Cloud Networking and SDN Explained (Network+)

Why it matters. Most company networks now stretch into a cloud provider, and the exam expects you to know the vocabulary. The good news: a cloud network is the same subnets, routes and firewalls you already know, configured through software instead of cables.

Service and deployment models

Model	You manage	Provider manages	Example
IaaS	OS, apps, data, network settings	Hardware, virtualisation	A virtual machine you rent
PaaS	Your app and data	OS, runtime, scaling	A managed app or database platform
SaaS	Your data and users	Everything else	Email or office apps in a browser

Deployment models: public (shared provider), private (one organisation), hybrid (both, connected), community (shared by organisations with common needs). Shared responsibility means security duties split along the table above: the provider secures the cloud, you secure what you put in it.

A cloud network (VPC)

• VPC / VNet: your private network inside the provider, with your own address range.
• Public and private subnets: public ones route to an internet gateway; private ones reach out through a NAT gateway, the same idea as our NAT lab.
• Connecting the office: a site-to-site VPN over the internet (like our WireGuard lab), or a dedicated private circuit such as AWS Direct Connect or Azure ExpressRoute.

	Security group	Network ACL
Applies to	Each instance / interface	A whole subnet
State	Stateful: replies are allowed automatically	Stateless: you allow return traffic yourself
Rules	Allow only	Allow and deny, checked in order

Reading it. “Stateful” is the same connection tracking you saw in the NAT lab’s conntrack table. That one word explains most exam questions about these two.

SDN: separating the brain from the muscle

A traditional switch decides where traffic goes (the control plane) and moves it (the data plane) in the same box. Software-defined networking moves the decisions to a central controller that programs many devices at once. Apps talk to the controller through northbound APIs; the controller talks to devices through southbound APIs. The management plane is how admins configure and monitor it all. Network function virtualisation (NFV) runs firewalls and routers as software instead of dedicated boxes.

SD-WAN, VXLAN, SASE

Term	What it does	Familiar cousin
SD-WAN	Steers branch traffic across internet, LTE or MPLS links by application, with central policy and zero-touch setup	Routing basics, made smarter
VXLAN	Carries layer 2 networks across a layer 3 network, inside UDP port 4789; a 24-bit ID allows about 16 million segments versus 4,094 VLANs	Our VLAN lab, stretched across data centers
SASE	Delivers networking (SD-WAN) and security (secure web gateway, CASB, zero trust access, firewall as a service) from the cloud, close to the user	Zero trust: never trust by location

The cloud is just someone else’s computer. With a very good firewall. Configured by you. Good luck. — Nyx

Also on the exam: infrastructure as code (networks described in files, versioned like software), elasticity (scaling up and down automatically), and multitenancy (many customers sharing hardware, kept apart by the provider).

Practise it

These topics are in the Network+ practice test, scored by exam domain.

NextHigh availability, disaster recovery and documentation→

Go deeper

• VLANs and 802.1Q lab — the layer 2 idea VXLAN stretches
• NAT and firewalls lab — stateful versus stateless, hands-on

Explainer, written by StashGrid with AI help and checked against the CompTIA Network+ N10-009 objectives and the published standards (IEEE 802.11 and 802.3, TIA-568) before publishing. Speeds and distances are the standard ratings; real-world results are lower. StashGrid isn’t affiliated with CompTIA. Spotted an error? Tell us.