JNCIA-Design cheat sheet

Three-tier hierarchy: core (fast, resilient forwarding), distribution (policy, aggregation, routing boundaries), access (endpoint attachment, PoE, port density).

Collapsed core merges core and distribution into one layer; appropriate when the site is small enough that a dedicated core adds latency and cost without scaling benefit.

Availability formula: A = MTBF / (MTBF + MTTR); a 99.99% target allows about 52 minutes of downtime per year.

Redundancy rule: component redundancy without independent failure paths does not raise availability; shared power, shared uplink, or shared conduit are common-mode failures.

OSPF/EIGRP/IS-IS use cost or metric-based shortest path; BGP uses policy attributes (AS_PATH, LOCAL_PREF, MED) and is the choice for multi-homed or inter-AS designs.

Address plan: reserve a contiguous block per site and per function (management, users, voice, servers, DMZ), summarize at the distribution layer, and keep growth space of 30-50%.

MTU: standard Ethernet is 1500 bytes; jumbo frames are commonly 9000 bytes and must be consistent end-to-end on every L2/L3 hop, or traffic is dropped or fragmented.

Design documentation set: logical topology, physical topology, addressing plan, VLAN plan, routing policy, and failure-domain map; each change is traceable to a design record.

Access layer port budget = active endpoint ports + 20-30% spare + uplink ports; PoE budget is calculated per port class (e.g., 802.3af 15.4 W, 802.3at 30 W) against switch PSU capacity.

STP: 802.1D convergence is tens of seconds; RSTP (802.1w) converges in sub-second to a few seconds; MSTP (802.1ab) maps VLANs to instances to reduce instance count.

Spanning-tree design rule: keep the root bridge on the distribution/core pair, set root primary/secondary, and use PortFast plus BPDU guard only on edge ports.

VLAN design: one subnet per VLAN, VLANs bounded to a single distribution block, and inter-VLAN routing performed at distribution or a collapsed core rather than at access.

Link aggregation (802.3ad/LACP) adds bandwidth and redundancy; member links must match in speed, duplex, and MTU, and traffic is hashed per flow, not per packet.

Wireless: 2.4 GHz uses 1/6/11 non-overlapping channels in North America; 5 GHz has many more channels; design for -67 dBm or better RSSI at cell edge and roughly 20-25 dB SNR for voice.

Voice design: separate voice VLAN, LLDP-MED or CDP for VLAN assignment, QoS trust boundary at the access edge, and PTP/priority queueing for call signaling and RTP.

First-hop redundancy: VRRP (RFC 5798) is standards-based; HSRP is Cisco-proprietary; GLBP adds load sharing; all require matched virtual IP, group, and preemption policy.

WAN technology selection: MPLS L3VPN for any-to-any with QoS and SLA; Internet + IPsec for cost-sensitive; dedicated line or dark fiber for deterministic latency and high bandwidth.

BGP design: eBGP between customer and provider, iBGP full mesh or route reflectors internally; filter inbound with prefix lists and max-prefix limits to prevent route leaks.

Multi-homing options: single-homed (one link, one provider), dual-homed (two links, one provider), multi-homed (two providers); only multi-homed protects against provider failure.

BGP best-path order (memorize): highest weight, highest LOCAL_PREF, locally originated, shortest AS_PATH, lowest origin type, lowest MED, eBGP over iBGP, lowest IGP metric to next hop, lowest router ID.

MTU and overlay: IPsec adds 50-73 bytes; GRE adds 24 bytes; set TCP MSS clamping (typically 1400 or 1360) so tunneled sessions do not black-hole on PMTUD failure.

SD-WAN design: application-aware policy per path, encrypted overlays over Internet/MPLS, local Internet breakout for SaaS, and centralized control plane with per-site data plane.

QoS model: classify and mark at edge (DSCP EF for voice, AF41 for video, AF21 for signaling), trust boundary at the access switch, and per-hop queuing with priority queue limited to about 30% of link.

Circuit sizing: peak utilization should stay below 70% of committed rate for real-time traffic; oversubscription ratios of 4:1 to 20:1 are typical for aggregation links.

Spine-leaf: every leaf connects to every spine, no leaf-to-leaf links; equal-cost multipath (ECMP) provides active-active forwarding; spine count sets bisection bandwidth.

Oversubscription = total downstream (host-facing) bandwidth / total upstream (spine-facing) bandwidth; 1:1 is non-blocking, 3:1 is common for general compute, 1:1 for storage.

Bisection bandwidth = number of spine links x link speed (per direction); it must exceed worst-case inter-half traffic, not average traffic.

Leaf-spine vs traditional three-tier: leaf-spine keeps east-west traffic to two hops (leaf-spine-leaf) and avoids STP blocking by using L3 to the leaf with ECMP.

VXLAN provides 24-bit VNI space (about 16 million segments) versus 12-bit VLAN (4094 usable); VXLAN encapsulates L2 frames in UDP (port 4789) and requires an underlay MTU of at least 1550-1600 bytes.

EVPN uses BGP control plane with route types: type 2 MAC/IP, type 3 inclusive multicast, type 5 IP prefix; it replaces flood-and-learn with control-plane MAC learning.

Storage: Fibre Channel (FC) uses lossless buffer-to-buffer credit; FCoE and iSCSI require lossless Ethernet (PFC, ETS) to avoid drops; NVMe-oF over TCP or RoCEv2 is increasingly common.

Data center availability: dual power feeds from separate PDUs and UPS, redundant leaf pairs (vPC/MLAG), and failure-domain isolation so a single switch loss removes at most one path.

Zone model: untrusted (Internet), DMZ (public-facing services), trusted (internal), and management; default deny between zones with explicit allow rules and logging.

Firewall placement: stateful inspection at zone boundaries, not inside a broadcast domain; traffic that never crosses a zone boundary is not filtered by the perimeter firewall.

DMZ design: public servers sit in DMZ, never in the internal network; inbound flows terminate in DMZ and internal access is brokered, not direct.

802.1X components: supplicant, authenticator (switch), authentication server (RADIUS); EAP variants include EAP-TLS (certificate, strongest), PEAP/MSCHAPv2, and EAP-TTLS.

NAC/MAB: MAC Authentication Bypass for devices without supplicants; use with profiling and restricted VLANs because MAC addresses are spoofable.

IPsec: IKE phase 1 builds the ISAKMP SA (auth, DH, encryption); phase 2 builds IPsec SAs (ESP for encryption, AH for integrity only); ESP is preferred because AH does not survive NAT.

Encryption selection: AES-GCM provides authenticated encryption; SHA-256 or better for integrity; DH groups 14 (2048-bit) or higher; avoid IKEv1 aggressive mode and DES/3DES.

Defense in depth: segmentation, least-privilege ACLs, IDS/IPS at ingress and between zones, centralized syslog, and AAA with TACACS+ for device administration (encrypts full payload, separates authz).