Cisco Certified Network Associate (CCNA) 200-301 · Free study guide

Objective 6.3 — Explain software-defined architecture

Software-defined architecture separates concerns so operators can reason about physical reachability, logical segmentation, decision-making, forwarding, and programmatic interfaces. The key terms—underlay, overlay, fabric, control plane, data plane, northbound API, and southbound API—describe relationships. They are not interchangeable product labels.

Underlay carries the transport

The underlay is the foundational network that provides reachability among the devices or tunnel endpoints supporting a design. It has its own addressing, routing, link capacity, convergence, and failure behavior. If the underlay cannot carry packets between endpoints, the overlay cannot repair that physical or routed break.

Underlay verification includes interfaces, neighbors, routes, path MTU, latency, and loss. Stable transport is especially important when logical tunnels add headers and depend on reachability among many endpoints.

Overlay supplies logical connectivity

An overlay builds logical paths or segments across the underlay. It can separate tenants or policy groups without requiring the physical topology to mirror every logical relationship. Encapsulation adds information and overhead, so MTU and visibility still matter. A fabric is the coordinated system of nodes, links, control mechanisms, and policy that provides this connectivity; it may include both underlay and overlay functions.

Do not use “overlay” as a synonym for encryption. Some encapsulations can be combined with protection, but logical tunneling alone does not necessarily provide confidentiality or endpoint authentication.

Separate control from forwarding

The control plane learns or decides reachability and policy state. The data plane forwards actual user traffic according to installed tables. A correct control-plane entry is strong evidence, but data-plane counters and test traffic show whether packets actually follow the intended path. Management functions configure and observe these planes without becoming identical to either one.

Place the APIs

A northbound API generally exposes controller capabilities to applications and operator systems. A southbound API or protocol connects a controller toward managed devices or infrastructure. “North” and “south” describe direction relative to the controller, not geography. Authentication, authorization, schema, versioning, and failure behavior matter on both sides.

Worked scenario

Two overlay endpoints appear in the controller, but their tunnel remains down. The underlay route to one endpoint was withdrawn after a failed link. Editing logical segmentation will not restore transport. Verify physical state and the underlay route first, restore reachability, confirm tunnel state, then test traffic inside the intended segment.

Verification evidence

Trace a flow through source segment, overlay identifier, tunnel endpoints, underlay route, destination segment, and policy. Inspect control-plane state, data-plane counters, encapsulation overhead, controller status, and API errors. Test both permitted and isolated paths.

Common traps

• Assuming an overlay works without underlay reachability.
• Equating encapsulation with encryption.
• Treating control-plane state as complete forwarding proof.
• Reversing northbound and southbound relationships.
• Calling one device a fabric without considering coordinated system behavior.

Readiness checklist

• I can distinguish underlay, overlay, and fabric.
• I separate control-plane decisions from data-plane forwarding.
• I can place northbound and southbound interfaces.
• I can trace a logical flow over its physical dependencies.