CCNP Chapter 3: Network Security & Programmability
SDN Security
Software-Defined Networking (SDN) decouples the control plane from the data plane, centralizing network intelligence. This architecture enhances network programmability and agility. However, it also introduces new security challenges as the centralized controller becomes a potential single point of failure or attack. SDN security focuses on ensuring the integrity and availability of control traffic, authenticating controller-device communications, and monitoring for anomalous behavior across the network.
Controller(config)# security authentication key mySecureKey123 Controller(config)# monitor traffic anomaly-detection enable
Micro-Segmentation
Micro-segmentation is a network design principle that breaks down traditional security perimeters into smaller, more controlled segments. This allows organizations to apply granular security policies at the workload or application level. Technologies such as VLANs, VXLANs, and Cisco TrustSec enable micro-segmentation by assigning context-based policies to devices. In enterprise environments, micro-segmentation is critical for limiting lateral movement of threats and ensuring compliance.
View Full Image
Switch(config)# vlan 10 Switch(config-vlan)# name SEGMENT_A Switch(config)# vlan 20 Switch(config-vlan)# name SEGMENT_B
Network Automation
Automation in networking is achieved through tools and protocols that enable devices to be configured, monitored, and managed programmatically. Automation reduces human error, speeds up deployment, and increases network reliability. Protocols such as NETCONF and RESTCONF, along with data modeling languages like YANG, are commonly used for automation. These technologies allow for centralized and consistent configuration of devices, making large-scale network management feasible and efficient.
View Full Image
curl -X GET http://router.local/restconf/data/interfaces -H "Accept: application/yang-data+json"