Networking Concepts · Topic 11 of 11
Modern Network Use Cases
Summarize SDN, SD-WAN, VXLAN, zero trust architecture, SASE and SSE, and infrastructure as code with automation and orchestration in modern networks.
- 5 min
- SDN separates the control plane from the data plane and uses a central controller.
- SD-WAN steers traffic over multiple links by policy and supports zero touch provisioning.
- VXLAN carries Layer 2 frames over Layer 3 and is used for data center interconnect.
What it is
Modern networks lean on software for control, on encryption and identity for security, and on automation for scale. The exam names the technologies and asks what each is for.
You do not need to configure these. You need to know the problem each one solves and the key terms attached to it.
How it works
Software defined networking
Software defined networking (SDN) separates the control plane, which decides where traffic goes, from the data plane, which forwards it. A central controller holds the logic and programs the devices.
Applications talk to the controller through a northbound interface, and the controller talks to the devices through a southbound interface. The management plane is used to configure and monitor the system.
| Plane | Job |
|---|---|
| Application | Business apps that request network behavior |
| Control | Central logic that decides the paths |
| Infrastructure (data) | Devices that forward packets |
Software defined WAN
A software defined wide area network (SD-WAN) applies the SDN idea to the connections between sites. A central policy decides which link, such as broadband, cellular or Multiprotocol Label Switching (MPLS), each application uses.
Key features are application awareness (traffic is steered by application), transport independence (it works over any underlay), central policy management and zero touch provisioning (ZTP), where a new branch device configures itself when plugged in.
Virtual Extensible LAN
Virtual Extensible LAN (VXLAN) wraps Layer 2 frames inside User Datagram Protocol (UDP) packets so a Layer 2 network can stretch across a Layer 3 network. Its 24 bit network identifier allows about 16 million segments, far more than the 4094 usable virtual LAN (VLAN) IDs, and it is common in data centers and for data center interconnect (DCI).
Zero trust architecture
Zero trust architecture (ZTA) assumes no user or device is trusted just because it is inside the network. Every request is verified using identity, device health and context before access is granted.
Core ideas are policy based authentication, authorization with least privilege access, and checks that continue after login. Segmentation limits how far an attacker can move.
Secure edge services
Secure Access Service Edge (SASE) combines network and security functions in a cloud delivered service. Security Service Edge (SSE) is the security half of SASE, without the networking part.
Typical functions include secure web gateways, cloud access security, and zero trust network access, delivered close to users wherever they work.
| Term | Contains |
|---|---|
| SASE | Wide area networking plus security services from the cloud |
| SSE | Security services only, such as web filtering and zero trust access |
Infrastructure as code and automation
Infrastructure as code (IaC) describes devices and networks in files that tools apply automatically. Automation performs a task without manual steps. Orchestration coordinates many automated tasks into a workflow.
Reusable playbooks and templates make changes repeatable. Version control tracks who changed what, and a dynamic inventory keeps the list of devices up to date.
Source control applies version control to configuration files, with three ideas to know:
- Central repository: one shared store, such as a Git server, that holds the approved templates and configurations. Automation pulls from it, so it is the single source of truth.
- Branching: an engineer copies the code to a branch, tests a change there and merges it into the main branch only after review. This matches change management, because production stays untouched until the change is approved.
- Conflict identification: if two engineers edit the same lines of a configuration or template, the tool reports a merge conflict. A person must choose or combine the edits before the merge can finish.
Why they matter
These technologies support remote work, cloud growth and security needs. They give centralized control, consistent policy and faster change, at the cost of dependence on the controller and its security.
What to remember for the exam
- SDN separates the control plane from the data plane and uses a central controller.
- SD-WAN steers traffic over multiple links by policy and supports zero touch provisioning.
- VXLAN carries Layer 2 frames over Layer 3 and is used for data center interconnect.
- Zero trust means never trust by location. Verify each request and use least privilege.
- SASE combines wide area networking and security as a cloud service. SSE is the security portion only.
- IaC uses code and templates to build and change infrastructure consistently.
- Automation does one task. Orchestration coordinates many tasks.
- Application awareness, transport independence and central policy are SD-WAN selling points.
If a branch device must configure itself when it is plugged in, the key term is zero touch provisioning. If a data center needs Layer 2 across a routed core, think VXLAN.
Common mistakes
Mixing up the planes. The control plane decides, and the data plane forwards. SDN moves the deciding to a controller.
Confusing SASE and SSE. SSE has only the security services. SASE adds the networking such as SD-WAN.
Treating zero trust as a product. It is an approach, built from identity, device checks, segmentation and policy.
Thinking SD-WAN replaces every link. It manages and steers over existing links, such as broadband or MPLS.
Mixing automation and orchestration. Orchestration ties automated tasks together in order.
A central SDN controller is both the strength and the weak point of the design. If it is unavailable or compromised, the impact can be large, so it must be protected and made redundant.
Check yourself
Answer these three.
What does SDN separate?
The control plane from the data plane.
Which technology lets a new branch device configure itself on connection?
SD-WAN zero touch provisioning (ZTP).
What does zero trust require for each request?
Verification of identity and context with least privilege access, whatever the network location.
Topic 11 of 11 in Networking Concepts
Test yourself on Networking Concepts
The full CompTIA Network+ N10-009 question bank has 910 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.