Core: Layer 2 Control Plane
In one line Convergence starts at the wire: how fast a device detects a failure sets the floor for everything STP, aggregation, or routing can do above it. Down detection * Physical loss of signal / light - fastest; the interface goes down immediately. * Protocol keepalives - needed when the physical layer stays up
Core: Layer 2 Control Plane
Requirement / business driver Provide a loop-free active L2 topology with automatic recovery, while bounding the blast radius of L2 faults. The variants VariantNotes STP (802.1D)Original; slow (30-50 s). Legacy only. PVST+ / Rapid-PVST+Per-VLAN trees; RPVST+ is fast (RSTP per VLAN) - common Cisco default. RSTP
Core: Layer 2 Control Plane
Requirement / business driver Use all redundant links (not STP-blocked ones) and remove single points of failure, without creating loops. Options * LACP / EtherChannel - bundle parallel links between two devices into one logical link. * MLAG / vPC - two switches present a single LAG to a dual-homed device; both forward (dual-active)
Core: Layer 2 Control Plane
In one line Without snooping a switch floods multicast like broadcast to every port - snooping constrains it to only the ports that asked. The pieces * IGMP (IPv4: v2 ASM, v3 SSM) and MLD (IPv6: v1 ~ IGMPv2, v2 ~ IGMPv3) are how hosts signal group membership. * IGMP / MLD snooping lets the switch
Core: Layer 2 Control Plane
Requirement / business driver Bound the blast radius of L2 faults and make the access/distribution layer resilient - without the "redundancy" secretly being a single failure. The four levers (blueprint 2.5) * Fate sharing - the subtle one. Two uplinks down the same conduit, or a shared control plane (VSS/
Core: Layer 3 Control Plane
In one line Structured layering bounds failure domains, scales the control plane, and localizes policy - it is the foundation every other L3 decision sits on. Layers and their purpose * Access - host/edge connectivity and the policy edge (QoS marking, NAC, first-hop security). * Distribution - aggregation and the routing/policy boundary:
Core: Layer 3 Control Plane
In one line The addressing plan enables (or prevents) summarization, and PBR/NAT are deliberate exceptions to normal routing that carry real costs. Policy-based routing (PBR) Overrides destination-based forwarding by source, application, or markings. Use sparingly - it bypasses normal routing and TE, complicates troubleshooting, and can hide from
Core: Layer 3 Control Plane
The interior routing protocol choice. Usually decided by multivendor needs, scale, SR/TE direction, and operational familiarity - rarely by raw performance, since all three converge fast when tuned. Requirement / business driver A stable, scalable interior routing foundation that fits the customer's vendor mix, growth, and operations team - and
Core: Layer 3 Control Plane
Requirement / business driver Use BGP where the requirement is policy control, scale beyond an IGP, internet multihoming, or a DC/WAN fabric - not as a general interior protocol. Where BGP earns its place * Internet edge / multihoming - provider-independent policy and failover. * DC underlay - eBGP per-rack ASN (simple, scalable) and
Core: Layer 3 Control Plane
Requirement / business driver Shrink routing tables and bound how far a failure propagates, while not blackholing or badly de-optimizing traffic. Benefits Smaller RIB/FIB; fewer SPF/flooding events (topology hiding) so faster, more stable convergence; a single flap behind a summary doesn't ripple outward. Costs / risks * Suboptimal
Core: Layer 3 Control Plane
Requirement / business driver Exchange routes between protocols or domains (mergers, migrations, multi-protocol cores) without creating loops or suboptimal routing. The hazard Mutual redistribution at multiple points is the classic trap: a route redistributed from protocol A into B can be learned back into A as if external, creating a
Core: Layer 3 Control Plane
In one line Protect adjacency formation and route integrity so the control plane can't be spoofed, hijacked, or DoSed. Techniques (apply at every trust boundary) * Neighbor authentication - OSPF/IS-IS/EIGRP key-chains; BGP TCP-AO (legacy MD5). * Passive interfaces - never form adjacencies toward hosts/access edges. * Control-