An endpoint plugs into a port. Somehow, seconds later, it is in the right virtual network, carrying the right security group tag, with the right policy following it wherever it goes in the fabric. That "somehow" is host
An SD-Access fabric is not a pile of switches. It is a set of roles, and every switch in the fabric plays one or more of them. Understand the roles and the fabric makes sense; miss them and it
Before an SD-Access fabric can do anything clever - before LISP, before VXLAN, before a single policy - it needs one boring, rock-solid thing underneath it: an IP network where every fabric node can reach every other fabric node'
Transport technologies fail in layers, and the art of troubleshooting them is knowing which layer to suspect. An MPLS L3VPN has an IGP, LDP, MP-BGP, VRFs, and a label stack, any one of which can break while the others
Almost every mid-to-large enterprise WAN ends up running both MPLS and DMVPN. Not because someone planned it that way, but because they solve different problems, and a real network has both problems. MPLS gives you a private, SLA-
Every DMVPN carries IPsec, and every IPsec deployment sits on one of two key-exchange protocols: IKEv1, the original from 1998, or IKEv2, its 2005 replacement. Most networks still run IKEv1 because it works and nobody wanted to touch a
Everyone builds a second DMVPN hub for redundancy. Far fewer people test that the failover actually works - and the ones who do are often unpleasantly surprised. A dual-hub DMVPN can have both hubs up, both spokes registered, routing fully
BGP is the most powerful choice for the PE-CE protocol in an MPLS L3VPN - it scales, it carries policy, and it hands the provider fine-grained control. But it comes with a trap that catches every engineer once: BGP&
You have an IPv4 MPLS L3VPN running. Your customers each have their own VRF, their own routing table, their own isolated slice of the core. It works, it scales, it makes money. Then a customer asks for IPv6, and you
Layer 2 problems have a special quality: the switches all say everything is fine, and yet nothing works. There is no routing table to inspect, no neighbour state to compare, just VLANs, trunks, and a spanning tree that is quietly
The switching features that make headlines are the protocols - spanning tree, VLANs, EtherChannel. The features that actually keep a switch running are the unglamorous administrative ones: how the hardware tables are carved up, what happens when a port is disabled
ARP is the most trusting protocol in the building. A host asks "who has 10.10.10.1?" and believes whatever answer comes back, with no verification of any kind. So an attacker replies "I do"