SDN, SD-WAN and infrastructure as code

Why this matters

Objective 1.8 is "summarize evolving use cases for modern network environments", and it is the newest material on the exam. It is also the objective most likely to be phrased as a benefit rather than a mechanism — questions describe a problem an organisation has and ask which modern approach solves it.

The unifying idea across everything here is separating decisions from devices. Traditional networking puts the decision in the box: each switch decides how to forward, each router runs its own policy, each firewall has its own rule set edited by hand. Everything in this lesson pulls that decision out into something central and programmable.

The lesson

SDN: separating the control plane from the data plane

Every network device does two jobs. The data plane (or forwarding plane) moves packets: receive on one port, look up, send out another, millions of times a second. The control plane decides how: run the routing protocols, build the tables, apply the policy.

Traditionally both live in every device, so a network of two hundred switches holds two hundred independent control planes, each configured separately.

Software-defined networking (SDN) moves the control plane out to a central controller. Devices keep their data planes and become fast, simple forwarders; the controller holds the whole topology, decides policy once, and programs the devices.

The benefits are the examinable part:

• Central policy management. One place to express intent, rather than the same change typed two hundred times with two hundred chances to mistype it.
• A whole-network view, so decisions can be optimal rather than locally reasonable.
• Programmability. The controller exposes an API, so the network can be driven by software instead of by people.
• Faster change, because provisioning is a call rather than a maintenance window.

The cost is that the controller becomes critical infrastructure and must be made redundant.

SD-WAN

SD-WAN applies the same idea to the wide area network, and it is what most organisations actually encounter.

The old model backhauled everything: a branch office sent all traffic over an expensive private circuit to headquarters, and reached the internet from there. When applications moved to SaaS, that became absurd — traffic travelled to head office to come straight back out.

SD-WAN puts a device at each branch that can use any transport and chooses intelligently between them. The four properties CompTIA names:

Transport agnostic. The branch may have MPLS, broadband, and 5G at once. SD-WAN treats them as a pool and does not care which is which, so you can add cheap broadband instead of upgrading an expensive circuit.

Application aware. It identifies the application and applies per-application policy — voice over the lowest-latency path, backups over the cheapest, SaaS straight out to the internet. It also measures each path continuously and moves traffic when one degrades, which a static route cannot do.

Zero-touch provisioning. A new branch device is shipped to site, plugged in by whoever is there, and calls home to the controller to receive its entire configuration. No engineer travels, and every site is configured identically because the same template built them all.

Central policy management. Policy is defined once at the controller and distributed everywhere, as with SDN.

VXLAN and data centre interconnect

VXLAN (Virtual Extensible LAN) solves two problems at once.

The first is scale. A traditional VLAN ID is 12 bits — 4,094 usable VLANs. That is ample for one company and nowhere near enough for a cloud provider hosting thousands of tenants. VXLAN uses a 24-bit identifier, giving about 16 million segments.

The second is reach. VXLAN performs layer 2 encapsulation: it wraps Ethernet frames inside UDP packets so a layer 2 segment can be carried across a routed layer 3 network. Two servers in different data centres can sit on the same logical subnet even though everything between them routes.

That capability is what data center interconnect (DCI) needs. Stretching a layer 2 domain between sites lets virtual machines migrate between data centres without changing address, and lets clusters that require layer 2 adjacency span sites. The encapsulation is sometimes described as MAC-in-UDP, which is a fair summary of what it does.

The caution worth knowing: stretching layer 2 between sites also stretches its failure modes, so a broadcast storm or a loop is no longer contained to one building.

Zero trust architecture

Zero trust discards the assumption that being inside the network means being trusted. The old model was a hard perimeter around a soft interior: get past the firewall and you could reach everything. That fails against a stolen credential, a compromised laptop, or anyone already inside.

Zero trust assumes the network is hostile everywhere and verifies every request on its own merits. Its principles, all named in the objective:

Policy-based authentication. Identity is verified per request, against policy that considers more than a password — who the user is, what device they are on, whether it is patched and managed, where they are, what time it is, how unusual the request looks. The same user on a managed laptop and on an unknown phone gets different answers.

Authorization. Authentication proves who you are; authorization decides what you may do, and under zero trust it is evaluated per resource, per request, not granted once at login for the whole session.

Least privilege access. Every identity gets the minimum access needed for its task, and no more. It limits the blast radius when — not if — an account is compromised, and it is the principle that makes the other two worth having.

Related and often mentioned: microsegmentation, dividing the network into very small zones so that compromising one workload does not grant reach to its neighbours.

SASE and SSE

SASE (Secure Access Service Edge) — pronounced "sassy" — merges networking and security into one cloud-delivered service. It combines SD-WAN with security functions (secure web gateway, cloud access security broker, zero-trust network access, firewall as a service) and delivers them from the provider's edge locations rather than from your data centre.

The driver is the same one behind SD-WAN: when users and applications are both outside the office, backhauling traffic to a data centre for inspection adds latency and cost to protect a perimeter that no longer contains anything. SASE inspects at an edge near the user instead.

SSE (Security Service Edge) is the security half of SASE on its own — the same cloud-delivered security controls, without the SD-WAN networking. You would choose SSE if you are happy with your existing WAN and only want the security functions.

SASE = SD-WAN + SSE is a fair one-line summary for the exam.

Infrastructure as code, and automation

Infrastructure as code (IaC) means defining infrastructure in machine-readable files that are executed to produce it, rather than configuring it by hand. The file is the source of truth; the running system is its output.

Automation is the broader practice this sits inside: having software perform the repeatable work. In networking that means device configuration, provisioning, compliance checking and remediation.

The benefits follow directly from the definition:

• Consistency. Fifty devices built from one definition are identical. Fifty built by hand are fifty variations, and the differences are invisible until one of them behaves differently at 2 a.m.
• Speed, because applying a definition is faster than typing.
• Auditability, because the definition is a file that can be reviewed, diffed and approved before it is applied.
• Repeatability. Rebuilding after a failure is re-running a definition rather than remembering what was there.

The next lesson covers the practices that make this work in the real world — templates, drift, inventories and source control — along with the IPv6 transition.