ACE Professional cheat sheet

Cloud connectivity decision rule: private VIF or interconnect for steady high-volume traffic; site-to-site VPN over internet for low-cost, quick-turnup, or backup paths; internet breakout for SaaS and public endpoints.

Transit gateway (hub-and-spoke) centralizes VPC/VNet peering and routing, avoids full-mesh peering sprawl, and enables a shared inspection or egress VPC.

VPC peering is non-transitive: A peered to B and B peered to C does not give A reachability to C; use a transit hub or explicit peering for each pair.

Overlapping CIDR blocks block peering and complicate VPN; plan IP addressing so on-premises, cloud regions, and future acquisitions do not collide.

Route table longest-prefix match wins; a more specific /24 beats a summarized /16 regardless of route origin or administrative distance settings.

Security groups are stateful and instance-attached; network ACLs are stateless and subnet-attached, so return traffic must be explicitly allowed in ACLs.

Direct interconnect provides dedicated private circuits with BGP peering, while hosted connections resell partner capacity; both avoid internet path variability.

Egress charges apply per GB leaving the cloud, and cross-AZ or cross-region traffic is often billable; place chatty workloads in the same zone or region.

BGP best-path order: highest weight, highest local preference, locally originated, shortest AS path, lowest origin type, lowest MED, eBGP over iBGP, lowest IGP metric to next hop, then tie-breakers.

eBGP default administrative distance is 20 and iBGP is 200; static routes are typically 1 and connected 0, so static wins over any BGP-learned prefix of equal length.

iBGP requires either full mesh or route reflectors because routes learned from one iBGP peer are not re-advertised to other iBGP peers (split-horizon rule).

MED is a hint to neighboring autonomous systems and is compared only among paths from the same neighbor AS by default; local preference is the primary outbound-path knob.

Route summarization shrinks tables and dampens churn but can blackhole traffic if a less-specific summary is advertised while a component prefix is down.

BGP graceful restart and BFD speed convergence: BFD detects sub-second failures, while graceful restart preserves forwarding during control-plane restarts.

Anycast advertises the same prefix from multiple sites; routing selects the nearest instance, which is the basis for DNS, CDN, and DDoS-scrubbing architectures.

RPKI origin validation flags invalid announcements (wrong origin AS) and can drop them, mitigating prefix hijacks; it does not validate the full AS path.

Campus fabric underlay uses routed links (often IS-IS or OSPF) with an overlay such as VXLAN-GPO or LISP for segmentation and mobility.

VXLAN uses a 24-bit VNI (about 16 million segments) and encapsulates Layer 2 frames in UDP port 4789 over a routed underlay.

Wi-Fi 6 (802.11ax) adds OFDMA and uplink MU-MIMO for dense environments; Wi-Fi 6E extends into the 6 GHz band, adding clean channels and reducing interference.

WPA3 replaces the PSK handshake with SAE, providing forward secrecy and resistance to offline dictionary attacks on captured handshakes.

PoE budget math: total switch PoE watts must cover the sum of powered devices (APs, cameras, phones) with headroom; 802.3bt supplies up to 90 W per port.

AI-driven campus operations use telemetry baselines to detect anomalies (roaming failures, DHCP issues, RF interference) rather than static threshold alerts.

Segmentation via group-based policy or SGTs enforces intent (who may talk to whom) independent of IP subnet, simplifying moves and guest isolation.

Rogue AP and wireless intrusion detection compares detected BSSIDs against the authorized inventory; containment sends deauth frames to suppress the rogue.

Streaming telemetry (gNMI/gRPC, model-driven) pushes data continuously at sub-second intervals, unlike SNMP polling which samples at fixed intervals.

Flow records (NetFlow/IPFIX/sFlow) capture per-conversation metadata: 5-tuple, byte/packet counts, timestamps, and optionally application or AS information.

Synthetic monitoring (active probes) measures reachability and latency from known vantage points; passive monitoring observes real traffic without injecting packets.

The four golden signals are latency, traffic, errors, and saturation; they prioritize what to alert on for services and network paths.

Distributed tracing follows a request across services using trace and span IDs, exposing where latency accumulates in multi-tier or microservice paths.

Time synchronization matters: correlating logs, flows, and metrics requires NTP/PTP discipline, or timelines will not align across devices.

Cardinality control: label or dimension explosion (per-user, per-URL) inflates metric storage and query cost; aggregate or sample high-cardinality fields.

Alert design uses SLOs and error budgets; symptom-based alerts (user-visible failures) reduce noise compared with cause-based threshold alerts on every interface.