapli)

■■■■■□□□□□ 5/10

netapi demonstrates depth. Gap: Nornir multi-device orchestration

Model-Driven Telemetry

□□□□□□□□□□ 0/10

gRPC dial-in/dial-out on C9300 needed

Readiness Summary

Status	Count	Percentage
✅ Ready	1	10%
■■■■■□□□□□ 5/10	4	40%
❌ Gap	5	50%

Gap Closure — Software, Not Hardware

Every gap is software-only. No additional equipment purchases are required.

Required Software Installations

Software	Purpose	Install Target
Cisco Modeling Labs (CML)	Virtual IOS-XE/NX-OS/IOS-XR topologies	kvm-02.inside.domusdigitalis.dev (or P16g)
Cisco NSO	Network Services Orchestrator — free from DevNet	VM on kvm-01.inside.domusdigitalis.dev
pyATS/Genie	Network test automation framework	P16g (pip install)
Ansible + networking collections	cisco.ios, cisco.ise, cisco.nxos	P16g (pip install)
Nornir + plugins	Multi-device orchestration	P16g (pip install)
Telegraf + InfluxDB + Grafana	Model-driven telemetry collection	k3s cluster or dedicated VM

Software

Purpose

Install Target

Cisco Modeling Labs (CML)

Virtual IOS-XE/NX-OS/IOS-XR topologies

kvm-02.inside.domusdigitalis.dev (or P16g)

Cisco NSO

Network Services Orchestrator — free from DevNet

VM on kvm-01.inside.domusdigitalis.dev

pyATS/Genie

Network test automation framework

P16g (pip install)

Ansible + networking collections

cisco.ios, cisco.ise, cisco.nxos

P16g (pip install)

Nornir + plugins

Multi-device orchestration

P16g (pip install)

Telegraf + InfluxDB + Grafana

Model-driven telemetry collection

k3s cluster or dedicated VM

Required Configuration Changes

Target Change

Target	Change
C9300 IOS-XE	`netconf-yang` (single command enables NETCONF)
C9300 IOS-XE	gRPC model-driven telemetry subscription
ISE	pxGrid persona activation + certificate enrollment
VyOS	API/HTTP service for programmatic config management

C9300 IOS-XE

netconf-yang (single command enables NETCONF)

C9300 IOS-XE

gRPC model-driven telemetry subscription

ISE

pxGrid persona activation + certificate enrollment

VyOS

API/HTTP service for programmatic config management

Recommended Lab Exercises

Exercises organized by CCIE DevNet domain, all executable against existing infrastructure:

Phase 1 — Foundation (pyATS + NETCONF)

Build pyATS testbed YAML for C9300 + 3560-CX + VyOS
pyats learn interface --testbed testbed.yaml against real hardware
pyATS health checks: compare pre/post snapshots after config changes
ncclient NETCONF get-config and edit-config against C9300
YANG model exploration with pyang for IOS-XE and ISE

Phase 2 — Orchestration (Ansible + Nornir)

Ansible playbook: VLAN provisioning across C9300 + 3560-CX
Ansible playbook: ISE endpoint group creation via ERS
Nornir inventory: all network devices with grouped credentials
Nornir task: parallel config backup across entire network
Ansible + Vault integration: dynamic credential retrieval

Phase 3 — Advanced (NSO + Telemetry + CI/CD)

NSO service package: VLAN + ACL deployment across multi-vendor
Model-driven telemetry: gRPC subscription → Telegraf → Grafana
pxGrid integration: ISE session data → custom Python consumer
GitLab CI/CD pipeline: commit → lint → Ansible deploy → pyATS verify
CML topology: multi-site OSPF/BGP with programmatic provisioning

Phase 4 — Lab Simulation (8-Hour Practice)

Timed scenarios combining multiple domains
ISE policy automation + switch config + wireless provisioning in single workflow
Troubleshooting: break-fix scenarios with API-driven diagnostics
End-to-end: new site deployment via NSO + Ansible + pyATS validation

Competitive Advantage

What this lab provides that CML-only environments cannot:

Advantage	Detail
Real RADIUS flows	802.1X EAP-TLS with Vault-issued certificates against production ISE
Real API latency	ISE ERS responses from actual policy engine, not simulated
Real certificate enrollment	Vault PKI → ISE trust chain in production
Real wireless	C9800 WLC HA pair with physical AP — actual RF management
Real BGP peering	Cilium ↔ VyOS — not simulated routing adjacencies
Real HA failover	VyOS VRRP, Vault Raft, WLC SSO — actual failure scenarios

Advantage

Detail

Real RADIUS flows

802.1X EAP-TLS with Vault-issued certificates against production ISE

Real API latency

ISE ERS responses from actual policy engine, not simulated

Real certificate enrollment

Vault PKI → ISE trust chain in production

Real wireless

C9800 WLC HA pair with physical AP — actual RF management

Real BGP peering

Cilium ↔ VyOS — not simulated routing adjacencies

Real HA failover

VyOS VRRP, Vault Raft, WLC SSO — actual failure scenarios

Timeline Estimate

Phase	Milestone	Target
0	DevNet Associate (200-901) — likely a formality given current API work	Q3 2026
1	DevNet Professional (350-901 DEVCOR)	Q1 2027
2	Lab preparation: pyATS, NSO, Ansible, telemetry depth	Q2–Q3 2027
3	CCIE DevNet Expert lab attempt	Q4 2027

Phase

Milestone

Target

DevNet Associate (200-901) — likely a formality given current API work

Q3 2026

DevNet Professional (350-901 DEVCOR)

Q1 2027

Lab preparation: pyATS, NSO, Ansible, telemetry depth

Q2–Q3 2027

CCIE DevNet Expert lab attempt

Q4 2027

These are rough targets. CISSP (Aug 2026) and RHCSA (2026) take priority per existing study plan. The DevNet path benefits from the fact that daily work already exercises the automation surface.