JNCDS-SEC cheat sheet

Requirement sources: business drivers, technical constraints, existing topology, budget, compliance scope, timeline - classify each as mandatory, desirable, or out of scope before design starts.

Design documents ladder: requirements doc → conceptual (logical) design → high-level design → low-level design → implementation/verification plan; each stage must trace back to a numbered requirement.

Capacity formula: aggregate demand = sum of per-site peak throughput × oversubscription ratio; size uplinks to peak, not average, and state the assumed busy-hour window.

Availability target drives redundancy: single device ≈ 99.5%, redundant supervisor/PSU ≈ 99.9%, full device + link redundancy ≈ 99.99% (four nines ≈ 52 min downtime/year).

MTBF/MTTR availability: A = MTBF / (MTBF + MTTR); improving MTTR (fast failover, spares) is usually cheaper than raising MTBF.

Scope boundaries: list in-scope devices, out-of-scope legacy, demarcation points, and who owns each (customer, carrier, integrator) - ambiguity here is the top cause of design disputes.

Growth model: apply a stated CAGR to port count and bandwidth for a 3–5 year horizon; record headroom percentages per layer as a design assumption.

Compliance inputs to capture early: data residency, PCI-DSS segmentation, HIPAA, retention/logging windows - these become hard constraints on segmentation and logging design.

Zero-trust decision rule: authenticate and authorize every session (user + device posture) regardless of network location; perimeter-only trust is insufficient for remote and BYOD traffic.

Segmentation hierarchy: macro-segmentation (VRF/VLAN per function) plus micro-segmentation (policy between workloads) - enforce with stateful firewalls or group-based policy, not ACLs alone.

802.1X components: supplicant, authenticator (switch/WLC), authentication server (RADIUS); EAP-TLS (certificates) is strongest, PEAP/MSCHAPv2 needs server-cert validation to resist evil-twin.

Control-plane hardening: SSHv2 only, AAA with TACL, disable unused services (CDP/LLDP externally, HTTP, Telnet), routing authentication (OSPF MD5/SHA, BGP TCP-AO or MD5), and CoPP to rate-limit punted traffic.

Data-plane protections: uRPF (strict at edge, loose in asymmetric core), DHCP snooping + dynamic ARP inspection + IP Source Guard, port security, and storm control on access ports.

Encryption rule: MACsec for hop-by-hop LAN/WAN link protection, IPsec (IKEv2) for untrusted transport, TLS 1.2+ for management and APIs; never rely on WEP/WPA/TKIP.

Firewall placement rule: stateful inspection at trust boundaries (data center edge, internet edge, inter-VRF/segmentation gateway); keep policy least-privilege with explicit deny and logged default-deny.

Threat detection coverage: NetFlow/IPFIX for volumetric anomalies, IDS/IPS at ingress, DNS-layer security, and centralized syslog to SIEM with synchronized NTP for correlation.

Management plane separation: dedicated out-of-band management VRF/VLAN with ACLs restricting source subnets; never expose management to the internet.

Telemetry choices: SNMPv3 (authPriv) for polling, streaming telemetry (gNMI/gRPC) for high-frequency state, syslog for events, NetFlow/IPFIX for traffic - pick per use case, not one for all.

Configuration governance: infrastructure-as-code templates, config backup after every change, version control, and change windows with documented rollback.

NTP hierarchy: stratum 0 reference → stratum 1 servers → internal stratum 2; all devices within milliseconds for log correlation, certificates, and 802.1X.

HA design rules: redundant supervisors, dual power feeds on separate PDUs, dual-homed uplinks to distinct line cards/devices, and no single shared L2 domain across failure zones.

Failover timing: BFD (sub-second) with IGP fast convergence, HSRP/VRRP/GLBP with preempt and tracking, and NSF/SSO to avoid control-plane restart on supervisor switchover.

Monitoring baselines: track interface errors/discards, CPU/memory, uptime, BGP/OSPF neighbor state, power/thermal, and license expiry; alert on thresholds, not just outages.

Backup and recovery: documented device RMA/spare strategy, golden configs per role, and tested restore procedure - recovery time objective should match the availability target.

Three-tier vs collapsed core: three-tier (core/distribution/access) for large campuses with policy boundaries; collapsed core for small/medium sites where distribution functions fold into core.

Access layer rule: one VLAN per subnet, Layer 2 access with trunk uplinks; keep spanning tree domains small and aligned to distribution pairs.

Spanning tree: RSTP/MSTP with distribution as root (lowest priority), PortFast + BPDU Guard on edge ports, Root Guard on downstream-facing ports, Loop Guard on non-designated ports.

L2 vs L3 at distribution: route at distribution for fast convergence and bounded failure domains; use L2 only where mobility or legacy requires it.

Wireless design inputs: coverage (RSSI ≥ -67 dBm for voice, -72 dBm data), channel plan (1/6/11 on 2.4 GHz, non-overlapping 5 GHz), AP density per client count, and WLC placement (local vs flexconnect).

PoE budgeting: sum per-port class draw against switch PoE budget; 802.3bt (up to 90 W) for Wi-Fi 6/6E APs and cameras - verify budget, not just per-port capability.

Stacking/chassis rule: stack members share control plane - keep stacks within one wiring closet and size stack bandwidth for uplink oversubscription.

Branch design: single integrated router/switch/AP platform, local survivability (SRST/flexconnect), and a documented fallback path if the WAN link fails.

Topology selection: hub-and-spoke for centralized policy and low cost, full/partial mesh for any-to-any latency-sensitive traffic, SD-WAN overlay to combine both with per-application policy.

Transport mix: MPLS for SLA-backed any-to-any, internet broadband for cost/capacity, 5G/LTE for backup - active/active with per-flow or per-app steering beats active/standby.

Routing at the edge: eBGP to carriers with prefix filters and max-prefix limits, iBGP with route reflectors in large ASes, and summarized advertisements toward the WAN.

SD-WAN components: controller (orchestrator), vEdge/cEdge devices, overlay tunnels (IPsec), and application-aware policies with SLA probes (latency, jitter, loss).

QoS model: classify and mark at the access edge, trust boundary at the WAN edge, 6–8 classes, priority queue for voice/video (≤33% of link), and shaping to the contracted rate.

Bandwidth sizing: per-site busy-hour demand + 30–50% headroom, plus separate sizing for backup path if it must carry full load during failover.

High availability: dual WAN links on diverse paths/providers, BFD for fast failure detection, and documented failover behavior per application (stateful vs stateless).

Addressing: use provider-independent space or NAT carefully; plan summarizable blocks per region so WAN routing tables stay small.

Spine-leaf rule: every leaf connects to every spine (full mesh), no leaf-to-leaf or spine-to-spine links; equal-cost multipath gives predictable any-to-any latency (typically 2–3 hops).

Oversubscription math: leaf uplink capacity ÷ server downlink capacity; 3:1 is common for general compute, 1:1 for storage/HPC - state the ratio explicitly.

VXLAN/EVPN: VXLAN provides L2 over L3 with 24-bit VNI space; EVPN (BGP) is the control plane for MAC/IP learning - replaces flood-and-learn and spanning tree in the overlay.

Anycast gateway: same distributed gateway IP/MAC on every leaf so hosts keep their gateway when migrating - required for seamless VM mobility across racks.

Underlay routing: eBGP (common, simple policy) or OSPF/IS-IS with ECMP; keep underlay L3-only and stable, with BFD and fast convergence.

Storage networking: Fibre Channel (FC/FCoE) needs lossless transport - PFC and ETS for FCoE; iSCSI/NVMe-oF over TCP tolerates standard Ethernet with adequate buffering.

Multi-site DC: DCI over VXLAN/EVPN or OTV; stretch only the subnets that need mobility, and design for split-brain prevention (vPC/M-LAG across sites is discouraged).

Server access: dual-homed NICs to two leaf switches (vPC/M-LAG or EVPN multihoming) for link redundancy; single-homed is acceptable only for non-critical workloads.