Core: Security
In one line Security is a design constraint applied in layers, not a bolt-on - every design choice is weighed against confidentiality, integrity, and availability (CIA). The frame * CIA triad - the lens for every requirement: keep data secret (C), unaltered (I), and reachable (A). They trade off (e.g., inline
Core: Security
Requirement / business driver Protect the devices and the three planes themselves so the network can't be subverted or DoS'd through its own infrastructure. Per-plane protection * Control plane - CoPP / CPPr rate-limit traffic punted to the CPU (routing, ARP, management) so a flood can't
Core: Security
Requirement / business driver Authenticate and authorise both who administers the devices and what/who connects to the network, with an audit trail. TACACS+ vs RADIUS TACACS+RADIUS Primary useDevice administration (CLI)Network access (802.1X/MAB, VPN) TransportTCP 49UDP 1812/1813 EncryptionEntire payloadPassword only GranularityPer-command authorizationAuthorize at access (coarse)
Core: Security
Requirement / business driver Admit the right devices/users to the right segment with the right policy - dynamically, across wired and wireless, at scale. The pieces * NAC (e.g., Cisco ISE) ties 802.1X/MAB (AAA and identity - RADIUS, TACACS+, 802.1X) to authorization results: dynamic VLAN, dACL, or SGT assignment
Core: Security
Requirement / business driver Close the access-edge attack surface - L2 is where untrusted hosts plug in, and most L2 attacks are cheap and local. The toolkit (apply at the access edge) * DHCP snooping - trust only legitimate DHCP servers; builds the binding table the next two tools use. * Dynamic ARP Inspection
Core: Security
Requirement / business driver Encrypt data in transit on links/paths you don't fully trust (campus uplinks, DCI, WAN, leased fibre) - choosing the right layer to encrypt at. MACsec vs IPsec MACsec (802.1AE)IPsec LayerL2, hop-by-hopL3, across routed paths EncryptsEthernet frames on a linkIP packets end-
Core: Security
Requirement / business driver Enforce policy and inspect traffic at boundaries (internet edge, DC, inter-zone) with the right mode, features, and placement. Firewall deployment options Routed vs transparent is the data-path mode (becomes a gateway, or inserts at L2 without re-IP); virtual (multi-context) and clustered/HA are
Core: Security
Requirement / business driver Detect abuse and mitigate it without taking the service down with it - especially volumetric DDoS and spoofing. Threats and counters * DDoS (volumetric / protocol / application): mitigate with scrubbing (on-prem or cloud), RTBH (remote-triggered black hole via BGP), BGP Flowspec (granular drop/rate-limit rules), upstream rate-
Core: Security
Requirement / business driver Move from "trust the inside, guard the perimeter" to never trust, always verify - because the perimeter has dissolved (cloud, remote work, lateral movement). Principles Never trust / always verify, least privilege, assume breach, identity-centric access, and microsegmentation so a compromise can't move laterally.