## Enterprise Network Architecture Fundamentals

Enterprise network architecture defines the blueprint for designing, implementing, and managing an organization's network infrastructure. It emphasizes scalability, resilience, security, and performance, adapting to evolving business needs and technological advancements.

## Hierarchical Campus Design

The traditional three-tier hierarchical design is fundamental for campus networks, promoting modularity, redundancy, and ease of management.

• Access Layer: Connects end-user devices (PCs, phones, access points) to the network. Focuses on port density, Power over Ethernet (PoE), and port-level security features.
• Distribution Layer: Aggregates access layer switches, provides routing, policy enforcement (e.g., QoS, ACLs), and acts as a boundary for broadcast domains. It offers uplink redundancy to the core.
• Core Layer: Provides high-speed packet switching between distribution layer devices. Focuses on extreme reliability, fast transport, and minimal processing to ensure maximum throughput.

## WAN Architectures

Wide Area Network (WAN) architectures connect geographically dispersed sites.

• Traditional WAN: Often uses technologies like MPLS, leased lines, or VPNs over the internet, requiring manual configuration and static routing policies.
• SD-WAN (Software-Defined WAN): An overlay architecture that abstracts the underlying transport (broadband, MPLS, LTE). It provides centralized control, application-aware routing, and improved performance, enhancing agility and reducing operational costs.

## Wireless LAN Architectures

Wireless networks are integral to modern enterprises.

• Controller-Based WLAN: Access Points (APs) are centrally managed by a Wireless LAN Controller (WLC), which handles AP configuration, client authentication, mobility, and radio resource management.
• Controller-Less WLAN (e.g., Cisco Meraki): APs manage themselves and can be cloud-managed, simplifying deployment and management for smaller to medium-sized environments.

## Data Center Architectures

Data centers host critical applications and data.

• Traditional Three-Tier: Similar to campus design (access, aggregation/distribution, core), but optimized for server connectivity and traffic patterns.
• Spine-Leaf Architecture: A modern, flatter, and highly scalable design using a Clos network topology. It provides predictable latency and high bandwidth between any two points, ideal for virtualized and cloud environments.
• ACI (Application Centric Infrastructure): Cisco's Software-Defined Networking (SDN) solution for data centers, providing centralized policy-based automation and network programmability, focusing on application requirements.

## Network Programmability and Automation

Modern architectures increasingly leverage APIs (Application Programming Interfaces), controllers (e.g., Cisco DNA Center), and orchestration tools to automate network operations, configuration, and provisioning, moving towards intent-based networking.

## Cloud Architectures

Enterprise networks now extend to and integrate with various cloud models:

• Public Cloud: Services offered by third-party providers over the internet (e.g., AWS, Azure).
• Private Cloud: Dedicated cloud infrastructure for a single organization.
• Hybrid Cloud: A mix of public and private cloud resources, allowing flexible workload placement.
• Multi-Cloud: Using multiple public cloud providers to avoid vendor lock-in and leverage best-of-breed services.

Virtualization technologies are fundamental for modern network architectures, enabling flexibility, scalability, and efficiency by abstracting resources from their underlying hardware.

## Server Virtualization

This involves running multiple Virtual Machines (VMs) on a single physical server. A hypervisor is the software that creates and runs VMs. There are two main types:

• Type 1 Hypervisor (Bare-Metal): Runs directly on the host hardware, examples include VMware ESXi, Microsoft Hyper-V, and Cisco's KVM-based hypervisors. It offers high performance and security.
• Type 2 Hypervisor (Hosted): Runs as an application on an existing operating system, examples include VMware Workstation or VirtualBox. It's simpler for testing but less efficient for production.

## Network Virtualization

This abstracts network resources, allowing logical networks to operate independently of the physical infrastructure.

• Software-Defined Networking (SDN): Separates the control plane (decision-making) from the data plane (packet forwarding). An SDN controller (e.g., Cisco DNA Center, Cisco vManage for SD-WAN) centralizes network intelligence and configuration, enabling programmatic management and automation.

• Network Function Virtualization (NFV): Decouples network functions (e.g., routers, firewalls, load balancers) from proprietary hardware appliances and runs them as Virtualized Network Functions (VNFs) on standard servers. This improves agility and reduces operational costs. Key components include NFV Infrastructure (NFVI) and Management and Orchestration (MANO).

• Virtual Switching: Software-based switches (e.g., vSphere Standard Switch, vSphere Distributed Switch) connect VMs to the physical network and provide advanced features like traffic shaping and security policies.

• Overlay Networks: Create logical networks on top of an existing underlay physical network. They encapsulate traffic, allowing logical segments to span across disparate physical locations. VXLAN (Virtual Extensible LAN) is a common overlay technology that extends Layer 2 segments over a Layer 3 underlay using VXLAN Tunnel Endpoints (VTEPs) and Virtual Network Identifiers (VNIs).

• VRF-Lite (Virtual Routing and Forwarding Lite): A feature on routers that allows multiple independent routing tables to coexist on a single router, providing network segmentation and virtualization for different customers or departments.

## Cisco Specific Virtualization

• Cisco SD-WAN: An overlay network solution that uses a centralized controller (vSmart) to build secure, intelligent tunnels (vEdge/cEdge) over any transport, optimizing application performance and simplifying WAN management.
• Cisco DNA Center: An SDN controller for campus and branch networks, providing automation, assurance, and security through a single pane of glass.

## Layer 2 Infrastructure

Layer 2 infrastructure forms the foundation of modern enterprise networks, providing connectivity within a local area network (LAN). Key technologies ensure efficient, redundant, and secure data forwarding.

## VLANs and Trunks

• VLANs (Virtual Local Area Networks) segment a single physical switch into multiple logical broadcast domains, improving security and performance. Devices in different VLANs cannot communicate without a Layer 3 device.
• Trunks are links that carry traffic for multiple VLANs between switches or between a switch and a router.
• IEEE 802.1Q is the industry standard for VLAN tagging on trunk links. It inserts a 4-byte tag into the Ethernet frame header, identifying the VLAN.
• The Native VLAN on an 802.1Q trunk link sends untagged frames. Mismatched native VLANs can cause connectivity issues and security risks.
• DTP (Dynamic Trunking Protocol) is a Cisco-proprietary protocol used to negotiate trunking parameters between switches.

## Spanning Tree Protocol (STP)

• STP prevents Layer 2 loops in redundant network topologies, which can cause broadcast storms and MAC address table instability. It achieves this by logically blocking redundant paths.
• Root Bridge: The central point of an STP domain, elected based on Bridge ID (priority + MAC address). All paths to the root bridge are preferred.
• RSTP (Rapid Spanning Tree Protocol - 802.1w) is an evolution of classic STP, offering significantly faster convergence (typically within seconds) by rapidly transitioning ports to forwarding states.
• MSTP (Multiple Spanning Tree Protocol - 802.1s) allows multiple STP instances, mapping one or more VLANs to each instance. This optimizes resource utilization and provides load balancing by allowing different VLANs to use different root bridges and forwarding paths.

## EtherChannel

• EtherChannel (also known as Link Aggregation Group or LAG) bundles multiple physical Ethernet links into a single logical link. This provides increased bandwidth and link redundancy.
• LACP (Link Aggregation Control Protocol - 802.3ad) is an open standard protocol for negotiating EtherChannels.
• PAgP (Port Aggregation Protocol) is a Cisco-proprietary protocol for negotiating EtherChannels.
• Static EtherChannels can be configured without negotiation protocols.

## Layer 2 Security Features

• Port Security: Limits the number of MAC addresses allowed on a switch port, preventing unauthorized devices from connecting. Actions for violations include shutdown, restrict, or protect.
• DHCP Snooping: Prevents rogue DHCP servers from issuing IP addresses and mitigates DHCP starvation attacks. It builds a binding table of trusted DHCP servers and valid IP-MAC bindings.
• Dynamic ARP Inspection (DAI): Protects against ARP spoofing and poisoning by validating ARP packets against the DHCP snooping binding table. Untrusted ports block invalid ARP packets.
• IP Source Guard: Prevents IP and MAC address spoofing by filtering traffic based on the DHCP snooping binding table. It ensures that only traffic with valid source IP and MAC addresses is forwarded.

## Layer 3 Infrastructure Fundamentals

Layer 3 infrastructure focuses on routing and forwarding packets across networks. Key concepts include Administrative Distance (AD), which ranks the trustworthiness of routing information sources (lower is better), and Metric, used by a routing protocol to determine the best path within its own domain. When multiple paths exist, the router uses the Longest Prefix Match to select the most specific route.

## Interior Gateway Protocols (IGPs)

OSPF (Open Shortest Path First)

An open-standard link-state routing protocol. OSPF divides networks into areas to improve scalability and reduce routing table size. Area 0 (backbone area) is mandatory, and all other areas must connect to it. Routers in Area 0 are called Backbone Routers. Area Border Routers (ABRs) connect regular areas to Area 0. Designated Routers (DRs) and Backup Designated Routers (BDRs) are elected on multi-access segments to reduce LSA flooding.

EIGRP (Enhanced Interior Gateway Routing Protocol)

Cisco proprietary distance-vector protocol with link-state characteristics. EIGRP uses the Diffusing Update Algorithm (DUAL) to ensure loop-free paths and fast convergence. It calculates a composite metric based on bandwidth, delay, reliability, and load. EIGRP maintains a topology table containing all learned routes, including feasible successors (backup paths).

## Border Gateway Protocol (BGP)

An exterior gateway protocol (EGP) and path-vector protocol used for inter-AS routing on the internet. BGP uses Autonomous System Numbers (ASNs) to identify routing domains. eBGP connects different ASes, while iBGP connects routers within the same AS. BGP routers exchange path attributes (e.g., AS_PATH, NEXT_HOP, LOCAL_PREF, MED) to influence best path selection. Route Reflectors are used to scale iBGP by relaxing the full-mesh requirement.

## Route Manipulation & Redundancy

Route Redistribution allows different routing protocols to exchange route information, but requires careful configuration due to varying ADs and metrics. Route Summarization (or aggregation) reduces routing table size and instability by advertising a single summary route for multiple specific routes.

First Hop Redundancy Protocols (FHRPs) like HSRP (Hot Standby Router Protocol), VRRP (Virtual Router Redundancy Protocol), and GLBP (Gateway Load Balancing Protocol) provide default gateway redundancy. HSRP and VRRP use an active/standby model, while GLBP offers load balancing across multiple routers.

## Advanced Layer 3 Features

VRF-Lite (Virtual Routing and Forwarding-Lite) allows a single router to host multiple independent routing tables, providing network segmentation. Policy-Based Routing (PBR) allows forwarding decisions to be made based on criteria other than the destination IP address, using `match` and `set` commands. Bidirectional Forwarding Detection (BFD) provides rapid detection of forwarding path failures, enabling faster convergence for routing protocols.

## WLAN Fundamentals

Wireless LANs (WLANs) operate based on IEEE 802.11 standards (e.g., 802.11a/b/g/n/ac/ax). Unlike wired networks, WLANs use CSMA/CA (Carrier Sense Multiple Access with Collision Avoidance) due to the half-duplex nature of radio communication. Wi-Fi operates primarily in the 2.4 GHz and 5 GHz ISM bands. The 5 GHz band offers more non-overlapping channels and higher throughput but has a shorter range and is more susceptible to obstacles. SSIDs (Service Set Identifiers) broadcast the network name.

## WLAN Architecture

Modern enterprise WLANs typically use a controller-based architecture. Access Points (APs) can operate in various modes:

• Lightweight AP: Requires a Wireless LAN Controller (WLC) for configuration, management, and often data forwarding (centralized switching).
• Autonomous AP: Self-contained, configured individually, acts as its own controller.
• FlexConnect AP: A lightweight AP mode where data traffic can be locally switched at the AP, and client authentication can be locally handled when the WLC is unreachable, ideal for branch offices.

WLCs manage APs, centralize configuration, and provide services like Radio Resource Management (RRM) for automated channel and power optimization. Cisco offers AireOS and Catalyst WLC platforms, with Catalyst WLCs representing the newer, integrated approach.

## WLAN Security

WPA2 and WPA3 are the primary security standards. WPA3 is the latest, offering stronger encryption (192-bit CNSA mode), Enhanced Open for public Wi-Fi, and SAE (Simultaneous Authentication of Equals) for stronger PSK-like authentication.

For enterprise deployments, 802.1X authentication is used, leveraging EAP (Extensible Authentication Protocol) methods (e.g., PEAP, EAP-TLS) and a RADIUS (Remote Authentication Dial-In User Service) server to authenticate users and devices against a central database (e.g., Cisco ISE). This provides individual user credentials and dynamic per-user encryption keys, unlike Pre-Shared Key (PSK) which uses a single key for all clients.

## Roaming

Client roaming allows devices to move between APs without losing connectivity. Layer 2 roaming occurs when clients move between APs on the same subnet. Layer 3 roaming is more complex, involving clients moving between APs on different subnets, often managed by the WLC to maintain IP address continuity.

## Network Assurance Fundamentals

Network Assurance is the practice of continuously monitoring, managing, and optimizing network performance and security to ensure it meets business requirements. It involves proactive identification and resolution of issues, leveraging various tools and methodologies.

## Key Monitoring Technologies

• SNMP (Simple Network Management Protocol): An application-layer protocol for managing and monitoring network devices. It uses Managers (NMS) and Agents (devices). SNMP v3 offers authentication and encryption. Uses UDP ports 161 (agent) and 162 (manager).
• NetFlow/IPFIX: Technologies for collecting IP traffic flow information. Useful for network monitoring, security analysis, and capacity planning. NetFlow exports records containing source/destination IP, ports, protocol, etc. IPFIX is an IETF standard based on NetFlow v9.
• Syslog: A standard for sending system event messages to a centralized server. Messages are categorized by severity levels (e.g., emergency, alert, critical, error, warning, notice, informational, debug) and facilities. Crucial for troubleshooting and security auditing.
• SPAN (Switched Port Analyzer) / ERSPAN (Encapsulated Remote SPAN): SPAN mirrors traffic from one or more source ports/VLANs to a destination port for analysis. ERSPAN extends this across Layer 3 boundaries by encapsulating mirrored traffic in a GRE tunnel, allowing remote analysis.
• IP SLA (Service Level Agreement): A feature that generates and analyzes traffic to measure network performance. It simulates various network operations (e.g., ping, HTTP GET, UDP jitter) to measure metrics like latency, jitter, packet loss, and availability.

## Programmable Assurance

• Model-Driven Telemetry (MDT): A modern approach to network monitoring where devices push operational data to collectors. It uses data models (e.g., YANG) and encoding formats (e.g., GPB, JSON) over transports like gRPC. MDT offers higher frequency, granular data collection, and reduced overhead compared to traditional polling (e.g., SNMP).
• APIs (Application Programming Interfaces): NETCONF and RESTCONF are protocol-independent APIs used for configuring and monitoring network devices. They use YANG data models to define data structures. They enable programmatic interaction with devices, facilitating automation and assurance tasks.

## Troubleshooting Methodologies

Common approaches include Top-down (application to physical), Bottom-up (physical to application), and Divide and Conquer (isolating layers or segments). Establishing a baseline of normal network behavior is critical for identifying anomalies and troubleshooting efficiently.

## Infrastructure Security Fundamentals

Infrastructure security is paramount for protecting network devices and the data they transmit. Key areas include securing device access, the control plane, the data plane, and Layer 2 infrastructure.

## Device Access Control (AAA)

Authentication, Authorization, and Accounting (AAA) is a framework for controlling who can access network devices and what actions they can perform.

• Authentication: Verifies user identity (e.g., username/password).
• Authorization: Determines permitted actions for authenticated users.
• Accounting: Tracks user activity and resource consumption.

RADIUS and TACACS+ are common AAA protocols. RADIUS often combines AAA and is used for network access. TACACS+ separates AAA, offering more granular authorization, making it ideal for device administration. Local authentication serves as a crucial fallback.

## Control Plane Security

The control plane handles critical device operations, including routing protocols and management traffic (SSH, SNMP). Protecting it prevents device compromise or denial of service.

• Control Plane Policing (CoPP): Protects the device's CPU from excessive traffic by rate-limiting or dropping packets destined for the control plane, preventing resource exhaustion attacks.
• Management plane protection involves using secure protocols like SSH (instead of Telnet) and SNMPv3 (with authentication and encryption) for remote access and monitoring.

## Data Plane Security

The data plane is responsible for forwarding user traffic.

• Access Control Lists (ACLs): Filter traffic based on criteria such as source/destination IP addresses, port numbers, and protocols.
• Unicast Reverse Path Forwarding (uRPF): Mitigates IP spoofing by verifying that the source IP address of an incoming packet has a valid, routable path back to its origin. Packets failing this check are dropped.

## Layer 2 Security

Layer 2 attacks can severely impact network availability and data integrity.

• DHCP Snooping: Prevents rogue DHCP servers and DHCP starvation attacks by building and maintaining a trusted database of DHCP bindings.
• Dynamic ARP Inspection (DAI): Prevents ARP spoofing and poisoning by validating ARP packets against the DHCP snooping binding database or static entries.
• IP Source Guard: Restricts client IP traffic on untrusted Layer 2 ports to only known source IP/MAC address combinations, preventing IP and MAC address spoofing.
• Port Security: Limits the number of MAC addresses learned on a switch port and defines actions (e.g., shutdown, restrict) when limits are exceeded, preventing MAC flooding.
• BPDU Guard and Root Guard: Protect against rogue STP BPDUs, preventing unauthorized changes to the spanning-tree topology.

## VPN Technologies

Virtual Private Networks (VPNs) provide secure, encrypted communication over untrusted networks.

• IPsec: A suite of protocols providing data confidentiality, integrity, and authentication. It's used for both site-to-site and remote-access VPNs. IPsec operates in two main phases: IKE (Internet Key Exchange) for negotiating security associations, and IPsec itself for data encryption and authentication.

## Network Automation and Programmability

Network automation is crucial for modern, scalable, and efficient network operations, reducing manual errors and accelerating deployments. It involves using software to manage and configure network devices.

## Data Models

Data models provide a structured, standardized way to represent network device configurations and operational states.

• YANG (Yet Another Next Generation): A data modeling language used to define the structure of configuration and state data for network devices. It's human-readable and machine-parseable.
• JSON (JavaScript Object Notation): A lightweight, human-readable data interchange format, widely used with REST APIs.
• XML (Extensible Markup Language): A markup language that defines a set of rules for encoding documents in a format that is both human-readable and machine-readable. Often used with NETCONF.

## APIs and Protocols

APIs (Application Programming Interfaces) enable programmatic interaction with network devices.

• NETCONF (Network Configuration Protocol): A protocol designed for configuring network devices. It uses XML to encode configuration data and runs over SSH for secure transport. It's transaction-based and provides robust error handling.
• RESTCONF: A HTTP-based protocol that uses YANG data models to configure and monitor network devices. It leverages standard HTTP methods (GET, POST, PUT, DELETE) for operations, making it stateless and scalable.
• gRPC (Google Remote Procedure Call): A high-performance, open-source RPC framework that can be used for network programmability, often for streaming telemetry. It uses Protocol Buffers for data serialization.

## Automation Tools and Concepts

• Python: A widely adopted programming language for network automation due to its simplicity, extensive libraries, and strong community support.
• Ansible: An open-source automation engine that automates provisioning, configuration management, application deployment, and orchestration. It's agentless, using SSH to communicate with devices. Playbooks written in YAML define desired states.
• Software-Defined Networking (SDN): Decouples the network's control plane from the data plane, centralizing control and enabling programmatic management of network resources. Northbound APIs allow applications to interact with the SDN controller, while Southbound APIs (like OpenFlow) enable the controller to program network devices.
• Orchestration: The automated arrangement, coordination, and management of computer systems, middleware, and services. It often involves chaining multiple automation tasks together.

## Telemetry

• Model-Driven Telemetry (MDT): A modern approach to network monitoring where devices stream operational data to collectors. It uses YANG data models to define the data structure and can push data in real-time, offering greater visibility than traditional polling methods (e.g., SNMP).