CompTIA Network+ Cloud and Data Center Networking: VPCs, Spine-Leaf, SD-WAN, and VXLAN

Where cloud and data center topics sit in N10-009

All of this material is in Networking Concepts, the domain worth 23% of CompTIA Network+ N10-009 (V9). Objective 1.3 asks you to summarize cloud concepts and connectivity options. Objective 1.6 asks you to compare topologies and architectures. Objective 1.8 asks you to summarize use cases for modern network environments. CompTIA's two blog posts of December 18, 2024 name SD-WAN, VXLAN, infrastructure as code, zero trust, and SASE/SSE among the topics added in V9.

Hypervisors and the cloud service models are already A+ material, so this page stays on the network side: where traffic goes, and which component decides.

A VPC described in words (objective 1.3)

A virtual private cloud (VPC) is your own private network inside a provider's cloud. Here is an AWS-style example, with private RFC 1918 addresses. A fictional retailer builds VPC 10.50.0.0/16 with two subnets and a link back to its headquarters network, 10.10.0.0/16.

Read the table as three behaviors:

• Internet gateway. It gives the public subnet a path to and from the internet. Whether a given connection is allowed still depends on the security rules.
• NAT gateway. AWS's documentation, for one provider, describes it as letting instances in a private subnet connect to services outside the VPC while external services cannot start connections to them. A public NAT gateway is created in a public subnet and sends its traffic on to the internet gateway. That is why the private subnet's default route points at the NAT gateway, not straight at the internet gateway.
• VPN or Direct Connect. A VPN carries traffic to headquarters through an encrypted tunnel over the internet. Direct Connect, as the objectives name it, is a dedicated private connection between your site and the provider.

Two design rules follow. The VPC range and the headquarters range must not overlap, or the private subnet's routes become ambiguous. The application servers have no public IPv4 address. That avoids a direct public IPv4 endpoint, but it does not guarantee isolation: load balancers, routes, security rules, and other access paths still need to enforce the intended policy.

The objectives also list network security groups and network security lists. Both are provider-managed rule sets that allow or deny traffic to cloud resources. Providers use the names differently, and some attach one kind to individual resources and the other to whole subnets, so check the provider's documentation for which applies where.

The free mixed set of 20 Network+ questions includes a private-subnet item about outbound updates. You can work the private-subnet NAT gateway question →, with an explanation for every option.

Network+ cloud terms that are easy to swap

Three-tier, collapsed core, and spine and leaf (objective 1.6)

Traffic direction is the reason spine and leaf exists. North-south traffic enters or leaves the data center, such as a customer reaching a web server. East-west traffic moves between servers inside it, such as a web server calling a database. In a spine-and-leaf fabric, traffic from any leaf to any other leaf crosses exactly one spine.

Worked fabric. A data center has 4 spines and 12 leaves. Each leaf has one uplink to each spine, so 4 uplinks per leaf and 4 × 12 = 48 spine-to-leaf links. Traffic between two servers on different leaves goes leaf, spine, leaf, and it has 4 equal paths, one through each spine. Adding a thirteenth leaf adds 4 more links and changes no other leaf's path length.

The objectives also list mesh, hybrid, star or hub-and-spoke, and point-to-point topologies. Recognize them by shape: everyone linked to everyone, a mix, everything through a center, and one link between two sites.

SDN and SD-WAN (objective 1.8)

Software-defined networking (SDN) separates the part that decides where traffic should go, the control plane, from the part that forwards it, the data plane, and runs the decisions from a central controller. CompTIA's Q&A blog says SDN suits an internal network in a single location, and that Network+ added SD-WAN because organizations increasingly rely on sites spread across many places.

The objectives list four SD-WAN traits. A fictional branch with a broadband line and a cellular backup shows each one:

• Transport agnostic. The SD-WAN device builds its paths over whatever links the branch has, here broadband and cellular.
• Application aware. It recognizes traffic by application, so it can treat a voice call differently from a file backup.
• Central policy management. One policy, written once at headquarters, says voice uses the link with the lowest measured delay variation and backups use broadband only.
• Zero-touch provisioning. A replacement branch device is shipped unconfigured, plugged in on site, and pulls its configuration from the central controller.

VXLAN: Layer 2 segments across a Layer 3 network

VXLAN carries Layer 2 traffic inside UDP packets so that one Layer 2 segment can stretch across a routed network, for example between racks in a spine-and-leaf fabric or between data centers. That second use is the data center interconnect (DCI) item in 1.8.

RFC 7348 gives the two numbers to know. Each VXLAN segment has a 24-bit identifier, the VNI, and 2^24 = 16,777,216, which the RFC rounds to up to 16 million segments. IANA assigned UDP port 4789 to VXLAN, and the RFC says it should be the default destination port. The RFC also notes that machines in different VXLAN segments cannot communicate with each other directly.

Zero trust and SASE/SSE on Network+

Zero trust architecture drops the idea that being inside the network makes a device trusted. The 1.8 sub-bullets are policy-based authentication, authorization, and least privilege access. Passy's Security+ guide to zero trust's control and data planes goes deeper than Network+ needs.

Watch one spelling. Objective 1.8 prints "Secure Access Secure Edge (SASE)," but the acronym list in the same document and both CompTIA blogs say Secure Access Service Edge. Use Service. SSE stands for Security Service Edge. As the terms are commonly used, SASE combines wide-area connectivity, such as SD-WAN, with security services delivered from the cloud, and SSE is the security-service part on its own. The Network+ security concepts guide covers segmentation and remote access.

Infrastructure as code, worked on one change

Infrastructure as code (IaC) manages network configuration as files that tools apply, instead of typing commands into each device. A fictional campus team manages 40 switches this way.

1. Template. One reusable playbook sets the NTP and syslog servers on every switch.
2. Source control. The playbook lives in a central repository with version control. An engineer makes the change on a branch, and a teammate reviews it before it is merged.
3. Conflict identification. Two engineers edit the same template in the same week. The repository flags the conflict before either version reaches a switch.
4. Dynamic inventory. The list of target switches comes from the team's device records, so a newly added switch is included automatically.
5. Drift and compliance. A nightly check finds that someone changed switch 17 by hand. The report shows the difference from the approved configuration, and the next run puts it back.

Upgrades follow the same path: stage the change, apply it to a few devices, then roll it out. IPv6 addressing and the 1.8 compatibility tools (dual stack, tunneling, NAT64) are in the Network+ IPv6 guide, and route tables and NAT are in the routing guide.