Cisco CCNA Preparation · lesson 31 of 36 · 25 min
Traditional vs Controller-Based Networking
In traditional networking, each device independently runs the control plane (routing/switching decisions) and data plane (forwarding packets). Configuration is done device-by-device via CLI — slow, error-prone, and hard to scale.
In controller-based (SDN) networking, the control plane is centralized in a software controller. The controller has a global view of the network and pushes forwarding rules to devices. Devices become simpler forwarding engines.
Key SDN concepts:
Data Plane (Forwarding Plane) — forwards packets based on rules. Runs on the device hardware (ASICs).
Control Plane — makes forwarding decisions (routing protocols, STP, ARP). In SDN, moved to the controller.
Management Plane — device management (SSH, SNMP, NETCONF). Separate from control/data.
SDN Architecture — Overlay, Underlay, Fabric
Underlay — the physical network infrastructure (routers, switches, cables). Provides IP connectivity between all nodes.
Overlay — a virtual network built on top of the underlay using tunneling (VXLAN, GRE). Provides logical segmentation independent of physical topology.
Fabric — the combination of underlay + overlay + controller. Cisco SD-Access and SD-WAN are fabric solutions.
Northbound API — interface between the SDN controller and applications/orchestration systems (REST API). Applications use this to program the network.
Southbound API — interface between the controller and network devices (OpenFlow, NETCONF, RESTCONF, gRPC). Controller uses this to push configuration.
Cisco DNA Center
Cisco DNA Center is the controller for Cisco SD-Access. It provides a northbound REST API for automation and uses NETCONF/RESTCONF southbound to configure Catalyst switches. Key benefit: intent-based networking — describe what you want, the controller figures out how.
AI and Machine Learning in Network Operations
The CCNA exam includes awareness of AI/ML in networking:
Anomaly detection — ML baselines normal traffic patterns and alerts on deviations (potential attacks, failures).
Predictive analytics — forecast capacity needs, predict failures before they occur.
Automated remediation — controller automatically responds to detected issues (reroute traffic, quarantine infected host).
Cisco DNA Center uses AI/ML for encrypted traffic analysis (ETA) — detecting malware in encrypted flows without decrypting them.
Key Terms
Key Terms
Knowledge Check — 12 Questions
Automation — SDN & Controller-Based Networking
In SDN, which plane is centralized in the controller?
- Data plane
- Control plane
- Management plane
- Forwarding plane
Answer: Control plane
SDN centralizes the control plane (routing/switching decisions) in a software controller, leaving the data plane on devices.
The northbound API on an SDN controller is used by:
- Network devices to receive configuration
- Applications and orchestration systems to program the network
- End users to browse the internet
- Routers to exchange routing updates
- Answer: Applications and orchestration systems to program the network
Northbound APIs (typically REST) allow applications and automation tools to interact with the controller.
Which protocol is a southbound API used by SDN controllers to configure devices?
- REST
- SNMP v2c
- NETCONF
- Telnet
Answer: NETCONF
NETCONF is a southbound API that controllers use to push structured configuration to network devices.
An overlay network is:
- The physical cables and switches
- A virtual network built on top of the physical underlay using tunneling
- The management network
- A backup routing path
- Answer: A virtual network built on top of the physical underlay using tunneling
Overlay networks (using VXLAN, GRE, etc.) provide logical segmentation independent of the physical topology.
In traditional networking, each device independently runs its own control plane.
- True
- False
Answer: True
Traditional devices run distributed control planes — each router/switch makes its own forwarding decisions independently.
Cisco DNA Center is the controller for which Cisco solution?
- SD-WAN
- SD-Access
- ACI
- NSO
Answer: SD-Access
Cisco DNA Center is the management and controller platform for Cisco SD-Access (campus fabric).
The data plane is responsible for:
- Making routing decisions
- Forwarding packets based on existing rules
- Managing device configuration
- Exchanging routing protocol updates
- Answer: Forwarding packets based on existing rules
The data plane (forwarding plane) forwards packets using the FIB/CAM table populated by the control plane.
Which AI/ML capability allows detecting malware in encrypted traffic without decryption?
- Deep packet inspection
- Encrypted Traffic Analytics (ETA)
- WRED
- NetFlow
Answer: Encrypted Traffic Analytics (ETA)
Cisco ETA uses ML to analyze metadata and flow patterns to detect malware signatures in encrypted flows.
The combination of underlay + overlay + controller is called a network _____.
Answer: fabric
A network fabric combines the physical underlay, virtual overlay, and SDN controller into an integrated solution.
Intent-based networking means:
- Manually configuring each device
- Describing desired outcomes and letting the controller configure devices
- Using only open-source protocols
- Replacing all hardware with virtual machines
- Answer: Describing desired outcomes and letting the controller configure devices
Intent-based networking abstracts configuration — administrators express what they want; the controller determines how.
Which southbound protocol uses XML-encoded data over SSH to configure devices?
- REST
- NETCONF
- RESTCONF
- OpenFlow
Answer: NETCONF
NETCONF uses XML-encoded RPCs over SSH (port 830) to configure and retrieve device state.
The management plane handles:
- Packet forwarding
- Routing protocol updates
- Device configuration and monitoring (SSH, SNMP)
- VLAN tagging
- Answer: Device configuration and monitoring (SSH, SNMP)
The management plane handles out-of-band management traffic — SSH sessions, SNMP polling, syslog.
Previous lesson: Device hardening: disable unused services, secure passwords, AAA, login banners
Back to Cisco CCNA Preparation
Next lesson: GRE tunnels, DMVPN overview, SSL/TLS VPN concepts