# Spine-Leaf and Software-Defined Network Architectures

> Chapter 2 of the Courseiva ENCOR curriculum — https://courseiva.com/learn/encor/spine-leaf-and-sdn-architectures

**Official objective:** 1.2 — Describe spine-leaf architecture and SDN architectures (controller-based, overlay, underlay)

## Introduction

How do you build a network that can handle massive growth without grinding to a halt? That is the problem spine-leaf and software-defined network (SDN) architectures solve. For the 350-401 ENCOR exam, you must understand these designs because they are the foundation of modern data centres and large enterprise networks.

## The Hospital Wing Analogy

Have you ever visited a large hospital and wondered how a patient in the emergency room gets a specialist’s report from the radiology department on the other side of the building, without anyone running through the corridors with a paper chart?

In old hospital designs, each department had one main corridor that all messages had to pass through. If that corridor was blocked or slow, the whole hospital was paralysed. Modern hospitals use a spine-leaf design. The ‘spine’ is like a central hub – a large, fast tower that connects to every wing of the hospital. The ‘leaf’ is the local switchboard in each wing – the emergency room, the surgical ward, the radiology suite. Every leaf connects directly to every spine, and every spine connects to every leaf. There is no single corridor that can become a bottleneck.

Now, imagine that the hospital wants to change how patient records are shared without rebuilding the whole building. That is software-defined networking (SDN). Instead of rewiring physical walls, the hospital manager writes a new policy on a computer – the SDN controller – and the policy instantly tells every leaf and spine how to behave. The physical building (the underlay) stays the same; the new rules (the overlay) are a virtual layer that runs on top, just like updating an app on your phone.

## Core explanation

Let’s break down what a network actually does before we talk about architecture. A network is a system of cables, switches, and routers that lets computers talk to each other. In a traditional ‘three-tier’ design, you had a core, distribution, and access layer – like a tree with branches. Traffic had to go up the trunk, through a branch, and back down. This created bottlenecks and made it hard to add new parts.

Spine-leaf architecture is a two-layer design that fixes this. A ‘spine’ is a high-speed switch that does nothing but forward traffic. A ‘leaf’ is a switch that connects to endpoints – servers, storage, or your laptop. Every leaf connects to every spine, and every spine connects to every leaf. This is called a full-mesh topology. No leaf connects directly to another leaf; traffic must go leaf-to-spine-to-other-leaf. The key benefit is that every path is exactly one hop away, which means latency is consistent and predictable. You can also add capacity easily: if you need more bandwidth, you add another spine, and every leaf instantly gets a new path.

Now, how do you control this network? That is where software-defined networking (SDN) comes in. SDN separates the ‘control plane’ (the brain that decides where traffic goes) from the ‘data plane’ (the hardware that actually moves the traffic). In a traditional switch, each device makes its own decisions. In SDN, a central software controller – often called an SDN controller – makes all the decisions and tells each switch what to do.

Within SDN, you will hear two key terms: underlay and overlay. The underlay is the physical network – the actual cables, switches, and routers. It provides the basic connectivity. The overlay is a virtual network built on top of the underlay. Think of the underlay as the roads and highways, and the overlay as the navigation app (like Google Maps) that tells your car how to route around traffic. Overlays use technologies like VXLAN (Virtual Extensible LAN) to create isolated virtual networks that can span across the physical network, regardless of where the devices are physically located.

Why does this matter for a beginner? Because companies like Google, Amazon, and Facebook do not use old-school three-tier networks. They use spine-leaf and SDN. The 350-401 ENCOR exam expects you to describe these architectures, explain how they work, and understand when to use each.

Let’s look at a practical example. Imagine a data centre with 40 racks of servers. In a traditional design, you would have a big core switch that connects to distribution switches, which connect to access switches. If the core switch fails, every single rack goes offline. In spine-leaf, you have 4 spine switches. If one spine switch fails, traffic simply uses the other three spines – the network stays up because every leaf is connected to multiple spines.

The SDN controller in this scenario could be a product like Cisco Application Policy Infrastructure Controller (APIC). The network engineer configures a policy in the APIC, and the APIC automatically configures every switch to enforce that policy. For example, the engineer can say, ‘All web servers in the finance department can only talk to database servers on port 3306’. The APIC pushes that rule to every leaf switch. The engineer never touches a single switch command-line interface.

In summary, spine-leaf gives you scalability and resilience. SDN gives you centralised control and automation. Together, they form the backbone of modern network architectures.

## Real-world context

Imagine you are a network engineer at a mid-sized e-commerce company called ‘ShopFast’. The company has grown from 10 servers to 200 in just two years. The old network, built with a three-tier design, is struggling. Every Friday evening, the site becomes slow because the core switch cannot handle the traffic spike from weekend shoppers. Your manager asks you to design a new network that can scale easily and recover from failures instantly.

First, you decide to implement a spine-leaf architecture. You order four spine switches – these are high-capacity switches like Cisco Nexus 9300 series. You order 20 leaf switches – one for each rack of servers. Your team racks them, cables every leaf to every spine using 40 Gigabit Ethernet fibre cables, and connects the servers to the leaf switches.

Now, how do you configure them? In a traditional network, you would log into each switch and type commands. Instead, you use Cisco APIC, an SDN controller. You create a ‘tenant’ called ‘ShopFast-Production’. Inside that tenant, you define ‘application profiles’ for the web tier, the app tier, and the database tier. You write a policy that web servers must be on VLAN 100, app servers on VLAN 200, and database servers on VLAN 300. You also write a policy that says traffic from web to app is allowed, and app to database is allowed, but no device can talk directly from web to database.

When you click ‘deploy’, the APIC automatically configures every leaf switch with the correct VLANs and access control lists (ACLs). It also configures VXLAN overlays so that even if a virtual machine moves from one rack to another, its IP address stays the same and the network follows it.

Three months later, the company acquires a smaller competitor and needs to add 50 more servers. You order one more spine switch and ten more leaf switches. You cable the new leaf switches to all five spines. The APIC automatically discovers the new switches and applies the existing policies. The entire expansion takes one afternoon instead of two weeks of manual configuration.

When a spine switch fails due to a power supply issue, the network does not skip a beat. Traffic from the leaf switches automatically uses the other four spines. Users notice nothing. Your manager is impressed.

The key lesson for an IT professional is that spine-leaf and SDN are not just exam topics – they are the practical way to build networks that are scalable, resilient, and automatable. You will spend less time troubleshooting and more time designing policies that align with business needs.

## Exam focus

The 350-401 ENCOR exam tests your understanding of spine-leaf and SDN architectures in several specific ways. You will see multiple-choice questions (single answer and multiple answer) and drag-and-drop questions. The exam does not require you to configure these architectures from scratch, but it does expect you to describe them, compare them, and identify correct statements about them.

Here are the specific concepts they love to test:

- Spine-leaf topology: Know that every leaf connects to every spine, and leaves do not connect to each other. Understand that this creates a non-blocking, low-latency fabric.
- Underlay vs. overlay: Be able to define each. The underlay is the physical network (the real cables and switches). The overlay is the virtual network (VXLAN, NVGRE) that runs on top. A common trap is mixing these up – for example, saying VXLAN is an underlay when it is an overlay.
- SDN architecture: Know the three planes – control plane (makes decisions), data plane (forwards packets), and management plane (monitoring and configuration). Understand that SDN centralises the control plane.
- Controller-based vs. traditional: In traditional networking, each device has its own control plane (distributed). In SDN, the controller is the single control plane (centralised). The exam might ask: ‘Which statement is true about controller-based networking?’ The answer will describe centralised control.
- APIC and ACI: Cisco’s Application Centric Infrastructure (ACI) is a specific implementation of spine-leaf plus SDN using the APIC controller. The exam tests that APIC is the central policy engine.

Common traps:

- The exam might offer an answer choice that says ‘In a spine-leaf network, spine switches connect directly to other spine switches.’ That is false – spines never connect to each other.
- Another trap: ‘SDN means the data plane is centralised.’ That is false – only the control plane is centralised; the data plane stays distributed in switches.
- They might list VXLAN as a type of underlay. Do not fall for it – VXLAN is an overlay encapsulation technology.

Key definitions to memorise:

- Spine switch: A high-speed switch that connects only to leaf switches.
- Leaf switch: A switch that connects to endpoints and to every spine switch.
- Underlay network: The physical network providing IP connectivity.
- Overlay network: A virtual network built on top of the underlay using encapsulation.
- SDN controller: The central software that manages network devices and policies.
- VXLAN: Virtual Extensible LAN, an overlay protocol that creates Layer 2 segments over a Layer 3 underlay.

The exam also tests your ability to distinguish between different SDN solutions – for example, Cisco ACI (controller-based, policy-driven) versus Cisco SD-Access (which uses a different controller, Cisco DNA Center, and focuses on campus networks). Know that both are SDN but target different environments: ACI for data centres, SD-Access for campus.

Finally, be ready for a drag-and-drop question where you must place terms like ‘spine’, ‘leaf’, ‘underlay’, and ‘overlay’ into a diagram. Memorise the simple diagram: leafs at the bottom, spines at the top, all connected in a full mesh. That visual will save you on exam day.

## Step by step

1. **1. Cabling the Physical Underlay** — Run fibre cables from each leaf switch to every spine switch in the network. This creates a full-mesh between the leaf and spine layers. For example, with 4 spines and 20 leaves, you run 80 cables (20 leaves x 4 spines). This step establishes the physical connectivity that the overlay and SDN will use.
2. **2. Configuring the Underlay Routing** — Configure an Interior Gateway Protocol (IGP) like OSPF or IS-IS on the spine and leaf switches to distribute reachable IP addresses. Alternatively, use BGP (Border Gateway Protocol). This ensures that every leaf knows how to reach every spine and vice versa. The underlay must be fully functional before the overlay can work.
3. **3. Deploying the SDN Controller** — Install and initialise the SDN controller – for example, Cisco APIC for ACI. The controller runs on a cluster of servers. It discovers all the leaf and spine switches using protocols like LLDP (Link Layer Discovery Protocol) and takes over their configuration. The controller becomes the single point of policy management.
4. **4. Defining the Overlay Network** — Configure VXLAN tunnels on the leaf switches. The SDN controller instructs each leaf to create VXLAN tunnel endpoints (VTEPs). The overlay then creates virtual Layer 2 networks (called ‘bridge domains’ in ACI) that can stretch across all racks, allowing virtual machines to move freely while keeping the same IP and MAC addresses.
5. **5. Applying Policies and Contracts** — Use the SDN controller to define policies that govern traffic flow. For example, create an ‘application profile’ that defines which endpoints (like web servers) can talk to which other endpoints (like database servers) and on which ports. The controller automatically pushes these policies as ACLs and routing rules to all leaf switches.
6. **6. Validating and Monitoring** — Use monitoring tools (built into the SDN controller or external) to verify that traffic flows correctly between leaves and spines. Check for any black holes or path failures. The controller provides a dashboard showing real-time traffic patterns, which helps identify bottlenecks or misconfigurations quickly.

## Comparisons

### Spine-Leaf Topology vs Traditional Three-Tier Topology

**Spine-Leaf Topology:**
- Two-layer: spine and leaf only
- Every leaf connects to every spine (full mesh)
- Predictable, low latency (one hop between leaves)

**Traditional Three-Tier Topology:**
- Three-layer: core, distribution, access
- Traffic flows up and down a tree structure
- Latency varies depending on the path (more hops possible)

### Underlay Network vs Overlay Network

**Underlay Network:**
- Physical cables and switches
- Handles basic IP forwarding
- Must be configured first to provide connectivity

**Overlay Network:**
- Virtual network built on top of the underlay
- Uses encapsulation (e.g., VXLAN) to create logical segments
- Provides isolation and virtual machine mobility

### Traditional Networking (Distributed Control Plane) vs SDN (Centralised Control Plane)

**Traditional Networking (Distributed Control Plane):**
- Each switch makes its own routing decisions
- Configuration is done per device via CLI
- Harder to apply consistent policies across many switches

**SDN (Centralised Control Plane):**
- A central controller makes all routing decisions
- Configuration is done centrally via a GUI or API
- Policies are automatically pushed to all devices

### Cisco ACI vs Cisco SD-Access

**Cisco ACI:**
- Designed for data centre fabrics
- Uses APIC as the controller
- Focuses on application-centric policies (contracts)

**Cisco SD-Access:**
- Designed for campus networks (offices, buildings)
- Uses Cisco DNA Center as the controller
- Focuses on user and device identity (ISE integration)

## Diagram

_A spine-leaf topology with three spine switches and three leaf switches, each leaf connected to every spine and to a server rack._

```mermaid
flowchart TD
    A[Spine 1] --- B[Leaf 1]
    A --- C[Leaf 2]
    A --- D[Leaf 3]
    E[Spine 2] --- B
    E --- C
    E --- D
    F[Spine 3] --- B
    F --- C
    F --- D
    B --- G[Server Rack A]
    C --- H[Server Rack B]
    D --- I[Server Rack C]
```

## Common misconceptions

- **Misconception:** Spine-leaf means every switch can talk to every other switch directly. **Reality:** In spine-leaf, a leaf switch cannot talk directly to another leaf switch. Traffic must go leaf-to-spine-to-leaf. This ensures consistent latency. (Beginners confuse the full-mesh nature of spine-to-leaf connections with a full mesh among all switches. They miss the ‘no leaf-to-leaf’ rule.)
- **Misconception:** SDN and spine-leaf are the same thing and must always be used together. **Reality:** Spine-leaf is a physical topology (how switches are cabled), while SDN is a control architecture (how the network is managed). You can have a spine-leaf network with traditional routing protocols (like OSPF) and no SDN controller. They are independent concepts. (Vendors often market them together, so beginners assume they are inseparable.)
- **Misconception:** The overlay network replaces the underlay completely. **Reality:** The overlay runs on top of the underlay. You cannot have an overlay without a physical underlay to carry the encapsulated packets. The underlay still exists; the overlay just adds a virtual layer. (The word ‘overlay’ sounds like it sits on top and might be seen as a replacement, but it is an addition, not a replacement.)
- **Misconception:** In SDN, the controller makes every forwarding decision for every packet in real time. **Reality:** The controller programs forwarding rules into the switches in advance (proactive mode) or on the first packet of a flow (reactive mode), but after that, the switch forwards packets locally without involving the controller for every single packet. The controller is not involved in every microsecond decision. (This comes from misunderstanding centralisation – beginners think it means per-packet control, which would be impossibly slow.)
- **Misconception:** Spine-leaf is only useful in massive data centres like Google's. **Reality:** Spine-leaf is also used in small-to-medium enterprise data centres because it simplifies cabling, makes scaling predictable, and reduces the risk of a single switch failure taking down the whole network. (The story of big tech companies using it makes beginners think it is not relevant to smaller setups.)

## Key takeaways

- Spine-leaf is a two-layer topology where every leaf switch connects to every spine switch, and leaves never connect directly to each other.
- The underlay is the physical network; the overlay is a virtual network built on top using encapsulation like VXLAN.
- SDN centralises the control plane into a single controller, separating it from the data plane that forwards packets.
- In spine-leaf, adding a new spine switch instantly increases bandwidth for every leaf because each leaf gains an extra path.
- Cisco ACI is a specific implementation of spine-leaf plus SDN, using the APIC as the central policy controller.
- VXLAN extends Layer 2 segments across a Layer 3 underlay, enabling virtual machine mobility without changing IP addresses.
- Spine-leaf provides predictable low latency because every path from any leaf to any other leaf is exactly one hop through a spine.
- SDN allows network policies to be defined once and automatically applied to every device, reducing manual configuration errors.

## FAQ

**How many spine switches do I need in a spine-leaf network?**

In production, you typically use at least two spines for redundancy, but most designs use four or more. The exact number depends on the number of leaf switches and the desired bandwidth. Each leaf should connect to every spine to maintain the full-mesh property.

**Can I use spine-leaf with traditional routing protocols like OSPF?**

Yes. Spine-leaf is a physical topology, so you can run OSPF or IS-IS on the leaf and spine switches as the underlay routing protocol. Many enterprises still use traditional dynamic routing without an SDN controller. SDN is optional but adds centralised policy management.

**What is the difference between ACI and SD-Access?**

ACI (Application Centric Infrastructure) is designed for data centre networks and uses the APIC controller. SD-Access is designed for campus networks (buildings, offices) and uses Cisco DNA Center. Both are SDN solutions, but they target different environments and use different hardware and software.

**Does spine-leaf replace all other network topologies?**

No. Spine-leaf is ideal for data centres where east-west traffic (server-to-server) is heavy. For small branch offices or simple networks, a traditional three-tier or flat network may be simpler and cheaper. Spine-leaf is a specialised solution for specific scaling needs.

**What does ‘non-blocking’ mean in spine-leaf?**

A non-blocking fabric means that the total bandwidth from all leaf switches to all spines is at least equal to the total bandwidth from the leafs to the endpoints. In practice, this means that no single link becomes a bottleneck, and every server can communicate at full wire speed simultaneously.

**How does VXLAN work in simple terms?**

VXLAN (Virtual Extensible LAN) wraps an original Ethernet frame inside a UDP packet. The leaf switch attaches a VXLAN header with a network identifier (VNI) before sending it across the underlay. The receiving leaf switch strips the header and delivers the original frame to the destination. This lets you create over 16 million isolated virtual networks.

## Check your understanding

1. **In a spine-leaf architecture, can a leaf switch connect directly to another leaf switch?**

   Answer: No. Leaf switches never connect directly to each other; traffic between leaves must always go through a spine switch to ensure consistent latency.

2. **What is the role of an SDN controller in a software-defined network?**

   Answer: The SDN controller centralises the control plane, making all routing and policy decisions, and then programs the switches (data plane) with the necessary forwarding rules.

3. **Name one encapsulation technology used to build an overlay network in a spine-leaf fabric.**

   Answer: VXLAN (Virtual Extensible LAN) is commonly used to create overlay networks over a Layer 3 underlay.

4. **What is a key advantage of spine-leaf over a traditional three-tier network?**

   Answer: Spine-leaf provides predictable low latency because every leaf-to-leaf path is exactly one hop through a spine, and adding more spines easily increases bandwidth.

5. **What does Cisco ACI stand for and what type of controller does it use?**

   Answer: ACI stands for Application Centric Infrastructure. It uses the APIC (Application Policy Infrastructure Controller) to manage the spine-leaf fabric.

---

Interactive version with quiz and diagrams: https://courseiva.com/learn/encor/spine-leaf-and-sdn-architectures