CloudNetX key terms

A design pattern connecting on-premises networks to public cloud virtual networks using dedicated circuits, VPN tunnels, or cloud interconnects, so workloads share private addressing and consistent routing policies.

A network layout where spoke networks connect only through a central hub that inspects, filters, and routes traffic, simplifying policy enforcement at the cost of extra hops.

A regional routing service that attaches many virtual networks and on-premises links to a single managed hub, replacing full-mesh peering with centralized route propagation and policy.

An ordered set of destination prefixes and next hops that determines where a router sends each packet; longest-prefix match wins when multiple entries apply.

The exterior gateway protocol that exchanges reachability between autonomous systems, carrying path attributes used for loop prevention and best-path selection across enterprise and cloud links.

A BGP technique that repeats the local autonomous system number in advertised paths, making them look longer and therefore less preferred for inbound traffic engineering.

A logical network built on tunnels over an underlying physical fabric, decoupling virtual addressing and policy from the transport so segments can span sites and clouds.

The physical or provider transport that carries overlay tunnels, typically engineered for high bandwidth, low latency, and simple IP routing without tenant-specific policy.

A tunneling protocol that encapsulates Layer 2 frames in UDP, using a 24-bit segment identifier to stretch many isolated virtual networks across a routed IP fabric.

The largest frame or packet a link can carry; tunnels add headers that shrink usable payload, so path MTU discovery and fragmentation handling must be planned to avoid silent drops.

A WAN architecture that centrally manages policy across mixed transports, steering application traffic by quality and preference rather than static routing alone.

Forwarding that classifies traffic by application signature and steers each flow onto the path with the best measured latency, loss, or jitter at that moment.

Dividing a network into isolated zones with controlled inter-zone paths, limiting lateral movement and letting each zone carry its own trust and compliance rules.

Enforcing allow-lists per workload or identity rather than per subnet, so policy follows the asset and east-west traffic is filtered close to the source.

A security model that grants no implicit trust based on network location, verifying identity and device posture for every request before allowing access.

The principle of granting only the permissions needed for a specific task and duration, reducing the blast radius if credentials or sessions are compromised.

Policy that authorizes traffic according to authenticated user or device identity rather than source IP address, often brokered by a policy engine and enforcement points.

A converged architecture delivering networking and security functions such as secure web gateway, firewall, and zero-trust access from a cloud edge near users.

Protecting data on the wire with protocols such as TLS, IPsec, or MACsec so intercepted traffic cannot be read or altered between endpoints.

A suite of protocols that authenticates and encrypts IP packets using security associations negotiated by IKE, commonly forming site-to-site and remote-access VPN tunnels.

The lifecycle of issuing, distributing, renewing, and revoking digital certificates, whose expiry or misconfiguration is a frequent cause of sudden tunnel and TLS failures.

The hierarchy of certificate authorities, registration processes, and revocation services that lets parties validate each other's public keys through a shared trust anchor.

Detection and scrubbing of volumetric or application-layer floods, using upstream filtering, rate limits, and anycast absorption to keep legitimate service available.

An ordered rule set that permits or denies traffic by zone, address, port, application, or identity, evaluated top-down with an implicit deny at the end.

The ability to infer internal system state from emitted telemetry, combining metrics, logs, and traces so unexpected conditions can be diagnosed without prior hypotheses.

A recorded profile of normal behavior for a link, device, or application, used as the reference against which anomalies and trend drift are judged.

A contractual commitment on measurable service levels such as availability, latency, or restoration time, with defined remedies when targets are missed.

An internal target for a measurable reliability or performance indicator, usually stricter than the external SLA, guiding engineering priorities and error-budget decisions.

Instrumentation that tags requests with a shared identifier across services, revealing where latency accumulates in a multi-tier or microservice call path.

A flow-export format that summarizes conversations by addresses, ports, byte and packet counts, and timestamps, supporting traffic accounting and anomaly analysis.

A management protocol for polling device counters and receiving traps, widely used for interface statistics, uptime, and threshold alerting on network gear.

A standard event-logging transport that forwards device and application messages to a central collector, with severity levels enabling filtering and alerting.

Classification, marking, queuing, and shaping mechanisms that prioritize latency-sensitive traffic and bound delay, jitter, and loss during congestion.

Automated comparison of current telemetry against learned or thresholded norms to flag unusual traffic, error rates, or latency spikes worth investigation.

A condition where forward and return paths differ, breaking stateful inspection and some tunnels; diagnosis requires checking routes and policies on every hop.

Recording raw frames at an interface for protocol analysis, ideally with a targeted filter and ring buffer to limit storage while preserving the failing flow.

A structured method that moves past symptoms to the underlying fault, using timelines, change correlation, and evidence to prevent recurrence.

A path failure where oversized packets are dropped and the needed ICMP fragmentation message is blocked, so small packets pass while large transfers stall.