Networks Plus Stuff

NAS

Network Attached Storage

File-level storage; shared folders

SAN

Storage Area Network

High speed network; block level storage; looks like locally attached disks

VPC

Virtual Private Cloud; Isolated spot in public cloud where you control IP, subnets, routing

Network Security Groups

Allow or deny traffic from cloud resources; stateful, applied to individual resources/interfaces

Network Security List

Subnet level traffic rules for both inbound and outbound

Multitenancy

Multiple customers have same underlying infrastructure (cloud)

GRE

Generic Routing Encapsulation

Tunnels one protocol inside another to carry traffic

Does not provide encryption by itself

IPSec

Protocols that protects IP traffic

Uses authentication, integrity checks, and optionally encryption

AH

Auth Header

Packet auth but no encryption

Helps protect against replay attacks

ESP

Encapsulating Security Payload

Provides encryption and auth, integrity, and replay protection. This is used in VPNs

IKE

Establishes keys and security settings for IPSec

802.11a

5GHz, faster than b

802.11b

2.4GHz

802.11g

2.4 GHz; better than b

802.11n

Wifi 4; Both 2.4 and 5; 600 Mbps

802.11ac

Wifi 5; 5 GHz; 6.9 Gbps

802.11ax

Wifi6; 2.4Ghz, 5Ghz, 6Ghz; 9.6Gbps

802.3

Wired Ethernet Networks

Spine and Leaf

Data Center Topology

Every leaf switch connects to every spine switch

Three tiered hierarchical model

Core

Distribution

Access Layers

Core layer

Backbone that transports traffic between distribution layers

Distribution Layer

Connects access layers

Handles routing, policies, and traffic filtering

Access Layer

Connects end devices to the network

Collapsed core

Combines core and distribution layers; smaller networks

VXLAN

Encapsulates Layer 2 Ethernet Frames inside Layer 3 UDP packets

Extends layer 2 networks

DCI

Data Center Interconnect

Connects separate data centers so they can share resources, replicate data, redundancy

Layer 2 Encapsulation

Wrap layer 2 frames inside another protocol for stuff like VXLAN

SASE

Combines networking and security services

Delivered through cloud

SD-WAN

Secure web gateways

ZTA

SSE

Security Service Edge

Security part of SASE

Playbook

Defined sequence of automated steps for completing a task or responding to an event

Template

Reusable configuration or blueprint for deploying systems consistently

BGP

Between AS; Protocol of the Internet

EIGRP

Distance Vector Protocol

Selects routes using metrics like bandwidth and delay

OSPF

Link-state routing calculates shortest paths using cost (usually based on bandwidth)

Dijkstra’s

Link state

Routers all build map of network and calculate the shortest path

Distance vector

Routers share info with neighbors and choose routes based on distance and direction

AD

Trustworthiness of a route source

Lower value better

Prefix length

Determines how specifically a route matches a destination IP; longest prefix WINS

Metric

Cost value when comparing routes

PAT

Multiple private devices to share one public IP by tracking connections using port numbers

AKA NAT overload

FHRP

First Hop Redundancy Protocol

Redundant default gateway using multiple routers and a shared virtual gateway address

VIP

Virtual IP

Address shared by a logical service rather than one physical interface

Used for redundant gateways or load balancers

Subinterface

Logical interface within physical interface, used to route traffic for multiple VLANs over one trunk connection

MTU

Maximum Transmission Unit

VLAN database

Stores VLAN IDs and associated information configured on a switch

SVI

Switch Virtual Interface

Logical Layer 3 interface for a VLAN

Used for management or routing between VLANs on a multilayer switch

What domains do VLANs separate

Broadcast

What do trunks do

Carry multiple VLANs

What do SVIs do

Management or inter-VLAN routing

Multilayer switch

Operating at Layer 2 and 3

Switching Ethernet Frames and routing IP packets without a separate router

802.1Q

Frame tagging; multiple VLANs to share Ethernet link

Native VLAN

Carries untagged traffic on 802.1Q trunk by default

Channel

Portion of wireless frequency

Channel width

Amount that a Wifi Channel occupies; wider ones provider more throughput

Non overlapping channels of 2.4Ghz

1, 6, 11

802.11h

Regulating 5GHz usage

Dynamic Frequency Selection

Transmit Power Control

2.4 GHz vs 5 GHz

5 has shorter range but higher throughput

SSID

Network Name

BSSID

Basic Service Set Identifier

Points to a specific AP using MAC address

ESSID

Extended Service Set Identifier

Shared SSID among multiple APs

Ad hoc

No need for an AP

WPA2

AES with CCMP

WPA3

Newer, uses password auth through SAE

PSK Auth

Devices use a shared password

Enterprise auth

Uses an auth server

Typically RADIUS with 802.1X/EAP so you can authenticate users or devices individually

Autonomous AP vs Lightweight AP

Auto - Managed individually

Lightweight - WLF (Wireless LAN controller) managed

IPAM

IP address management

Tools and processes used to track, allocate, and manage IP addresses, subnets, and DHCP/DNS information

Layer 1 diagram

Physical devices, cables, ports, connections

Layer 2 Diagram

Switches, VLANs, trunks, Layer 2 connectivity

Layer 3 diagram

Shows routers, IP subnets, gateways, and routing paths

SNMP

Collects info like interface status, bandwidth, and errors

Ports:

Polling: 161

Traps: 162

SNMP trap

Unsolicited alert sent by device to a monitoring system when a specific event occurs

MIB

Management Information Base

Structured collection of managed devices that SNMP is gonna query

SNMP v2c

Supports monitoring with community strings but does not encrypt SNMP messages

Community String

Shared text value used by SNMP v1/v2c to control access

Like a password but it is NOT encrypted

SNMP v3

Adds auth and encryption options; more secure

Port mirroring

Copies network traffic from selected switch ports or VLANs to a monitoring port for packet analysis

Ad hoc discovery

Runs manually or on demand to ID devices in that moment

Scheduled discovery

Runs automatically at intervals to keep the network inventory current

Active-Active

Multiple systems operate simultaneously to share workload

Active-Passive

One system actively handles workloads and there is a standby system if the active one fails

DHCP Reservation

Always assign an IP to a particular device, usually by MAC address

DHCP scope

IP address range it can lease

DHCP options

Default gateway, DNS server, domain name

DHCP relay

Forwards requests between subnets when the DHCP server is on a different network

DHCP exclusion

Must not dynamically assign

SLAAC

IPv6 Stateless address auto config

Devices make their own IPv6 using router advertisements without a DHCP server

DNSSEC

Digital signature to DNS records to verify integrity

Does NOT encrypt DNS queries

DoH

Encrypts using HTTPS

DoT

Encrypts DNS queries using TLS, on a port separate from other traffic (853)

A

Hostname → IPv4

AAAA

Hostname → IPv6

CNAME

Alias points to another hostname

MX

Mail servers responsible for receiving email for a domain

TXT

Test information; used for domain verification and email security policies

NS

Name servers responsible for a DNS zone

PTR

IP → Hostname

Reverse lookup

Forward lookup zone

Hostnames → IP Addresses

Reverse lookup zone

IP → hostname

Uses PTR records

Authoritative DNS server

Provides definitive answers from its own DNS zone records