CloudNetX cheat sheet

Hub-and-spoke centralizes inspection but forces hairpinning; transit gateway or hub VPC peering reduces spoke-to-spoke latency when traffic volume justifies mesh links.

Three-tier vs. collapsed core: collapsed core merges distribution and core, acceptable below roughly 1,000 access ports or when L3 routing sits at access.

Bandwidth sizing: oversubscription ratio = access-edge aggregate bandwidth / uplink bandwidth; 20:1 suits general access, 4:1 to 1:1 suits server and storage tiers.

Availability math: serial availability = product of component availabilities; parallel redundant paths = 1 - product of (1 - A) for each independent path.

MTU rule: IPsec/GRE/VXLAN encapsulation adds 24-100 bytes; set underlay MTU to 9000 for VXLAN fabrics or clamp TCP MSS to path MTU minus 40.

Cloud egress: design for egress charges and asymmetric latency; keep chatty tiers in the same region/zone and use private endpoints to avoid NAT gateway egress.

Redundancy decision: dual-homed links need diverse physical paths and separate power; single-homed is acceptable only for non-critical leaf workloads with documented RTO.

Address plan: size each subnet for 2x current host count plus growth, reserve a /64 per IPv6 segment, and never overlap RFC 1918 ranges used by partners or acquisitions.

Zero trust decision rule: authenticate and authorize every flow explicitly; identity plus device posture replaces implicit trust from network location.

IPsec phases: IKE phase 1 builds the ISAKMP SA (policy, DH group, auth), phase 2 builds IPsec SAs (ESP/AH, PFS); mismatched DH group or PFS fails phase 2.

Stateful firewall returns traffic only for flows in the state table; asymmetric routing through different firewalls breaks the state lookup and drops return packets.

TLS inspection requires a forward proxy certificate trusted by clients; pinned or mutual-TLS applications must be placed on a bypass list.

Microsegmentation uses security groups or distributed policy enforced at the hypervisor/host, not at the physical switch, so east-west traffic is filtered per workload.

AAA: RADIUS encrypts only the password field, TACACS+ encrypts the full payload and separates authentication, authorization, and accounting.

DDoS tiers: always-on volumetric scrubbing at the provider edge plus on-premises stateful protection for protocol and application-layer floods.

Least privilege for management: out-of-band management VLAN, jump host, MFA, and no management plane reachable from user subnets.

SNMP: v2c sends community strings in cleartext; v3 with authPriv (SHA plus AES) is required where configuration or credentials traverse the wire.

Flow data: NetFlow/IPFIX and sFlow report per-flow metadata, not payload; sampling rates above 1:1000 distort small-flow analysis.

Syslog severity 0-7: 0 emergency, 1 alert, 2 critical, 3 error, 4 warning, 5 notice, 6 informational, 7 debug; send 0-4 to the central collector.

Latency budget: RTT plus serialization plus queuing; interactive apps tolerate roughly 150 ms one-way, voice needs under 150 ms one-way and jitter under 30 ms.

Bandwidth-delay product = bandwidth x RTT; it sets the TCP window needed to fill a path, and a window below BDP caps throughput regardless of link speed.

Capacity rule: alert at 70 percent sustained utilization over 15 minutes, investigate at 85 percent; interface errors and discards are leading indicators before saturation.

Time sync: NTP stratum decreases by one per hop; authentication (NTS or keyed) prevents spoofed time that corrupts logs and certificate validation.

Baseline before change: capture interface counters, latency, and flow mix so post-change comparison distinguishes regression from normal diurnal variation.

Layer order: verify physical/link (interface up, errors), then L2 (MAC, VLAN, STP), then L3 (ARP, route, ping), then L4 (port, ACL), then application.

Ping success with TCP failure points to a stateful firewall, ACL, or service not listening; test the specific port with a TCP handshake tool.

Traceroute shows the forward path only; return path asymmetry requires a reverse trace or per-hop flow analysis.

MTU black hole: small pings succeed, large or TLS handshakes stall; test with DF-set packets of increasing size to find the path MTU.

Duplicate IP or MAC: ARP table conflicts, flapping CAM entries, and intermittent loss; check for proxy ARP and misconfigured static addresses.

STP loop symptoms: broadcast storms, high CPU, MAC table churn across ports; verify root bridge placement and that edge ports use PortFast/BPDU guard.

DNS faults mimic application outages; compare resolution from client, resolver, and authoritative server, and check TTL and split-horizon views.

Packet capture placement matters: a SPAN port drops frames under load and misses egress-only drops; capture at both ends to localize the fault.