Routers, switches, firewalls and other appliances

Why this matters

Objective 1.2 is a vocabulary objective, and vocabulary objectives are where marks are cheapest. Every device here gets identified by what it decides on — a switch decides on MAC addresses, a router on IP addresses, a layer 7 load balancer on the contents of a request. Learn each box by the field it reads and the layer it reads it at, and the questions answer themselves.

It also sets up most of the rest of the course. Later lessons configure these devices; this one is about knowing which is which and why you would deploy it.

The lesson

Physical and virtual appliances

Every device below exists in two forms, and CompTIA lists this distinction first because it changes the trade-offs rather than the function.

A physical appliance is dedicated hardware. It often uses purpose-built silicon — ASICs — so it forwards at line rate regardless of load, and it has real ports you can plug into. It occupies rack space, draws power, and has to be bought before it can be used.

A virtual appliance is the same software running as a VM or container on general-purpose hardware. It can be deployed in minutes, cloned, snapshotted, scaled with demand, and placed inside a cloud environment where you own no hardware at all. The costs are that it competes for the host's CPU, so throughput varies with what else is running, and it depends on the hypervisor's own networking being correct.

The general rule the exam wants: physical where you need guaranteed throughput and physical ports; virtual where you need flexibility, rapid deployment or a cloud presence.

Switch

Operates at layer 2 and forwards frames using MAC addresses.

A switch learns by watching. When a frame arrives it records the source MAC and the port it came in on, building a MAC address table. When it has to forward a frame it looks up the destination: if it knows the port, it sends the frame only there (unicast forwarding); if it does not, it floods the frame out every port except the one it arrived on, and learns the answer from the reply.

Two consequences matter. Each switch port is its own collision domain, which is why switches replaced hubs. But by default every port is in the same broadcast domain, so a broadcast reaches everything — and that is the problem VLANs exist to solve.

A multilayer switch adds layer 3 routing to the same chassis, which is how inter-VLAN routing is normally done.

Router

Operates at layer 3 and forwards packets using IP addresses.

A router connects different networks and decides, for each packet, which interface leads toward the destination — consulting its routing table and choosing the most specific matching route. It rewrites the layer 2 frame at every hop and decrements the TTL.

Routers do not forward broadcasts, which makes each router interface a broadcast domain boundary. That single fact answers a large number of exam questions: if a scenario needs to contain broadcast traffic, the answer is routing or VLANs, not a bigger switch.

Firewall

Filters traffic against a rule set, allowing or denying based on source and destination address, port and protocol.

A stateless firewall evaluates each packet on its own. A stateful firewall tracks connections, so it can permit return traffic for a session it saw being established without a separate rule — which is both more secure and far easier to administer.

A next-generation firewall (NGFW) inspects further up the stack: it can identify the application regardless of port, apply user identity, and perform deep packet inspection. That is the practical difference to remember — a traditional firewall reasons about addresses and ports, an NGFW reasons about applications and users.

IDS and IPS

Both detect suspicious traffic by signature or by deviation from a baseline. The distinction is placement and authority.

An IDS (intrusion detection system) is out of band. It receives a copy of traffic, usually from a mirrored port or a network tap, and alerts. It cannot stop anything, and because it is not in the path it cannot break anything either.

An IPS (intrusion prevention system) is in line. Traffic passes through it, so it can block. That power carries risk: a false positive drops legitimate traffic, and an IPS failure can take the link down unless it is designed to fail open.

The exam framing is consistent — detect and alert versus prevent and block, out of band versus in line.

Load balancer

Distributes incoming requests across a pool of servers, so that no one server is overwhelmed and the failure of one does not take the service down. It also performs health checks and stops sending traffic to a server that fails them.

The layer matters, and it is a favourite question. At layer 4 the balancer decides on IP and port only; it is fast and protocol-agnostic but cannot see inside the request. At layer 7 it reads application data — the HTTP host header, the URL, cookies — so it can route /api to one pool and /images to another, and keep a user pinned to a server through session persistence.

Proxy

Sits between clients and servers and makes requests on someone's behalf.

A forward proxy acts for the clients: internal users reach the internet through it, so it can filter content, enforce policy, cache and log. A reverse proxy acts for the servers: external requests hit it first, and it forwards them inward, which lets it terminate TLS, cache, hide the internal topology and serve as the front end a load balancer might sit behind.

The direction is the whole distinction. Forward proxies protect and control users; reverse proxies protect and accelerate servers.

NAS and SAN

Both provide storage over the network; the difference is what kind of storage.

NAS (network-attached storage) serves files. It is a device on the existing Ethernet network speaking file-sharing protocols such as SMB or NFS. Clients mount a share and see files and folders. Simple, inexpensive, and it uses infrastructure you already have.

SAN (storage area network) serves blocks. It presents raw block devices over a dedicated high-speed network — Fibre Channel, FCoE or iSCSI — and the attached server treats the result as if it were a local disk, formatting it with its own filesystem. More complex and more expensive, and what you deploy for databases and virtualisation clusters that need low latency.

Files versus blocks is the answer the exam is looking for. A secondary cue: NAS runs on the general network, a SAN usually has its own.