CompTIA Network+ N10-009 objective 1.8 includes several modern network designs. Their names often appear together, but they solve different problems. The useful question is whether the scenario concerns network control, branch connectivity, logical segmentation, or security services.
Fast rule: Centralized control points toward SDN. Application-aware branch paths point toward SD-WAN. Layer 2 segments carried over a Layer 3 network point toward VXLAN. Cloud security alone points toward SSE; combining that security with WAN networking points toward SASE.
1. Match the problem to the design
| Technology | Primary job | Question clue | Does not solve by itself |
|---|---|---|---|
| Software-defined networking (SDN) | Program network control and policy separately from packet forwarding | Controller, automated policy, control plane | A faulty physical path |
| Software-defined wide-area networking (SD-WAN) | Choose and manage paths across wide-area network links | Several branches, broadband and private links, application-aware steering | Every cloud access-security requirement |
| Virtual Extensible Local Area Network (VXLAN) | Carry logical Layer 2 segments across a routed underlay | Tenant isolation, virtual workloads, encapsulation | Encryption or broken underlay connectivity |
| Secure Access Service Edge (SASE) | Bring WAN connectivity and cloud-delivered security together | Branch networking and distributed security policy as one design | Application authorization without correct identity policies |
| Security Service Edge (SSE) | Deliver cloud-based access and security services | Web filtering, cloud application controls, private app access | WAN link selection and branch routing |
2. SDN vs. SD-WAN
SDN separates network control decisions from the devices forwarding packets. A controller or centralized management system can distribute policy across switches and other devices. The devices still need healthy links and valid forwarding information. SDN is a broad design approach, not a single WAN product.
SD-WAN applies software-defined management to wide-area network (WAN) connectivity. An organization with branch offices might have broadband and private WAN circuits. SD-WAN can monitor path quality and steer an application's traffic according to policy. It may use encrypted tunnels, but the security properties depend on the implementation and configuration.
- Choose SDN when the main requirement is programmable, coordinated network control.
- Choose SD-WAN when the main requirement is managing and selecting paths between sites and cloud resources.
- A deployment can use both. SD-WAN is a specialized use of software-defined networking, so the terms are related rather than competing answers in every scenario.
3. VXLAN and the underlay
VXLAN is an overlay. It encapsulates Ethernet Layer 2 traffic so logical segments can extend across a Layer 3 Internet Protocol (IP) underlay. Its 24-bit VXLAN Network Identifier (VNI) supports far more logical segments than a traditional 12-bit Virtual Local Area Network (VLAN) identifier.
For example, virtual machines on separate racks may need to share a logical Layer 2 segment even though the physical network between racks is routed. VXLAN Tunnel Endpoints (VTEPs) encapsulate and decapsulate those frames. The underlay still carries the outer IP packets.
A VXLAN troubleshooting sequence starts with the basics:
- Check physical connectivity and routing between tunnel endpoints.
- Check that each endpoint uses the intended VNI and tunnel mapping.
- Verify the underlay Maximum Transmission Unit (MTU) can accommodate encapsulation overhead.
- Investigate overlay forwarding only after the underlay is reachable.
Important: VXLAN encapsulates traffic; it does not inherently encrypt it. If encryption is required, a separate appropriate protection mechanism is needed. Also, a VXLAN overlay is different from a Virtual Private Network (VPN) designed primarily for secure remote connectivity.
4. SASE vs. SSE
SASE joins WAN networking with cloud-delivered security. It is useful when branches, remote users, and cloud applications need coordinated connectivity and access policy.
SSE covers the security-service portion of that architecture. It can secure access to websites, cloud applications, and private applications while an existing WAN solution continues to handle networking.
| Requirement | SASE | SSE |
|---|---|---|
| Cloud-delivered web and application security | Yes | Yes |
| SD-WAN networking as part of the architecture | Yes | No |
| Use case | Modernize branch connectivity together with security | Add cloud security while keeping a separate WAN design |
Neither acronym guarantees correct identity verification, segmentation, or security policy. Always read the specific capability that the scenario requires.
5. Security services inside SSE
These services explain what the security portion actually does:
- Secure Web Gateway (SWG): Applies web access policy and helps block unsafe web destinations or downloads.
- Cloud Access Security Broker (CASB): Provides visibility and policy controls for cloud application use and data movement.
- Zero Trust Network Access (ZTNA): Grants access to specified applications based on identity and context instead of automatically trusting a user because of network location.
- Firewall as a Service (FWaaS): Delivers firewall policy enforcement through a cloud service.
Zero trust is a security approach rather than a synonym for SASE, SSE, or ZTNA. A deployment still needs suitable authentication, authorization, and policy enforcement. For the larger model, see the NIST Zero Trust Architecture publication.
6. Scenario comparisons
Several branches need application-aware path selection
Start with SD-WAN. The clues are competing WAN paths and different application needs. A private circuit with low packet loss might carry voice traffic while other traffic uses broadband, according to measured health and policy. SD-WAN cannot create bandwidth that does not exist.
A data center needs more logical tenant segments
Start with VXLAN. Multiple logical Layer 2 segments can run over a shared routed fabric. Validate VNI assignments and the physical underlay before blaming an application's gateway or a firewall.
An organization wants one method to push switching policies
Start with SDN. Centralized control reduces the need to configure every device separately. The implementation still needs change review, rollback plans, and healthy controller-to-device connectivity.
Remote workers need cloud web and application security
Start with SSE if a WAN design already exists and the request is specifically about enforcing access and security controls. The needed services might include SWG, CASB, and ZTNA.
Branch connections and security policies are both being redesigned
Consider SASE. The requirement combines network connectivity and cloud-delivered security. In practice, verify which WAN and security functions the proposed architecture actually includes.
7. Troubleshooting clues
| Symptom | First distinction to investigate |
|---|---|
| Branch application slows down after a WAN link changes | SD-WAN path health, steering policy, and available capacity |
| Overlay workloads cannot reach each other across racks | VXLAN endpoint reachability, underlay routes, VNI, and MTU |
| One switch did not receive a new network policy | SDN controller reachability, configuration state, and policy deployment |
| Users can browse public sites but private apps are denied | SSE identity context, ZTNA application policy, and connector health |
| Security policy works for one branch but not another | SASE/SSE policy scope, identity context, branch forwarding, and applicable service path |
The name of the architecture is only a starting clue. Check whether the failure is in the physical underlay, forwarding/transport path, policy control, or application access before changing a setting.
8. Common exam traps
- Treating SDN and SD-WAN as unrelated technologies. SD-WAN applies software-defined management to WAN connectivity.
- Assuming SDN replaces switches or routing. Devices still forward traffic over physical or virtual links.
- Choosing VXLAN for encryption. VXLAN adds encapsulation and logical segmentation, not confidentiality by itself.
- Treating an overlay as a replacement for a healthy underlay. The routed transport still matters.
- Assuming every SD-WAN implementation includes all SASE security services.
- Treating SSE as WAN transport selection. SSE focuses on cloud security; the WAN function remains separate.
- Assuming SASE means users automatically receive trusted access. Access policies must still be designed and enforced.
- Confusing a cloud security service with a guarantee that every application or traffic path is protected.
9. Rapid review grid
| If the scenario asks for... | Think first | Because... |
|---|---|---|
| Central policy for forwarding devices | SDN | Control is programmable and coordinated |
| Best available path across WAN links | SD-WAN | Application-aware WAN policy picks paths |
| Layer 2 segments across routed racks | VXLAN | An overlay carries encapsulated frames |
| WAN connectivity plus cloud security | SASE | Networking and security are combined |
| Cloud security without WAN redesign | SSE | Security services are the focus |
| Private application access based on identity | ZTNA | Access follows the application policy |