Network Architectures, Cloud and Virtualization

Exam topics covered

1.2 Describe characteristics of network topology architectures

1.2.a Two-tier 1.2.b Three-tier 1.2.c Spine-leaf 1.2.d WAN 1.2.e Small office/home office (SOHO) 1.2.f On-premises and cloud

1.12 Explain virtualization fundamentals (server virtualization, containers, and VRFs)

Foundation. This chapter steps back from individual protocols to the big picture: how campus networks are organised into tiers, how data centres use spine-leaf fabrics, how sites connect across a WAN, how small offices are built, and how much of the network now lives in the cloud. It finishes with virtualization: VMs and containers on servers, and VRFs that give one router several separate routing tables. These topics are conceptual on the exam, but you must recognise each architecture from a diagram and describe its strengths.

11.1 Campus Architectures: Two-Tier and Three-Tier

Cisco's hierarchical campus design divides the network into layers, each with a specific job, which makes it predictable, scalable and easier to troubleshoot.

Access layer – where end devices connect: PCs, phones, printers and wireless APs. Access switches provide PoE, VLAN assignment, port security, QoS marking and other edge features.

Distribution layer – aggregates many access switches. It is usually the Layer 2/Layer 3 boundary, providing inter-VLAN routing, first hop redundancy (HSRP), route summarization and policy (ACLs).

Core layer – the high-speed backbone that connects distribution blocks, the data centre and the WAN/Internet edge. Its job is to move packets as fast and reliably as possible, so it avoids CPU-heavy features.

11.1.1 Two-tier (collapsed core)

In a two-tier design, the core and distribution layers are combined into a single collapsed core (often a pair of Layer 3 switches). Every access switch has an uplink to each core/distribution switch, so the loss of any one uplink or one core switch does not isolate the access switch. Two-tier designs suit small and medium campuses, typically a single building, where a separate core would add cost without benefit.

• L3 L3
• Collapsed core /
• distribution Layer 3 switches, FHRP, routing

Access Access switches (Layer 2), each dual-homed to both collapsed-core switches

Figure 11-1 Two-tier campus: access switches connect to a redundant collapsed core/distribution pair.

11.1.2 Three-tier

As a campus grows to several buildings, connecting every distribution pair to every other would require a full mesh of links, which does not scale. A three-tier design adds a dedicated core layer: each building (a distribution block) connects to the core, and the core interconnects all blocks, the data centre and the WAN edge. Adding a building means adding one block with two uplinks, not re-cabling everything.

Figure 11-2 Three-tier campus: core (top), distribution blocks (middle), access (bottom).

Table 11-1 Two-tier versus three-tier campus design

Two-tier (collapsed core) Three-tier

Layers Access + combined core/distribution Access, distribution, core Typical

size

One building, small to medium campus Multiple buildings, large campus Cost Lower (fewer devices) Higher

• Scalability Limited: every new block needs links to the
• collapsed core
• High: new blocks attach only to
• the core

Exam alert

If a question describes a design in which access switches connect directly to a pair of switches that also provide the backbone, it is two-tier (collapsed core). If there is a separate layer whose only job is fast transport between distribution blocks, it is three-tier.

11.2 Data Centre Architecture: Spine-Leaf

Traditional three-tier designs were built for north-south traffic: clients talking to servers and the Internet. Modern data centres are dominated by east-west traffic: servers, VMs and containers talking to each other (web tier to application tier to database, storage replication, microservices). In a three-tier tree, east-west traffic may cross several layers, and spanning tree blocks redundant links. The spine-leaf design (a Clos fabric) solves both problems, and it is the basis of Cisco ACI.

Every leaf switch connects to every spine switch.

Spines never connect to other spines, and leaves never connect to other leaves. Servers, storage, firewalls and WAN routers connect only to leaves.

As a result, any server reaches any other server across exactly leaf – spine – leaf: the same number of hops and the same predictable latency, no matter where they are. Links are usually routed (Layer 3) and all are active with equal-cost multipath (ECMP), so there is no spanning tree blocking. To add server ports you add a leaf; to add bandwidth between leaves you add a spine.

• L3 L3
• L3 L3 L3 L3
• Spine
• Leaf

Wan

every leaf to every spine

Dashed path: any server to any other server = leaf – spine – leaf

Figure 11-3 Spine-leaf fabric: every leaf connects to every spine, so any two endpoints are always two hops apart.

11.3 Small Office/Home Office (SOHO)

A SOHO network serves a home or a small office with a handful of users. It usually relies on a single consumer-grade or small-business device, often called a wireless router, that combines many functions: a router with NAT/PAT and a DHCP server, a small Ethernet switch, a wireless access point, a basic firewall, and sometimes the DSL or cable modem itself. The Internet connection is typically broadband (DSL, cable or fibre) or cellular, and a VPN client or small VPN router connects remote workers back to the corporate network.

• All-in-one SOHO router
• router + NAT/PAT + DHCP + firewall
• + 4-port switch + Wi-Fi AP (+ modem)

Isp

Figure 11-4 A SOHO network built around one integrated device.

11.4 WAN Architectures

A wide area network connects sites that are geographically separated: branches to headquarters, offices to data centres, and everything to the Internet and cloud. Enterprises rarely own WAN cabling; instead they buy WAN services from service providers. WAN designs are described by their topology and by the connection type used.

11.4.1 WAN topologies

Point-to-point – a direct link between two sites.

Hub-and-spoke – every branch (spoke) connects to a central site (hub). Simple and cheap, but branch-to-branch traffic goes through the hub, and the hub is a critical point of failure.

Full mesh – every site connects to every other: optimal paths and high redundancy, but n(n−1)/2 links, so 10 sites need 45 links.

Partial mesh – important sites are meshed, others are hub-and-spoke: a compromise. Single-homed / dual-homed – a site with one connection to one provider versus two connections (to one provider, or to two providers for dual multihomed resilience). Point-to-point Hub-and-spoke

hub

Full mesh

Figure 11-5 Common WAN topologies.

11.4.2 WAN connection options

Table 11-2 summarises the WAN services you should recognise. Private WAN services (leased

line, MPLS, Metro Ethernet) offer predictable performance and SLAs at a higher price; Internet-based options are cheaper and everywhere but are best effort, so traffic must be protected with VPNs. Modern SD-WAN solutions combine several of these transports at each site and choose the best path per application (see Chapter 33).

Table 11-2 WAN connection options

• Option How it works Characteristics
• Leased line Dedicated point-to-point circuit (historically
• T1/E1 serial, today usually Ethernet)
• between two sites
• Private, fixed bandwidth, very
• reliable; expensive and point-to-point only

Mpls vpn

Figure 11-6 A dual-WAN branch: a private MPLS VPN as primary and an Internet VPN over broadband or 5G as backup.

11.5 On-Premises and Cloud

Traditionally, an organization bought servers, storage and network devices and installed them in its own data centre: on-premises (“on-prem”). It controls everything, but pays up front (capital expenditure), must plan capacity years in advance, and runs the facilities, power, cooling and staff itself. Cloud computing turns IT into a service that is consumed on demand and paid for as an operating expense. NIST (SP 800-145) defines five essential characteristics of cloud computing:

• 1. On-demand self-service – consumers provision resources themselves through a portal or API, without a human at the provider.
• 2. Broad network access – services are reachable over the network from many device types.
• 3. Resource pooling – the provider serves many customers (tenants) from shared physical resources.
• 4. Rapid elasticity – capacity scales up and down quickly, often automatically.
• 5. Measured service – usage is metered and billed (pay as you go).

11.5.1 Cloud service models

Service models differ in how much of the stack the provider manages, as Figure 11-7 shows. Infrastructure as a Service (IaaS) – the provider supplies virtual machines, storage and networks; you manage the OS, runtime and applications. Example: renting VMs in a public cloud, or deploying a virtual router such as Cisco Catalyst 8000V in a cloud VPC. Platform as a Service (PaaS) – the provider also manages the OS, middleware and runtime; you deploy your code and data. Examples: managed databases, application hosting platforms.

Software as a Service (SaaS) – the provider delivers a complete application; you just use it. Examples: Microsoft 365, Webex, Salesforce.

Figure 11-7 Division of responsibility in on-premises, IaaS, PaaS and SaaS.

11.5.2 Cloud deployment models

Table 11-3 Cloud deployment models

Model Description

Public cloud Owned and run by a provider (AWS, Microsoft Azure, Google Cloud) and shared by many customers over the Internet.

Private cloud Cloud characteristics (self-service, elasticity, metering) delivered for a single organization, on-premises or hosted.

Hybrid cloud A combination of private and public clouds with workloads and data moving between them.

Community

cloud

Shared by several organizations with common needs, such as government agencies.

Many organizations also use multicloud, services from more than one public provider. Connecting to a public cloud can be done over the Internet (simple, but best effort), an Internet VPN (encrypted), or a private WAN connection such as an MPLS VPN or a dedicated interconnect to the provider (for example AWS Direct Connect or Azure ExpressRoute) for predictable performance.

Exam alert

Match the service model to who manages what: IaaS = you manage the OS and up; PaaS = you manage only applications and data; SaaS = you just use the application. And remember that a private cloud is defined by its cloud characteristics, not by its location.

11.6 Server Virtualization

Physical servers running one application each sat mostly idle. Server virtualization uses a hypervisor to divide one physical host into many isolated virtual machines (VMs), each with virtual CPUs, memory, disks and NICs (vNICs) and its own operating system. Benefits include consolidation (less power, cooling and space), fast provisioning from templates, snapshots, and live migration of running VMs between hosts.

11.6.1 Type 1 and Type 2 hypervisors

A Type 1 (bare-metal) hypervisor runs directly on the server hardware. Examples are VMware ESXi, Microsoft Hyper-V and KVM. It is efficient and secure, and it is what data centres and clouds use. A Type 2 (hosted) hypervisor runs as an application on top of a normal operating system, such as Oracle VirtualBox or VMware Workstation on a laptop. It is convenient for labs and testing but adds overhead.

Figure 11-8 A Type 1 hypervisor runs directly on hardware; a Type 2 hypervisor runs on a host operating system.

11.6.2 Virtual switching

VMs on the same host still need to talk to each other and to the physical network. The hypervisor provides a virtual switch (vSwitch), a software Layer 2 switch inside the host. Each VM's vNIC connects to a vSwitch port, and the host's physical NICs act as the vSwitch's uplinks to the physical access (or leaf) switch. The vSwitch supports VLANs: each VM port is placed in a VLAN (a port group in VMware terminology), and the uplink to the physical switch is an 802.1Q trunk carrying all of the host's VLANs. Two VMs on the same host and VLAN communicate without their traffic ever leaving the server.

Physical host (Type 1 hypervisor)

Web VM

Vlan 10

App VM

Vlan 10

DB VM

Vlan 20

Mgmt VM

Vlan 30

Figure 11-9 VMs connect through vNICs to a virtual switch, which trunks their VLANs to the physical network.

11.6.3 Containers

A VM virtualizes the hardware, so every VM carries a full guest operating system: gigabytes of disk, its own boot process and its own patches. A container virtualizes the operating system instead. Containers share the host's OS kernel and package only the application and its libraries; a container engine such as Docker isolates their processes, files and network. They are small, start in seconds, suit microservices and run unchanged on a laptop, server or cloud. Large numbers are managed by an orchestrator such as Kubernetes. The trade-off is weaker isolation than VMs.

Figure 11-10 VMs each carry a guest OS; containers share the host OS kernel and package only the application.

Table 11-4 Virtual machines versus containers

Virtual machine Container

Virtualizes Hardware Operating system

Includes Full guest OS + application Application + libraries only Size / start

time

Gigabytes / minutes Megabytes / seconds

Isolation Strong (separate kernels) Process-level (shared kernel)

• Managed by Hypervisor (ESXi, Hyper-V,
• KVM)
• Container engine (Docker) and orchestrator
• (Kubernetes)

11.7 Network Virtualization with VRFs

Servers are not the only things that can be virtualized. Virtual Routing and Forwarding (VRF) divides one physical router or Layer 3 switch into several virtual routers. Each VRF has its own routing table, its own forwarding table (CEF) and its own set of interfaces. An interface (physical, subinterface or SVI) belongs to exactly one VRF; interfaces not assigned to any VRF stay in the global (default) routing table. Because the tables are independent: traffic in one VRF cannot reach another VRF unless you deliberately leak routes between them, giving Layer 3 separation similar to what VLANs give at Layer 2; different VRFs can use overlapping IP addresses, for example two customers that both use 10.1.1.0/24.

Service providers use VRFs on PE routers to keep MPLS VPN customers apart. Enterprises use VRF-lite (VRFs without MPLS) to separate guest, IoT, PCI or partner traffic across a shared campus or data centre, and to keep a separate management network.

R1 (one physical router)

Vrf custa

routing table A

10.1.1.0/24, 10.1.2.0/24

Vrf custb

Same 10.1.1.0/24 in both VRFs: no conflict, no communication between them

Figure 11-11 Two VRFs on one router keep separate routing tables and may reuse the same subnets.

11.7.1 Configuring and verifying VRF-lite

Configuration has two steps: create the VRF, then assign interfaces to it. Assigning an interface to a VRF removes its IP address, so configure the address after the vrf forwarding command. Newer IOS XE releases use vrf definition with an address family; the older ip vrf syntax shown in the comments is still accepted on many platforms.

R1(config)# vrf definition CUSTA ! older syntax: ip vrf CUSTA
R1(config-vrf)# address-family ipv4
R1(config-vrf-af)# exit-address-family
R1(config-vrf)# vrf definition CUSTB ! (same address-family lines)
R1(config-vrf)# interface GigabitEthernet0/1
R1(config-if)# vrf forwarding CUSTA ! older syntax: ip vrf forwarding CUSTA
R1(config-if)# ip address 10.1.1.1 255.255.255.0
R1(config-if)# interface GigabitEthernet0/2
R1(config-if)# vrf forwarding CUSTA
R1(config-if)# ip address 10.1.2.1 255.255.255.0
R1(config-if)# interface GigabitEthernet0/3
R1(config-if)# vrf forwarding CUSTB
R1(config-if)# ip address 10.1.1.1 255.255.255.0 ! same subnet as CUSTA: allowed
! ...and Gi0/4 in CUSTB with 10.1.4.1/24
R1# show vrf

• Name Default RD Protocols Interfaces
• CUSTA <not set> ipv4 Gi0/1
• Gi0/2
• CUSTB <not set> ipv4 Gi0/3
• Gi0/4

R1# show ip route vrf CUSTA

Routing Table: CUSTA

Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area (remaining code lines omitted)

• Gateway of last resort is not set
• 10.0.0.0/8 is variably subnetted, 4 subnets, 2 masks
• C 10.1.1.0/24 is directly connected, GigabitEthernet0/1
• L 10.1.1.1/32 is directly connected, GigabitEthernet0/1
• C 10.1.2.0/24 is directly connected, GigabitEthernet0/2
• L 10.1.2.1/32 is directly connected, GigabitEthernet0/2

R1# show ip route | include 10.1.
R1# (nothing: VRF routes are not in the global table)

Figure 11-12 Each VRF has its own routing table, and VRF routes do not appear in the global table. (Output is illustrative of Cisco IOS 15 / IOS XE.)

Commands that act on routing must name the VRF, or they use the global table: for example ping vrf CUSTA 10.1.2.10 , traceroute vrf CUSTA 10.1.2.10 and ip route vrf CUSTA 0.0.0.0 0.0.0.0 10.1.2.254 . A plain ping 10.1.2.10 from R1 would fail, because the global table has no route to 10.1.2.0/24.

Tip

If a ping from a router fails but hosts on that subnet work fine, check whether the interface is in a VRF. Forgetting the vrf keyword in ping, traceroute, static routes and show ip route is the most common VRF mistake.

Soho

hub-and-spoke

full mesh

Mpls vpn

• 1. Which design combines the core and distribution layers into one layer?

• A. Three-tier
• B. Two-tier (collapsed core)
• C. Spine-leaf
• D. Full mesh

• 2. In a spine-leaf architecture, which two statements are true? (Choose two.)

• A. Every leaf connects to every spine.
• B. Spines connect to each other in a full mesh.
• C. Servers connect to spine switches.
• D. Any two servers are separated by a consistent number of hops.
• E. Leaves connect directly to other leaves.

• 3. Which layer of a three-tier campus is usually the Layer 2/Layer 3 boundary and runs FHRPs?

• A. Access
• B. Distribution
• C. Core
• D. Edge

• 4. Spine-leaf designs were developed primarily to optimise which kind of traffic?

• A. North-south
• B. East-west
• C. Broadcast
• D. Multicast

• 5. Which WAN service lets enterprise routers see each other as if connected to one Ethernet switch across a city?

• A. Leased line
• B. Metro Ethernet E-LAN
• C. DSL
• D. Internet VPN

• 6. How many links does a full mesh of 6 sites require?

• A. 6
• B. 12
• C. 15
• D. 30

• 7. A company rents virtual machines from a provider and installs its own OS patches and applications. Which service model is this?

• A. IaaS
• B. PaaS
• C. SaaS
• D. On-premises

• 8. Which two are NIST essential characteristics of cloud computing? (Choose two.)

• A. On-demand self-service
• B. Dedicated hardware per customer
• C. Rapid elasticity
• D. Fixed annual capacity
• E. Mandatory Internet VPN

• 9. Which describes a Type 1 hypervisor?

• A. It runs as an application on Windows or macOS.
• B. It runs directly on the server hardware.
• C. It shares the host OS kernel with containers.
• D. It runs only inside a container.

• 10. What component connects VMs on a host to each other and to the physical network?

• A. Virtual switch
• B. Container engine
• C. Orchestrator
• D. Hypervisor console

• 11. Which two statements about containers are true? (Choose two.)

• A. Each container includes a full guest operating system.
• B. Containers share the host OS kernel.
• C. Containers typically start faster than VMs.
• D. Containers require a Type 2 hypervisor.
• E. Containers provide stronger isolation than VMs.

• 12. What happens when you enter vrf forwarding CUSTA on an interface that already has an IP address?

• A. The address is moved into the VRF automatically.
• B. The IP address is removed.
• C. The command is rejected.
• D. The interface is shut down.

• 13. Which command displays the routing table of VRF RED?

• A. show ip route RED
• B. show vrf RED route
• C. show ip route vrf RED
• D. show ip vrf route RED

Answers

• 1. B. A two-tier design collapses core and distribution into one pair of switches.
• 2. A, D. Each leaf connects to every spine; spines do not interconnect, servers attach to leaves, and every path is leaf-spine-leaf.
• 3. B. Distribution typically provides inter-VLAN routing, FHRP and policy.
• 4. B. Spine-leaf gives consistent, high-bandwidth server-to-server (east-west) paths.
• 5. B. E-LAN is a multipoint Metro Ethernet service that behaves like a single switch.
• 6. C. n(n−1)/2 = 6 × 5 / 2 = 15.
• 7. A. In IaaS the customer manages the OS and everything above it.
• 8. A, C. The five are on-demand self-service, broad network access, resource pooling, rapid elasticity and measured service.
• 9. B. Type 1 (bare metal) hypervisors such as ESXi run directly on hardware. A describes Type
• 10. A. The hypervisor's vSwitch connects vNICs and uses physical NICs as uplinks.
• 11. B, C. Containers share the kernel and are lightweight; VMs give stronger isolation.
• 12. B. IOS removes the IP address; you must re-enter it after assigning the VRF.
• 13. C. show ip route vrf RED .