JNCDS-DC cheat sheet

Spine-leaf is a two-tier Clos fabric: every leaf connects to every spine, spines never connect to each other, and leaves never connect to leaves at the same tier.

Clos bisection bandwidth = number of spines × per-spine bandwidth toward leaves; oversubscription = total leaf downlink capacity ÷ total leaf uplink capacity.

North-south traffic crosses the spine tier (client to server); east-west traffic stays leaf-local or crosses spines between leaves - design for east-west dominance in modern DCs.

Recommended oversubscription ratios: 1:1 for storage or latency-critical tiers, 3:1 for general compute, up to 4:1 or higher for edge/access tiers.

Server rack density drives ToR choice: 1RU 48-port 25G leaf serves ~24 dual-homed servers; 100G/400G uplinks are used for spine-facing ports.

Redundancy rules: dual-homed servers use LACP/MC-LAG across two leaves; dual-homed border leaves provide redundant external paths; no single device should be a cut vertex for any VLAN.

ECMP path count = number of equal-cost next hops; with 4 spines a leaf has 4 uplinks and up to 4 ECMP paths per destination prefix.

Cabling: single-mode fiber (OS2) for long runs and 100G/400G reaches beyond 100 m; multimode OM4/OM5 with SR optics for intra-row runs under ~100–150 m; DAC for in-rack.

Failure-domain math: a fabric with N spines tolerates N-1 spine failures at reduced bandwidth; a leaf failure isolates only its attached servers if servers are dual-homed.

VLAN = Layer 2 broadcast domain; VXLAN = Layer 2 over Layer 3 encapsulation with a 24-bit VNI supporting ~16 million segments versus VLAN's 12-bit 4094 usable IDs.

VXLAN VTEP encapsulates original frames in UDP port 4789; the outer IP header carries source/dest VTEP addresses and the VNI identifies the tenant segment.

EVPN Type 2 = MAC/IP advertisement (used for host reachability), Type 3 = inclusive multicast Ethernet tag (BUM replication), Type 5 = IP prefix route for routing between subnets.

MC-LAG (vPC/VPC) presents one logical LAG to a dual-homed server; keep peer-link and keepalive on separate paths and avoid routing protocol peering across the peer-link.

STP is largely unnecessary in a leaf-spine fabric where every link forwards; if STP is retained, use RSTP/MST and align root placement with the border.

Storm control and BUM suppression: unknown unicast flooding is bounded by EVPN MAC learning; broadcast/multicast rate limits are configured per port.

Jumbo frames require MTU ≥ 9000 end-to-end on the underlay; VXLAN adds 50 bytes of overhead (outer IP/UDP/VXLAN headers), so physical MTU must be at least 1550 for standard frames or 9050 for jumbo.

Port-channel hashing: LACP distributes flows by hash of L2/L3/L4 headers; a single flow uses one member link, so per-flow throughput is capped at one link's speed.

The underlay is pure Layer 3: eBGP with unique ASNs per leaf and a shared spine ASN (or iBGP with route reflectors) provides loop-free ECMP reachability between VTEP loopbacks.

eBGP underlay design: each leaf uses a private ASN, spines share one ASN; leaf advertises only its loopback /32, spines advertise nothing except learned routes - this yields deterministic ECMP.

ECMP requires identical cost metrics across paths; with eBGP the AS_PATH length must match, so avoid prepending on spine links in the underlay.

BFD with sub-second timers detects link/node failure faster than BGP hold timers (default 180 s hold, 60 s keepalive); tune to 3×300 ms for fast convergence.

Anycast gateway: the same IP and MAC are configured on every leaf for a given VLAN so servers keep their default gateway when moved; distributed anycast avoids traffic tromboning to a border.

Route summarization at the border reduces the external table propagated into the fabric; advertise only aggregate prefixes and a default route inward if needed.

MTU and ECMP: ensure all ECMP members have equal MTU; asymmetric MTU causes silent drops for jumbo or VXLAN-encapsulated frames.

Loopback addressing: assign a unique /32 per VTEP from a dedicated range; the loopback is the BGP router-ID and the VXLAN tunnel source/destination.

Security zoning: separate tenant/application segments into distinct VRFs or VNIs; inter-zone traffic traverses a stateful firewall (physical or virtual) rather than routing directly in the fabric.

Distributed firewalling places policy enforcement at the leaf (or hypervisor) so east-west traffic is filtered before it crosses the spine, avoiding hairpinning to a central appliance.

Micro-segmentation uses workload-level policy (IP/MAC/port or identity tags) instead of subnet-level ACLs; policy is applied close to the source.

First-hop security: DHCP snooping, dynamic ARP inspection, and IP source guard prevent spoofing; RA Guard blocks rogue IPv6 routers.

Control-plane protection: CoPP rate-limits exception traffic to the CPU; BGP maximum-prefix and TTL security (GTSM) protect against route injection and spoofed sessions.

Load balancing services: one-armed vs inline; in a VXLAN fabric use anycast VIPs with health-checked pools, and ensure return traffic symmetry for stateful devices.

AAA and 802.1X: RADIUS/TACACS+ for device admin; 802.1X/MAB for port authentication; NAC can assign dynamic VLAN or SGT based on identity.

Encryption: MACsec on point-to-point links protects L2 in transit; IPsec protects VXLAN over untrusted transport (e.g., DCI over WAN).

Declarative vs imperative: declarative tools (intent-based controllers, Terraform) converge to a desired state; imperative scripts (CLI/Ansible ad-hoc) execute steps in order.

Idempotency means re-running a task yields the same end state; Ansible modules and Terraform resources are designed to be idempotent, shell/CLI commands usually are not.

NETCONF (port 830) uses XML and YANG models; RESTCONF uses HTTP/JSON with YANG; both are model-driven alternatives to SNMP/CLI scraping.

Telemetry streaming (gNMI/gRPC) pushes data at high frequency versus SNMP polling; use it for fabric-wide counters, buffer drops, and interface state.

Configuration management: version control every template, use golden-config validation, and stage changes with commit/rollback (candidate config + confirmed commit).

Terraform state tracks managed resources; remote state with locking prevents concurrent apply conflicts; plan before apply to preview drift.

CI/CD pipeline for network: lint templates → render config → validate in lab/digital twin → deploy in waves → post-change verification via telemetry.

Zero-touch provisioning (ZTP/PnP) uses DHCP options or cloud redirect to deliver bootstrap image and day-0 config; device identity via serial or certificate.

Spine-leaf is a two-tier Clos fabric: every leaf connects to every spine; spines never interconnect and leaves never interconnect at the same tier.

Bisection bandwidth = spines × per-spine bandwidth toward leaves; oversubscription = total leaf downlink capacity ÷ total leaf uplink capacity.

North-south traffic crosses the spine tier (client to server); east-west traffic stays leaf-local or crosses spines between leaves - design for east-west dominance in modern DCs.

Recommended oversubscription ratios: 1:1 for storage or latency-critical tiers, 3:1 for general compute, up to 4:1 or higher for edge/access tiers.

Server rack density drives ToR choice: a 1RU 48-port 25G leaf serves ~24 dual-homed servers; 100G/400G uplinks are used for spine-facing ports.

Redundancy rules: dual-homed servers use LACP/MC-LAG across two leaves; dual-homed border leaves provide redundant external paths; no single device should be a cut vertex for any VLAN.

ECMP path count = number of equal-cost next hops; with 4 spines a leaf has 4 uplinks and up to 4 ECMP paths per destination prefix.

Cabling: single-mode fiber (OS2) for long runs and 100G/400G reaches beyond 100 m; multimode OM4/OM5 with SR optics for intra-row runs under ~100–150 m; DAC for in-rack.

Failure-domain math: a fabric with N spines tolerates N-1 spine failures at reduced bandwidth; a leaf failure isolates only its attached servers if servers are dual-homed.

VLAN = Layer 2 broadcast domain; VXLAN = Layer 2 over Layer 3 encapsulation with a 24-bit VNI supporting ~16 million segments versus VLAN's 12-bit 4094 usable IDs.

VXLAN VTEP encapsulates original frames in UDP port 4789; the outer IP header carries source/dest VTEP addresses and the VNI identifies the tenant segment.

EVPN Type 2 = MAC/IP advertisement (used for host reachability), Type 3 = inclusive multicast Ethernet tag (BUM replication), Type 5 = IP prefix route for routing between subnets.

MC-LAG (vPC/VPC) presents one logical LAG to a dual-homed server; keep peer-link and keepalive on separate paths and avoid routing protocol peering across the peer-link.

STP is largely unnecessary in a leaf-spine fabric where every link forwards; if STP is retained, use RSTP/MST and align root placement with the border.

Storm control and BUM suppression: unknown unicast flooding is bounded by EVPN MAC learning; broadcast/multicast rate limits are configured per port.

Jumbo frames require MTU ≥ 9000 end-to-end on the underlay; VXLAN adds 50 bytes of overhead (outer IP/UDP/VXLAN headers), so physical MTU must be at least 1550 for standard frames or 9050 for jumbo.

Port-channel hashing: LACP distributes flows by hash of L2/L3/L4 headers; a single flow uses one member link, so per-flow throughput is capped at one link's speed.

The underlay is pure Layer 3: eBGP with unique ASNs per leaf and a shared spine ASN (or iBGP with route reflectors) provides loop-free ECMP reachability between VTEP loopbacks.

eBGP underlay design: each leaf uses a private ASN, spines share one ASN; leaf advertises only its loopback /32, spines advertise nothing except learned routes - this yields deterministic ECMP.

ECMP requires identical cost metrics across paths; with eBGP the AS_PATH length must match, so avoid prepending on spine links in the underlay.

BFD with sub-second timers detects link/node failure faster than BGP hold timers (default 180 s hold, 60 s keepalive); tune to 3×300 ms for fast convergence.

Anycast gateway: the same IP and MAC are configured on every leaf for a given VLAN so servers keep their default gateway when moved; distributed anycast avoids traffic tromboning to a border.

Route summarization at the border reduces the external table propagated into the fabric; advertise only aggregate prefixes and a default route inward if needed.

MTU and ECMP: ensure all ECMP members have equal MTU; asymmetric MTU causes silent drops for jumbo or VXLAN-encapsulated frames.

Loopback addressing: assign a unique /32 per VTEP from a dedicated range; the loopback is the BGP router-ID and the VXLAN tunnel source/destination.

Security zoning: separate tenant/application segments into distinct VRFs or VNIs; inter-zone traffic traverses a stateful firewall (physical or virtual) rather than routing directly in the fabric.

Distributed firewalling places policy enforcement at the leaf (or hypervisor) so east-west traffic is filtered before it crosses the spine, avoiding hairpinning to a central appliance.

Micro-segmentation uses workload-level policy (IP/MAC/port or identity tags) instead of subnet-level ACLs; policy is applied close to the source.

First-hop security: DHCP snooping, dynamic ARP inspection, and IP source guard prevent spoofing; RA Guard blocks rogue IPv6 routers.

Control-plane protection: CoPP rate-limits exception traffic to the CPU; BGP maximum-prefix and TTL security (GTSM) protect against route injection and spoofed sessions.

Load balancing services: one-armed vs inline; in a VXLAN fabric use anycast VIPs with health-checked pools, and ensure return traffic symmetry for stateful devices.

AAA and 802.1X: RADIUS/TACACS+ for device admin; 802.1X/MAB for port authentication; NAC can assign dynamic VLAN or SGT based on identity.

Encryption: MACsec on point-to-point links protects L2 in transit; IPsec protects VXLAN over untrusted transport (e.g., DCI over WAN).

Declarative vs imperative: declarative tools (intent-based controllers, Terraform) converge to a desired state; imperative scripts (CLI/Ansible ad-hoc) execute steps in order.

Idempotency means re-running a task yields the same end state; Ansible modules and Terraform resources are designed to be idempotent, shell/CLI commands usually are not.

NETCONF (port 830) uses XML and YANG models; RESTCONF uses HTTP/JSON with YANG; both are model-driven alternatives to SNMP/CLI scraping.

Telemetry streaming (gNMI/gRPC) pushes data at high frequency versus SNMP polling; use it for fabric-wide counters, buffer drops, and interface state.

Configuration management: version control every template, use golden-config validation, and stage changes with commit/rollback (candidate config + confirmed commit).

Terraform state tracks managed resources; remote state with locking prevents concurrent apply conflicts; plan before apply to preview drift.

CI/CD pipeline for network: lint templates → render config → validate in lab/digital twin → deploy in waves → post-change verification via telemetry.

Zero-touch provisioning (ZTP/PnP) uses DHCP options or cloud redirect to deliver bootstrap image and day-0 config; device identity via serial or certificate.

Spine-leaf is a two-tier Clos fabric: every leaf connects to every spine; spines never interconnect and leaves never interconnect at the same tier.

Bisection bandwidth = spines × per-spine bandwidth toward leaves; oversubscription = total leaf downlink capacity ÷ total leaf uplink capacity.

North-south traffic crosses the spine tier (client to server); east-west traffic stays leaf-local or crosses spines between leaves - design for east-west dominance in modern DCs.

Recommended oversubscription ratios: 1:1 for storage or latency-critical tiers, 3:1 for general compute, up to 4:1 or higher for edge/access tiers.

Server rack density drives ToR choice: a 1RU 48-port 25G leaf serves ~24 dual-homed servers; 100G/400G uplinks are used for spine-facing ports.

Redundancy rules: dual-homed servers use LACP/MC-LAG across two leaves; dual-homed border leaves provide redundant external paths; no single device should be a cut vertex for any VLAN.

ECMP path count = number of equal-cost next hops; with 4 spines a leaf has 4 uplinks and up to 4 ECMP paths per destination prefix.

Cabling: single-mode fiber (OS2) for long runs and 100G/400G reaches beyond 100 m; multimode OM4/OM5 with SR optics for intra-row runs under ~100–150 m; DAC for in-rack.

Failure-domain math: a fabric with N spines tolerates N-1 spine failures at reduced bandwidth; a leaf failure isolates only its attached servers if servers are dual-homed.

VLAN = Layer 2 broadcast domain; VXLAN = Layer 2 over Layer 3 encapsulation with a 24-bit VNI supporting ~16 million segments versus VLAN's 12-bit 4094 usable IDs.

VXLAN VTEP encapsulates original frames in UDP port 4789; the outer IP header carries source/dest VTEP addresses and the VNI identifies the tenant segment.

EVPN Type 2 = MAC/IP advertisement (used for host reachability), Type 3 = inclusive multicast Ethernet tag (BUM replication), Type 5 = IP prefix route for routing between subnets.

MC-LAG (vPC/VPC) presents one logical LAG to a dual-homed server; keep peer-link and keepalive on separate paths and avoid routing protocol peering across the peer-link.

STP is largely unnecessary in a leaf-spine fabric where every link forwards; if STP is retained, use RSTP/MST and align root placement with the border.

Storm control and BUM suppression: unknown unicast flooding is bounded by EVPN MAC learning; broadcast/multicast rate limits are configured per port.

Jumbo frames require MTU ≥ 9000 end-to-end on the underlay; VXLAN adds 50 bytes of overhead (outer IP/UDP/VXLAN headers), so physical MTU must be at least 1550 for standard frames or 9050 for jumbo.

Port-channel hashing: LACP distributes flows by hash of L2/L3/L4 headers; a single flow uses one member link, so per-flow throughput is capped at one link's speed.

The underlay is pure Layer 3: eBGP with unique ASNs per leaf and a shared spine ASN (or iBGP with route reflectors) provides loop-free ECMP reachability between VTEP loopbacks.

eBGP underlay design: each leaf uses a private ASN, spines share one ASN; leaf advertises only its loopback /32, spines advertise nothing except learned routes - this yields deterministic ECMP.

ECMP requires identical cost metrics across paths; with eBGP the AS_PATH length must match, so avoid prepending on spine links in the underlay.

BFD with sub-second timers detects link/node failure faster than BGP hold timers (default 180 s hold, 60 s keepalive); tune to 3×300 ms for fast convergence.

Anycast gateway: the same IP and MAC are configured on every leaf for a given VLAN so servers keep their default gateway when moved; distributed anycast avoids traffic tromboning to a border.

Route summarization at the border reduces the external table propagated into the fabric; advertise only aggregate prefixes and a default route inward if needed.

MTU and ECMP: ensure all ECMP members have equal MTU; asymmetric MTU causes silent drops for jumbo or VXLAN-encapsulated frames.

Loopback addressing: assign a unique /32 per VTEP from a dedicated range; the loopback is the BGP router-ID and the VXLAN tunnel source/destination.

Security zoning: separate tenant/application segments into distinct VRFs or VNIs; inter-zone traffic traverses a stateful firewall (physical or virtual) rather than routing directly in the fabric.

Distributed firewalling places policy enforcement at the leaf (or hypervisor) so east-west traffic is filtered before it crosses the spine, avoiding hairpinning to a central appliance.

Micro-segmentation uses workload-level policy (IP/MAC/port or identity tags) instead of subnet-level ACLs; policy is applied close to the source.

First-hop security: DHCP snooping, dynamic ARP inspection, and IP source guard prevent spoofing; RA Guard blocks rogue IPv6 routers.

Control-plane protection: CoPP rate-limits exception traffic to the CPU; BGP maximum-prefix and TTL security (GTSM) protect against route injection and spoofed sessions.

Load balancing services: one-armed vs inline; in a VXLAN fabric use anycast VIPs with health-checked pools, and ensure return traffic symmetry for stateful devices.

AAA and 802.1X: RADIUS/TACACS+ for device admin; 802.1X/MAB for port authentication; NAC can assign dynamic VLAN or SGT based on identity.

Encryption: MACsec on point-to-point links protects L2 in transit; IPsec protects VXLAN over untrusted transport (e.g., DCI over WAN).

Declarative vs imperative: declarative tools (intent-based controllers, Terraform) converge to a desired state; imperative scripts (CLI/Ansible ad-hoc) execute steps in order.

Idempotency means re-running a task yields the same end state; Ansible modules and Terraform resources are designed to be idempotent, shell/CLI commands usually are not.

NETCONF (port 830) uses XML and YANG models; RESTCONF uses HTTP/JSON with YANG; both are model-driven alternatives to SNMP/CLI scraping.

Telemetry streaming (gNMI/gRPC) pushes data at high frequency versus SNMP polling; use it for fabric-wide counters, buffer drops, and interface state.

Configuration management: version control every template, use golden-config validation, and stage changes with commit/rollback (candidate config + confirmed commit).

Terraform state tracks managed resources; remote state with locking prevents concurrent apply conflicts; plan before apply to preview drift.

CI/CD pipeline for network: lint templates → render config → validate in lab/digital twin → deploy in waves → post-change verification via telemetry.

Zero-touch provisioning (ZTP/PnP) uses DHCP options or cloud redirect to deliver bootstrap image and day-0 config; device identity via serial or certificate.