JNCDS-DC key terms

A two-tier data center topology where every leaf switch connects to every spine switch, and spines connect only to leaves. It provides predictable any-to-any latency and scales by adding leaves or spines rather than cascading tiers.

The access-tier switch in a spine-leaf fabric that connects servers, storage, and service appliances. It uplinks to all spines and typically serves as the Layer 2 or Layer 3 boundary for attached hosts.

The aggregation-tier switch in a spine-leaf fabric that interconnects all leaf switches. Spines carry only fabric traffic, never host connections, and provide equal-cost paths between any pair of leaves.

The relationship between total downstream capacity and available uplink capacity at a given tier. A 3:1 ratio means hosts can demand three times the bandwidth the uplinks can deliver, so lower ratios suit latency-sensitive or storage-heavy workloads.

Traffic that flows between servers inside the data center, such as application-to-database or VM-to-VM communication. It dominates modern designs and drives the need for flat, high-bandwidth fabrics instead of north-south optimized hierarchies.

Traffic entering or leaving the data center, typically between internal hosts and external clients or the internet. It passes through border or edge devices and is usually a smaller share of total volume than east-west traffic.

A leaf switch pair that connects the fabric to external networks, WAN, or internet edges. It typically hosts routing peering, firewalls, and load balancers, and often runs VRFs to separate tenant or security zones.

An access switch mounted at the top of a server rack that aggregates the rack's hosts and uplinks into the fabric. ToR designs shorten cabling runs and simplify rack-level moves, adds, and changes.

An access switch placed at the end of a row of racks rather than in each rack. It centralizes cabling and can reduce switch count, but increases cable length and complicates per-rack isolation compared with top-of-rack designs.

Cisco's software-defined networking architecture in which a centralized controller programs a policy model applied to leaf and spine switches. Policies are defined by endpoint groups, contracts, and tenants rather than per-switch CLI configuration.

The Application Policy Infrastructure Controller, the clustered management and policy brain of Cisco ACI. It exposes a REST API and GUI, stores the intended policy state, and pushes configuration to fabric switches.

In Cisco ACI, a logical container that isolates policies, VRFs, bridge domains, and endpoint groups for an organization or workload. Tenants share the physical fabric while remaining independent in policy and addressing.

An ACI policy object that groups endpoints sharing the same policy requirements, such as a tier of web servers. It binds to a bridge domain and controls which contracts govern traffic to and from its members.

In ACI, a policy construct that defines permitted communication between endpoint groups through subjects and filters. Traffic is denied by default, so connectivity requires an explicit contract relationship between providers and consumers.

A tunneling protocol that encapsulates Layer 2 frames in UDP, using a 24-bit VNI to identify up to roughly 16 million overlay segments. It stretches Layer 2 domains across a routed underlay, commonly with VXLAN-GPO or EVPN control planes.

A VXLAN Tunnel Endpoint that encapsulates and decapsulates overlay frames. It maps local VLANs to VNIs, learns remote MAC addresses, and forwards encapsulated traffic over the IP underlay to peer VTEPs.

The 24-bit VXLAN Network Identifier that labels an overlay segment, analogous to a VLAN ID but far larger in scale. Each VNI maps to a bridge domain or Layer 2 segment and must be consistent across participating VTEPs.

Ethernet VPN, a BGP address family that distributes MAC and IP reachability for overlay networks. It replaces flood-and-learn with control-plane learning, supports multihoming via Ethernet segment identifiers, and is the standard control plane for VXLAN fabrics.

A distributed default gateway where every leaf uses the same IP and MAC address for a subnet. Hosts can move anywhere in the fabric and keep their gateway, enabling seamless VM mobility and optimal first-hop routing.

A Layer 2 forwarding domain that groups interfaces or VNIs into one broadcast segment. In ACI and EVPN designs it holds the subnet gateway and determines flooding, ARP handling, and routing behavior for its members.

Virtual Routing and Forwarding, a technique that creates multiple independent routing tables on the same device. It isolates overlapping address spaces and is the basis for tenant separation and security zoning.

The controlled exchange of routes between VRFs, typically through a shared or transit VRF. It enables selective connectivity between isolated zones, such as shared services, without merging their full routing tables.

Equal-Cost Multipath, the practice of installing multiple equal-cost next hops and hashing flows across them. In fabrics it uses the many parallel leaf-spine links, and consistent hashing prevents packet reordering within a flow.

The physical IP-routed network of spines and leaves that carries encapsulated overlay traffic. It must provide stable, loop-free, high-bandwidth reachability between VTEP loopbacks, usually via OSPF or BGP with ECMP.

A logical network built on top of the underlay using tunnels such as VXLAN. It delivers Layer 2 and Layer 3 segments independent of physical topology, enabling mobility and policy decoupled from cabling.

A BGP speaker that receives routes from clients and reflects them to other clients, removing the need for a full iBGP mesh. In EVPN fabrics, spine or dedicated nodes often act as route reflectors for VTEP peering.

A mechanism where a server or switch connects to multiple leaves using an Ethernet Segment Identifier, providing active-active or active-standby redundancy without traditional stacking or MLAG. EVPN advertises per-segment reachability and handles failover.

Cisco Virtual Port Channel, which lets two switches appear as one logical device to downstream hosts using a peer link and peer keepalive. It provides active-active Layer 2 multihoming without spanning tree blocking.

A Layer 2 loop-prevention protocol that elects a root bridge and blocks redundant links. Modern data center fabrics minimize or avoid it through routed underlays, vPC, or EVPN multihoming to keep all links forwarding.

A security approach that enforces policy between individual workloads rather than at perimeter firewalls only. It typically uses distributed firewalls or endpoint-group contracts to restrict lateral east-west movement inside the data center.

A virtual instance of a physical firewall with its own policy, interfaces, and routing table. Multiple contexts let one appliance separate tenants or zones while sharing hardware resources.

The redirection of traffic through service appliances such as firewalls, load balancers, or intrusion prevention systems. In fabrics it can be policy-based, using PBR or ACI service graphs, so traffic follows a defined chain.

A forwarding method that selects the next hop based on criteria such as source address, protocol, or port rather than destination alone. It is commonly used to steer selected flows through firewalls or other service nodes.

IEEE 802.1AE link-layer encryption and integrity protection for Ethernet frames. It secures hop-by-hop links such as switch-to-switch or host-to-switch connections and is often used for data center interconnects and endpoint links.

A suite of protocols that encrypts and authenticates IP packets at Layer 3. In data centers it commonly secures traffic over untrusted WAN or DCI links, complementing MACsec which protects individual Ethernet hops.

The network and technologies linking two or more data centers for replication, workload mobility, or disaster recovery. It may use dark fiber, DWDM, or IPsec-protected tunnels and typically extends Layer 2 or EVPN segments between sites.

Managing network and compute configuration through version-controlled declarative files rather than manual CLI changes. Tools apply the desired state repeatedly, enabling review, rollback, and consistent deployment across many devices.

An agentless automation tool that runs playbooks over SSH or APIs to configure devices and systems. It uses YAML tasks and modules, and is widely used for repeatable network configuration and compliance checks.

The property that applying the same automation repeatedly produces the same result without unintended changes. It lets teams re-run playbooks safely and is a core expectation of declarative configuration tools.

A data modeling language that defines the structure and constraints of device configuration and state. NETCONF and RESTCONF use YANG models to expose standardized, vendor-neutral interfaces for automation.

A network management protocol that uses XML-encoded RPCs over SSH to read and change configuration described by YANG models. It supports candidate configs, validation, and transactions, making changes safer than CLI scripting.

A lightweight management protocol that maps YANG-modeled data to HTTP methods and JSON or XML payloads. It offers a REST-style alternative to NETCONF for programmatic configuration and telemetry retrieval.