I85PREP
⌘ K
DCNP study materials
DCNP study resources

DCNP: Network Virtualization and Software-Defined Networking

DCNP · Work through your exam, one topic at a time.

All guide sections

Network Virtualization and Software-Defined Networking

Domain 3 tests the separation of control and forwarding, and how virtual networks are built over a shared physical fabric. You should be able to explain what a controller actually does, how tenants are isolated, and where NFV fits.

Core model

  • SDN separates the control plane (decisions) from the data plane (forwarding). A controller programs devices through southbound interfaces such as NETCONF, RESTCONF, gNMI, or OpenFlow.
  • The controller is usually not in the forwarding path. If it fails, existing flows keep forwarding; new provisioning stops.
  • Overlay virtualization decouples tenant topology from physical topology. VXLAN provides the data-plane encapsulation; EVPN or a controller provides the control plane.
  • VRFs provide Layer 3 isolation per tenant. VNIs provide Layer 2 segmentation. Both are usually needed.
  • NFV virtualizes network functions (firewall, load balancer, router) as VMs or containers; it is complementary to SDN, not the same thing.

Design rules

  • Keep the underlay simple and stable; put policy and tenant complexity at the edge or in the overlay.
  • Use a source of truth for VNI, VLAN, and subnet allocation so two tenants never collide.
  • Plan for controller clustering and backup; a single controller is a provisioning single point of failure.

Worked example

Two tenants both use 10.0.0.0/24. Tenant A gets VRF-A and VNI 10010; tenant B gets VRF-B and VNI 10020. Each leaf has a per-VRF anycast gateway (for example 10.0.0.1 in each VRF). EVPN route targets scope advertisements so A prefixes never enter B. Without separate VRFs, the duplicate subnet causes overlapping-route errors and traffic leaks. Without separate VNIs, Layer 2 flooding crosses tenants.

Traps that cost marks

  • Assuming the controller forwards traffic; it programs, it does not normally switch packets.
  • Treating NFV as synonymous with SDN.
  • Using VRFs alone for Layer 2 isolation, or VNIs alone for Layer 3 isolation.
  • Forgetting route-target import and export policy, which is what actually enforces tenant separation.
  • Assuming an overlay makes the underlay design irrelevant.