NETCONF replaces screen-scraping with structured XML over SSH against YANG models. This walkthrough drives Cisco IOS XE with ncclient from a real Linux automation host, from first hello to config change.
EEM runs on the router itself, watching for events and acting on them with no external server to depend on. This article builds three EEM applets on Cisco IOS XE for config automation, troubleshooting, and data collection, and fires all three for real.
VRFs, VLANs, VXLAN, and LISP all segment a network at different layers. This decision framework shows what each one actually separates and when to use it, so you do not reach for a fabric when a VLAN would do.
The network no longer stops at the physical switch port. Hypervisors, virtual switches, and VM networking explained for engineers who know networking but not the compute side, where your VLANs actually terminate.
The hard engineering in SD-Access adoption is the border where the fabric meets your existing campus. This covers how VXLAN and LISP traffic crosses that boundary and the realistic migration paths that keep users up.
SD-Access is LISP as the control plane, VXLAN as the data plane, and Catalyst Center operating the whole thing. This article explains the fabric architecture, its roles, and the policy model, extending the network virtualization cluster.
VXLAN without a control plane is flood-and-learn, and that does not scale to a real data center. BGP EVPN is what fabrics actually use: what it advertises, the route types that carry reachability, and why it replaced flooding everywhere.
VXLAN stretches Layer 2 across a routed network by wrapping Ethernet frames in UDP. This deep dive takes the encapsulation apart to the byte level with a real crafted-and-decoded packet, covering VNIs and VTEPs.
An IP address is both identity and location, and that overload breaks mobility. LISP splits the two into separate namespaces. This post explains the protocol and proves it on a real IOS XE lab, from first dropped packet to clean flow.
The management plane is the softest target on the box. This article hardens it on Cisco IOS XE with real captures: SSH done right, VTY restrictions, and brute-force protection, alongside AAA and CoPP in the infrastructure security cluster.
RESTCONF, Catalyst Center, and SD-WAN Manager APIs are doors into your infrastructure. Learn tokens, TLS, and least privilege for network APIs, framed for network engineers rather than web developers.
MACsec (IEEE 802.1AE) encrypts and authenticates every Ethernet frame on the link itself, so an attacker tapping the cable sees only ciphertext. This article explains how it works, how MKA distributes keys, and where it fits.