Three planes on one router
| Aspect | Data plane | Control plane | Management plane |
|---|---|---|---|
| Job | Forward traffic using tables already built | Build and maintain the tables | Let people and tools configure and monitor the device |
| Examples | Switching a frame by MAC address, applying an ACL, rewriting addresses for NAT | OSPF hellos and LSAs, STP BPDUs, ARP resolving a next hop | SSH and console sessions, SNMP polls, syslog messages |
| Pace | Every packet, often in hardware | When neighbors or topology change | When someone or something asks |
| If it fails | Traffic stops although the tables look right | Tables go stale and new paths are not learned | You lose access while traffic keeps flowing |
| In a controller design | Stays on each device | Largely centralized in the controller | Consolidated at the controller |
The SDN stack, top to bottom
Traditional against controller-based
In a traditional network every router runs its own control plane: each OSPF router knows only what its neighbors have told it, and a policy change is typed device by device. A controller-based network leaves forwarding on each device but centralizes policy and much of the decision making, so one change at the controller reaches every device it manages. Cisco’s campus controller is Catalyst Center (formerly DNA Center); a wireless LAN controller steering lightweight access points is an older, narrower case of the same idea. The v1.1 topics (6.2, 6.3) name these ideas directly; the v2.0 list folds controllers into 5.3, a comparison of network management approaches.
Northbound and southbound, by direction
Put the controller in the middle of a vertical map. Northbound interfaces face up, toward the applications and scripts that read data from the controller or tell it what to do. Southbound interfaces face down, toward the devices the controller programs. Direction is the whole test: an API between controller and router is southbound whatever protocol carries it.
Underlay, overlay, fabric
The underlay is the physical network and the routing that makes every device reachable. The overlay is the set of virtual tunnels built on top of it, carrying user traffic between edge devices. Together they form the fabric.
Where automation tools fit
Configuration tools push changes through management-plane connections such as SSH or an API, which is why the exam lists them beside controllers. How the two named tools differ is on Ansible vs Terraform.
Frames on Control vs data plane
Practice frames written by our editors for study, not Cisco items. The 200-301 exam itself mixes multiple choice, drag-and-drop and lab-style items.
Frame 001 of 006 · 0 answered · 0 ok
Keys
1–5 or A–E pick an option (on choose-N frames they toggle; then Check answer) · ← → previous / next frame · ↑ ↓ move in the frame list
- Frame 001 of 006
A router forwards a packet to its destination IP address. Which of the following is the plane of the router where this action takes place?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
The management plane carries traffic to and from the device for administration, such as SSH or SNMP.
Note on B
The SBI is the API between an SDN controller and devices, not a plane of the router.
Note on C
The control plane builds the routing table with protocols such as OSPF, but it does not move each transit packet.
Note on D
Correct: forwarding a packet through the router, by looking up its destination and sending it out an interface, is data-plane work.
Best answer: D · why
A router’s work splits into three planes. The control plane learns and decides: routing protocols, ARP and building the routing table. The data plane (forwarding plane) moves transit packets using those tables, often in hardware. The management plane is the device’s own administration: SSH, SNMP and syslog. The southbound interface (SBI) is an SDN term for the API between a controller and devices.
- Frame 002 of 006
Which type of action is performed at the control plane in software-defined networking (SDN)?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
Setting up SSH access is a management-plane task.
Note on B
Inspecting packets as they pass through is data-plane work, not the control plane.
Note on C
Log analysis belongs to management and monitoring tools, not to the control plane.
Note on D
Correct: building and updating routing and forwarding decisions is the control plane’s job, which SDN centralizes in the controller.
Best answer: D · why
The control plane decides where traffic should go: routing protocols, path computation and routing table updates. In SDN, much of that work moves from each device to a central controller, which programs the devices’ forwarding tables through southbound APIs. The data plane forwards packets, and the management plane covers access and monitoring such as SSH, SNMP and logs.
- Frame 003 of 006
What best describes the role of the management plane in a software-defined network?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
Correct: the management plane is how administrators reach and configure devices, through SSH, Telnet, SNMP or controller APIs.
Note on B
Moving user data through the network is the data plane’s job.
Note on C
Routing decisions and path selection belong to the control plane.
Note on D
Security policy is enforced across all planes, so threat detection is not what defines the management plane.
Best answer: A · why
Network functions are grouped into planes. The data plane forwards user traffic. The control plane decides where traffic goes: routing protocols, STP, ARP. The management plane is how people and tools access and configure the devices: SSH (preferred over Telnet, which sends everything in clear text), SNMP, syslog, NTP and APIs. In SDN, the controller adds its own management interfaces on top.
- Frame 004 of 006
What is the primary difference between traditional networking and controller-based networking?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
This reverses the two: controller-based networks are the programmable ones, through northbound APIs.
Note on B
Controller-based networks still run on physical switches and routers; the controller manages them.
Note on C
Correct: a controller takes over much of the control logic for many devices, while traditional devices each run their own control and data planes.
Note on D
Controller-based designs cover wired campus, data center and WAN networks, not only wireless.
Best answer: C · why
In a traditional network, every router and switch runs its own control plane (routing protocols, STP) beside its data plane and is configured one box at a time. In a controller-based network, a central controller holds the policy and much of the control logic and programs devices through southbound APIs, while applications drive it through northbound APIs. Catalyst Center (formerly DNA Center) and SD-WAN are examples; a wireless LAN controller is the familiar small-scale case.
- Frame 005 of 006
In the context of network automation, which part of a software-defined network uses APIs to enable communication between the network infrastructure and applications?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
A fabric edge node is a switch where endpoints attach in an SD-Access fabric; it is part of the infrastructure, not an API layer.
Note on B
Correct: northbound APIs, usually REST, let applications and scripts talk to the controller that manages the network.
Note on C
The overlay is the logical network of tunnels built over the physical one; it carries traffic, not application API calls.
Note on D
The underlay is the physical network that carries the overlay’s tunnels, and it has no role in application APIs.
Best answer: B · why
In an SDN architecture, the controller sits in the middle. Northbound interfaces (NBIs), typically REST APIs, connect it to applications, scripts and orchestration tools. Southbound interfaces (SBIs), such as NETCONF, RESTCONF, OpenFlow or CLI and SNMP, connect it to network devices. Overlay, underlay and fabric describe how the network itself is built, not how applications talk to it.
- Frame 006 of 006
What is the primary purpose of southbound APIs in a software-defined network?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
That is the northbound interface: applications reach the controller through APIs, usually REST.
Note on B
Correct: southbound APIs such as NETCONF, RESTCONF or OpenFlow let the controller push configuration to network devices and read their state.
Note on C
Links between controllers are sometimes called east-west interfaces, not southbound ones.
Note on D
End users reach applications over ordinary application protocols, which is not an SDN API layer.
Best answer: B · why
An SDN controller has two main API directions. Northbound APIs face up, toward applications, scripts and orchestration platforms, and are usually REST. Southbound APIs face down, toward the switches, routers and access points the controller manages; common examples are NETCONF, RESTCONF, OpenFlow and, in practice, SSH CLI and SNMP. East-west interfaces connect controllers to each other.
Planes and APIs: short answers
Is ARP control plane or data plane?
Control plane. ARP builds the IP-to-MAC table that the data plane then uses when it rewrites frames.
Which interface does a script that pulls a device inventory from the controller use?
The northbound one. Anything above the controller, whether a dashboard, a Python script or a ticketing system, talks to it northbound; the controller then reaches the devices southbound.
Is QoS marking control plane or data plane?
Data plane: the router marks or queues each packet as it forwards it. The policy that tells it how was typed or pushed through the management plane.
Do cloud platforms and Kubernetes mean the same thing by these terms?
The idea carries over: a Kubernetes control plane schedules and tracks workloads while worker nodes run them. The CCNA uses only the networking meaning.