Core: Security
Requirement / business driver Authenticate and authorise both who administers the devices and what/who connects to the network, with an audit trail. TACACS+ vs RADIUS TACACS+RADIUS Primary useDevice administration (CLI)Network access (802.1X/MAB, VPN) TransportTCP 49UDP 1812/1813 EncryptionEntire payloadPassword only GranularityPer-command authorizationAuthorize at access (coarse)
Core: Security
Requirement / business driver Admit the right devices/users to the right segment with the right policy - dynamically, across wired and wireless, at scale. The pieces * NAC (e.g., Cisco ISE) ties 802.1X/MAB (AAA and identity - RADIUS, TACACS+, 802.1X) to authorization results: dynamic VLAN, dACL, or SGT assignment
Core: Security
Requirement / business driver Close the access-edge attack surface - L2 is where untrusted hosts plug in, and most L2 attacks are cheap and local. The toolkit (apply at the access edge) * DHCP snooping - trust only legitimate DHCP servers; builds the binding table the next two tools use. * Dynamic ARP Inspection
Core: Security
Requirement / business driver Encrypt data in transit on links/paths you don't fully trust (campus uplinks, DCI, WAN, leased fibre) - choosing the right layer to encrypt at. MACsec vs IPsec MACsec (802.1AE)IPsec LayerL2, hop-by-hopL3, across routed paths EncryptsEthernet frames on a linkIP packets end-
Core: Security
Requirement / business driver Enforce policy and inspect traffic at boundaries (internet edge, DC, inter-zone) with the right mode, features, and placement. Firewall deployment options Routed vs transparent is the data-path mode (becomes a gateway, or inserts at L2 without re-IP); virtual (multi-context) and clustered/HA are
Core: Security
Requirement / business driver Detect abuse and mitigate it without taking the service down with it - especially volumetric DDoS and spoofing. Threats and counters * DDoS (volumetric / protocol / application): mitigate with scrubbing (on-prem or cloud), RTBH (remote-triggered black hole via BGP), BGP Flowspec (granular drop/rate-limit rules), upstream rate-
Core: Security
Requirement / business driver Move from "trust the inside, guard the perimeter" to never trust, always verify - because the perimeter has dissolved (cloud, remote work, lateral movement). Principles Never trust / always verify, least privilege, assume breach, identity-centric access, and microsegmentation so a compromise can't move laterally.
Core: Wireless
In one line Wi-Fi is a half-duplex shared medium - so the real design currency is airtime, not headline data rates. The physics that drive design * Bands: 2.4 GHz (range, few non-overlapping channels - 1/6/11, congested), 5 GHz (more channels, the workhorse), 6 GHz (Wi-Fi
Core: Wireless
Requirement / business driver Choose how APs are controlled and where client data flows - the decision that drives scale, the data path, and WAN behaviour. Options * Autonomous APs - standalone, per-AP config; only for a handful of APs. * Centralized controller (CAPWAP) - APs join an on-prem WLC; central switching tunnels client
Core: Wireless
Requirement / business driver Place WLCs and shape CAPWAP so the data path is efficient and wireless survives failures. Tunnel optimization (the trombone problem) With central switching, all client traffic is tunnelled to the WLC, then back out - even traffic destined locally hairpins/trombones through the controller, adding latency and load.
Core: Wireless
Requirement / business driver Let clients move between APs/controllers without dropping sessions - critical for voice/video and seamless mobility. L2 vs L3 roaming * L2 roaming - client moves between APs in the same subnet/VLAN; keeps its IP, simple. * L3 roaming - client moves to an AP/controller in a different subnet;
Core: Wireless
Requirement / business driver Design the RF so it meets the actual goal - coverage, capacity, voice, or location - which pull in different directions. Coverage vs capacity (the core tension) * Coverage design - fewer APs, larger cells, max range; fine for warehouses/low-density. * Capacity / high-density design - more APs, smaller cells, lower