Core: Network Virtualization
In one line Source routing where the path is encoded as a stack of segments (SIDs) - removing per-LSP LDP/RSVP state from the core. Two data planes * SR-MPLS - SIDs are MPLS labels (reuses the MPLS data plane). * SRv6 - SIDs are IPv6 addresses; "network programming" carries both
Core: Network Virtualization
In one line Multi-tenant VPNs over a shared MPLS core - L3VPN (routed, per-VRF) and L2VPN (Ethernet / pseudowire). L3VPN * VRFs on each PE isolate customer routing tables. * RD (route distinguisher) makes overlapping prefixes unique; RT (route target) is the import/export policy that controls which VRFs see which routes
Core: Network Virtualization
In one line Decouple the logical network from the physical underlay via encapsulation (VXLAN / MPLS / GRE) plus a control plane (EVPN / LISP / flood-and-learn). Encapsulation + control-plane options OverlayData planeControl planeTypical use VXLAN flood-and-learnVXLAN (MAC-in-UDP)multicast / ingress-replication learninglegacy / simple VXLAN + BGP EVPNVXLANMP-BGP EVPNmodern
Core: Network Virtualization
Requirement / business driver Pick the site-to-site / WAN overlay that meets the customer's needs for encryption, scale, dynamic connectivity, multicast/routing, and transport (private vs internet). Constraints * Encryption mandated? Transport = internet or private MPLS/L2? * Spoke count and need for dynamic spoke-to-spoke mesh? * Must the
Core: Network Virtualization
Requirement / business driver Isolate tenants / security zones / traffic at the right plane and scale - from basic L2 separation to scalable identity-based microsegmentation. Options * VLAN - L2 broadcast-domain separation. * PVLAN - sub-segmentation inside a VLAN (isolated/community ports). * VRF-Lite - L3 routing-table separation, configured per hop. * SGT / TrustSec - policy/
Core: Network Virtualization
Requirement / business driver A transport-independent, app-aware, centrally-managed, secure WAN - decoupling policy from the underlying circuits. The four planes * Orchestration - zero-touch onboarding and certificate/trust bring-up. * Management - central controller for config, monitoring, policy. * Control - distributes routes and policy to edges (an OMP-style overlay control plane)
Core: Network Virtualization
Requirement / business driver Choose the enterprise WAN architecture that balances SLA, cost, agility, app-awareness, and security. Options * MPLS L3VPN - SP-managed private any-to-any with strong SLA. * DMVPN over internet (DIY) - cheap encrypted overlay you build/operate. * SD-WAN - transport-independent, app-aware, centrally managed (often hybrid MPLS
Core: Network Virtualization
Requirement / business driver Protect latency/jitter/loss-sensitive applications (voice, video, storage, trading) across constrained links, reconciling application requirements with infrastructure limits. Models * Best-effort - no guarantees. * IntServ (RSVP) - per-flow reservations; doesn't scale. * DiffServ - per-hop behaviors (PHB) keyed on DSCP classes; the scalable standard. Strategy Classify
Core: Network Virtualization
Requirement / business driver Configure, monitor, and assure the network with tooling that scales and feeds automation/observability. Options TraditionalModel-driven ExamplesSNMP, SYSLOG, CLINETCONF / RESTCONF (YANG), gNMI, streaming telemetry ModelMIBs / unstructuredYANG structured data models Transportpull (polling)push (subscriptions), sub-second Scale / granularitylimitedhigh, programmable Fitlegacy, coexistencenew designs, automation, AIOps Within the gRPC
Core: Network Virtualization
In one line The frameworks that structure operations and architecture - FCAPS, ITIL, TOGAF, DevOps - plus how to migrate a design safely. Reference models * FCAPS - Fault, Configuration, Accounting, Performance, Security: the network-management functional model. * ITIL - IT service management (incident/change/problem). * TOGAF - enterprise architecture framework. * DevOps / NetDevOps - CI/CD, Infrastructure
Core: Security
In one line Security is a design constraint applied in layers, not a bolt-on - every design choice is weighed against confidentiality, integrity, and availability (CIA). The frame * CIA triad - the lens for every requirement: keep data secret (C), unaltered (I), and reachable (A). They trade off (e.g., inline
Core: Security
Requirement / business driver Protect the devices and the three planes themselves so the network can't be subverted or DoS'd through its own infrastructure. Per-plane protection * Control plane - CoPP / CPPr rate-limit traffic punted to the CPU (routing, ARP, management) so a flood can't