CNPLE key terms

A LAN design model that separates access, distribution, and core layers so each layer handles distinct functions, improving scalability, fault isolation, and predictable traffic flow between endpoint devices and the network backbone.

A two-tier design in which the distribution and core layers are merged into one pair of switches, reducing cost and hop count in smaller campuses while still providing policy and routing boundaries.

A data center topology where every leaf switch connects to every spine switch, giving uniform, low-latency paths between servers and allowing predictable east-west traffic scaling through equal-cost multipathing.

A tunneling protocol that encapsulates Layer 2 frames inside UDP packets, extending VLAN segments across a routed Layer 3 underlay and supporting far more segments than traditional 802.1Q VLAN IDs allow.

A logical topology built on top of an existing physical underlay, using encapsulation to create virtual segments and reachability independent of the underlying routed infrastructure.

The physical or routed foundation that carries encapsulated overlay traffic, typically built with IP routing and equal-cost multipathing so overlay endpoints have redundant, high-bandwidth paths.

A set of protocols that let multiple routers or switches share a virtual gateway address, so hosts keep connectivity when a gateway device fails or is taken out of service.

An open standard first-hop redundancy protocol in which a master router owns a virtual IP address and forwards traffic for the group, with backups taking over if the master stops advertising.

A Layer 2 loop-prevention protocol that elects a root bridge and blocks redundant ports, producing a loop-free forwarding topology that adapts when links fail or change state.

A Cisco implementation of rapid spanning tree that runs one instance per VLAN, giving faster convergence than legacy 802.1D and allowing per-VLAN load balancing of blocked links.

A port security feature that places an edge port into an error-disabled state if it receives a bridge protocol data unit, preventing unauthorized switches from influencing the spanning tree topology.

A spanning tree protection feature that blocks a port from accepting superior bridge protocol data units, keeping the intended root bridge in place and preventing topology changes from misconfigured downstream switches.

A bundle of parallel physical links treated as one logical link, increasing bandwidth and providing redundancy while spanning tree sees a single port and avoids blocking member links.

An IEEE standard negotiation protocol that dynamically forms and maintains link aggregation bundles between two devices, verifying that member links match in speed, duplex, and configuration.

Logical groupings of OSPF routers and links that limit link-state flooding and topology calculation to a portion of the domain, with all areas connecting through the backbone area.

A formed relationship between two OSPF routers that requires matching area, timers, authentication, and MTU settings, and that precedes exchange of link-state information.

The collection of link-state advertisements a router stores for its area, describing topology and prefixes, from which the router runs the shortest path first algorithm to build its routing table.

Values carried in BGP updates that describe a route and drive best-path selection, including weight, local preference, AS path, origin, MED, and next hop.

A router allowed to reflect routes learned from one internal BGP peer to other internal peers, removing the need for a full mesh of sessions inside an autonomous system.

A routing capability that installs multiple paths of equal metric to the same destination and shares traffic across them, improving utilization and resilience in routed and data center fabrics.

A security model that treats no user or device as inherently trusted, verifying identity and context for every request and enforcing least-privilege access regardless of network location.

A port-based access control standard that authenticates a supplicant through an authenticator to a RADIUS server before granting network access, often assigning a VLAN or policy after success.

A client-server protocol that centralizes authentication, authorization, and accounting for network access, allowing switches and wireless controllers to validate credentials against a central policy store.

A Cisco-developed protocol that separates authentication, authorization, and accounting and encrypts the entire payload, commonly used to control and audit administrative access to network devices.

A suite of protocols that authenticates and encrypts IP packets at Layer 3, using security associations and protocols such as AH and ESP to protect site-to-site and remote-access traffic.

A key exchange protocol that negotiates and maintains IPsec security associations, supporting mutual authentication, rekeying, and mobility so tunnels recover from address changes.

A one-way agreement between IPsec peers that defines the protocols, algorithms, keys, and lifetime used to protect traffic in a given direction.

Dividing a network into isolated zones using VLANs, VRFs, or firewalls so that a compromise or fault in one area cannot freely reach sensitive resources in another.

A virtual routing and forwarding instance that gives a device multiple independent routing tables, allowing overlapping address space and traffic separation on shared physical infrastructure.

The controlled redistribution of prefixes between otherwise isolated routing tables, such as VRFs, so specific destinations are reachable across a boundary without merging the full tables.

A numeric scale from 0 to 7 that ranks log messages by urgency, from emergency through debug, letting operators filter and route events to appropriate collection systems.

Unsolicited notifications an agent sends to a manager when a defined condition occurs, providing event-driven monitoring without waiting for the manager to poll the device.

A flow-export technology that summarizes IP conversations by source, destination, ports, and volume, supporting traffic analysis, capacity planning, and anomaly detection.

A feature that generates synthetic probes to measure latency, jitter, packet loss, and reachability between devices, often used to trigger path changes or verify service-level commitments.

A mechanism that monitors the state of an interface, route, or probe and adjusts dependent features, such as first-hop redundancy priority or static routes, when the tracked object changes.

A function on a router or switch that forwards broadcast DHCP requests from a client subnet to a central server and returns replies, enabling centralized address management across subnets.

A Layer 2 security feature that classifies ports as trusted or untrusted and drops server-originated DHCP messages on untrusted ports, preventing rogue servers from handing out addresses.

A protocol that synchronizes device clocks to a reference time source, keeping log timestamps, certificates, and authentication events consistent across the network for correlation and compliance.

The point in the network where a device begins trusting or re-marking packet classification fields, typically the access switch port or phone, so priority treatment stays consistent end to end.

A six-bit field in the IP header used to classify packets into per-hop behaviors, letting routers and switches apply differentiated forwarding, queuing, and drop treatment.

The scheduling of packets waiting for an egress interface, using techniques such as priority, weighted fair, or class-based queues to control delay and loss for different traffic classes.

Managing network and system configuration through version-controlled declarative files that tools apply automatically, making changes repeatable, reviewable, and recoverable rather than manually typed.

A property of an automation operation where applying the same desired state repeatedly produces the same result without unintended side effects, making repeated runs safe and predictable.

The gradual divergence between a device's actual configuration and its intended baseline, often caused by manual changes, which automation detects and corrects by reapplying desired state.

A network management protocol that uses XML-encoded remote procedure calls over a secure transport to read and edit structured configuration data on devices, supporting transactions and candidate configurations.

A data modeling language that defines the structure, types, and constraints of configuration and state data exposed by a network device, enabling vendor-neutral automation and validation.

A protocol that exposes YANG-modeled data through HTTP methods and JSON or XML encoding, giving automation tools a web-friendly alternative to NETCONF sessions.

A YAML file describing an ordered set of tasks and desired states applied to inventoried hosts, typically over SSH, without requiring an agent on managed devices.

Expressing governance, security, and compliance rules in machine-readable files that pipelines evaluate automatically, so violations block changes before they reach production.

A controlled process for requesting, reviewing, approving, scheduling, and documenting modifications to production systems, reducing outages and preserving an auditable record of what changed.

An access model that grants permissions to defined roles rather than individuals, so users receive only the capabilities their job requires and changes are easier to audit.

The principle of granting each user, device, or process only the minimum access needed to perform its function, limiting the blast radius of error or compromise.

The average time required to restore a failed component or service to working order, a key reliability metric used to evaluate operational maturity and support decisions about redundancy.

A group of IP networks under one administrative authority with a common routing policy, identified by a unique number and used as the unit of interdomain routing on the internet.