CloudNetX flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Oversubscription ratio

Access-edge aggregate bandwidth divided by uplink bandwidth. A 20:1 ratio fits general user access, while 4:1 or better is typical for server and storage tiers.

Collapsed core design

An architecture merging the core and distribution layers into one tier. Suitable for smaller campuses, roughly under a thousand access ports, where L3 routing moves to access.

Serial availability formula

For components in series, total availability equals the product of each component availability. Adding a dependency always lowers the end-to-end result.

Parallel availability formula

For independent redundant paths, availability equals one minus the product of each path's unavailability. Two 99 percent paths yield 99.99 percent.

VXLAN MTU overhead

VXLAN adds 50 bytes, plus outer IP and Ethernet headers. Underlay MTU of 9000 avoids fragmentation, or clamp TCP MSS to path MTU minus 40.

Hub-and-spoke hairpinning

Spoke-to-spoke traffic traverses the hub, adding latency and hub capacity load. Direct peering or a transit gateway reduces this when traffic volume justifies it.

IPv6 subnet sizing

Each IPv6 segment receives a /64 to support stateless autoconfiguration. Plan the site allocation so /64s remain aggregatable for routing.

Zero trust principle

No implicit trust from network location. Every flow is authenticated and authorized using identity and device posture before access is granted.

IKE phase 1 versus 2

Phase 1 builds the ISAKMP SA using policy, DH group, and authentication. Phase 2 builds IPsec SAs for ESP or AH. Mismatched DH or PFS fails phase 2.

Stateful firewall asymmetry

A stateful firewall permits return traffic only for flows in its state table. Asymmetric routing through different firewalls causes return packets to be dropped.

TLS inspection requirement

Inspection uses a forward proxy certificate trusted by clients. Applications using certificate pinning or mutual TLS must be excluded via bypass list.

Microsegmentation enforcement

Policy is enforced at the hypervisor or host per workload, not on the physical switch. This filters east-west traffic between workloads on the same segment.

RADIUS versus TACACS+

RADIUS encrypts only the password field. TACACS+ encrypts the entire payload and separates authentication, authorization, and accounting into distinct functions.

Management plane isolation

Device management sits on an out-of-band VLAN reachable only through a jump host with MFA, never from user or guest subnets.

DDoS scrubbing tiers

Always-on volumetric scrubbing at the provider edge handles pipe floods, while on-premises stateful devices handle protocol and application-layer attacks.

SNMPv3 authPriv

SNMPv3 with authentication and privacy uses SHA for integrity and AES for encryption. Required wherever credentials or configuration cross untrusted links.

NetFlow versus packet capture

NetFlow and IPFIX report per-flow metadata such as addresses, ports, and byte counts without payload. Packet capture records full contents but scales poorly.

Syslog severity levels

Levels 0 to 7: emergency, alert, critical, error, warning, notice, informational, debug. Most operations send levels 0 through 4 to the central collector.

Bandwidth-delay product

Bandwidth multiplied by round-trip time gives the data in flight needed to fill a path. A TCP window below this value caps throughput.

Voice latency budget

One-way latency should stay under 150 milliseconds with jitter under 30 milliseconds. Interactive data tolerates roughly 150 milliseconds one-way.

Utilization alert thresholds

Alert at 70 percent sustained over 15 minutes and investigate at 85 percent. Interface errors and discards are earlier indicators of saturation.

NTP stratum

Stratum decreases by one per hop from the reference clock. Higher stratum means further from the source and generally less accurate time.

Flow sampling distortion

Sampling rates above 1:1000 can miss small or short flows. Use lower sampling or full flow export when analyzing low-volume application traffic.

Baseline before change

Record interface counters, latency, and flow mix before a change so post-change comparison separates a regression from normal daily variation.

Layered troubleshooting order

Check physical and link state, then L2 switching, then L3 routing and ARP, then transport ports and ACLs, and finally the application itself.

Ping works, TCP fails

ICMP succeeds while application connections fail, indicating a stateful firewall, access list, or a service not listening on that port.

Forward versus return path

Traceroute reveals only the forward path. Asymmetric return routing requires a reverse trace or per-hop flow analysis to locate the fault.

MTU black hole test

Small pings succeed but large packets or TLS handshakes stall. Send don't-fragment packets of increasing size to find the path MTU.

Duplicate address symptoms

Conflicting ARP entries, flapping MAC tables, and intermittent loss. Check for proxy ARP and statically assigned addresses outside the DHCP scope.

STP loop symptoms

Broadcast storms, high switch CPU, and MAC table churn across multiple ports. Verify root bridge placement and enable BPDU guard on edge ports.

DNS fault isolation

Compare resolution from client, local resolver, and authoritative server. Check TTL values and split-horizon views that return different answers by source.

SPAN port limitations

A mirror port drops frames under load and misses egress-only drops. Capture at both endpoints to determine where packets are lost.