JNCIA-Design key terms

A campus LAN structure split into core, distribution, and access layers. The core forwards at high speed, distribution applies policy and routing boundaries, and access connects endpoints. Each layer has a distinct role, which keeps design modular and simplifies troubleshooting.

A two-tier campus design where the core and distribution functions merge into one layer, usually a pair of switches. It suits smaller sites where a dedicated core would add cost and hops without improving performance. Redundancy is normally provided between the merged nodes.

A Layer 2 control protocol that blocks redundant paths so an Ethernet network forms a loop-free tree. It elects a root bridge and selects forwarding or blocking states per port. Rapid variants converge in seconds, but design should still avoid large flat Layer 2 domains.

The number of switches and endpoints sharing one broadcast domain. Large domains increase flooding, slow convergence, and failure blast radius. Good campus design keeps access VLANs local to a wiring closet or building and routes between them at the distribution layer.

A mechanism such as VRRP or a vendor equivalent that gives hosts a shared virtual default gateway address. If the active router fails, a standby takes over the address, so endpoints keep connectivity without reconfiguration. It is a standard requirement for resilient access designs.

The total power a switch can deliver to powered devices across its ports, minus cable loss. Design must sum expected draw from access points, cameras, and phones and leave headroom. Insufficient budget causes devices to reboot or fail to power on.

Planning of the edge switches that connect user devices, including port count, speed, PoE, VLAN assignment, and uplink capacity. Oversubscription ratios and cable distances are decided here. It is where most user-visible performance and availability problems originate.

Multi-chassis link aggregation, where two separate switches present one logical link aggregation group to a server or downstream switch. It removes dependence on Spanning Tree for that link and allows both uplinks to forward simultaneously, improving bandwidth and failover time.

Dividing an OSPF routing domain into areas to limit link-state flooding and computation. Area 0 is the backbone, and other areas connect through it. Summarization at area borders shrinks tables. Poor area layout causes suboptimal paths and heavy recomputation.

Advertising one aggregate prefix in place of many more specific ones. It reduces routing table size and hides topology changes behind the summary, limiting failure propagation. It requires contiguous addressing, so IP address planning must happen before deployment.

A documented allocation of subnets and address ranges across sites, floors, and device classes, sized with growth headroom. It enables summarization, simplifies firewall rules, and prevents overlap during mergers. It is a foundational design artifact, not an afterthought.

Estimating future traffic and sizing links, devices, and power to carry it with acceptable headroom. It uses measured utilization trends plus known growth drivers such as new applications or sites. Without it, designs either fail under load or waste budget.

The relationship between aggregate edge port bandwidth and the capacity of the uplink carrying that traffic. A 4:1 ratio means edge ports together can offer four times the uplink speed. Lower ratios suit bandwidth-heavy workloads; higher ratios are acceptable for light office traffic.

Deciding how traffic classes are marked, queued, and scheduled so latency-sensitive flows such as voice survive congestion. It requires consistent classification at the edge and trust boundaries set correctly. Overly complex schemes are hard to operate and often misconfigured.

Measuring the mix, volumes, and patterns of traffic on an existing or modeled network. Results inform link sizing, QoS class definitions, and where to place security inspection. Profiling before design avoids guessing and reveals flows that diagrams miss.

A logical Layer 2 broadcast domain created by configuration on switches rather than physical cabling. VLANs separate user groups, support policy at Layer 3 boundaries, and let one physical topology serve several purposes. Trunks carry multiple VLANs between switches.

A WAN architecture that centralizes policy and steers traffic across multiple transports such as broadband, MPLS, and LTE based on application and link quality. It reduces dependence on expensive circuits and simplifies branch provisioning through a controller.

A service provider offering that forwards customer traffic using label-switched paths and isolates customers through virtual routing instances. It provides any-to-any connectivity with service level agreements, and is often retained for critical sites while cheaper links carry bulk traffic.

A design that combines private circuits with internet-based links, usually with policy deciding which traffic uses which path. It balances cost against guarantees, and requires careful routing and security treatment for the internet paths.

A standards-based tunnel that encrypts and authenticates traffic between sites or remote users over untrusted networks. Design choices include tunnel endpoints, routing over tunnels, and failover behavior. It is common for branch-to-hub connectivity and remote access.

The ordered decision process a router uses to pick one path among several for the same prefix, considering attributes such as local preference, AS path length, and MED. Designers influence traffic flow by setting these attributes deliberately rather than accepting defaults.

Connecting one network to more than one provider or path for resilience and better routing control. It requires a public address strategy and BGP policy to influence inbound and outbound traffic. Without careful design, failover may be slow or asymmetric.

The physical access method connecting a site to a provider, such as fiber, copper, cable, or fixed wireless. Availability, latency, and cost vary by location, so design must verify what is actually serviceable at each site before committing to a topology.

A data center topology where every leaf switch connects to every spine switch, and servers attach only to leaves. Traffic between servers crosses a predictable number of hops, which supports even load distribution and easy scaling by adding leaves or spines.

Traffic between servers inside the data center, such as application tiers, storage, and replication flows. It usually dominates volume in modern designs, which is why flat, high-bandwidth topologies and distributed security controls are preferred over funneling through a central appliance.

An encapsulation that carries Layer 2 frames over an IP network using a 24-bit segment identifier. It lets large numbers of isolated segments span a routed underlay, removing the scaling limits of traditional VLANs across many sites.

A logical network built on top of an existing physical or routed underlay, using tunnels to create connectivity independent of the underlying topology. Overlays enable mobility and segmentation but require attention to MTU, underlay stability, and troubleshooting visibility.

The physical and routed foundation that carries overlay tunnels in a data center. It is typically a simple, stable Layer 3 fabric with predictable equal-cost paths. Underlay failures surface as overlay outages, so it should be designed and monitored for simplicity.

Running many virtual machines per physical host multiplies MAC addresses, flows, and bandwidth per switch port. Design must account for uplink oversubscription, virtual switching behavior, and address table scale. It changes port density and traffic assumptions compared with physical servers.

Planning dedicated or converged connectivity for block and file storage, with attention to latency, loss sensitivity, and path redundancy. Separate storage fabrics isolate traffic from user data, while converged designs reduce cabling but demand strict QoS and buffer planning.

Grouping interfaces into security zones and writing policy between zones rather than between individual interfaces. It keeps rule sets small and auditable as the network grows. Clear zone naming and documented intent are essential for long-term maintainability.

Dividing a network into isolated parts so that a compromise or fault in one part cannot freely reach others. It is implemented with VLANs, VRFs, firewalls, or overlays, and is most effective when policy between segments is explicit and tested.

Applying security policy to individual workloads or small groups rather than to broad network zones. It limits lateral movement inside a data center, but depends on accurate workload identity and consistent policy enforcement across hypervisors and bare-metal hosts.

Permitting only the traffic and access that a documented business need requires, denying the rest. In network design this means explicit rules with narrow sources, destinations, and ports, plus periodic review. It reduces attack surface but demands accurate application flow data.

A network segment holding services reachable from the internet while separated from internal systems. Design places public-facing servers there, allows inbound traffic only to published ports, and restricts outbound flows from the DMZ into the internal network.

Network access control authenticates and authorizes devices before or as they connect, then places them into an appropriate segment. It enforces policy for unknown or noncompliant endpoints. Success depends on accurate device inventory and a well-defined quarantine path.

A security model that grants access based on verified identity and device posture for each request, rather than trusting a location inside the perimeter. Network design must support strong authentication, granular policy, and logging wherever resources live.

Two firewalls or routers configured so one actively forwards while the other monitors and takes over on failure. Design must define failure detection, session state synchronization, and which interfaces are monitored, or failover may be slow or cause outages.