Software-Defined Networking
SDN is a network architecture that separates the control plane (brains) from the data plane (traffic forwarding). Instead of configuring each router or switch manually, you manage the entire network centrally through software (a controller).
SDN Architecture | Plane | Also Known As | "What It Does" | Simple Analogy | Real-World Examples | |------|---------------|----------------|----------------|---------------------| | Data Plane | Forwarding Plane / Infrastructure Layer | The "Muscle" or "Assembly Line". It's responsible for the actual movement of user data from one interface to another. It does the heavy lifting based on rules given by the control plane. | The postal workers who physically sort and deliver mail based on the established routes. | • Forwarding a frame from port 1 to port 2 on a switch• Encrypting data• Performing Network Address Translation (NAT) on a packet | | Control Plane | Control Layer | The "Brain" or "Traffic Control Center". It makes decisions about how data should be forwarded. It builds the maps and rules that the data plane follows. | The route planners who design the delivery routes, update maps for road closures, and tell the postal workers where to go. | • Building routing tables (OSPF, BGP)• Maintaining MAC address tables• Running the Spanning Tree Protocol (STP) | | Management Plane | Application Layer | The "Administrative Office". This is how humans interact with the device to configure, monitor, and manage it. It does not handle user data traffic. | The manager's office where you go to set policies, check delivery stats, or complain about service. You're not there to deliver mail yourself. | • SSHing into a switch• Using a web interface (GUI)• Using SNMP to monitor performance |
Software-Defined Wide Area Network (SD-WAN)
SD-WAN applies SDN concepts to WAN connections (e.g., connecting branch offices, data centers, and cloud). SD-WAN dynamically uses multiple connection types (fiber, LTE, broadband, etc.) and automatically chooses the best path for traffic.
SD-WAN Features
Application Aware:
The network identifies and prioritizes traffic based on the type of application, not just IP or port. EG Zoom call gets priority over YouTube streaming.
Zero-Touch Provisioning (ZTP):
Devices automatically configure themselves without manual setup when first powered on. When connected, the device contacts the SDN controller → downloads configuration → joins the network automatically.
Transport Agnostic:
SD-WAN doesn't care what type of connection is used underneath — it can use any transport method.
Central Policy Management:
Admins create and enforce network-wide policies (security, routing, QoS) from one dashboard instead of configuring each device.
Data Center Interconnection: The Problem & Solution
The Problem: Disconnected Data Centers
Modern applications are distributed across multiple data centers (on-premise and cloud), but this creates challenges:
- Different IP Schemes: Each data center might use its own, conflicting IP address ranges.
- Different Connectivity: Data centers have varying connection types (fiber, metro Ethernet) and bandwidth.
- Application Ignorance: Applications should run anywhere without being rewritten to account for network differences.
- VLAN Limitations: Traditional VLANs can't solve this because they are limited to ~4,000 networks and are confined to Layer 2, making them non-routable over the internet.
The Solution: Virtual Extensible LAN (VXLAN)
VXLAN is a "Layer 2 over Layer 3" tunneling protocol that creates a virtual network overlay on top of a physical underlay network.
Key Benefits of VXLAN:
- Massive Scale: Supports up to 16 million virtual networks (compared to VLAN's 4,000).
- Layer 3 Transport: Uses the existing IP network (including the public internet) as its transport, making it ideal for connecting geographically separate data centers.
- Abstraction: Completely abstracts the virtual network from the underlying physical network. Applications don't need to know about IP schemes or connectivity types.
SASE (Secure Access Service Edge)
SASE (pronounced "sassy") is a cloud-based network and security framework that combines network connectivity + security services into one unified cloud-delivered service.
It brings security closer to the user, device, and application — no matter where they are.
Instead of routing all traffic through your on-prem firewall, you apply security policies directly from the cloud edge, near the user.
Core Components of SASE | Category | Examples / Functions | | ----------------------------------------- | -------------------------------------------------------- | | Networking (SD-WAN) | Connects branch offices, cloud, and users efficiently | | Cloud Security | Centralized, scalable, cloud-hosted security | | Zero Trust Network Access (ZTNA) | Enforces identity-based access to apps | | CASB (Cloud Access Security Broker) | Monitors and controls cloud app usage | | SWG (Secure Web Gateway) | Filters and blocks malicious web traffic | | FWaaS (Firewall as a Service) | Cloud-based firewall protection across users |
(Security Service Edge)
SSE is the security half of SASE — it focuses only on cloud-delivered security (no networking component like SD-WAN). So while SASE = networking + security, SSE = security only — designed for organizations that already have strong networking infrastructure.
IPv6 Address Types
| Type | Prefix | Purpose | | ------------------------ | ---------- | ---------------------------------------- | | Global Unicast | 2000::/3 | Public, Internet-routable | | Link-Local | fe80::/10 | Local network only, like APIPA in IPv4 | | Unique Local (ULA) | fc00::/7 | Private internal networks | | Multicast | ff00::/8 | One-to-many communications | | Loopback | ::1 | Localhost (like 127.0.0.1) | | Unspecified | :: | No IP assigned (placeholder) |
IPv4 ↔ IPv6 Compatibility Mechanisms
Dual Stack: Devices and routers run both IPv4 and IPv6 simultaneously. They can communicate using either protocol depending on what the other side supports.
Tunneling: Encapsulate IPv6 packets inside IPv4 packets to travel across IPv4 networks. Used when part of the network doesn't yet support IPv6 natively.
NAT64: Network Address Translation 64 — allows IPv6-only clients to communicate with IPv4-only servers.