Before you start
Nothing required, but pairs well with Core Network Services if you haven't done that one yet.
CLUSTER 0.4
Every networking concept in this entire hub — VNets, load balancers, firewalls — is built on four ideas: the OSI model, TCP/IP, subnetting, and NAT. This is the one cluster worth genuinely understanding before moving on, not skimming.
Drag to rotate · click a node to jump to that topic
Think of it as: the shared vocabulary network engineers use to describe "where" a problem is
A 7-layer mental model of how data actually moves — from the physical cable, up through addressing and routing, to the application you're using. When someone says "that's a Layer 3 issue," they're using this model to be precise about what's broken.
Think of it as: the actual rules the internet runs on, in practice
Where OSI is theoretical, TCP/IP is what's really implemented everywhere. IP handles addressing (getting data to the right device); TCP handles reliability (making sure it arrives complete and in order).
Think of it as: dividing one office building into separate floors with their own directories
Instead of every device on a company's network being able to see every other device, subnetting splits the network into smaller segments — improving both organisation and security.
Think of it as: a single office receptionist handling calls for 200 employees who don't each have a direct outside line
Network Address Translation lets an entire office share one public internet address, translating traffic between the internet and each device's private internal address behind the scenes.
Every domain further into this hub — Networking, Identity & Security, even Compute — assumes you already have this mental model. Subnetting specifically trips up more beginners than almost anything else in networking; it's worth sitting with slowly rather than rushing through.
REAL-WORLD SCENARIO
A company's 200 employees all browse the internet using a single public IP address the outside world sees — that's NAT at work. Internally, their devices are subnetted into separate ranges for staff laptops, servers, and guest Wi-Fi, so a compromised guest device can't directly reach the finance server sitting on a different subnet.