Week 5: The network of tomorrow (and IPv6)

Why IPv6: mitigating address exhaustion

IPv4 has about 4.3 billion addresses and the free pools ran out years ago. NAT and private addressing stretched IPv4, but they add complexity and break some apps. IPv6 is the real fix for address exhaustion: 128-bit addresses (2^128, about 3.4 x 10^38), enough for every device to have a globally unique address. A standard IPv6 subnet is a /64, which alone holds 2^64 addresses.

Exam tip IPv6 also removes broadcast (uses multicast), uses Neighbor Discovery in place of ARP, and supports SLAAC so hosts can configure themselves.

Reading and shortening IPv6

An IPv6 address is 8 groups (hextets) of 4 hex digits separated by colons. Two rules to shorten it: (1) drop leading zeros in any group; (2) replace one run of consecutive all-zero groups with ::. You may use :: only once, or the address becomes ambiguous.

Full:
2001:0db8:0000:0000:0000:ff00:0042:8329
Rule 1 (drop leading zeros):
2001:db8:0:0:0:ff00:42:8329
Rule 2 (one zero run -> ::):
2001:db8::ff00:42:8329

Invalid: 2001::25::1  (:: used twice)

Exam tip Trap: you can drop LEADING zeros only. 0db8 becomes db8, but ff00 stays ff00.

Software-defined networking (SDN)

Network devices have planes: the data (forwarding) plane moves packets, the control plane decides where they go (routing tables, STP), and the management plane is how admins configure them (SSH, SNMP, APIs). SDN separates the control plane from the hardware and centralizes it in a controller. Apps talk to the controller through northbound APIs; the controller programs switches through southbound APIs. One place to change the whole network.

Exam tip Planes: data = forward, control = decide, management = configure. SDN = central control plane.

SD-WAN

SD-WAN applies SDN ideas to the wide area network. Each store gets an SD-WAN edge box that uses several links at once and a central controller decides the path. Four features to know; the first two:

• Application aware: it identifies apps (VoIP, POS, video) and steers each one to the best link based on latency, jitter and loss.
• Zero-touch provisioning: ship the box to the store, plug it in, it calls home and downloads its config. No engineer on site.

SD-WAN: transport and policy

The other two SD-WAN features:

• Transport agnostic: it does not care if the link is MPLS, cable broadband, fiber or LTE/5G.
• Central policy management: one console sets routing and security policy for every site at once.

Exam tip Opening 20 stores with no IT staff on site? Zero-touch provisioning. Voice moves to the cleaner link automatically? Application aware.

VXLAN

VXLAN (Virtual Extensible LAN) stretches Layer 2 segments across a Layer 3 network. It is Layer 2 encapsulation: original Ethernet frames are wrapped in UDP/IP (UDP port 4789) by VTEPs (tunnel endpoints) and routed anywhere. Its 24-bit VNI allows about 16 million segments versus 4,094 VLANs. Big uses: multi-tenant clouds and data center interconnect (DCI), so a VM can move between data centers and keep its IP.

Exam tip Need more than 4,094 segments, or the same Layer 2 network in two data centers over a routed link? VXLAN.

Zero trust architecture (ZTA)

Old model: inside the firewall = trusted. Zero trust (ZTA): never trust, always verify, no matter where the request comes from. Three ideas on the exam: policy-based authentication (identity plus context: device health, location, time, MFA, checked continuously), authorization for each request to each resource, and least privilege access (only the access the job needs, often with microsegmentation).

Exam tip Trap: zero trust does not mean "trust nothing so block everything". It means verify every request explicitly and grant the minimum.

IaC and automation

With infrastructure as code (IaC) you describe network and cloud config in text files and let tools apply it, so every build is repeatable. Automation pieces on the exam: playbooks (ordered steps to run, e.g. "configure a new store switch"), templates (a config with variables like VLAN or hostname) and reusable tasks (small blocks such as "set NTP" used by many playbooks).

# store-switch.yml (simplified)
- hosts: store_switches
  tasks:
    # reusable task
    - include: tasks/ntp.yml
    # template + vars
    - template: vlans.j2
      vars: {voice_vlan: 50, data_vlan: 20}

Exam tip IaC goal: the same input produces the same config every time, with no hand typing.

Drift, compliance, upgrades, dynamic inventories

Configuration drift happens when someone makes a manual change and a device no longer matches its approved baseline. IaC tools compare live config to the code, report drift and push it back into compliance. Upgrades: firmware rolled out to devices in automated, staged batches. Dynamic inventories build the target list live from a source (cloud API, IPAM, CMDB) in place of a hand-maintained static list, so new devices are included automatically.

Exam tip Exam: "device config no longer matches the standard after a manual change" = configuration drift.