Campus Security, Segmentation, and Observability
This domain ties together access control, traffic isolation, and visibility. Segmentation concepts: VLANs for L2 isolation, VRFs for L3 isolation, and ACLs for policy enforcement at the edge. Understand where to enforce policy - typically at the access port or the first-hop gateway - and how ACL direction (ingress vs. egress) changes what is filtered. Know 802.1X basics: supplicant, authenticator (switch), authentication server (RADIUS), and the difference between port-based and MAC-based authentication, plus MAB fallback for devices that cannot run a supplicant.
Security concepts: control-plane protection (CoPP) to rate-limit traffic to the CPU, DHCP snooping and dynamic ARP inspection to block spoofing, and storm control to contain broadcast floods. Understand AAA for management access and the principle of least privilege via roles.
Observability: streaming telemetry vs. SNMP polling, sFlow for flow sampling, and how CloudVision aggregates telemetry for anomaly detection. Know that telemetry is push-based and near-real-time, while SNMP is pull-based and coarse.
Traps: (1) Placing an ACL on the wrong interface or direction so it filters nothing. (2) Assuming 802.1X authenticates the user's traffic end-to-end - it authenticates the port. (3) Confusing sFlow (sampled flows) with full packet capture. (4) Forgetting CoPP protects the CPU, not the data plane.
Rule of thumb: isolate with VLAN/VRF, enforce with ACL at the closest point to the source, and observe with streaming telemetry. Worked example: to block guest VLAN hosts from reaching the corporate VLAN, apply an ingress ACL on the guest gateway interface denying traffic to corporate subnets while permitting internet-bound traffic - enforcing at the first-hop gateway keeps policy centralized and auditable.