Every Layer 2 security feature worth having is built on one foundation: a table that says "this IP address, with this MAC, is legitimately on this port." DHCP snooping builds that table. Dynamic ARP Inspection uses it to
A single misbehaving host can take down an entire VLAN. It does not take a spanning tree loop - a NIC stuck in a fault state, a virtualised workload gone wrong, or a genuine attack can flood broadcast frames fast enough
Spanning tree has one blind spot, and it is a dangerous one. STP decides whether to block a port based on the BPDUs it receives. But what if a link can send in one direction and not the other? A
Two switching standards, both trying to prevent loops, neither aware the other exists. That is what an MST-to-PVST+ boundary is, and it is one of the most misunderstood corners of Layer 2 - which is a problem, because you
Sooner or later somebody decides the network is moving from EIGRP to OSPF. Maybe a merger brought in a multi-vendor estate. Maybe the standards team decided on open protocols. Maybe an architect just likes link-state better. The reason
Redistribution between two routing protocols at a single point is easy. Redistribution between two routing protocols at two points is where networks go to die, and it is the reason redistribution has such a fearsome reputation in the CCIE lab.
EIGRP over DMVPN works beautifully, right up until the moment you realise none of your spokes can reach any of your other spokes. The tunnels are up. NHRP is registered. The neighbours are all in the table. And the routes
You have two hubs. You want every spoke to prefer HUB1 and fall back to HUB2 only when HUB1 is unreachable. The interface bandwidth and delay are identical, so EIGRP sees two equal paths and load-shares across both - which
Summarisation is a trade. You send one prefix instead of fifty, which shrinks the routing table and hides internal churn from your spokes. But you also lose the granularity: everything inside the summary now looks equally distant, and if two
A branch office with two WAN routers is a good design. Two routers, two circuits, no single point of failure. It is also the exact topology that creates one of EIGRP's nastiest failure modes: the site learns its
OSPF has an unhelpful habit: when you break it, it usually says nothing. An adjacency that should form simply does not. A route that should be in the table simply is not. There is one failure mode - exactly one - where
Two routes to the same prefix. One has a metric of 20. The other has a metric of 31. Which one does OSPF install? If you answered "the one with metric 20", you have just failed a very