SDN Explained: Control Plane, Data Plane and OpenFlow for Network+

Software-defined networking separates the part of a network device that decides where traffic should go from the part that actually forwards it. Those two functions are the control plane and the data plane, and on a traditional switch or router they live in the same box.

SDN pulls the control plane out of every device and centralizes it in a controller, so the network is configured once as a whole rather than device by device.

Understand that sentence and the rest follows. Everything else — the benefits, the risks, the terminology — is a consequence of that one architectural move.

The Three Planes

CompTIA tests all three, and mixing them up is the common error.

Control plane. Decides how traffic should be handled. Routing protocols, spanning tree, MAC learning, and the logic that builds forwarding tables. In SDN this moves to the controller.

Data plane (also called the forwarding plane). Actually moves packets, according to the tables the control plane produced. This stays on the device, because forwarding has to happen at line rate in hardware.

Management plane. How you administer the device — SSH, the web interface, SNMP, the API. Distinct from both of the above, and frequently offered as a distractor.

The Architecture

Application layer — the business applications and network services expressing what they need: this traffic should be prioritized, these segments should be isolated.

Northbound interface — the API between applications and the controller. Usually REST. It lets software request network behaviour without knowing anything about the underlying hardware.

Control layer — the SDN controller, holding a complete view of the topology and computing forwarding decisions for the whole network.

Southbound interface — the protocol between the controller and the devices. OpenFlow is the classic example; NETCONF, RESTCONF and vendor APIs are also used.

Infrastructure layer — the switches and routers, now largely just fast forwarding engines.

The northbound/southbound distinction is examinable: northbound faces the applications, southbound faces the hardware. The mnemonic that works is that north is "up" toward software and south is "down" toward the wires.

Why Organizations Do It

• Central configuration. One policy change applies across hundreds of devices, instead of an engineer logging into each one and hoping the configurations stay consistent.
• Automation and programmability. The network becomes something software can change, which is what makes infrastructure-as-code possible for networking.
• A global view. The controller sees the whole topology, so it can make better path decisions than distributed protocols making local ones.
• Vendor flexibility. In principle, commodity hardware with the intelligence in software.
• Micro-segmentation. Fine-grained policy between workloads, which is the enabling technology for zero trust inside the data centre.

The Risks

The obvious one, and the one exams ask about: the controller is a single point of failure and a single point of compromise. Lose it and you may lose the ability to change the network — or, depending on the design, the network itself. Compromise it and an attacker can reroute, mirror, or block any traffic in the environment.

So SDN controllers are deployed in clusters, placed on an isolated management network, and given the strongest authentication available. The southbound channel must be encrypted and authenticated, because an attacker who can inject flow rules controls the network.

There is also a design distinction worth knowing: a network where devices cannot forward at all without the controller fails hard. Most production designs keep a degree of local forwarding intelligence so a controller outage degrades rather than destroys.

Related Terms

• SD-WAN — the same idea applied to wide area links, steering traffic across MPLS, broadband and cellular by policy. The most widely deployed form of SDN by far.
• NFV — network function virtualization. Running firewalls, load balancers and routers as software instances rather than dedicated appliances. Complementary to SDN but a distinct concept, and exams sometimes ask you to separate them.
• Intent-based networking — a layer above, where you declare the outcome and the system works out the configuration.
• Overlay and underlay — the virtual network built on top (often VXLAN) versus the physical network beneath it.
• Zero-touch provisioning — devices configuring themselves from the controller on first boot.

Network+ (N10-009) Exam Tips

• SDN separates the control plane from the data plane and centralizes control. This is the definition to have ready.
• Know all three planes, including the management plane.
• Northbound faces applications; southbound faces devices.
• OpenFlow is the classic southbound protocol.
• The controller is the single point of failure.
• Distinguish SDN from NFV — separating control from forwarding versus virtualizing network functions.
• SD-WAN is SDN applied to WAN links, and is examinable in its own right.

Security+ and Cloud+ Angles

Security+ (SY0-701) focuses on securing the controller and the southbound channel, and on SDN as the mechanism behind micro-segmentation and zero trust network design.

Cloud+ (CV0-004) notes that every cloud VPC is software-defined networking — the virtual switches, routers and security groups you configure through an API are exactly this architecture, which is why cloud networking is configuration rather than cabling.

Key Takeaways

• SDN separates the control plane from the data plane and moves control to a central controller.
• Three planes: control decides, data forwards, management administers.
• Northbound is the application-facing API; southbound talks to the hardware, often via OpenFlow.
• The benefits are central configuration, automation and a global topology view.
• The controller is the critical asset — cluster it, isolate it, and protect the southbound channel.
• SDN is not NFV, and SD-WAN is SDN applied to wide area links.