JNCDS-DC flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Clos fabric bisection bandwidth

The aggregate bandwidth crossing the middle of a spine-leaf fabric, computed as the number of spines multiplied by the per-spine bandwidth toward leaves. It sets the theoretical maximum for east-west traffic between leaf pairs.

Oversubscription ratio

Total leaf downlink capacity divided by total leaf uplink capacity. A 3:1 ratio means servers can collectively demand three times the uplink bandwidth, which is acceptable for general compute but not storage tiers.

Spine ASN design in eBGP

Each leaf gets a unique private ASN while all spines share one ASN, so a leaf sees equal AS_PATH length to every spine and installs all uplinks as ECMP next hops for loopback prefixes.

Anycast distributed gateway

The same gateway IP and MAC address are configured on every leaf for a given VLAN. A server keeps its default gateway when migrated, and traffic never tromboning to a single border device.

VXLAN VNI space

VXLAN uses a 24-bit VNI, allowing roughly 16 million segments, compared with the 12-bit VLAN ID space that yields 4094 usable identifiers after reserving 0 and 4095.

EVPN route type 2

The MAC/IP advertisement route. It distributes host MAC addresses and optionally associated IP addresses between VTEPs, enabling control-plane MAC learning and suppressing unknown unicast flooding.

EVPN route type 5

The IP prefix route. It advertises IP subnets across the fabric so leaves can route between VNIs without requiring every host MAC to be learned, which improves scale for large subnets.

VXLAN MTU overhead

VXLAN encapsulation adds 50 bytes: outer IP header, UDP header, and VXLAN header. Underlay MTU must be at least 1550 for standard frames and about 9050 when carrying jumbo frames.

BFD fast failure detection

Bidirectional Forwarding Detection sends sub-second probes independent of routing protocol timers. A 3 times 300 ms profile detects failure in under one second versus BGP's default 180-second hold time.

ECMP and AS_PATH length

Equal-cost multipath requires identical path metrics. With eBGP underlay, AS_PATH length must match across spines, so route prepending on spine-facing links breaks ECMP and must be avoided.

VTEP loopback addressing

Each VTEP is assigned a unique /32 loopback from a dedicated range. That address is the BGP router ID and the source and destination of VXLAN tunnels, keeping tunnels independent of physical link state.

MC-LAG peer-link separation

The peer-link carries control and data traffic between MC-LAG peers, while the keepalive runs on a separate path. Routing protocol peering across the peer-link is avoided to prevent hairpinned traffic.

LACP flow hashing limit

A port-channel distributes traffic by hashing Layer 2, 3, and 4 header fields. A single flow maps to one member link, so per-flow throughput is capped at one link's speed regardless of bundle size.

STP in leaf-spine fabric

In a pure Layer 3 leaf-spine fabric every link forwards and no Layer 2 loop exists, so STP is unnecessary. If retained for legacy access, use RSTP or MST with root placement aligned to the border.

Distributed firewalling benefit

Policy enforcement at the leaf or hypervisor filters east-west traffic before it crosses the spine. This avoids hairpinning inter-server flows to a central appliance and reduces latency and appliance load.

Micro-segmentation policy scope

Policy is written per workload using IP, MAC, port, or identity tags rather than per subnet. Enforcement near the source allows fine-grained east-west control without redesigning the addressing plan.

DHCP snooping and DAI

DHCP snooping marks ports as trusted or untrusted and builds a binding table. Dynamic ARP Inspection uses that table to drop ARP packets with spoofed IP-to-MAC bindings, blocking man-in-the-middle attacks.

CoPP control-plane policing

Control Plane Policing rate-limits traffic destined to the CPU, such as routing updates, ARP, and ICMP. It protects protocol stability during floods while allowing essential exception traffic through.

BGP maximum-prefix protection

A per-neighbor limit on accepted prefixes. When the limit is exceeded the session is shut down or warned, preventing a misbehaving peer from exhausting memory with an unintended full-table advertisement.

MACsec versus IPsec

MACsec encrypts Layer 2 frames on point-to-point links using hop-by-hop keys. IPsec encrypts IP packets end to end and is used for VXLAN over untrusted transport such as data-center interconnect over WAN.

Stateful service return symmetry

Stateful firewalls and load balancers require both directions of a flow to traverse the same device. Asymmetric ECMP paths break session state, so design pinned paths or use stateful anycast clustering.

Declarative versus imperative automation

Declarative tools describe the desired end state and converge toward it. Imperative scripts execute ordered steps. Declarative approaches tolerate drift better because re-running converges to the intended configuration.

Idempotency in automation

A task is idempotent when repeated execution produces the same end state. Ansible modules and Terraform resources are idempotent; raw CLI or shell commands usually are not and can duplicate changes.

NETCONF and RESTCONF

Model-driven management interfaces defined by YANG. NETCONF uses XML over port 830 with candidate and confirmed-commit capabilities; RESTCONF maps the same models to HTTP methods and JSON payloads.

Streaming telemetry versus SNMP

gNMI and gRPC telemetry push high-frequency data from the device, while SNMP polls at intervals. Streaming suits buffer-drop and counter monitoring where polling granularity misses short spikes.

Terraform remote state locking

State records which resources Terraform manages. Storing it remotely with locking prevents concurrent applies from conflicting, and running plan before apply previews drift between declared and actual configuration.

Zero-touch provisioning bootstrap

A new device obtains an address via DHCP or cloud redirect, discovers the controller, authenticates by serial or certificate, and receives its image and day-0 configuration without manual console access.

Confirmed commit rollback

A candidate configuration is committed with a timeout. If the change is not confirmed within the window, the device automatically reverts to the previous configuration, protecting remote changes from lockout.

North-south versus east-west traffic

North-south crosses the spine tier between clients and servers. East-west flows server to server and dominates modern data centers, so fabric design emphasizes leaf-local switching and spine capacity.

Dual-homed server redundancy

A server with two NICs connects to two different leaves using LACP or MC-LAG. A single leaf failure leaves the server reachable through the peer, and no VLAN depends on one device.

Optics and cabling selection

Single-mode OS2 with long-reach optics covers runs beyond 100 m and 100G/400G distances. Multimode OM4/OM5 with short-reach optics suits intra-row links, and DAC cables suit in-rack connections.

Border route summarization

Border leaves aggregate external prefixes before advertising into the fabric, shrinking the table each leaf must hold. A default route inward can further reduce state for fabric-only devices.