Cisco Certified Network Associate (CCNA) — knowledge map
The 83 core concepts of Cisco Certified Network Associate (CCNA) and how they connect. Click a node in the map above to explore related terms and prerequisites; the list below indexes every concept with its definition and links to its prerequisites and related concepts.
Concepts (83)
Broadcast
A communication mode that sends data to every host on the same network segment at once. Most public-cloud virtual networks (VPC/VNet equivalents) don't support broadcast by default, so on-prem applications built around it typically need a redesign when migrated.
OSPF
A link-state interior gateway protocol (IGP). Each router shares full topology information (LSAs) and selects the least-cost path by summing costs derived from link bandwidth. It scales to large networks via areas and converges quickly on topology changes; its default administrative distance is 110.
Related: Administrative distance (AD)
VLAN (Virtual LAN)
A technique that logically divides switch ports into multiple broadcast domains without changing physical wiring. IEEE 802.1Q tagged VLAN adds a VLAN ID tag to frames so a single trunk link carries multiple VLANs distinctly. Communication between VLANs requires inter-VLAN routing by an L3 switch or router.
Prerequisites: Broadcast
Related: Layer 3 Switch
Flooding
Flooding is the behavior by which an L2 switch forwards a frame out all ports except the ingress port, occurring when the destination MAC address is not in its MAC address table or when the destination is a broadcast/multicast address. While useful for resolving unknown destinations, excessive flooding wastes bandwidth and, in looped topologies, can trigger broadcast storms.
Prerequisites: Multicast、Broadcast、Broadcast storm、Layer 2 Switch
DHCP
A protocol that automatically assigns the network settings a device needs — including an IP address — when it connects to the network, saving an administrator the trouble of manually configuring an IP address on every device.
PortFast
A Cisco feature applied to access ports connecting only end hosts (like a PC) that skips STP's listening/learning states and moves straight to forwarding, eliminating delays such as a DHCP client timing out while waiting for STP convergence. It must never be enabled on ports connecting to another switch, which risks a loop.
Prerequisites: DHCP、Access Port and Trunk Port、STP Port States (Blocking/Listening/Learning/Forwarding)
Broadcast storm
A failure where, with a loop present in an L2 network, broadcast frames (which lack a TTL) circulate and amplify endlessly between switches, spiking CPU usage and congesting links until the network becomes unusable. It is prevented by loop avoidance via STP.
Prerequisites: Broadcast
RADIUS
A protocol for centralized authentication, authorization, and accounting (AAA). Used as an authentication server in wireless LAN, VPN, and IEEE 802.1X environments, it centrally manages per-user credentials to control network access.
Lightweight AP
An access point that holds no configuration of its own and instead operates under constant control and configuration delivered from a WLC over a CAPWAP tunnel. Only an IP address needs to be set on the AP itself, making it suited to large-scale, centrally managed multi-site deployments. It contrasts with an autonomous AP.
Prerequisites: Autonomous AP
Related: CAPWAP
RSTP and Rapid PVST+
RSTP (IEEE 802.1w) collapses the original STP (802.1D) four states (blocking/listening/learning/forwarding) into discarding/learning/forwarding and, via alternate ports (backup paths) and a proposal/agreement handshake, converges far faster than STP. Rapid PVST+ is Cisco's implementation that runs an independent instance of RSTP per VLAN, allowing a different root bridge and load balancing per VLAN.
Prerequisites: Root Bridge and Root Bridge Election、VLAN (Virtual LAN)
WPA2-PSK and WPA2-Enterprise
WPA2 offers two authentication modes. WPA2-PSK (WPA2-Personal) authenticates every device with one shared passphrase, a simple scheme suited to homes and small sites; WPA2-Enterprise authenticates each device or user individually via 802.1X/RADIUS, suited to large organizations that need per-user access control.
Prerequisites: IEEE 802.1X (port-based authentication)、RADIUS
Access Port and Trunk Port
An access port belongs to a single VLAN and forwards untagged frames to end devices, while a trunk port carries frames for multiple VLANs over one physical link, tagging them (e.g., via IEEE 802.1Q) to identify their VLAN. On trunks, a native VLAN (the untagged default VLAN) mismatch between switches can create security issues such as VLAN hopping.
Prerequisites: VLAN (Virtual LAN)
Related: Native VLAN
Layer 2 Switch
An L2 switch forwards frames at the data-link layer based on MAC addresses, relaying frames on a per-port basis by learning and consulting its MAC address table. It does not handle IP addressing or routing, so it is limited to forwarding within the same network (subnet/VLAN); communication between different networks requires an L3 switch or router. It is also the unit at which VLANs and STP are implemented.
Prerequisites: VLAN (Virtual LAN)
Related: Layer 3 Switch
Root Bridge and Root Bridge Election
The root bridge is the reference point at the top of the tree topology that STP builds; every other switch computes its shortest path toward it. Election is automatic: the switch with the lowest bridge ID (bridge priority plus MAC address) in exchanged BPDUs becomes root, with MAC address as a tiebreaker when priorities are equal. Administrators can force a specific switch to become root by manually lowering its priority value.
Spanning Tree Protocol (STP)
A protocol that, when redundant paths (loops) form in an L2 network, elects the switch with the lowest bridge ID (priority + MAC address) as the root bridge and automatically blocks redundant ports to prevent loops and broadcast storms. RSTP is a faster-converging variant.
Prerequisites: RSTP and Rapid PVST+、Broadcast、Broadcast storm、Root Bridge and Root Bridge Election
STP Port States (Blocking/Listening/Learning/Forwarding)
STP moves a port through a sequence of states before convergence to prevent loops while stabilizing the topology. Blocking receives BPDUs only, forwarding no traffic and learning no MAC addresses; listening sends/receives BPDUs to compute the topology but still forwards no traffic; learning begins building the MAC address table but still does not forward traffic; forwarding is the final state where the port both forwards traffic and learns addresses.
Prerequisites: MAC Address Learning
Subnet mask
A value marking the boundary between the network and host portions of an IP address (e.g., 255.255.255.0)—the dotted-decimal counterpart to a CIDR prefix length, still used in on-prem network gear and some cloud configuration screens.
AAA (Authentication, Authorization, Accounting)
A collective term for three access-control functions. Authentication verifies who the user is, authorization decides what an authenticated user is permitted to do, and accounting records what was actually done. Cisco devices centralize these functions using RADIUS or TACACS+ as the AAA server.
CAPWAP
A tunneling protocol that establishes a tunnel between a lightweight AP and a WLC to carry control information and client data. It sets up separate CAPWAP control tunnels (for control traffic) and CAPWAP data tunnels (for client data).
Related: Lightweight AP
Catalyst Center (formerly DNA Center)
Cisco's centralized management controller for enterprise networks. It unifies automated device discovery and bulk provisioning, SD-Access policy distribution, assurance (health visibility), and a REST API automation entry point into one dashboard. Formerly named DNA Center.
Related: SD-Access
EtherChannel
Cisco's implementation name for bundling multiple physical switch ports into one logical link, using either LACP (open standard) or PAgP (Cisco proprietary) to negotiate the bundle. STP sees the bundle as a single logical link, so it gains bandwidth and redundancy without STP blocking individual member links.
Prerequisites: Link aggregation (LACP)
Related: PAgP (Port Aggregation Protocol)
HSRP (Hot Standby Router Protocol)
Cisco's proprietary protocol implementing an FHRP. Within a group, the router with the highest priority becomes the active router and owns the virtual IP/MAC address, while the runner-up waits as the standby router. Whether a recovered former-active router automatically reclaims control is governed by the preempt setting.
Related: FHRP (First Hop Redundancy Protocol)
Aging (MAC address table)
The lifetime assigned to each entry in an L2 switch's MAC address table. An entry with no traffic for a set period (300 seconds by default on Cisco) is automatically removed (aged out), preventing table bloat and letting a moved host be correctly re-learned.
Prerequisites: Layer 2 Switch
OSPF adjacency
The state (Full state) in which two OSPF routers have exchanged LSAs and fully synchronized their link-state databases with each other. Unlike a neighbor relationship that merely exchanges Hellos and stays at 2-Way, only routers with an established adjacency actually exchange routing information. Duplicate router IDs, mismatched Hello/Dead timers, and mismatched area numbers are typical causes that block adjacency formation.
Prerequisites: Hello/Dead timer (OSPF)、LSA (Link State Advertisement)、Router ID (OSPF)、OSPF
LSA (Link State Advertisement)
The unit of information an OSPF router advertises describing the state of its own links (interface, cost, connected neighbor, etc.). The collection of LSAs gathered from every router forms the link-state database (LSDB), from which each router computes its shortest-path tree via the SPF algorithm. LSA types (Type 1, Type 2, etc.) differ in scope and content.
Prerequisites: OSPF
TACACS+
A Cisco proprietary protocol providing AAA for device administration (login and command authorization on network devices). It uses TCP, encrypts the entire packet, and treats authentication, authorization, and accounting as independent processes, in contrast to RADIUS, which uses UDP, combines authentication and authorization into one packet, and is used mainly for network access control.
Prerequisites: RADIUS
Wildcard mask
A bit mask used in ACLs and OSPF network statements to specify a matching address range. Its bit meaning is inverted from a subnet mask: a 0 bit means the corresponding address bit must match, while a 1 bit means don't care. It is typically the bitwise inverse of the subnet mask.
Prerequisites: OSPF、Subnet mask
Multicast
A communication mode that delivers data only to hosts that joined a specific group. Like broadcast, it's often not natively supported by cloud virtual networks; where it's required, teams use a dedicated feature such as a transit-gateway's multicast capability, or redesign around unicast instead.
Prerequisites: Broadcast
IEEE 802.1X (port-based authentication)
A standard for per-port LAN access authentication. Until the supplicant (device) is authenticated by an authentication server (RADIUS), the switch port permits only EAPoL authentication traffic and blocks normal data traffic; the port opens after success. EAP-TLS is a strong mutual-authentication method using client certificates.
Related: RADIUS
Administrative distance (AD)
A value indicating how trustworthy a routing information source is relative to others; a smaller value is preferred. When routes of equal prefix length are learned from multiple protocols, AD decides the source priority before comparing metrics (e.g., static 1, OSPF 110, RIP 120).
ARP spoofing and countermeasures
An attack that sends forged ARP replies on the LAN to register a wrong IP-to-attacker-MAC mapping in victims' ARP tables, relaying traffic through the attacker (a foothold for man-in-the-middle). The countermeasure is Dynamic ARP Inspection (DAI), which uses a legitimate IP-MAC table built by DHCP snooping to block forged ARP packets.
Prerequisites: DHCP、DHCP snooping
IPv4 Address
A 32-bit Internet-layer address consisting of a network portion and a host portion, with the boundary expressed via subnet mask or CIDR notation (e.g., /24). Address exhaustion has driven widespread use of NAPT and IPv6 coexistence. Frequently tested as the basis for subnetting and CIDR aggregation calculations.
Prerequisites: IPv6 Address、Subnet mask
IPv6 Address
A 128-bit Internet-layer address written as eight 16-bit hexadecimal fields separated by colons, where a single run of consecutive zero fields may be abbreviated once with '::'. Its prefix length denotes the network portion, with the interface identifier typically occupying the lower 64 bits — a structural contrast to IPv4 subnet masking.
Prerequisites: Subnet mask
Layer 2 Loop
A layer 2 loop is a forwarding loop that arises when switches are interconnected via redundant paths without an active loop-prevention mechanism such as STP. Because layer 2 frames have no TTL, broadcast frames circulate and multiply endlessly around the loop, causing a broadcast storm and MAC address table instability that can disable the entire network.
Prerequisites: Broadcast、Broadcast storm
Layer 3 Switch
An L3 switch integrates network-layer routing functions with the fast physical/data-link-layer switching of an L2 switch, performing tasks such as inter-VLAN routing in hardware (ASIC) rather than relying primarily on software-based routing as a conventional router does. Because it can both create VLANs and route between them in a single device, it is widely deployed as the core switch in large-scale LANs.
Related: Layer 2 Switch、VLAN (Virtual LAN)
MAC Address Learning
MAC address learning is a function by which an L2 switch dynamically records the mapping between a received frame's source MAC address and the ingress port in its MAC address table (FDB); subsequent frames destined to that MAC address are then forwarded only to the corresponding port. Before learning occurs, or when the destination is unknown, the switch floods the frame to all ports. Entries not referenced within an aging timeout are removed from the table.
Prerequisites: Aging (MAC address table)、Flooding、Layer 2 Switch
Port security
A switch feature that sets, per port, a maximum number of learned/allowed MAC addresses or specific permitted MACs, and shuts the port down or drops frames when the limit is exceeded or an unauthorized MAC is seen. It prevents MAC address table overflow (MAC flooding) attacks that flood the table with forged source MACs.
Prerequisites: Flooding
QoS (prioritization & rate control)
Mechanisms to control the quality of multiple traffic types sharing limited bandwidth. Delay/jitter-sensitive voice/video get prioritization (priority queuing); bursty traffic gets shaping (buffering the excess to smooth transmission) or policing (dropping/marking the excess). DiffServ (DSCP) classifies traffic.
Prerequisites: DSCP and PHB、Traffic Shaping and Policing
DHCP snooping
A switch feature that classifies ports as trusted (connected to a legitimate DHCP server) or untrusted (general endpoints) and discards DHCP server replies (OFFER/ACK) arriving on untrusted ports, preventing a rogue DHCP server from distributing a fake gateway (a man-in-the-middle attack).
Prerequisites: DHCP
YAML
A human-friendly text format that expresses hierarchy through indentation. Favored for CloudFormation and other IaC tools and CI/CD pipeline config files, and interconvertible with JSON representing the same data.
Prerequisites: JSON
Multi-factor authentication (MFA)
Strengthens identity proof with a second factor beyond a password.
Ansible (network automation)
A configuration-management tool that declares desired configuration in YAML-formatted playbooks and applies it in bulk to many network devices over SSH or an API without requiring an agent on the device. Modules written in Python absorb per-vendor differences, and the design emphasizes idempotency — running the same playbook repeatedly produces the same result.
Prerequisites: Idempotency、Configuration management、YAML
Autonomous AP
An access point that carries its own configuration and radio-control functions and operates independently without relying on a WLC. It suits small sites or standalone deployments, but as the number of APs grows, each must be configured and managed individually, and centralized monitoring or seamless roaming becomes difficult.
BPDU Guard
A Cisco feature that immediately puts a PortFast-enabled port into err-disable if it receives a BPDU (an STP control frame), preventing an unintended switch connection on a port meant only for an end host from causing an unexpected topology change or loop.
Prerequisites: PortFast
CDP (Cisco Discovery Protocol)
A Cisco proprietary Layer 2 protocol that lets neighboring Cisco devices exchange information such as device type, hostname, IP address, and connected port, letting administrators map the topology. Unlike the vendor-neutral LLDP, it works only between Cisco devices, and is often disabled on ports facing untrusted external connections to limit information disclosure.
Prerequisites: LLDP (Link Layer Discovery Protocol)
DORA (DHCP four-message exchange)
The acronym for DHCP's four-step message exchange when assigning an IP address: the client's broadcast Discover, the server's Offer, the client's Request confirming its choice, and the server's Acknowledge. When renewing an existing lease, the exchange can skip Discover/Offer and use only Request/ACK.
DSCP and PHB
DSCP (Differentiated Services Code Point) marks a packet's priority class in a field of the IP header, with values such as EF (Expedited Forwarding, for top-priority traffic like voice), AF (Assured Forwarding, subdivided by class and drop precedence), and CS (backward-compatible with the old IP precedence field). Each network device independently applies a per-hop behavior (PHB) matching the DSCP value at every hop, delivering consistent QoS from source to destination.
DTP (Dynamic Trunking Protocol)
A Cisco proprietary protocol that auto-negotiates trunking between adjacent switch ports. While convenient, an unintentionally negotiated trunk can be a foothold for VLAN hopping, so best practice is to disable DTP (nonegotiate) on ports that do not need it.
Prerequisites: VLAN (Virtual LAN)
LLDP (Link Layer Discovery Protocol)
A vendor-neutral neighbor-discovery protocol standardized as IEEE 802.1AB. Like CDP, it exchanges neighboring device information at Layer 2, but it also works in mixed-vendor environments beyond Cisco equipment.
Native VLAN
The default VLAN that a trunk port forwards untagged under IEEE 802.1Q. If the native VLAN configured on each end of a trunk does not match, frames can land in the wrong VLAN or enable a VLAN hopping attack.
Prerequisites: VLAN (Virtual LAN)
Related: Access Port and Trunk Port
OSPF designated router election (DR / BDR / DROTHER)
A mechanism OSPF uses on multi-access networks (such as Ethernet) to avoid a full mesh of adjacencies among every router. The router with the highest priority is elected DR (Designated Router), the runner-up becomes BDR (Backup Designated Router), and every other router (a DROTHER) forms a full adjacency only with the DR and BDR, exchanging routing information indirectly through the DR. This greatly reduces the volume of LSA exchange.
Prerequisites: OSPF
OSPF network types
A classification that changes how OSPF forms adjacencies based on an interface's physical characteristics. On a broadcast network type (like Ethernet), a DR/BDR election takes place; on a point-to-point network type (like a serial link), there is only one possible neighbor, so no DR/BDR election occurs and both routers form a full adjacency directly. A mismatched network type causes Hello-packet parameter mismatches that block adjacency formation.
Prerequisites: Classification、Broadcast、OSPF
PAgP (Port Aggregation Protocol)
A Cisco proprietary protocol that auto-negotiates EtherChannel bundling. It serves the same purpose as the open-standard LACP but works only between Cisco devices, with modes desirable (active) and auto (passive).
Prerequisites: Link aggregation (LACP)
Related: EtherChannel
PMF (Protected Management Frames)
A mechanism that encrypts and authenticates wireless management frames (such as deauthentication and disassociation) to prevent tampering. Without it, an attacker can easily send forged disconnect frames as a denial-of-service (deauthentication) attack; WPA3 mandates PMF.
Prerequisites: WPA3 and SAE
REST API (network automation)
An API design style that operates on resources using HTTP methods (GET/POST/PUT/DELETE, etc.). It lets scripts query and change configuration on a controller such as Catalyst Center by exchanging JSON-formatted data, enabling bulk operations across many devices instead of logging into each device's CLI individually.
Prerequisites: Catalyst Center (formerly DNA Center)、JSON
SD-Access
A Cisco intent-based networking architecture that builds a VXLAN-based overlay fabric on top of a physical-topology-independent underlay, with policy (who can access what, and how) defined centrally and automatically distributed from Catalyst Center. It reduces manual per-device CLI configuration while improving segmentation consistency and deployment speed.
Prerequisites: Overlay and Underlay
Split-MAC architecture
An architecture in which 802.11 MAC-layer functions are split between the AP and the WLC over the CAPWAP tunnel. Time-critical operations such as beacon transmission and acknowledgments stay on the AP, while management functions such as authentication and roaming decisions are centralized on the WLC, letting many APs be centrally controlled without sacrificing wireless real-time responsiveness.
Prerequisites: CAPWAP
Sticky learning (port security)
A port security configuration mode that automatically writes dynamically learned MAC addresses into the running configuration, thereafter treating them as permanently allowed addresses. It sits between manually entering each MAC statically and re-learning from scratch on every reload, reducing operational effort while retaining lasting control.
Prerequisites: Port security
WLC (Wireless LAN Controller)
A device that centrally manages multiple lightweight APs. By consolidating configuration and control of SSIDs, radio channels, transmit power, and roaming into the WLC, it automates and centralizes work that would otherwise be configured on each AP individually.
Prerequisites: Lightweight AP
Classification
A supervised task predicting a category/label (e.g., spam or not).
Biometric authentication
An authentication method that verifies identity using physical traits (biometric information) such as fingerprints, face, iris, or veins. It serves as the inherence factor in multi-factor authentication. Its accuracy is measured by the false rejection rate (FRR), the rate of wrongly rejecting the legitimate user, and the false acceptance rate (FAR), the rate of wrongly accepting an impostor; the two are in a trade-off relationship.
Prerequisites: Multi-factor authentication (MFA)
Idempotency
A property where repeating the same operation any number of times yields the same result. Distributed systems often duplicate requests via network retries; an idempotent design (e.g., using an idempotency key) lets duplicate delivery be handled safely.
IPsec
A protocol suite that encrypts and authenticates traffic at the IP packet level, used to encrypt the path in site-to-site VPNs (on-prem to a cloud VNet/VPC). The tunnel won't establish unless both ends agree on encryption, integrity, and key-exchange settings.
Prerequisites: Site-to-Site VPN and Remote Access VPN
JSON
A lightweight text format representing structured data as braces and key–value pairs. Widely used wherever machine-readability matters most—API request/response bodies and permission definitions like IAM or bucket policies.
DHCP relay agent
Because DHCP DISCOVER and similar messages are broadcasts that do not cross routers, a relay function (IP helper) is configured on each segment's router (default gateway) so clients on a server-less segment can use a server on another segment. It relays received DHCP broadcasts to the specified server as unicast, letting one server serve multiple subnets.
Private Address
IPv4 address ranges defined by RFC 1918 for use solely within private organizational networks (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16). They are not routed on the public Internet, so external communication requires NAPT translation to a global address.
Prerequisites: IPv4 Address
SDN (Software-Defined Networking)
An architecture that separates the control plane (routing decisions) from the data plane (packet forwarding); an SDN controller centrally computes routing with a full network view and distributes forwarding rules to switches via protocols such as OpenFlow, enabling centralized control and automation without per-device configuration.
Prerequisites: Control Plane and Data Plane
Site-to-Site VPN and Remote Access VPN
Site-to-site VPN establishes a persistent tunnel between VPN gateways at two locations so all devices behind them communicate transparently, while remote access VPN has individual client devices run VPN software to connect a single user into the corporate network. The former suits inter-site traffic; the latter suits telework and mobile access.
Configuration management
The activity of identifying and recording versions of deliverables, documents, and baselines, and applying only approved changes to keep them consistent. Working alongside integrated change control, it ensures the authoritative baseline version can always be uniquely traced.
VLSM (Variable Length Subnet Mask)
A technique that divides a single address space into subnets with different mask lengths according to the host count each department or segment needs. Assigning right-sized blocks avoids address waste and unnecessary enlargement of the attack surface.
Prerequisites: Subnet mask
WPA3 and SAE
SAE (Simultaneous Authentication of Equals, aka Dragonfly), the key-establishment method adopted by the wireless LAN security standard WPA3. It resolves the offline-dictionary-attack weakness of WPA2-PSK's four-way handshake with a scheme that cannot be brute-force-verified from mere traffic interception.
Prerequisites: WPA2-PSK and WPA2-Enterprise
CRUD operations
An acronym for the basic operations on data or resources: Create, Read, Update, and Delete. In a RESTful API these commonly map to the HTTP methods POST, GET, PUT (or PATCH), and DELETE respectively.
Prerequisites: REST API (network automation)
FHRP (First Hop Redundancy Protocol)
A collective term for protocols that make multiple physical routers appear as one virtual router, making a device's default gateway (its first hop) redundant. The open-standard VRRP and Cisco's proprietary HSRP and GLBP are common examples, all using a virtual IP address to automatically recover from a gateway failure without changing client configuration.
Prerequisites: VRRP (gateway redundancy)
Related: HSRP (Hot Standby Router Protocol)
Floating static route
A backup static route deliberately configured with a higher administrative distance than the primary route (dynamic or another static route) it backs up. Under normal conditions it stays out of the routing table and unused, but it is automatically installed and used the moment the primary route disappears, providing simple failover.
Prerequisites: Administrative distance (AD)
Hello/Dead timer (OSPF)
Two timers that govern how OSPF confirms a neighbor is alive. Routers exchange Hello packets at the Hello interval; if no Hello arrives within the Dead interval (by default four times the Hello interval), the neighbor is declared down and routes are recomputed. Mismatched Hello/Dead timer values between neighboring interfaces prevent adjacency from forming.
Prerequisites: OSPF
Router ID (OSPF)
A 32-bit value the OSPF process uses to uniquely identify a router within the network. If not manually configured, it is auto-selected as the highest IP address among loopback interfaces, or failing that, the highest address among physical interfaces. A duplicate router ID is a classic cause of adjacency-formation failures.
Prerequisites: OSPF
Link aggregation (LACP)
A technique that logically bundles multiple physical links into one high-bandwidth logical link, using all links for data transfer simultaneously (IEEE 802.3ad, controlled by LACP). It aggregates bandwidth and also provides redundancy since remaining links carry traffic if one fails — unlike STP redundancy, which keeps one link on standby.
Metric
A metric is the numeric value a routing protocol uses to select the best path, calculated from criteria such as hop count, bandwidth, delay, or cost depending on the protocol. Lower metric values are preferred and installed in the routing table; metrics compare routes within the same protocol, while administrative distance is used to compare routes learned from different protocols.
Related: Administrative distance (AD)
Overlay and Underlay
The underlay is the physical switching/routing infrastructure providing basic IP reachability, while the overlay is a logical network built on top of it via tunneling protocols such as VXLAN or GRE. Overlays decouple virtual network segmentation from the physical topology, enabling flexible multi-tenant designs.
Traffic Shaping and Policing
Shaping buffers and delays traffic exceeding a rate limit to smooth the output rate, avoiding drops at the cost of added latency, and is typically applied on egress. Policing instead drops or remarks (e.g., re-tags DSCP) excess traffic immediately without buffering, adding no delay but risking packet loss, and is typically applied on ingress to enforce a contracted rate.
Prerequisites: DSCP and PHB
STP Port Roles (Root Port/Designated Port)
STP assigns each port a role to determine which ports actively forward traffic. The root port is the single port on a non-root bridge with the lowest-cost path toward the root bridge (exactly one per switch), while the designated port is the port responsible for forwarding traffic onto a given segment (one per segment). Ports selected for neither role become blocking, non-designated ports.
Prerequisites: Root Bridge and Root Bridge Election、STP Port States (Blocking/Listening/Learning/Forwarding)
VRRP (gateway redundancy)
A protocol that groups multiple physical routers into one virtual router sharing a common virtual IP and virtual MAC address. Setting the virtual IP as the clients' default gateway lets a backup automatically take over the virtual IP/MAC if the master fails, eliminating the gateway single point of failure without changing client settings. HSRP is a similar protocol.
Prerequisites: HSRP (Hot Standby Router Protocol)
Control Plane and Data Plane
The control plane handles route computation and policy decisions that determine forwarding rules, while the data plane executes the actual packet forwarding according to those rules. SDN separates the two and centralizes the control plane, allowing flexible, network-wide programmatic control.