CEF — FIB, Adjacency & Why Process Switching Died

CEF is the default forwarding engine: no per-packet CPU work. Two precomputed structures: FIB — optimised copy of the RIB, longest-prefix entries, best path per prefix. Adjacency table — the rewritten L2 header per next-hop (MAC + outgoing interface), built from ARP/ND. Flow: RIB → FIB → Adjacency. Both update event-driven on routing or ARP […]

Ansible — Agentless Network Automation

Agentless automation over SSH: a control node connects to managed nodes, runs YAML playbooks, and enforces desired state — idempotent, so re-running a correct playbook changes nothing. Inventory groups hosts ([routers] R1 ansible_host=10.1.1.1); variables cascade inventory → group_vars → host_vars for templating. Network modules (ios_config, ios_command) speak CLI through netconf/ssh connection plugins. Push model, no […]

Fabric, SD-Access, LISP & SD-WAN

Fabric thinking: a big L2-ish reach (VXLAN overlay) over a simple routed underlay, with identity and policy decoupled from IP subnets. SD-Access roles Control-plane node: runs LISP mapping — answers “where is this host?” Edge node: encapsulates into the fabric, enforces policy at entry. Border node: fabric ↔ outside world; border + edge (FGP) for […]

SDN — Centralised Control Plane

SDN is an architecture, not a protocol: separate control plane from data plane, put the brain in a controller, program devices over APIs. Southbound: OpenFlow/NETCONF/RESTCONF; northbound: REST for applications. (“SDN = OpenFlow” is the classic false statement — OpenFlow is one implementation.) Devices become flow-table forwarders; the controller computes paths and installs entries. Design prerequisites: […]

IP SLA & Object Tracking — Failover on Health

Routing protocols see up/down and adjacencies — never latency, jitter, loss or a dead application. IP SLA injects synthetic probes (ICMP echo, UDP jitter, TCP connect, HTTP GET, DNS) every 60 s and measures what real traffic would feel. ip sla 1 icmp-echo 10.0.0.1 source-interface Gi0/0 threshold 100 frequency 10 ip sla schedule 1 life […]

Network Telemetry — Push-Based Monitoring

SNMP asks repeatedly and learns late. Telemetry inverts it: the device pushes state streams on schedule (or on event) over gRPC/TCP, encoded in GPB or JSON, shaped by YANG data models — Model-Driven Telemetry. Subscription = what data, how often, where to. Near real-time, low per-poll overhead, scales where polling collapses. Three modes: dial-out periodic, […]

NetFlow & Flexible NetFlow

Interface counters say how much; NetFlow says who talks to whom, how, when. Flows are keyed on the classic 7-tuple minus two (src/dst IP, src/dst port, protocol, ToS, interface), counted in a cache and exported to a collector when the flow ends or times out. v5 fixed format; v9 template-based; Flexible NetFlow = build your […]

SPAN, RSPAN & ERSPAN

Switches don’t let you sniff other people’s traffic — SPAN copies frames from source ports/VLANs (rx, tx or both) to a dedicated monitor port feeding Wireshark or an IDS. Original traffic untouched; the monitor port stops switching. RSPAN: mirrors across switches through a dedicated remote-span VLAN — L2 domain only. ERSPAN: GRE-encapsulated, routable across L3 […]

SNMP — Polls, Traps & v3 Security Model

Manager ↔ agent over UDP: queries on 161, traps/informs on 162. Devices expose a MIB tree addressed by OIDs; managers poll (GET/GETNEXT/GETBULK) or receive async TRAP (fire-and-forget) / INFORM (acknowledged). Version Security Notes v1 cleartext community legacy v2c still cleartext adds GETBULK, everywhere v3 auth (SHA) + priv (AES) the only correct choice; needs NTP […]

DAI & IP Source Guard — the Binding-Table Duo

Dynamic ARP Inspection validates every ARP packet on untrusted ports against the DHCP snooping binding table — forged “I am the gateway” replies (ARP spoofing / MITM) are dropped. Trusted ports skip validation. ip arp inspection vlan 10,20 interface Gi1/0/24 ip arp inspection trust IP Source Guard closes the other half: on untrusted ports, frames […]