I85PREP
⌘ K
JNCIP-DC study materials
JNCIP-DC study resources

JNCIP-DC: Data Center Security and Network Services

JNCIP-DC · Work through your exam, one topic at a time.

All guide sections

Data Center Security and Network Services

This domain tests control-plane protection, tenant isolation, Layer 2 hardening, and service insertion such as firewalls and NAT inside an EVPN fabric.

Control-plane protection

  • Apply a firewall filter to the loopback (set interfaces lo0 unit 0 family inet filter input protect-re) that permits BGP only from spine peer addresses, SSH only from management subnets, and ICMP, then discards everything else.
  • Use DDoS protection policers and routing-engine filters selectively; over-blocking BGP or BFD breaks the fabric faster than any attack.
  • Put management on a dedicated interface or VRF and enable only the specific services you need rather than all.

Tenant isolation

  • VRFs and route targets are the isolation boundary. Never leak route targets between tenants unless the design explicitly requires inter-tenant routing.
  • Private VLANs, port isolation, and no-local-switching block lateral traffic inside the same VLAN.

Layer 2 hardening

  • DHCP snooping, dynamic ARP inspection, MAC limiting, and port security restrict spoofing and flooding.
  • Storm control for broadcast, multicast, and unknown unicast protects the fabric from loops and misbehaving NICs.
  • Filter-based forwarding steers selected tenant traffic into a service VRF or firewall.

Worked example

Loopback filter terms, in order: term bgp allow source-address 10.0.0.0/31 protocol tcp destination-port bgp; term ssh allow source-address 192.0.2.0/24 protocol tcp destination-port ssh; term icmp allow protocol icmp; term else discard. Reasoning: underlay BGP peers use /31 addresses, so permitting only those subnets keeps BGP working while making the control plane unreachable from tenant VRFs.

Traps

  • Applying the filter under the wrong family or interface, so it silently does nothing.
  • Using destination-address where source-address was intended, blocking peers.
  • Locking yourself out with a filter change; always use commit confirmed and a rollback plan.