Arista ACE Specialist - WAN Routing flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Underlay vs overlay

The underlay is the physical/IP transport network providing reachability; the overlay is the logical tunnel network built on top that carries tenant or policy-steered traffic.

SD-WAN control plane separation

A centralized controller distributes topology and policy while edge devices forward data directly, avoiding forced hairpinning through a central hub.

Hub-and-spoke vs full mesh

Hub-and-spoke sends inter-branch traffic through a hub; full mesh lets branch edges build direct tunnels, reducing latency and hub load.

Transport independence

An SD-WAN edge attaches to multiple WAN transports such as broadband, LTE, MPLS, or dedicated internet, and selects transport per flow by policy.

Zero-touch provisioning

An edge boots, discovers the controller via DHCP, cloud redirect, or USB, authenticates, and pulls its configuration without manual on-site setup.

Overlay MTU budget

Encapsulation headers for IPsec, GRE, or VXLAN reduce usable payload, so underlay MTU must exceed overlay MTU by the encapsulation overhead.

Longest prefix match

The most specific route (longest prefix length) is selected before any protocol, metric, or administrative distance comparison is applied.

Administrative distance order

Tie-breaker between route sources for the same prefix: connected is most trusted, then static, then eBGP, then IGP, then iBGP.

BGP best-path order

eBGP prefers highest LOCAL_PREF, then shortest AS_PATH, then lowest origin type, then lowest MED, then eBGP over iBGP.

iBGP full-mesh requirement

iBGP does not re-advertise routes learned from one peer to another, so full mesh, route reflectors, or confederations are required for reachability.

OSPF cost calculation

OSPF cost equals reference bandwidth divided by interface bandwidth; lower total cost is preferred when choosing among equal-prefix paths.

BFD role

Bidirectional Forwarding Detection provides sub-second failure detection independent of routing protocol hello timers, accelerating convergence on degraded paths.

Route summarization tradeoff

Summarization shrinks routing tables but hides more-specific reachability; a summary is advertised only when a component route exists unless configured unconditionally.

SLA-based path selection

SD-WAN overlay path selection adds per-application SLA criteria such as latency, jitter, and loss on top of traditional IGP or BGP metrics.

Overlay tunnel identity

Each overlay tunnel is identified by an endpoint pair and transport, so an edge maintains separate tunnel state per remote edge per transport path.

VXLAN VNI size

VXLAN uses a 24-bit VNI supporting roughly 16 million segments, with the outer header carried over UDP port 4789 by default.

IPsec overhead estimate

IPsec tunnel mode adds roughly 50 to 70 bytes depending on cipher and mode, which must be accounted for when planning overlay MTU.

NAT traversal in overlay

When an edge sits behind NAT, the overlay learns its public endpoint via controller or relay, and keepalives maintain the NAT mapping.

Dynamic path failover

When the active transport violates the SLA profile for a flow, traffic moves to a secondary transport and can return when the primary recovers.

Overlay segmentation

VRFs or VNIs isolate tenant routing tables within the overlay, allowing overlapping address space to coexist across separate segments.

Full-mesh tunnel scaling

Full-mesh tunnel count grows as n(n-1)/2, so large deployments use hubs, route reflectors, or hub-and-spoke overlays to bound state.

Policy evaluation order

Traffic policy rules are evaluated top-down and the first match wins, so rules must be ordered from most specific to most general.

Common policy match criteria

Policy matches typically use application ID, source and destination prefix, DSCP, user or group, and transport, with actions to permit, deny, or steer.

DSCP marking across WAN

Map application classes to DSCP values at the edge and honor those markings in the underlay QoS policy to preserve intent end to end.

Local internet breakout

Trusted SaaS traffic is steered directly out of the branch instead of backhauled to a hub, reducing latency and hub bandwidth consumption.

Active/standby vs active/active

Active/standby keeps one path hot for failover, while active/active load-shares across paths; per-flow versus per-packet steering affects reordering risk.

Policy simulation

Dry-run or simulation tooling validates rule order and match counts before committing policy changes to production edges.

Troubleshooting order

Verify underlay reachability first, then tunnel state, then the routing table, then policy match, and finally application performance.

Key overlay health signals

Monitor tunnel up/down state, BFD status, per-path latency, jitter and loss, control-plane connectivity, and edge CPU and memory.

Flow telemetry for steering

Flow-level records such as IPFIX show which policy action and transport a flow used, confirming steering behavior faster than log inspection.

Common overlay failure causes

Frequent overlay failures include MTU and fragmentation problems, expired NAT mappings, mismatched keys or certificates, and asymmetric underlay routing.

Change safety on edges

Stage policy on a pilot edge, verify flow behavior and SLA metrics, then roll out broadly while keeping a rollback configuration ready.