JNCDS-WAN cheat sheet

Classify every input as business, functional, non-functional, or constraint; mark each mandatory or desired, and record its source and acceptance test.

Peak aggregate demand = users x per-user bandwidth x concurrency factor; add 20-30% headroom for burst and growth before selecting link speeds.

Port count over the horizon = current ports x (1 + annual growth)^years; use 3-5 years and round up to the next platform and line-card granularity.

Availability A = MTBF / (MTBF + MTTR); 99.9% allows about 8.77 hours/year, 99.99% about 52.6 minutes/year, and 99.999% about 5.26 minutes/year.

For voice and video, define one-way delay, jitter, and loss budgets before choosing topology; topology cannot fix an application SLA that was never specified.

Build a requirement traceability matrix that maps each requirement to design element, owner, and test; reject orphan design elements with no requirement.

Site profile inputs include user count, device mix, application flows, WAN circuits, power and cooling, security and compliance, and existing routed and switched topology.

Use the 5-tuple plus application identity to define QoS classes; keep the class count to 4-8 so scheduling and testing remain tractable.

SRX security policies are evaluated first-match top-down; end each zone pair with a default deny, and log denied inter-zone traffic.

Place interfaces in zones by trust level; traffic between zones traverses policy, while intra-zone traffic is not filtered by zone policy unless explicit filters or microsegmentation exist.

For IPsec use IKEv2, AES-GCM or AES-CBC with SHA-256, and DH group 14 or stronger; avoid DES, 3DES, MD5, SHA-1, and DH groups 1 and 2.

IKE Phase 1 builds the management SA; Phase 2 builds child SAs with traffic selectors and lifetimes that protect data.

Protect the Routing Engine with a loopback firewall filter that permits only management protocols from approved prefixes and rate-limits ICMP, ARP, and BGP or OSPF.

Campus access security uses 802.1X with RADIUS, DHCP snooping, dynamic ARP inspection, and RA guard to block rogue DHCP, ARP spoofing, and rogue IPv6 routers.

Segment tenants with VLANs and VRFs and EVPN-VXLAN; route between segments through a stateful firewall or security policy.

Use MACsec on point-to-point links where link-layer confidentiality is required and IPsec for tunnels over untrusted WAN or internet transports.

Risk score = likelihood x impact; use it to rank controls, but do not let a low score waive a regulatory requirement.

Series availability = A1 x A2 x ... x An; parallel availability = 1 - ((1-A1) x (1-A2) x ...).

Design redundancy as N+1 for shared capacity and 1+1 for critical paths; remove single points in power, uplink, Routing Engine, and circuit.

BFD detects forwarding failures faster than routing hellos; tune intervals to the failure domain and ensure both endpoints support the same timer profile.

Enable NSR and graceful restart where supported to avoid routing churn during control-plane switchover; verify data-plane and control-plane independence.

Use a dedicated management VRF or out-of-band network; never rely on the production data path for recovery access.

Set monitoring thresholds at 70% for warning, 80% for action, and 90% for critical on interface, CPU, memory, and queue utilization.

Streaming telemetry using gRPC or JTI pushes structured data at sub-minute intervals; SNMP polling is simpler but coarser and heavier on the device.

Use commit confirmed with a rollback timer for remote changes, and archive a rescue configuration before maintenance.

Define RTO and RPO for management systems; back up configurations, licenses, and certificates off-box and test restoration.

Use three tiers of access, distribution, and core for large campuses; collapse distribution and core when port count and policy scale permit.

Route at distribution or core; keep VLANs local to access blocks and avoid large Layer 2 domains that increase spanning-tree and failure scope.

PoE budget = sum of powered-device class maximums x count; reserve about 20% headroom and verify switch power supply and thermal limits.

802.3bt Type 3 delivers up to 60 W per port at the PSE and Type 4 up to 90 W; check cable category and bundle heating before high-power deployment.

Virtual Chassis combines EX or QFX switches into one logical device; MC-LAG provides active-active multihoming when a single logical chassis is not desired.

Uplink oversubscription = total access-port bandwidth / uplink bandwidth; lower ratios improve burst absorption but increase cost.

Spanning-tree edge protections include BPDU guard, root guard, and loop guard; use RSTP or MSTP and never disable STP on user-facing ports.

Wi-Fi design is capacity-led: estimate clients per AP and throughput per client, then plan channels and AP density; coverage alone is insufficient.

Use a /24 per VLAN for up to 254 hosts and size DHCP scopes to about 80% utilization; larger subnets increase broadcast and troubleshooting scope.

Choose MPLS L3VPN when strict SLA, any-to-any, and managed QoS are required; choose internet plus IPsec or SD-WAN when cost and agility dominate.

Hybrid WAN uses policy-based forwarding or SD-WAN application policies to steer voice and video to low-latency paths and bulk traffic to broadband.

For internet IPsec, account for encapsulation overhead; set TCP MSS clamping and verify path MTU to avoid fragmentation and black holes.

Dual CPE plus dual diverse circuits removes device and link single points; verify physical route diversity, not just logical provider diversity.

BGP multihoming: local preference chooses exit within the AS; MED hints to neighbors; AS-path prepending influences inbound traffic but is blunt.

WAN QoS maps applications to 4-8 classes; shape outbound traffic to the contracted rate and mark DSCP consistently end to end.

Site uplink = peak aggregate demand x headroom; add per-tunnel overhead and control traffic, then round up to the next circuit increment.

For SD-WAN, define underlay SLAs, tunnel redundancy, and application health probes; Juniper SSR and Mist WAN Assurance are examples of policy and visibility components.

Use BFD or RPM probes to measure latency, jitter, loss, and availability; tie thresholds to application SLA and failover policy.

Spine-leaf: every leaf connects to every spine, giving predictable East-West paths and ECMP; scale by adding leaves or spines, not by adding tiers.

EVPN-VXLAN uses MP-BGP EVPN for MAC and IP reachability and VXLAN for data-plane encapsulation over a Layer 3 underlay.

Oversubscription = downstream bandwidth / uplink bandwidth; 1:1 is non-blocking, 3:1 is common for general compute, and storage or AI fabrics often need lower ratios.

Underlay routing uses eBGP or OSPF with ECMP; keep the underlay simple and push tenant segmentation and policy to the EVPN overlay.

EVPN multihoming with ESI-LAG provides active-active host connections to multiple leaves; MC-LAG is an alternative for traditional multichassis aggregation.

For RoCEv2 storage, enable lossless priority flow control and ECN; separate or carefully manage storage and compute traffic classes.

Place top-of-rack leaves close to servers; account for rack power, cooling, and cabling before choosing port speed and density.

Data-center interconnect options include EVPN-VXLAN over IPsec, dark fiber, and MPLS; choose based on latency, encryption, and tenant stretch requirements.