Dell Networking Associate (D-NWG-FN-23) cheat sheet

OSI layers 1-7: Physical, Data Link, Network, Transport, Session, Presentation, Application; switches operate at L2, routers at L3, load balancers commonly at L4-L7.

Ethernet frame: preamble/SFD, destination MAC (6B), source MAC (6B), optional 802.1Q tag (4B), EtherType (2B), payload 46-1500B, FCS (4B); frame size 64-1518B without tag, 1522B with tag.

TCP three-way handshake is SYN, SYN-ACK, ACK; teardown uses FIN/ACK pairs or RST; sequence/acknowledgment numbers provide ordered, reliable delivery with windowing for flow control.

UDP is connectionless with an 8-byte header (source port, destination port, length, checksum) and no retransmission; used by DNS, DHCP, SNMP, TFTP, and VXLAN outer encapsulation.

IPv4 header is 20 bytes minimum; key fields are TTL (decremented per hop, loop prevention), protocol (6=TCP, 17=UDP, 1=ICMP), and header checksum recalculated at each router.

Private IPv4 ranges: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16; 169.254.0.0/16 is link-local (APIPA) assigned when DHCP fails; 127.0.0.0/8 is loopback.

Subnet math: usable hosts = 2^h - 2 where h = 32 - prefix length; /24 = 254 hosts, /25 = 126, /26 = 62, /27 = 30, /28 = 14, /29 = 6, /30 = 2.

ARP resolves IPv4 to MAC within a broadcast domain; gratuitous ARP announces address ownership and is used for duplicate address detection and fast failover.

IPv6 basics: 128-bit addresses, no broadcast (uses multicast and anycast), NDP replaces ARP, /64 is the standard host subnet, link-local is fe80::/10, and SLAAC uses RA plus EUI-64 or privacy addresses.

Dell PowerSwitch families: N-series (N1100, N1500, N2200, N3000, N3200) are campus/1GbE access switches; S-series (S4100, S5200, S6000, S6100) are data center 10/25/40/100GbE top-of-rack switches.

Z-series (Z9100, Z9264, Z9332, Z9432) are high-density 100GbE/400GbE spine and aggregation switches for leaf-spine fabrics; S5200 and S4100 are common leaf options.

PowerSwitch OS split: N-series and some S-series run Dell Networking OS9 (FTOS-based CLI); S5200, S6100, Z-series, and newer platforms run OS10 (Linux-based, Debian, with RESTCONF/Ansible support).

Dell SmartFabric Services (SFS) automates full-fabric provisioning on supported OS10 switches; SmartFabric Director provides SDN-style fabric lifecycle management for VXLAN EVPN deployments.

PowerConnect is the legacy line (now end-of-sale for most models) replaced by PowerSwitch N-series; PowerConnect CLI differs from OS9 and does not support many data center features.

Dell PowerEdge MX and VxRail integrate with PowerSwitch for converged infrastructure; MX7000 modular chassis uses MX9116n fabric switching engines running OS10.

Positioning rule: N-series for campus/wiring closet, S-series for 10/25GbE server access, Z-series for 100/400GbE spine, and SFS/Director for automated fabric management.

Dell Networking OS10 supports VLT, VXLAN, EVPN, BGP, OSPF, and REST API; OS9 supports VLT, stacking (some models), and traditional L2/L3 without native EVPN.

Dell ProSupport and ProSupport Plus are the service tiers; ProSupport Plus adds a dedicated account team and automated support for PowerSwitch hardware.

VLANs segment broadcast domains; 802.1Q adds a 4-byte tag with a 12-bit VLAN ID (1-4094 usable; 0 and 4095 reserved); native VLAN is untagged on trunk ports.

Spanning Tree: STP (802.1D) has slow convergence; RSTP (802.1w) adds rapid port roles (alternate, backup) and states (discarding, learning, forwarding); MSTP (802.1s) maps multiple VLANs to instances.

PortFast/edge port skips listening/learning on access ports; BPDU Guard err-disables a port that receives BPDUs, and Root Guard prevents a port from becoming root.

Link aggregation: LACP (802.3ad) negotiates bundles; Dell OS9/OS10 use 'port-channel' or 'lag' interfaces; all member ports must match speed, duplex, and VLAN configuration.

VLT (Virtual Link Trunking) on Dell S-series pairs two switches into one logical L2 domain using a VLT interconnect (VLTi) and a backup link; it provides active-active L2 multipathing without STP blocking.

VLT requires matching VLT domain ID, matching VLTi port-channels, and a backup heartbeat link; peer-routing enables L3 ECMP across the VLT pair.

MAC address table aging default is 300 seconds; unknown unicast is flooded within the VLAN until learned; static MAC entries can pin a device to a port.

Storm control limits broadcast, multicast, and unknown-unicast traffic per port; thresholds are set as percentage of line rate or packets per second.

Voice VLAN and LLDP-MED allow IP phones to be placed in a separate VLAN; PoE (802.3af/at/bt) budgets power per port (15.4W/30W/60-90W classes).

Static route syntax: 'ip route <next-hop|interface> [distance]'; administrative distance orders route sources (connected 0, static 1, eBGP 20, OSPF 110, RIP 120, iBGP 200).

OSPFv2: link-state IGP; neighbors form via Hello (default 10s on broadcast, 40s dead); areas must share area 0 (backbone); DR/BDR elected on multi-access segments; cost = reference bandwidth / interface bandwidth.

BGP: path-vector EGP; eBGP peers use AS-path loop prevention and are preferred over iBGP; iBGP requires full mesh or route reflectors; best-path order includes weight, local preference, AS-path length, origin, MED.

VRRP (RFC 5798) provides first-hop redundancy with a virtual IP and virtual MAC (00-00-5E-00-01-VRID); the master holds the VIP; Dell OS10 supports VRRP and VRRPv3 for IPv6.

ECMP allows up to N equal-cost next hops for a prefix; Dell OS10 supports ECMP for OSPF and BGP; hash is typically 5-tuple based.

Route redistribution between OSPF and BGP requires a route-map to control prefixes and set metrics; mutual redistribution without filtering can cause routing loops.

IPv4 to IPv6 migration: dual stack, 6to4, ISATAP, and NAT64/DNS64; Dell OS10 supports dual-stack interfaces and OSPFv3 for IPv6 routing.

DHCP relay ('ip helper-address') forwards client broadcasts to a DHCP server on another subnet; required when clients and server are in different VLANs.

Policy-based routing (PBR) uses a route-map to forward matching traffic to a specified next hop or interface, overriding the routing table for that flow.

Leaf-spine topology: every leaf connects to every spine; spines provide ECMP routing between leaves; east-west traffic traverses one spine hop; no STP blocking because L3 ECMP is used.

VXLAN encapsulates L2 frames in UDP (destination port 4789) with an 8-byte header and a 24-bit VNI (up to ~16M segments); the outer IP is the VTEP address.

EVPN (RFC 7432) is the control plane for VXLAN; BGP EVPN uses route types 1 (Ethernet auto-discovery), 2 (MAC/IP), 3 (inclusive multicast), 4 (Ethernet segment), 5 (IP prefix).

Anycast VTEP: multiple leaf switches share the same VTEP IP; any leaf can decapsulate traffic destined for a host behind it, simplifying multi-homing.

VLT plus VXLAN: a VLT pair can act as a single VTEP with a shared anycast VTEP address; requires consistent VXLAN VNI mapping and VLT backup link.

Dell SmartFabric Services automates VXLAN EVPN fabric creation: define a fabric, add switches, and SFS provisions underlay BGP, overlay EVPN, and VLAN-to-VNI mappings.

Underlay for VXLAN EVPN is typically eBGP or OSPF providing loopback reachability; overlay is iBGP EVPN between VTEPs; loopbacks (not physical links) are the VTEP source.

VXLAN MTU: outer encapsulation adds ~50 bytes; underlay MTU must be at least 1600 (often 9216 jumbo) to avoid fragmentation of encapsulated frames.

SmartFabric Director (SFD) provides intent-based fabric management for PowerSwitch OS10 VXLAN EVPN deployments, including lifecycle, telemetry, and fabric-wide policy.

Port security limits learned MAC addresses per port; violation actions are protect (drop), restrict (drop plus log), and shutdown (err-disable); sticky MACs persist across reloads.

802.1X: supplicant (client), authenticator (switch), authentication server (RADIUS); EAP methods include EAP-TLS (certificates) and PEAP/MS-CHAPv2; MAB falls back to MAC-based auth for non-supplicants.

DHCP snooping blocks rogue DHCP servers by trusting only uplink ports; the binding table feeds IP Source Guard and Dynamic ARP Inspection (DAI).

Dynamic ARP Inspection validates ARP packets against the DHCP snooping binding table; untrusted ports drop invalid ARP; rate-limit ARP to prevent DoS.

Access control lists: standard ACLs match source IP only (1-99); extended ACLs match source/destination IP, protocol, and ports (100-199); applied inbound or outbound on an interface.

AAA: authentication (who), authorization (what), accounting (what was done); RADIUS uses UDP 1812/1813, TACACS+ uses TCP 49 and encrypts the full payload.

SSH replaces Telnet for management (TCP 22); disable Telnet, set 'ip ssh server', and configure VTY ACLs plus privilege levels or role-based access.

Private VLANs isolate ports within a VLAN: promiscuous port reaches all, isolated ports reach only promiscuous, community ports reach each other plus promiscuous.

Control-plane policing and CoPP protect the switch CPU from excessive traffic (ARP, ICMP, routing protocol storms) by rate-limiting punted traffic.

SNMPv3 adds authentication (MD5/SHA) and privacy (DES/AES) versus v1/v2c community strings; traps/ informs push events to a collector; polling uses get/getnext/walk.

Syslog severity levels 0-7: 0 emergency, 1 alert, 2 critical, 3 error, 4 warning, 5 notice, 6 informational, 7 debug; Dell OS10 uses 'logging server ' with severity filters.

sFlow and NetFlow/IPFIX provide traffic sampling and flow telemetry; Dell OS10 supports sFlow and REST API-based telemetry; streaming telemetry pushes counters via gNMI/RESTCONF.

RESTCONF (RFC 8040) uses HTTP methods (GET, POST, PUT, PATCH, DELETE) and YANG models; NETCONF uses SSH (port 830) and XML; both are model-driven.

Dell OS10 REST API is enabled with 'rest-api' in configuration; base URL is https:///api/restconf; authentication uses basic auth or tokens.

Ansible modules for Dell OS10 (dellemc.os10 collection) configure interfaces, VLANs, and BGP; templates use Jinja2; idempotency is the key design goal.

LLDP (802.1AB) advertises neighbor identity, port, and capabilities; LLDP-MED extends it for voice devices; CDP is Cisco-proprietary and may be disabled on Dell by default.

NTP synchronizes device clocks (UDP 123); stratum 0 is reference, stratum 1 is directly attached; authentication uses MD5/SHA keys to prevent spoofing.

Configuration management: 'copy running-config startup-config' persists changes; OS10 uses candidate/transaction model ('commit') while OS9 applies immediately.

Interface troubleshooting sequence: check 'show interface status' for up/up, verify speed/duplex, check cable and SFP, then examine counters for CRC/alignment errors (physical) versus runts/giants (MTU).

VLT troubleshooting: verify VLTi is up, backup link reachable, domain IDs match, and 'show vlt mismatch' reports no inconsistencies; split-brain occurs if both VLTi and backup link fail.

STP troubleshooting: check root bridge with 'show spanning-tree', verify port roles/states, look for topology change notifications, and confirm consistent VLAN-to-instance mappings.

OSPF neighbor stuck in EXSTART/EXCHANGE indicates MTU mismatch; stuck in INIT indicates one-way Hello reachability; stuck in 2-WAY is normal on non-DR/BDR pairs.

BGP neighbor not establishing: check TCP 179 reachability, AS numbers, authentication, and 'show ip bgp summary' for state (Idle, Active, Connect, OpenSent, Established).

High availability options: VLT (L2 active-active), VRRP (L3 gateway redundancy), LACP (link redundancy), and stacking (single management plane on supported models).

Graceful restart / non-stop forwarding keeps forwarding during control-plane restart; BFD provides sub-second failure detection for OSPF, BGP, and static routes.

Log and capture: 'show logging', 'show tech-support', and ERSPAN/port mirroring ('monitor session') capture traffic for analysis; sFlow provides sampled flow visibility.

Power and environmental: 'show environment' reports PSU, fan, and temperature status; redundant PSUs and fans are hot-swappable on S-series and Z-series chassis.