Fabric security and resilience
Domain 4 asks you to treat the fabric as a trust domain: harden the control plane, control who may attach and what they may request, and design so that one node, port or WAN link cannot remove a service. The exam mixes IS-IS hardening, UNI and Fabric Attach admission control, and redundancy mechanics such as SMLT/RSMLT, vIST, the dual B-VID trees and Fabric Extend over IPsec.
Protecting the control plane
- Authenticate IS-IS hello and LSP PDUs (HMAC-MD5) on fabric links. A rogue node with a spoofed system-id or a duplicate nickname can attract traffic.
- Run IS-IS only on fabric ports. UNI and access ports must never form adjacencies.
- The management VSN (I-SID 16777215) gives fabric-wide reach to every management IP. Segregate it, filter it, and never extend it to tenants.
Admission control at the edge
- UNI authentication: EAP (802.1X) for supplicant-capable devices, NEAP for MAC-based devices. Unauthenticated ports land in a guest or isolated VLAN rather than the production service.
- Restrict the Fabric Attach I-SID assignment range per proxy. Without a bound, a compromised access switch can request any tenant service.
- Add DHCP snooping, dynamic ARP inspection and IP source guard on UNI ports; use MACsec where the hardware supports it; carry Fabric Extend over IPsec and firewall UDP 8472.
Resilience
- Two B-VIDs give independent trees; SMLT/RSMLT pairs dual-home access; vIST builds the cluster over the fabric so no physical IST link is needed; dual Fabric Extend tunnels remove the WAN single point of failure; IS-IS graceful restart keeps forwarding during control-plane restart.
Worked example
An SMLT pair dual-homes an access switch, with vIST carrying cluster control over the fabric instead of a dedicated IST link. When one SMLT leg fails, the access switch keeps forwarding on the remaining leg and the RSMLT routers keep the gateway reachable - but only if both peers can still see each other through the fabric. If the fabric path between the peers breaks, vIST drops and the cluster splits, so the design must guarantee redundant fabric reachability between cluster peers.
Traps that cost marks
Believing SMLT protects against both legs failing at once; leaving Fabric Attach with an unrestricted assignment range; leaving IS-IS enabled on a port facing a customer; assuming MACsec or FE encryption is on by default; believing vIST removes the need for fabric reachability between peers.