Network Infrastructure Flashcards

The strongest network segmentation boundary: no physical connection between two systems or segments. Because there is no cable, wireless link, or intermediary device, there is no network path for lateral movement. Cannot be defeated by software misconfiguration — only bypassed by physical access (USB drives, physical bridging). Used for classified networks, industrial control systems, and environments where any cross-segment communication is catastrophic. The fundamental limitation: zero scalability — each isolated domain requires its own dedicated physical hardware.

Both use dedicated physical hardware but differ in connectivity: Air gap: no connection at all — there is literally no path between segments; the strongest boundary. Physical segmentation: separate physical hardware per segment, but segments may be connected through a controlled routing or bridging device that enforces traffic policy. Both provide strong, auditable boundaries that cannot be defeated by software misconfiguration alone. Both suffer from the same scalability ceiling: 100 isolated customers = 100 switches minimum. The cost and scale problem drove the development of logical segmentation (VLANs).

VLANs (Virtual Local Area Networks) create logically isolated broadcast domains on shared physical switch hardware using IEEE 802.1Q tagging. The switch adds a VLAN ID to each Ethernet frame and only forwards it to ports belonging to that VLAN. A device on VLAN 10 cannot communicate with a device on VLAN 20 at Layer 2 — they are in completely separate broadcast domains, exactly as if connected to different physical switches. Inter-VLAN communication requires a Layer 3 device (router or Layer 3 switch), which becomes the enforcement point for ACL-based traffic policy.

An attack where a device in one VLAN gains access to another VLAN's traffic without passing through the Layer 3 routing device. The most common method is switch spoofing: the attacker's device sends 802.1Q trunk negotiation (DTP) frames to the switch, which auto-negotiates a trunk link back. A trunk port carries traffic for all VLANs — the attacker's machine then receives frames from every VLAN on the switch. Prevention: Statically configure all end-device ports as access ports (switchport mode access) and disable DTP (switchport nonegotiate). Only deliberate switch-to-switch uplinks should be trunk ports.

Traditional network devices (switches, routers, firewalls) integrate all functions — forwarding, routing decisions, and configuration — in one physical appliance. This works for physical networks but is impossible to replicate in cloud environments where there is no physical device to place. SDN solves this by separating the functions into three distinct planes — data, control, and management — that can be implemented independently in software on commodity hardware. Once separated, virtual firewalls, switches, and routers can be instantiated via API call in seconds. SDN is the enabling technology for all cloud networking.

The "doing" layer — where actual network traffic is forwarded and processed. The data plane executes forwarding decisions made by the control plane at high speed with minimal processing overhead. Functions: frame and packet forwarding (MAC table and IP routing table lookups), IEEE 802.1Q VLAN trunking, Network Address Translation (NAT), and in-line encryption/decryption (IPsec, MACsec). On a physical switch, the data plane = the front-panel ports where cables connect. In cloud/SDN: software running in the hypervisor networking stack. The data plane never makes routing decisions — it only executes them.

The "decision" layer — builds and maintains the tables the data plane uses to forward traffic. The control plane never directly forwards end-user traffic; it calculates forwarding intelligence. Functions: IP routing table (via static routes or dynamic routing protocols — OSPF, BGP), MAC address/CAM table, NAT state tables, session tables for stateful firewalls, dynamic routing protocol exchange with neighboring devices. When a link fails, the control plane recalculates the routing table → pushes updated paths to the data plane → traffic is automatically rerouted. The control plane = the "brain" that the data plane = the "hands" executes.

The "configuration" layer — how administrators interact with network devices to define behavior. Interfaces: SSH (CLI), HTTPS (web GUI), APIs (Netconf, RESTCONF, REST — essential for SDN automation), and SNMP v3 (monitoring). Changes flow top-down: management plane → updates control plane state → data plane adjusts forwarding. Highest-value attack target: management plane access = ability to reconfigure any security control — remove ACLs, create backdoor routes, disable logging. Must be accessible only from a dedicated management VLAN, use MFA, use encrypted protocols (SSH/HTTPS), and generate SIEM alerts on all configuration changes.

An attack technique where a compromised system is used as a foothold to access additional systems within the same network. On a flat (unsegmented) network, lateral movement is unrestricted — a compromised workstation has a direct Layer 2 path to every server and device on the same broadcast domain. Network segmentation is the primary defense: air gaps, physical segmentation, and VLANs all create barriers that prevent or complicate lateral movement. Without segmentation, a single compromised endpoint can become a full network breach. With proper VLAN segmentation and inter-VLAN ACL enforcement, lateral movement from a user VLAN to a server or database VLAN requires routing through a controlled enforcement point.

SDN enables three capabilities impossible with traditional hardware: (1) Dynamic provisioning: a new virtual firewall between load balancer and web servers can be created via API call in seconds — no hardware to rack, cable, or configure manually. (2) Elastic scaling: virtual network devices spawn and terminate with demand — physical hardware cannot match this. (3) Infrastructure as Code: because SDN exposes API-based management plane interfaces, the entire network configuration (firewall rules, routing tables, security groups) can be written as code in Terraform or CloudFormation and deployed through automated CI/CD pipelines — version-controlled, reviewed, and repeatable. Consistent policy can be pushed to thousands of virtual switches in one API call.