CISCO CCNA Study guide Identify and describe the functions of each of the seven layers of the OSI reference model When looking at the OSI model, it should be understood that each layer serves a specific function. Each of the 7 layers functions are defined by OSI and can be applied and used by any network product vendor. By having all network hardware and software vendors referencing the same model, any network can be built in a non-vendor specific multi-vendor environment with an expectation that compatibility will not be an issue. Of course there is a lot to be said for have a primary network vendor for management and customizability. The OSI functions are as follows: Layer 7 Application The Application layer provides services to application processes that are at a higher level than the OSI model; examples: FTP, Telnet, E-mail. This layer synchronizes cooperating applications and establishes agreement on procedures for error recovery and control of data integrity. Messages, defined as a logical grouping of information, are processed from applications at this layer. Layer 6 Presentation The Presentation layer provides data representation, presentation and code formatting and conversion. It is responsible for making sure that data received from the network can be used by the application and it makes sure information from an application can be sent onto the network. Data management issues include encryption, compression, ASCII, JPEG, EBCDIC. Layer 5 Session The Session layer is used for the establishment, maintenance, and management of sessions between applications. It is also responsible for synchronizing communication between application on different hosts. Layer 4 Transport The Transport layer Segments, Sequences, and reassembles data to and from data streams. With TCP/IP, this layer is responsible also for communicating with upper layers through Port address. With TCP/IP there are two different categories of Ports. TCP (Transmission Control Protocol) is used for connection-based reliable delivery of data (example: HTTP or FTP services). UDP (User Datagram Protocol) is used for connection-less unreliable transmission delivery of data (example: Real-Audio, QuickTime streaming). The establishment, maintenance, and termination of virtual circuit is also included at this layer along with Informational Flow-Control, Transport Fault Detection and Recovery and Quality of Service are also concepts involved at this layer. In an Novell network, SPX is similar to TCP. Layer 3 Network This layer Packets or creates Datagrams and determines the best path including path determination and selection to move data from one location to another. The path information is provided to this layer by the protocol packets network information. With the TCP/IP protocol, IP provides the network information that is extracted from the IP address by the subnet mask. In a Novell network, IPX carries the network information for routing functions. A router will make its decisions by using its routing table located in RAM on the router. Concepts here may include routers, Layer 3 switches, routed protocols, and logical addressing. Layer 2 Data-Link This layer Frames and physically addresses the data with a MAC address provides reliable transmission across a PHYSICAL link while also handling error notification, network topology, and flow control. Bridges, Layer 2 Switches, and also items such as Frame-Relay operate at this layer. This layer is comprised of two sub-layers. LLC sub-layer – This layer deals with framing, flow control, error detection and control, and MAC sub-layer addressing. IEEE 802.2 is an example of an LLC protocol. MAC sub-layer – This layer manages access to shared media such as CSMA/CD for Ethernet or Token management for Token Ring. Layer 1 Physical This layer converts frames to Bits and provides the electrical, mechanical, procedural, and functional means for activating and maintaining the physical link between systems. Binary transmission including the sending and receiving of binary data using various device interfaces occurs at this layer. Describe connection-oriented network service and connectionless network service, and identify the key differences between them There are two basic types of Transport layer methods: Connection-oriented and Connection-less. Connectionorieente network services are reliable, guarantee delivery of data while connectionless network services are unreliable, and provide only best effort delivery. With TCP/IP there are two different categories of services. ı TCP (Transmission Control Protocol) is used for connection-based reliable delivery of data (example: HTTP, FTP, Telnet services). ı UDP (User Datagram Protocol) is used for connection-less transmission with unreliable best effort delivery (example: RealAudio, QuickTime streaming, and TFTP). ı Transport (TCP, UDP) Describe Datalink addresses and Network addresses, and identify the key differences between them Data Link addresses (Data-link layer) are for the most part referred to as flat address space unique addresses. We mostly relate them to the term physical or hardware addressing. With most networking devices, those that support the Data Link functions, usually have there addresses integrated directly into the circuitry of the device. For example, the MAC (Media Access Control) address is used on Ethernet and Token-Ring networking device to uniquely represent the device to the network segment. Example Address: 00-AA-BB-CC-DD-EE (MAC Address) Network Addresses (Network Layer) are logical addresses that are used for path selection, route determination and selection. The relationship between a network device and a network address is logical and therefore can be managed or changed based on network design. It is important to keep in mind that when looking at logical address the entire network must be observed in order to have unique logical groupings of network devices. The Internet for example requires that all IP or logical addresses are unique. An ISP will assign these addresses to ensure they are valid and also routed properly. Example Address: 192.168.100.2 where 192.168.100 is the network and 2 is the individual host ID ı Network (IP, ARP, ICMP, IGMP) ı Data-link (MAC address and Frames) ı Physical (Media) Identify at least 3 reasons why the industry uses a layered model Communications environments typically layer functions of the application processing. The most popular of network layered models is the OSI seven-layered model. The OSI model breaks the networking process into layers, each with having a distinct responsibility or function. TCP/IP communications also can be described with the DOD model. Here are at least four reasons for the division of network functions: ı Reduce complexity of networking in several manageable sub-layers by dividing it into distinct, more easily learned operational sub-layers ı Clarify general functions by dividing the interrelated aspects of network operation into less complex elements ı Define standard interface for plug-and-play compatibility and multi-vender integration to allow manufacture’s to specialize in design and development on modular functions ı Prevent changes in a single area from impacting other areas so each area can evolve more quickly DOD Model: With the TCP/IP protocol, specific functions are also separated into layers. This model is called the DOD (Department of Defense) model with the following layers: ı Application (User interface, Presentation, Compression, Session management) ı Transport (TCP, UDP) ı Internet (IP, ARP, ICMP, IGMP) ı Network (Physical communication) OSI Model: For general Networking, specific functions are also separated into seven layers. This model is called the OSI (Open Systems Interconnect) model with the following layers: ı Application (User Application Interface) ı Presentation (ASCII, EBCDIC, JPEG) ı Session (Session Management) Define and explain the 5 conversion steps of data encapsulation The process of data encapsulation is a process that makes use of the layered model concept in that each layer depends on the layer above and below relative to OSI. The lower layer uses encapsulation to put the data from the upper layer into its own encapsulated data field. The five steps of conversion are as follows in both summary and detail. Details of Encapsulation: 1. A user sends a message and the alphanumeric characters are converted to use the internetwork which is the Data. The Application, Presentation, and Session participate in this process. 2. The Data is packaged for the internetwork transport into Segments and the transport function will determine if the message hosts at BOTH ends can reliably communicate. The Transport layer participates in this process. 3. The segment is placed into a Packet or Datagram along with a network header including the source and destination logical addresses. Network devices can now send packets along a Path. The Network layer participates in this process. 4. Each packet or datagram must be placed into a Frame. The frame header will contain information that is required to complete the data link functions. This includes adding the source and destination physical addresses (likely the MAC) into the frame header. The Datalink participates in this process. 5. The frame is encoded the data link frame into a Bit pattern of binary ones and zeros for transmission on the physical medium or wire. Clocking facilities enable devices to organize the bits as they travel through the network. The Physical layer participates in this process. Summary of Encapsulation: User Message Sent and here we go… 1. Message to Data (Application, Presentation, Session) 2. Data to Segment (Transport Layer) 3. Segment to Packet or Datagram (Network Layer) 4. Packet or Datagram to Frame (Data-Link Layer) 5. Frame to Bits (Physical Layer) Define flow control and describe the three basic methods used in networking Flow control is used to ensure data reliability. In basic terms, flow control is used to control the flow of a message from the sender to the receiver by starting and stopping the message transmission as necessary based on the receivers buffer. TCP at the Transport layer uses Windowing as a method flow control. Two mechanisms used with windowing ensure the delivery of segments with no duplication or data loss. These include Acknowledgements and Negative Acknowledgements and also sequencing and necessary retransmission. All these technologies work together to provide data reliability and optimal performance. Summary of methods of Flow control ı Buffering ı Sequencing and Windowing ı Acknowledgments/Negative Acknowledgments for retransmission List the key internetworking functions of the OSI Network Layer and how they are performed in a router The following are KEY internetworking functions of the OSI model: ı Establish network addresses Example: With the IP address 192.168.100.5, 192.168.100.0 is the network address and 5 is the hosts address when using a standard 255.255.255.0 class C subnet mask. ı Select the best path through a network Example: In a routers routing table the lower metric or cost of a route will receive priority if more than a single route to a target network exists ı Use a two part address Example: With the IP address 192.168.100.5, 192.168.100.0 is the network address and 5 is the hosts address when using a standard 255.255.255.0 class C subnet mask. ı Uses a routed protocol to carry user packets Example: TCP/IP, IPX/SPX, Appletalk, DECNet ı Use routing protocols between routers Example: RIP (Routing Information protocols), IGRP (Interior Gateway Routing Protocol), OSPF (Open Shortest Path First), EGRP (Exterior Gateway Routing Protocol), BGP (Boarder Gateway Routing Protocol) ı Setup and maintain routing tables Router(config)# ip route target-network mask next-hop Router(config)# ip route 0.0.0.0 0.0.0.0 next-hop Both Establish default next hop or gateway of last resort ı Discover networks and adapt to internetwork topology changes These are usually done with dynamic routing protocols such as RIP, OSPF, and IGRP or EIGRP ı Contain broadcasts These are usually done normally with routers. However special considerations are required for IPX SAP traffic Differentiate between the following WAN services: Frame Relay, ISDN/LAPD, HDLC, & PPP (FR) Frame Relay Overview Frame Relay is a high-performance wide-area network (WAN) protocol that operates at the physical and data-link layers of the OSI model. Originally designed for use across ISDN network interfaces, Frame Relay is now used over a variety of other network interfaces. Frame Relay features include: ı Data Communications Interface between user devices and network devices across WAN interfaces ı Communication speeds from 56Kbps to 2Mbps typically ı More efficient than its predecessor X.25 ı Support for Fiber Optic cabling and digital transmission ı Elimination of error correction and flow-control for optimal performance ı LMI (Local Management Interface) for extended functionality ı Standardized by ITU-T (International Telecommunications Union) and ANSI (American National Standards Institute) Frame Relay DCE and DTE Frame Relay devices can be categorized into the DTE and DCE areas: 1. Data terminal equipment (DTE) is customer owned end-node and internetworking devices which may include terminals, personal computers, routers, and bridges. 2. Data Circuit Terminating Equipment (DCE) are considered carrier-internetworking devices. These devices will typically be packet switches, Frame-Relay routers, or other devices configured as DCE. Both DTE and DCE are logical communication devices in that DTE initiates communications and DCE responds. Frame Relay Virtual Circuits Frame Relay provides connection-oriented data link layer communications implemented as virtual circuits. A Frame Relay Virtual Circuit is a logical connection created between a DTE device and a DCE device across a Frame Relay packet switched network or PSN. A virtual circuit can pass through several intermediate data circuit terminating equipment (DCE) devices or switches in a Frame Relay PSN. Multiple virtual circuits can also be multiplexed into a single physical circuit for transmission across the network. Virtual circuits are separated into two categories: 1. Switched Virtual Circuits (SVC) A SVC is one of the two types of virtual circuits that are used in Frame Relay. SVCs are temporary connections used only when there is a non-dedicated data transfer between DTE devices across the Frame Relay network. There are four operation states of a SVC. ı Idle – DTE to DTE connection is active with no data transfer ı Call setup – A virtual circuit between DTE devices is established ı Call termination -A virtual circuit between DTE devices is terminated ı Data transfer – Transmission of data between DTE devices over a virtual circuit 2. Permanent Virtual Circuits (PVC) PVCs are permanently established connections used when there are frequent and consistent data transfer between DTE devices over a Frame Relay network. PVCs do not require call setup and termination as SVCs do. PVCs have only two states. When data transfer is requested, it starts immediately because there is no circuit initialization. ı Idle – DTE to DTE connection is active with no data transfer ı Data transfer – Transmission of data between DTE devices over a virtual circuit Frame Relay (DLCI) Data Link Connection Identifier Frame Relay virtual circuits are identified by their data link connection identifiers or DLCI. DLCI have numeric values that are usually assigned by the service provider or public carrier. Although they are typically assigned by the service provider they are only important at a local level as the service provider are not unique in the Frame Relay network. Also, it is not unusual for two DTE devices connected with a virtual circuit to use different DLCI values when communicating on the same connection. (ISDN/LAPD) Integrated Services Digital Network overview ISDN is a group of communication protocols designed to transmit data, voice, and other source information over a public telephone network or PSTN. ISDN provides a set of digital services deliver voice, graphics, text, multimedia or other data to end devices. As of today, ISDN has become one of the leading technologies for transmitting data over older telephone networks at higher speeds. ISDN Standards ISDN covers standards that use the physical, data link, and network layers of the OSI model. ı Physical Layer – ISDN Basic Rate Interfaces (BRI) and ISDN Primary Rate Interfaces (PRI) are defined at this layer ı Data Link Layer – The ISDN data link layer is based on Link Access Procedure D channel (LAPD). ı Network Layer – The network layer specifies user-to-user, circuit switched, and packet-switched connections ISDN Network Components There are three main ISDN components: image\ebd_ebd1.gif 1. ISDN terminal equipment There are two types of terminal equipment, Type I TE1 and Type 2 TE2. TE1 is a specialized ISDN terminal used to connect ISDN through a four wire twisted pair link. TE2 is a non-ISDN DTE device that connects to ISDN via a terminal adapter TA. 2. ISDN termination equipment These are called NT devices and they specify the connection of the four wire subscriber devices to 2 wire local loops. There are three types of NT devices: 1. NT1 customer premise equipment 2. NT2 for digital private branch exchanges 3. NT1/2 that provides functionality of both NT1 and NT2 devices 3. ISDN reference points 1. R – The reference point between non-ISDN equipment and TA 2. S – The reference point between user terminals and an NT2 3. T -The reference point between NT1 and NT2 devices 4. U – The reference point between NT1 devices and line termination equipment (HDLC) High-Level Data Link Control services overview HDLC or High-Level Data Link Control protocol is a popular standard that supports three modes of transmission where SDLC (Synchronous Data Link Control) supports only one. 1. Normal response mode (NRM) is a transfer mode implemented with SDLC or HDLC. With it secondary cannot communicate with a primary until the primary gives permission. 2. Asynchronous response mode (ARM) HDLC only allows secondary to initiate communications with a primary without explicit permission 3. Asynchronous balanced mode (ABM) HDLC only allows a combined node as it can act as a Primary or Secondary station. HDLC is the default encapsulation on Cisco router serial links although as we will cover further PPP is often preferred for its enhanced services. HDLC comes in various subsets including NRM (Normal Response Mode), LAP (Link Access Procedure), LAPB (Link Access Procedure Balanced), LAPD (Link Access Procedure for ISDN D-Channel), and LAPM (Link Access Procedure for modems) (PPP) Point to Point Protocol overview PPP is looked at as the successor to SLIP or Serial Line IP. PPP provides router to router and host to network connections over both synchronous and asynchronous circuits. PPP supports a number of network layer protocols including Novell IPX and DECnet. PPP Standards are defined by ISO. PPP operations include: 1. Encapsulation supported by HDLC 2. Link Control Protocol LCP to establish, configure and test data link connections 3. Network Control Protocols (NCP’s) A number of NCPs are used to establish, maintain, and configure different network layer protocols Recognize key Frame Relay terms and features Introduction to Frame-Relay Frame Relay is based on VC’s or virtual circuits that offer an on demand throughput with a small amount of overhead. Frame relay encapsulates upper-layer data and provides DTE connections to the communications cloud or DCE that is basically a Frame Relay switch. Frame relay is a hybrid X.25 packet switched protocol. It has been used to upgrade many different types of packet switched network across the world as end user devices are requiring more bandwidth demands. Typical Frame Relay operates over PVCs (Permanent Virtual Circuits), which specifies that connections are static based on configuration. Multiple PVCs can interconnect DTEs across a Frame Relay network to a single destination. Each PVC is identified by a DLCI that provides the addressing for the routers Frame Relay support to the WAN. LMI or Local Management Interface is a term that refers to the overhead for connection setup and maintenance between the router and the switch. The Frame Relay Stack Frame Relay functions at the lower layers of the OSI model. It uses physical layer facilities such as fiber and offers high speed WAN transmissions to and from end nodes and LANs. Frame Relay encapsulates information from the upper layers of the OSI stack. It offers the following services: ı Transmission data rates of 56 to 64kbps, T1 to 2Mbps, and DS-3 speeds to 45Mbps. ı Best-Effort unreliable link which in most ways optimizes performance List commands to configure Frame Relay LMIs, maps, and subinterfaces Introduction to Frame-Relay Basic Frame Relay Interface Configurations Frame Relay is based on VC’s or virtual circuits that offer an on demand throughput with a small amount of overhead. Frame relay encapsulates upper-layer data and provides DTE connections to the communications cloud or DCE that is basically a Frame Relay switch. Frame relay is a hybrid X.25 packet switched protocol. It has been used to upgrade many different types of packet switched network across the world as end user devices are requiring more bandwidth demands. Sets Frame Relay encapsulation: Router (config-if) # encapsulation frame-relay [ietf] [Cisco] if the default but [IETF] for non-hardware specific solutions is required LMI Overview and Configuration Local Management Interface (LMI) is a set of enhancements to the primary Frame-Relay specification. LMI provides a number of functions including the definition of keep-alive and status messages sent between the Frame-Relay switch and the Frame-Relay DTE. With LMI, the Frame-Relay switch and DTE device exchange keep-alive messages every 10 seconds. Also, every 60 seconds a complete status is generated listing all DLCI active for each Frame-Relay interface. Selects LMI type -This only operates with Cisco equipment at both sides from router to the switch: Router (config-if) # frame-relay lmi-type {ansi | cisco | q933a} Notice that Cisco offers three types of LMI support: ı ANSI ı Q933A (ITU-T (CCITT)) ı Cisco Frame-Relay Interface DLCI versus Frame-Relay MAP and Configuration Examples Instead of adding PVCs to maintain a full-mesg topology and using inverse ARP to maintain a coimplete mapping of all remote local network addresses, Frame-Relay map statements can be used to statically map local DLCIs to unknown remote network layers addresses. Frame-Relay configuration is tough to understand when is comes to when you should use Frame-Relay map statements and when to use Frame-Relay interface-DLCI statements. Defines how to reach a destination -the Frame Relay map command is used to statically map destination network protocols addresses to a specific DLCI: Router (config) # frame-relay map protocol protocol-address DLCI [broadcast] [ietf | cisco] Example: Router 1 Interface s0 ip address 172.16.1.1 255.255.255.0 encapsulation frame-relay frame-relay map ip 172.16.1.2 101 Router 2 Interface s0 ip address 172.16.1.2 255.255.255.0 encapsulation frame-relay frame-relay map ip 172.16.1.1 201 Frame Relay Point-to-Point and Multipoint Subinterfaces A point-to-point Frame-Relay subinterface has a single DLCI associated with it. A point-to-point subinterface does not use frame relay “map” statements. If multiple point-to-point interfaces are configured on a single router interface, each sibinterface will require its own IP addressing information where each is on a different subnetwork. Again, by providing this interface, point-to-point subinterfaces completely bypass the DLCI to network address mapping issues. Example (points of interest are highlighted): Interface s0 No ip address encapsulation frame-relay ! interface serial0.1 point-to-point ip address 172.16.1.1 255.255.255.0 frame-relay interface-dlci 101 ! interface serial0.2 point-to-point ip address 172.16.2.1 255.255.255.0 frame-relay interface-dlci 201 ! A multipoint sub-interface can have multiple DLCIs assigned to it. Multipoint subinterfaces share many of the characteristics of a physical Frame-Relay interface. Frame-relay map statements can be used with multipoint subinterfaces. Also, inverse ARP may be used with configured multipoint interfaces. Example: Interface s0 No ip address encapsulation frame-relay ! interface serial0.1 multipoint ip address 172.16.1.1 255.255.255.0 frame-relay interface-dlci 501 frame-relay interface-dlci 502 ! Frame Relay Configuration Example #1 image\ebd_ebd2.gif Router A hostname Router ! ip subnet zero frame relay switching ! interface Ethernet0 no ip address no ip directed broadcast shutdown ! interface Serial0 no ip address no ip directed broadcast encapsulation frame relay keepalive 15 clockrate 2000000 frame relay lmi type ansi frame relay intf type dce frame relay route 100 interface Serial1 200 frame relay route 101 interface Serial1 201 ! interface Serial1 no ip address no ip directed broadcast encapsulation frame relay keepalive 15 clockrate 2000000 frame relay intf type dce frame relay route 200 interface Serial0 100 frame relay route 201 interface Serial0 101 ! ip classless ! line con 0 transport input none line aux 0 line vty 0 4 end Router B ! hostname Router ! interface Ethernet0 ip address 10.0.0.1 255.0.0.0 ! interface Serial0 ip address 192.168.1.1 255.255.255.0 encapsulation frame relay ! interface Seriall no ip address shutdown ! router rip network 10.0.0.0 network 192.168.1.0 ! ip classless ! line con 0 line aux 0 line vty 0 4 login ! Router C ! hostname Router ! interface Ethernet0 ip address 172.16.0.1 255.255.0.0 ! interface Ethernetl no ip address shutdown ! interface Serial0 ip address 192.168.1.2 255.255.255.0 encapsulation frame relay ! interface Seriall no ip address shutdown ! router rip network 192.168.1.0 network 172.16.0.0 ! no ip classless ! line con 0 line aux 0 line vty 0 4 login ! Identify PPP operations to encapsulate WAN data on Cisco routers PPP LCP Configuration Options Feature Operation Protocol 1. Multi-link Load balancing with multiple links Multi-link 2. Authentication Require a password PAP Perform Challenge Handshake CHAP 3. Compression Compress data at source /reproduce data at destination Stacker /Predictor 4. Error Detection Monitor data dropped on link Quality Prevent frame looping Magic Number Configuring PPP Defines encapsulation type as ppp Router (config-if) # encapsulation ppp Sets password checking for incoming calls Router (config-if) # ppp authentication pap Forces incoming calls to answer password challenges Router (config-if) # ppp authentication chap Sets host name and password for call verification Router (config-if) # username name password password Example (Cisco 804 ISDN Router): ! hostname Cisco804 ! dial-peer voice 1 pots call-waiting ring 0 port 1 destination-pattern 5551212 ! dial-peer voice 2 pots call-waiting ring 0 port 2 destination-pattern 5551212 ! pots country US ip subnet-zero no ip source-route ! ip name-server 104.78.15.1 isdn switch-type basic-ni ! interface Ethernet0 ip address 192.168.1.254 255.255.255.0 no ip directed-broadcast no ip proxy-arp ip nat inside ! interface BRI0 no ip address no ip directed-broadcast encapsulation ppp dialer pool-member 1 isdn switch-type basic-ni isdn spid1 80257840610101 5784061 isdn spid2 80257840910101 5784091 isdn incoming-voice modem ppp authentication chap pap callin hold-queue 75 in ! interface Dialer0 no ip address no ip directed-broadcast no cdp enable ! interface Dialer1 description ISP ip address 192.212.153.226 255.255.255.0 no ip directed-broadcast no ip proxy-arp ip nat outside encapsulation ppp no ip split-horizon dialer remote-name Cisco1 dialer idle-timeout 900 dialer string 4717221 class DialClass dialer hold-queue 10 dialer load-threshold 10 either dialer pool 1 dialer-group 1 ppp authentication chap pap callin ppp chap hostname cichost ppp chap password cicpass ppp pap sent-username cichost password cicpass ppp multilink ! ip nat inside source list 18 interface Dialer1 overload ip classless ip default-network 192.168.0.1 ip route 0.0.0.0 0.0.0.0 Dialer1 ip route 0.0.0.0 0.0.0.0 192.168.1.2 ! ! map-class dialer DialClass dialer isdn speed 56 access-list 18 permit 192.168.1.0 0.0.0.255 dialer-list 1 protocol ip permit ! line con 0 exec-timeout 0 0 transport input none stopbits 1 line vty 0 4 exec-timeout 0 0 login local ! end Describe Cisco's implementation of ISDN BRI ISDN provides a Wide Area Network (WAN) transport method for all most routing protocols including the most popular: TCP/IP, IPX/SPX, NetBeui and of course several others. It has the ability to inter-operate with various other WAN services including X.25 and Frame Relay. Cisco implements the following ISDN services on their routers: ISDN Features Include ı Multiple, independent B channels BRI is often referred to as 2B+D. This interface offers 2 bearer channels at 64kbps and an added 16kbps-signaling channel. These B channels can be used for voice and data transmission. Narrow-band ISDN is circuit switched oriented. The B channel is the most basic circuit-switching unit. The D channel carries signaling information (call setup) to control calls on B or Bearer channels. PRI in North America and Japan, 23 bearer (B) channels and one 64kbps D channel (a T1/DS1 facility) ı Bandwidth on demand The bandwidth on demand option allows a pre established load threshold setting to add available B channel resources to an ISDN call. ı Pre establish table entries on a destination router and incoming ISDN call screening Pre established table entries on a destination router provide incoming ISDN call screening. The destination will act on entries that specify which calls from a source router the destination will accept. ı PPP encapsulation PPP encapsulation offers efficient capabilities over other standard access methods to the Internet. These improvements include access control and compression methods. ı DDR(Demand Dial Routing) DDR improves the usage costs of ISDN by setting conditions that make the ISDN call, then disconnecting the call session when the link is not needed. Watch this though because several carries charge for each connect and disconnect. ı SNMP based network management Administrators can use an SNMP based network management application to control the ISDN interfaces. Routers use an ISDN Management Information Base (MIB) and can act as managed objects. Log into a Router in both user and privileged modes Cisco routers are configured from an interface that runs on the router console or from a terminal session. They can also be configured using remote access over a network. The Cisco Internetwork Operating System (IOS) software provides a secure password protected command interpreter referred to as “EXEC”. “EXEC” will interpret the commands typed and then fulfill the corresponding or requested operations. A user must be logged in to the router before an EXEC command can be issued. “EXEC” has two basic levels of access: ı User mode – Supports typical tasks including commands for monitoring basic router status ı Privileged mode – Supports typical tasks including commands for modifying router configuration Example A shows both User and Privileged mode: The assumption now is that you have connected via console or network to the router and have logged in. The first mode that will appear is the user mode. The “enable” command is issued to access Privileged mode. Router> User mode prompt Router> enable Password: ******** Router# Privileged mode prompt To return and log off the router the following commands are issued: Router# disable Router> Router> exit Other Router Mode Summary A Cisco router can be placed in several modes. Each mode provides functions as follows: ı User EXEC mode A "look only" mode in which the user can view some information about the router, but cannot change anything. ı Privileged EXEC mode Supports the debugging and testing commands, detailed examination of the router, manipulation of configuration files, and access to configuration modes. ı Setup mode Presents an interactive prompted dialogue at the console that helps the new create a first time basic configuration. ı Global configuration mode Implements powerful one line commands that perform simple configuration tasks. ı Other configuration modes Provide more complicated multiple line configurations. ı RXBOOT mode A maintenance mode that can be used, among other things, to recover lost passwords. Use the context-sensitive help facility The basic rules for help on a router are: ı If a bad command is entered, “% Unknown command or computer name, or unable to find computer address” will display on the screen. ı A “?” will display help for all or selected commands for example “Router>?” ı A “?” issued with a command may function in two ways: ı The first for example “Router>clock ?” would show the necessary missing parameters for that command. ı The second example “Router>clock?” would show ALL the commands starting with the letters “clock” and NOT the parameters for the “clock” command. WATCH THIS! ı Command entry and processing features supported include: ı Symbolic translation ı Keyword compression ı Command prompting ı Last command recall

or ı Syntax checking Use the command history and editing features The following table highlights the Cisco IOS command editing features. Move to the beginning of the command line Move to the end of the command line Move forward one character Move back one character Backs you out of configuration mode

Up arrow or last (previous) command line Down arrow or more recent command recall Entry completion Move back one word Move forward one word Show history Show command buffer Terminal history size Set command buffer size Terminal no editing Disable advanced editing features Terminal editing Re-enable advanced editing Examine router elements (RAM, ROM, CDP, show) Router Components ı RAM /DRAM Hint: Holds all running information when router is powered on, large around 8 to 32mb. Stores routing tables, ARP cache, fast switching cache, packet buffering (shared RAM), and packet hold queues. RAM also provides temporary and running memory for the router's configuration file while the router is powered on. RAM memory is cleared when the router is shutdown or reloaded. ı NVRAM Hint: Holds configuration file for router startup, small around 32k. Non volatile RAM stores the router's backup configuration file and retains information when the router is shutdown or reloaded. ı Flash -Hint: Holds IOS when router is powered down, large around 8 to 32mb. Erasable, reprograammabl ROM. Flash memory holds the operating system image and micro-code and allows the update of the IOS software without removing or replacing microchips. Flash content is retained when you power down or restart. Another note is that multiple copies of the IOS can be stored in flash memory if storage space permits. ı ROM Hint: Holds POST and BOOTSTRAP code when router is powering up. Contains power on diagnostics, a bootstrap program, and operating system software. Unfortunately, to upgrade one must remove and replace chips on the main board. ı Interfaces Hint: Where data moves in and out of the router. Network connections through which packets enter and exit the router. Interfaces are on the motherboard or on separate interface modules. Router Modes ı User EXEC mode A "read only" mode in that the user can view some information about the router, but cannot change anything or view specific configuration information. ı Privileged EXEC mode Supports the debugging and testing commands, detailed examination of the router, manipulation of configuration files, and access to configuration modes. All information is available to an administrator in this mode along with the ability to change system settings. Manage configuration files from the Privileged exec mode Configuration command summary Router configuration information can be displayed by several methods. “EXEC” mode commands can be used to configure from either a virtual terminal or a console terminal. Privileged mode commands can also be used to load a configuration from a network TFTP server meaning an administrator can maintain centralized configuration at a single site. Configure terminal Configure manually from the console terminal Configure memory Load configuration information from NVRAM Copy tftp running config Load configuration information from a network TFTP server. Copy run startup config Store the current configuration in RAM into NVRAM. Show running config Display the current configuration in RAM Copy running config tftp Store the current configuration in RAM on a network TFTP server Show startup config Display the saved configuration, which is the contents of NVRAM Erase startup config Erase the contents of NVRAM. Managing contents of NVRAM (Start Configuration) configure memory Loads configuration information from NVRAM. erase startup config or clear startupconnfig Erases the contents of NVRAM copy running config startup config Stores the current configuration in RAM into NVRAM show startup config Display the saved configuration, which is the contents of NVRAM NVRAM to RAM A current copy of the startup configuration in NVRAM can be copied to RAM using the “copy startupconnfi run” command. RAM to NVRAM A current copy of the running configuration stored in RAM can be copied to NVRAM using the “copy running-config start” command. TFTP server A current copy of the configuration currently in RAM can be stored on a TFTP Server using the “copy running-config tftp” command. You can configure the router by retrieving the configuration file stored on one of your network server by entering the “copy tftp running config command. Control router passwords, identification, and banner Passwords A system can be secured by using passwords to restrict local and network access. Passwords can be established both on individual commands and for the privileged mode and through various access methods such as the console port. Enable Password Router(config)# enable password admin Secret (Encrypted) Password Router(config)# enable secret admin Virtual Terminal Password Router(config)# line vty 0 4 Router(config line)# login Router(config line)# password cisco Console Password Router(config)# line console 0 Router(config)# login Router(config line)# password cisco Router Identification The prompt is automatically changed when the hostname of the router is changed UNLESS an overridding prompt is entered. If that is the case then the configured prompt string will always display unlesss in global configuration mode or below. Router Name Router(config)# hostname Chicago Chicago# Prompt String Router(config)# prompt Enter_Command_> Router(config)#exit Enter_Command_> Login Banner Login banners come in different forms and are displayed prior to login to a router. The two most common are the “Day-to-Day” banner also referred to as the MOTD or Message of the Day, and of course the LOGIN banner which unlike the MOTD would not usually be changed on a daily basis but would instead be more static. Prior to logging in, the MOTD is displayed before the login banner. Login Banner Chicago(config)# banner login z Welcome to the Chicago router. z Message of the Day Banner Chicago(config)# banner motd z Have a nice day and don’t forget to upgrade your IOS before 12/31/99! z Interface Description Per Interface Chicago(config)# interface e0 Chicago(config if)# description Chicago Accounting Department Identify the main Cisco IOS commands for router startup Commands Relating to Startup Show start up config or show config Display the backup configuration files Show running config Display the active configuration files Clear startup config Delete the backup configuration file in NVRAM Erase startup config Delete the backup configuration file in NVRAM Reload The reload command will reboot the router through the entire configuration process Setup The last command is used to enter setup mode from the privileged EXEC prompt Initializing the Router 1. The generic bootstrap loader executes from ROM on the CPU card 2. The operating system source is determined from the boot field of the configuration register 3. The operating system image is loaded into low addressed memory 4. The saved configuration file in NVRAM is loaded into main memory and executed sequentially 5. If no valid configuration file exists in NVRAM, the operating system enters SETUP mode, a prompt driven initial configuration routine Enter an initial configuration using the setup command The SETUP command issued from EXEC mode is a prompt driven configuration utility for basic router configuration. Advanced configuration must still be done from the standard configuration interface in config mode. Brackets [ ] indicate a defaulted value for the selection. Example #1 Router# setup ---System Configuration Dialog ---Continue with configuration dialog? [yes/no]: y At any point you may enter a question mark '?' for help. Use ctrl-c to abort configuration dialog at any prompt. Default settings are in square brackets '[]'. Basic management setup configures only enough connectivity for management of the system, extended setup will ask you to configure each interface on the system Would you like to enter basic management setup? [yes/no]: y Configuring global parameters: Enter host name [Router]: Chicago The enable secret is a password used to protect access to privileged EXEC and configuration modes. This password, after entered, becomes encrypted in the configuration. Enter enable secret []: secret The enable password is used when you do not specify an enable secret password, with some older software versions, and some boot images. Enter enable password [password]: enable The virtual terminal password is used to protect access to the router over a network interface. Enter virtual terminal password: cisco Configure SNMP Network Management? [no]: n Current interface summary Interface IP-Address OK? Method Status Protocol BRI0 unassigned YES unset administratively down down BRI0:1 unassigned YES unset administratively down down BRI0:2 unassigned YES unset administratively down down Ethernet0 unassigned YES unset administratively down down Enter interface name used to connect to the management network from the above interface summary: Ethernet0 Configuring interface Ethernet0: Configure IP on this interface? [no]: y IP address for this interface: 192.168.1.1 Subnet mask for this interface [255.255.255.0] : 255.255.255.0 Class C network is 192.168.1.0, 24 subnet bits; mask is /24 The following configuration command script was created: hostname Chicago enable secret 5 $1$/Hw9$P3KFbyh5RGeEOD5cQFrWV/enable password enable line vty 0 4 password cisco no snmp-server ! no ip routing ! interface BRI0 shutdown no ip address ! interface Ethernet0 no shutdown ip address 192.168.1.1 255.255.255.0 ! end [0] Go to the IOS command prompt without saving this config. [1] Return back to the setup without saving this config. [2] Save this configuration to nvram and exit. Enter your selection [2]: 2 Building configuration... 00:04:14: %LINK-3-UPDOWN: Interface BRI0:1, changed state to down 00:04:14: %LINK-3-UPDOWN: Interface BRI0:2, changed state to down 00:04:17: %LINK-3-UPDOWN: Interface Ethernet0, changed state to up Use the enabled mode 'configure' command to modify this configuration. Chicago# Copy and manipulate configuration files Configuration command summary Router configuration information can be displayed by several methods. Privileged mode commands can be used to configure from either a virtual terminal or a console terminal. Privileged mode commands can also be used to load a configuration from a network TFTP server allowing a network administrator to a maintain centralized configuration at a single site. Configure terminal Configure manually from the console terminal Configure memory Load configuration information from NVRAM Copy tftp running config Load configuration information from a network TFTP server. Copy run startup config Store the current configuration in RAM into NVRAM. Show running config Display the current configuration in RAM Copy running config tftp Store the current configuration in RAM on a network TFTP server Show startup config Display the saved configuration, which is the contents of NVRAM Erase startup config Erase the contents of NVRAM. Managing contents of NVRAM (Start Configuration) configure memory Loads configuration information from NVRAM. erase startup config or clear startupconnfig Erases the contents of NVRAM copy running config startup config Stores the current configuration in RAM into NVRAM show startup config Display the saved configuration, which is the contents of NVRAM NVRAM to RAM A current copy of the startup configuration in NVRAM can be copied to RAM using the “copy startupconnfi run” command. RAM to NVRAM A current copy of the running configuration stored in RAM can be copied to NVRAM using the “copy running-config start” command. TFTP server A current copy of the configuration currently in RAM can be stored on a TFTP Server using the “copy running-config tftp” command. You can configure the router by retrieving the configuration file stored on one of your network server by entering the “copy tftp running config command. List the commands to load Cisco IOS software from: flash memory, a TFTP server, or ROM Registers Registers control the boot and startup processes. Uses include changing and managing the IOS image and controlling the startup process and bypassing the startup configuration. The registers can be changed with the “Router(config)# config-register #x####” command where #x#### is represented as one of the following as basic settings: Register Setting Result 0x2101 or 0x101 Boot from ROM and NOT Flash IOS, used when upgrading IOS, startup-config is still processed 0x2102 or 0x102 Normal Mode Flash IOS and startup-config processed 0x2142 or 0x142 Boot from Flash IOS, startup-config is NOT processed 0x2141 or0x141 Boot from ROM and NOT Flash IOS, used when upgrading IOS, startup-config is also NOTl processed Specifying the Cisco IOS Software Location The “boot” commands in the NVRAM configuration are processed if there is a 2 in the first position of the register value. For example 0x2101 Router# configure terminal Router(config)# boot system flash {ios-filename} Router(config)# boot system tftp {ios-filename} {tftp-address} Router(config)# boot system rom [Ctrl Z] Router(config)# copy running config startup config The current value of the register can be viewed via the “Router#show ver” command Example: Chicago#show ver Cisco Internetwork Operating System Software IOS (tm) C800 Software (C800-G3-MW), Version 12.0(1)XB1, RELEASE SOFTWARE (fc1) TAC:Home:SW:IOS:Specials for info Copyright (c) 1986-1998 by cisco Systems, Inc. Compiled Wed 30-Dec-99 13:34 by sde Image text-base: 0x000E9000, data-base: 0x004F5000 ROM: TinyROM version 1.0(2) Chicago uptime is 3 days, 8 hours, 47 minutes System restarted by power-on System image file is "flash:c800-g3-mw.120-1.XB1" Cisco C804 (MPC850) processor (revision 1) with 43260K bytes of virtual memory. CPU part number 33 Bridging software. Basic Rate ISDN software, Version 1.1. 1 Ethernet/IEEE 802.3 interface(s) 1 ISDN Basic Rate interface(s) 4M bytes of physical memory (DRAM) 8K bytes of non-volatile configuration memory 8M bytes of flash on board (4M from flash card) Configuration register is 0x2102 Chicago# Prepare to backup, upgrade, and load a backup Cisco IOS software image Understanding the Registers (before you backup or upgrade) Registers control the boot and startup processes. Uses include changing and managing the IOS image and controlling the startup process and bypassing the startup configuration. The registers can be changed with the “Router(config)# config-register #x####” command where #x#### is represented as one of the following as basic settings: Register Result Setting 0x2101 or 0x101 Boot from ROM and NOT Flash IOS, used when upgrading IOS, startup-config is still processed 0x2102 or 0x102 Normal Mode Flash IOS and startup-config processed 0x2142 or 0x142 Boot from Flash IOS, startup-config is NOT processed 0x2141 or0x141 Boot from ROM and NOT Flash IOS, used when upgrading IOS, startup-config is also NOTl processed The current value of the register can be viewed via the “Router#show ver” command Example: Chicago#show ver Cisco Internetwork Operating System Software IOS (tm) C800 Software (C800-G3-MW), Version 12.0(1)XB1, RELEASE SOFTWARE (fc1) TAC:Home:SW:IOS:Specials for info Copyright (c) 1986-1998 by cisco Systems, Inc. Compiled Wed 30-Dec-99 13:34 by sde Image text-base: 0x000E9000, data-base: 0x004F5000 ROM: TinyROM version 1.0(2) Chicago uptime is 3 days, 8 hours, 47 minutes System restarted by power-on System image file is "flash:c800-g3-mw.120-1.XB1" Cisco C804 (MPC850) processor (revision 1) with 43260K bytes of virtual memory. CPU part number 33 Bridging software. Basic Rate ISDN software, Version 1.1. 1 Ethernet/IEEE 802.3 interface(s) 1 ISDN Basic Rate interface(s) 4M bytes of physical memory (DRAM) 8K bytes of non-volatile configuration memory 8M bytes of flash on board (4M from flash card) Configuration register is 0x2102 Chicago# Checking your space in flash Router# show flash or show ver use these commands to show you the total amount of Flash available. 1. Show ver will also display the current IOS file name in flash, amount of RAM and register values: Router#sh ver Cisco Internetwork Operating System Software IOS (tm) C800 Software (C800-G3-MW), Version 12.0(1)XB1, RELEASE SOFTWARE (fc1) TAC:Home:SW:IOS:Specials for info Copyright (c) 1986-1998 by cisco Systems, Inc. Compiled Wed 30-Dec-99 13:34 by esd Image text-base: 0x000E9000, data-base: 0x004F5000 ROM: TinyROM version 1.0(2) Router uptime is 36 minutes System restarted by power-on System image file is "flash:c800-g3-mw.120-1.XB1" Cisco C804 (MPC850) processor (revision 1) with 43260K bytes of virtual memory. CPU part number 33 Bridging software. Basic Rate ISDN software, Version 1.1. 1 Ethernet/IEEE 802.3 interface(s) 1 ISDN Basic Rate interface(s) 4M bytes of physical memory (DRAM) 8K bytes of non-volatile configuration memory 8M bytes of flash on board (4M from flash card) Configuration register is 0x2102 2. Show flash will also display the amount of flash and IOS directory as follows: Router#sh flash Directory of flash:/0 ----49096 Nov 03 1998 01:14:21 TinyROM-1.0(2) 3 -r-x 2314996 Dec 30 1998 21:37:19 c800-g3-mw.120-1.XB1 Creating a Software Image Backup Router(boot)# copy flash tftp IP address of remote host (255.255.255.255]? 192.16.3.211 Filename to write on tftp host? C2500 Upgrading the Image from the Net Router(boot)# copy tftp flash IP address of remote host (255.255.255.255]? 192.16.3.211 Filename to write on tftp host? C2500 Cisco 2500 Series Router IOS Upgrade Steps Router# enable Router# config t Router (config)# config-register 0x2101 Router (config)# CTRL Z Router# wr mem Router# reload Router(boot)> enable {should return with: (boot)router#} Router (boot)# copy tftp flash {Enter the necessary IP number of the tftp server} {Enter the name of the upgrade file} y y y Router (boot)# config t Router (boot) (config)# config-register 0x2102 Router (boot)# CTRL Z Router (boot)# wr mem Router (boot)# reload Router #sho ver Prepare the initial configuration of your router and enable IP The SETUP command issued from Privileged mode is a prompt driven configuration utility for basic router configuration. Advanced configuration must still be done from the standard configuration interface in config mode. Brackets [ ] indicate a defaulted value for the selection. Example Router# setup ---System Configuration Dialog ---Continue with configuration dialog? [yes/no]: y At any point you may enter a question mark '?' for help. Use ctrl-c to abort configuration dialog at any prompt. Default settings are in square brackets '[]'. Basic management setup configures only enough connectivity for management of the system, extended setup will ask you to configure each interface on the system Would you like to enter basic management setup? [yes/no]: y Configuring global parameters: Enter host name [Router]: Chicago The enable secret is a password used to protect access to privileged EXEC and configuration modes. This password, after entered, becomes encrypted in the configuration. Enter enable secret []: secret The enable password is used when you do not specify an enable secret password, with some older software versions, and some boot images. Enter enable password [password]: enable The virtual terminal password is used to protect access to the router over a network interface. Enter virtual terminal password: cisco Configure SNMP Network Management? [no]: n Current interface summary Interface IP-Address OK? Method Status Protocol BRI0 unassigned YES unset administratively down down BRI0:1 unassigned YES unset administratively down down BRI0:2 unassigned YES unset administratively down down Ethernet0 unassigned YES unset administratively down down Enter interface name used to connect to the management network from the above interface summary: Ethernet0 Configuring interface Ethernet0: Configure IP on this interface? [no]: y IP address for this interface: 192.168.1.1 Subnet mask for this interface [255.255.255.0] : 255.255.255.0 Class C network is 192.168.1.0, 24 subnet bits; mask is /24 The following configuration command script was created: hostname Chicago enable secret 5 $1$/Hw9$P3KFbyh5RGeEOD5cQFrWV/enable password enable line vty 0 4 password cisco no snmp-server ! no ip routing ! interface BRI0 shutdown no ip address ! interface Ethernet0 no shutdown ip address 192.168.1.1 255.255.255.0 ! end [0] Go to the IOS command prompt without saving this config. [1] Return back to the setup without saving this config. [2] Save this configuration to nvram and exit. Enter your selection [2]: 2 Building configuration... 00:04:14: %LINK-3-UPDOWN: Interface BRI0:1, changed state to down 00:04:14: %LINK-3-UPDOWN: Interface BRI0:2, changed state to down 00:04:17: %LINK-3-UPDOWN: Interface Ethernet0, changed state to up Use the enabled mode 'configure' command to modify this configuration. Chicago# Monitor Novell IPX operation on the router IPX Monitoring Command show ipx interface Shows IPX status and parameters show ipx route Shows Routing table contents show ipx servers Shows IPX server list show ipx traffic Shows Number and type of packets IP Monitoring Command show ip interface Shows IP status and parameters show ip route Shows Routing table contents show ip traffic Shows Number and type of packets IPX Troubleshooting Command Displays debug ipx routing activity Information about RIP update packets debug ipx sap Information about SAP update packets The debug ipx routing activity command displays information about IPX routing update packets that are transmitted or received. A router sends an update every 60 seconds. Each update packet can contain up to 50 entries. If there are more than 50 entries in the routing table, the update will include more than one packet. The debug ipx sap command displays information about IPX SAP packets that are transmitted or received. Like RIP updates, these SAP updates are sent every 60 seconds and may contain multiple packets. Each SAP packet appears as multiple line in the output, including a packet summary messages and a service detail message. SAP responses may be one of these types: 0x1----General query 0x2----General response 0x3----Get Nearest Server request 0x4----Get Nearest Server response IP Troubleshooting Command Displays debug ip routing activity Information about RIP update packets Describe the two parts of network addressing, then identify the parts in specific protocol address examples There are two general parts of a Layer 3 address: 1. Network address -Network address Path part used by the router 2. Host address -Host/Node address Specific port or device on the network. TCP/IP networks are represented by 32 bit addresses divided into a network portion and a host portion. The Internet Request For Comments (RFC) 1020 divides the network portion into classes. Classes are as follows: ı Class A Using 8 bits for the network, with the remaining 24 bits for host addressing ı Class B Using 16 bits for the network, with the remaining 16 bits for host addressing ı Class C Using 24 bits for the network, with the remaining 8 bits for host addressing ı Class D Used For IP multicast addresses TCP/IP networks can additionally be divided into sub-networks. When a TCP/IP address has been subnetted, the network part of the address is described by two elements: the network number, still assigned by the NIC, and the subnetwork number, assigned by the local network administrator. Classful TCP/IP Example: 17.20.2.1 with Class default subnet mask of 255.0.0.0: Network = 17, Node/Host = 20.2.1 SubNetted TCP/IP Example: 17.20.2.1 with subnetted mask of 255.255.0.0: Network = 17.20, Node/Host = 2.1 Novell Internet Packet Exchange (IPX) IPX uses a 48 bit hexadecimal host number usually derived automatically from the MAC address of a LAN interface to the IPX network, and a 32 bit Network number. IPX Example: adcafedd.0000.0a43.ad33 Network = adcafedd, Node/Host = 0000.0a43.ad33. AppleTalk 16 bit network numbers are assigned to physical links either individually or in ranges called cable ranges. The 8 bit AppleTalk node portion is called the host address. An Apple end station usually acquires this host address dynamically when it boots up onto the network. AppleTalk Example: 1000.11 (assume a cable range 1000 1000) Network = 1000, Node/Host = 11 Create the different classes of IP addresses [and subnetting] Standard IP Addressing and Classes With TCP/IP, addresses are comprised of a 32bit number separated into 4 octets. The important item to remember with an IP address is that that single 32bit number represents two distinct items of information, namely the SUBNET or NETWORK address and the HOST address. The subnet address is used to group TCP/IP devices into logical groups called networks. The host address is used to uniquely identify a host within a subnet. Of course the problem that arises when you represent two numbers in a single number is how to separate them. In the case of TCP/IP, the separation of the IP address into two pieces is done with an item called a subnet mask. The subnet mask also is a 32bit number. It will determine the network ID and the number of hosts in each network based on the class of the network mask. Default classes, addresses and masks are as follows: Class Range of Network Numbers Default Subnet Mask Number of host addresses per/network Class A 1.0.0.0 through 126.0.0.0 255.0.0.0 16,777,214 Class B 128.1.0.0 through 191.254.0.0 255.255.0.0 65,534 Class C 192.0.1.0 through 223.255.254.0 255.255.255.0 254 Class D 224.0.0.0 through 239.255.255.254 Used Multicast No host range exists Class Research Research No host range exists E Other 127.0.0.0 255.0.0.0 Reserved to LOCALHOST and Loop back testing Example Network 1: image\ebd_ebd4.gif Example Network #1 illustrates a typical network using a variety of network types and classes for example purposes. You will notice that the routers as pictured create broadcast domains that require different network definitions. This drawing does not illustrate the actual assignment of IP addresses to hosts but for network 192.168.1.0, the router at E0 would be probably be assigned IP address 192.168.1.1 with a mask of 255.255.255.0. The PC would probably be assigned 192.168.1.2 with a mask 255.255.255.0 AND a gateway of 192.168.1.1 (which is the router at E0). An important note! In any range, If the host portion is represented by ALL 0’s then that represents the NETWORK ID as in the picture. IF the host portion is represented by ALL 1’s then that represents the subnetwork broadcast ID. You must know both for the exam. Sub-network IP Addressing Sub-netting is nothing more than modifying the subnet mask to increase the number of networks and decrease the number of hosts on each network. Why you say? Lets say that you are given a Class A 10.0.0.0 network with mask 255.0.0.0. Your company has 50 networks and 250 hosts on each network. The issues here is that you really only have one network “10.0.0.0” but your company has 50 networks. Seeing that the host portion is “0.0.0” which allows over 16 million hosts we certainly do not need, we can reduce that number and at the same time increase that single 10 network into multiple “subnetted” networks. To do this we simply adjust the mask. In this case if we change the mask to 255.255.0.0, notice we did not change the 10, we are now using 10.1-254 as the networks and 0.0 as the hosts on each network. So what did that leave us with? 254 networks with 64k hosts on each network and all it took was a mask adjustment. Example Network 2: image\ebd_ebd5.gif What we have here if you notice is a single Class B network of 172.16.0.0 with default mask 255.255.0.0, split into 254 networks with 254 hosts per network by changing the mask to 255.255.255.0. Of course you see we only assigned the first two networks to our design but we have lots of room to grow. BUT, what if we did not want to change the mask from 255.255.0.0 to 255.255.255.0 because we have 300 hosts on each network. Recall when we changed the mask by an entire octet we gained 254 networks but reduced our hosts from 64k to 254 per network. Well you do not have to jump an entire octet. You can most certainly move the mask 1 bit at a time. For this we need to recall a bit more about binary because our masks will be a bit different. Before we get to the masks, lets look at a simple rule for determining the number of hosts and networks calculated from changing the mask. Incremental Subnetworking Starting again with 172.16.0.0 and looking at 255.255.0.0 represented as binary 11111111.1111111.00000000.00000000, we can move the mask 1 bit at a time to the right. Each time we move a bit we can count the bits take for the network and take a power of 2 to that number –2 and get a count for the new networks. So for example, if we take 4 bits we get 2^4-2 =14 networks. What remains is the same calculation, since we took 4 bits for the networks that leaves us 12 bits for the hosts. 2^12-2 = 4092. So to recap by moving the mask over 4 bits we went from 1 network to 14 networks and from 64534 hosts to 4092 hosts per network. Now what is the MASK you say? Well if you take the modified mask result of 11111111.11111111.11110000.00000000, remember we took 4 bits for the subnetting, we end up with a mask of 255.255.240.0. That is the mask we will use when assigning all hosts. To finalize this procedure we need to summarize with three items: 1. MASK Our mask is 255.255.240.0 for all new sub networks 2. Network ID’s and network broadcast ID’s The networks can easily be determine by takeing the lowest binary value in the mask and using that as both your first network id and your network increment. So if your mask is 11111111.11111111.11110000.00000000, the lowest value is 16 or 2^4 in the third octet. The broadcast ID is calculated by placing 1’s in each portion of the host range or simply the highest number in that range. Therefore our networks are: Net ID Broadcast ID 172.16.16.0 172.16.31.255 172.16.32.0 172.16.47.255 172.16.48.0 172.16.63.255 172.16.64.0 172.16.79.255 172.16.80.0 172.16.95.255 And so on 3. Assign host ranges for each subnetwork After determining the networks the host ranges are easy. The lowest number in the range is the host ID and the highest number in the range is the broadcast. Everything in between are the assignable host ID’s for that subnet. Net ID Broadcast ID Host Ranges 172.16.16.0 172.16.31.255 172.16.16.1 – 172.16.31.254 172.16.32.0 172.16.47.255 172.16.32.1 – 172.16.47.254 172.16.48.0 172.16.63.255 172.16.48.1 – 172.16.63.254 172.16.64.0 172.16.79.255 172.16.64.1 – 172.16.79.254 172.16.80.0 172.16.95.255 172.16.80.1 – 172.16.95.254 And so on Below is a chart that may assist in determining necessary subnetwork information: image\ebd_ebd6.gif Configure IP addresses Configuring TCP/IP Interface Addresses IP addresses are assigned to an interface. Each interface can support 1 or more IP addresses on a single interface. Each IP address can be on the same or a different subnetwork. The syntax for assigning an IP addresses is as follows: Router(config-if)# ip address ip-address subnet-mask [secondary] Example Router(config)# interface ethernet 0 Router(config-if)# ip address 192.168.1.1 255.255.255.0 Router(config-if)# ip address 192.168.2.1 255.255.255.0 secondary Other commonly used commands Router (config)# ip host name Adds static host name entries to the ip address name mapping table. This is used if a NDS server is not configured and if the administrator would like to access other IP hosts by name instead of IP addresses. Router (config)# ip name-server Specifies the name of the DNS server for host name lookup Router (config)# ip domain-lookup enabled Enable the use of DNS server lookups from the DNS server identified in the ip name-server command Router (config)# terminal ip netmask-format Sets the display format of the network mask when seen on show commands List the required IPX address and encapsulation type When configuring IPX on a Cisco router a valid network address is required. The network ID must match the current network in place or if it is a new network it must a valid 32bit number documented entered in hex. So, how does Cisco recommend you retrieve this information if you do not already know it? Simple: ı Use a Cisco IOS command to check on the neighbor Cisco router using the “Router# show cdp neighbor details” command ı Use NetWare command to check on the NetWare file server/router. From the NetWare console, enter the “CONFIG” command. ı Contacting NetWare administrator would simply be the easiest way. Along with the NetWare network ID, there are several different Ethernet framing types with different variations in the fields they use. This is critical because DIFFERENT encapsulations have DIFFERENT network Ids. This is why many routers will have secondary encapsulations so they can communicate and pass all necessary IPX traffic. Novell IPX Name Cisco IOS Name Uses Ethernet_II Arpa TCP/IP and DECnet Ethernet_8022 Sap Used with NetWare 3.12 and greater such as 4.x and OSI routing Ethernet_SNAP Snap TCP/IP and AppleTalk Ethemet_8023 Novell ether (default) Used with NetWare versions 2.x and 3.x. Also referred to as RAW Ethernet Token Ring Token IBM Token-Ring Token Ring_SNAP Snap TCP/IP and Token-Ring Identify the functions of the TCP/IP transport-layer protocols Transport Layer Protocols TCP Connection based protocols for RELIABLE communications with the following attributes: ı Uses Sequence Numbers ı Breaks messages into datagrams ı Reassembles datagrams into messages ı Handshakes with receiving device ı Sends Acknowledgments ı Uses Sliding -Windowing transmission technique ı Suited for WAN protocols such as Frame-Relay ı Examples: HTTP, FTP, TELNET UDP Connection-less based protocols for UN-RELIABLE communications with the following attributes: ı Provides NO software checking ı Relies on application layer reliability ı Provides connectionless transmission ı Uses NO Windowing ı Suited for performance oriented application ı Examples: Real Audio, Streaming, Video, Sound, TFTP Enable the Novell IPX protocol and configure interfaces Where TCP/IP usually has 1 configuration step, Novell IPX configuration involves two parts: Global tasks: Router(config)# ipx routing [node] The IPX routing command enables Novell IPX routing. When no node address is specified, the Cisco router uses the MAC address of the interface. In the case that a Cisco router has only serial interfaces, an address must be specified. Router(config)# ipx maximum paths paths To Enable load sharing if appropriate for your network. Load sharing is the division of routing tasks evenly among multiple routers to balance the work and improve network performance. The ipx maximum paths command enables round robin load sharing over multiple equal metric paths with default of 1 and a maximum of 512. Interface specific task: Router (config if)# ipx network number [encapsulation encapsulation type] [secondary] Assign unique network numbers to each interface. Multiple network numbers can be assigned to an interface, allowing support of different encapsulation types. The ipx network command enables Novell IPX processing. This command additionally assigns a primary and secondary network and also assigns encapsulation. Encapsulation, which is optional, specifies the encapsulation type for the interface. It can be one of the following types: novell ether, sap, arpa, snap. Novell IPX Configuration Example Router(config)# ipx routing Router(config)# ipx maximum paths 2 Router(config)# interface ethernet 0 Router(config-if)# ipx network a8023 encapsulation novell ether Router(config-if)# ipx network a8022 encapsulation sap secondary Router(config)# interface ethernet 1 Router(config-if)# ipx network b8022 encapsulation sap Identify the functions of the TCP/IP network-layer protocols Network Layer Protocols ARP This protocol maps a KNOWN IP address to a MAC sub-layer address. ARP also consults subnet masks to determine whether nodes are on the same subnet. When sending a packet, if nodes are on the same subnet, the frame is sent directly to the receiving node. If nodes are on different subnets, the frame is sent to the default gateway (default network on a Cisco router) for forwarding. RARP RARP uses a table entry on a server to respond to requests for mapping a KNOWN MAC address to an IP address. Example, BOOTP or DHCP servers. With a DHCP server, the client knows its IP address but must request an IP address from a server that most probably has a record stored of the IP MAC relationship. This way client’s are less likely to receive a different IP address each time communication with the DHCP server occurs. Diskless workstations also use RARP to request boot information. IP Provides routing information for best effort delivery. This also contains the transport layer protocol ID in the header. ICMP ICMP messages are carried in IP datagrams and are used to send error and control messages. Also used to send Destination Unreachable Messages Identify the functions performed by ICMP All TCP/IP hosts implement the Internet Control Message Protocol (ICMP). ICMP messages are carried in IP datagrams and are used to send error and control messages. PING is an example of a utility that uses the ICMP protocols for testing. If a router receives a packet that is unable to deliver to its ultimate destination, the router sends an ICMP host unreachable message to the source. An echo reply is a successful reply to a PING command although results may also include other ICMP message replys including unreachable destinations and time outs. Some the most common functions of ICMP include: ı Control and message functions at the network layer ı Used to send Destination Unreachable Messages ı Used to send Error and control messages Configure IPX access lists and SAP filters to control basic Novell traffic IPX/SPX access list overview In Novell IPX/SPX addressing is an 80bit address including a (32-bit) network portion and a (48bit) node portion derived from the MAC address of the interface. Each NetWare server has an internal IPX network number and performs IPX routing. The External IPX network numbers are assigned on Cisco router and NetWare server interfaces and must be unique and consistent with the network numbers known to the other NetWare servers and routers. IPX access lists check for source address, destination address, or both. IPX standard access lists use numbers in the range 800 899. Additionally, to control the traffic from the Service Advertisement Protocol (SAP), SAP filters use numbers in the range 1000 to 1099. Several other packet and route filters are available for managing IPX overhead traffic including Get Nearest Server (GNS), Routing Information Protocol (RIP), and NetWare Link Services Protocol (NLSP). Overview for IPX Access Lists ı NetWare IPX addresses use a network.node and socket number ı Standard lists (800 to 899) can filter source and destination address ı Extended lists (900 to 999) allow more precise filtering conditions ı Access lists (1000 to 1099) are SAP filters for service types and servers on one or more networks ı Other access list number ranges offer more Novell software filters including GNS, RIP, NLSP IPX Standard Access Lists Configuration Standard access list uses list number in range 800 to 899 Router Router(config)# access list access list number {deny I permit} source network [.source node] [source node mask] [destination network] [.destination node] [destination node mask] Use the access list command to filter traffic in an IPX network. Using filters on the outgoing router interface allows or restricts different protocols and applications on individual networks. access list number Access list number for an IPX filter list from 800 to 899 protocol Number of the protocol type, can be: 0=any protocol, 1=RIP, 4=SAP, 5=SPX, 17=NCP, 20=IPX NetBIOS source network Source network number, expressed in eight digit hexadecimal source node Node number on the source network. Represented as a 48 bit value shown in a dotted triplet of 4 digit hexadecimal numbers destination network Network number to which the packet is being sent destination node Node on the destination network to which the packet is being sent Activates the IPX standard access list on an interface Router(config-if)# ipx access group access list number Standard Access List Example: Objective: Allow only traffic from network b8022 destined for network a8022 to be forwarded out of Ethernet 0 image\ebd_ebd7.gif Router (config)# access-list 800 permit b8022 a8022 implicit deny all not visible in the list Router (config)# interface ethernet 0 Router (config-if)# ipx network a8022 Router (config-if)# ipx access group 800 Router (config)# interface ethernet 1 Router (config-if)# ipx network b8022 Router (config)# interface ethernet 2 Router (config-if)# ipx network c8022 Access List Commands Explanation 800 Access list number Permit Traffic that matches will be forwarded B8022 Source network A8022 Destination network Ipx access-group 800 Links to interface E0 IPX SAP Filters Configuration SAP filters are typically placed close to the source to ensure these SAP filters conserve bandwidth over WAN links. When a SAP advertisement arrives at the router interface, the contents are placed in the SAP table. The contents of the table are then propagated during the next SAP update. There are two types of SAP filters: IPX input SAP filter When a SAP input filter is in place, the services entered into the SAP table is reduced. The propagated SAP updates represent the entire table, but contain only a subset of all services. IPX output SAP filter When a SAP output filter is in place, the services propagated from the table are reduced. The propagated SAP updates represent a portion of the table contents and are a subset of all the known services. Router(config)# access list access list number {deny I permit} network [.node] [network mask node-mask] [service type [server name] access list number Number from 1000 to 1099, indicates a SAP filter list. Network [.node] Novell source internal network network mask node mask Mask to be applied to the network and node. Place ones in the positions to be masked. service type SAP service type to filter. Each SAP service type is identified by a hexadecimal number. Some standard used ones: 4=file servers, 7=print servers, 24=router, 98=access server Standard SAP filter Example #1: Objective: Prevent File Server advertisements from server c8022.1111.2222.3333 from being forwarded on S0. All other SAP services should be forwarded from any other source on S0. image\ebd_ebd8.gif Router (config)# access-list 1000 deny c8022.1111.2222.3333 4 Router (config)# access-list 1000 permit -1 implicit deny all not visible in the list Router (config)# interface ethernet 0 Router (config-if)# ipx network c8022 Router (config)# interface ethernet 1 Router (config-if)# ipx network a8022 Router (config)# interface serial 0 Router (config-if)# ipx network z8022 Router (config-if)# ipx output-sap-filter 1000 Access List Commands Explanation 1000 Access list number Deny Sap services matching will be blocked C8022.1111.2222.3333 Source network of SAP advertisements 4 Type of Sap service for File Services 1000 Access list number Permit Sap services matching will be forwarded -1 Source network of –1 means ALL networks Ipx output-sap-filter 1000 Apply access list as output Sap filter Standard SAP filter Example #2: Objective: Prevent Print server advertisements from servers on networks c8022 and a8022 from being entered into the SAP table while allowing all other SAP services from any source to be added into the SAP table. image\ebd_ebd9.gif Router (config)# access-list 1001 deny 7 Router (config)# access-list 1001 permit -1 implicit deny all not visible in the list Router (config)# interface ethernet 0 Router (config-if)# ipx network c8022 Router (config)# interface ethernet 1 Router (config-if)# ipx network a8022 Router (config)# interface serial 0 Router (config-if)# ipx network z8022 Router (config-if)# ipx input-sap-filter 1001 Access List Commands Explanation 1001 Access list number Deny Sap services matching will be blocked 7 SAP advertisement type; Print services 1001 Access list number Permit Sap services matching will be forwarded -1 Source network of –1 means ALL networks Ipx input-sap-filter 1001 Apply access list as input SAP filter Add the RIP routing protocol to your configuration RIP Overview The RIP protocol was originally specified in RFC 1058. A RIP table can be viewed by typing in the “show ip route” command. The following are some characteristics of RIP: ı It is a distance vector routing protocol ı Routing updates are broadcast every 30 seconds by default ı The maximum allowable hop count of 15 ı Hop count is used as the metric for path selection ı In newer versions of RIP load balancing RIP Configuration Router (config)# router rip Router (config router)# network network number Descriptions ı The router rip starts the RIP routing process ı The network number specifies a directly connected network Add the IGRP routing protocol to your configuration IGRP Overview IGRP is a distance vector routing protocol developed by Cisco. IGRP sends routing updates at 90 second intervals that target a particular autonomous system. The following are some key characteristics of IGRP: ı The IGRP routing protocol uses a combination of variables to determine a composite metric. ı Scalability to function in very large networks ı Versatility to automatically handle complex topologies ı Flexibility for segments having different bandwidth and delay characteristics IGRP Configuration Router (config)# router igrp autonomous system Router (config router)# network network number Descriptions ı The router igrp command enables the IGRP routing protocols ı The network command specifies any directly connected networks to be included ı The autonomous system identifies the IGRP router processes that will share routing information ı The network number specifies a directly connected network Explain the services of separate and integrated multi-protocol routing In a separated multi-protocol environment protocol processes operate totally independent of each other. In an integrated multi-protocol routing environment, several configured protocols share the results of the integrated routing algorithms. EIGRP (Enhanced IGRP) is a integrated multi-protocol example that is proprietary to Cisco. Enhanced IGRP uses a distance vector algorithm based on Cisco's IGRP and integrates support for IP, AppleTalk, and Novell IPX. Integrated multi-protocol routing has the following attributes: ı Enables path selection and packet switching for more than one routed protocol ı Conserve network and router resources ı Simplifies the administrative tasks ı Maintain routing updates that are usable by all configured routed protocols ı Generates and maintains separate routing tables for each of the routed protocols List problems that each routing type encounters when dealing with topological changes and describe techniques to reduce them Concept Summary Distance Vector protocols use the Bellman-Ford algorithm to calculate best route paths. Link-state protocols use the SPF algorithm to calculate best route paths. Distance Vector protocols DO NOT know the topology of the network where Link-State protocols DO know the topology of the entire network. Comparing Distance Vector routing to Link State routing ı Distance vector routing gets all topological data from the perspective from processing the routing table information of its neighbors. Link state routing obtains a complete understanding of the entire internetwork topology by accumulating all necessary LSPs. ı Distance vector routing determines the best path by incrementing the metric value it receives as tables move from router to router. Link state routing allows each router to work in tandem with other routers to calculate its own shortest path to destinations. ı With most distance-vector routing protocols, updates for topology changes come in periodic table updates. These tables pass incrementally from router to router, usually resulting in slower convergence. Link state routing protocols usually trigger updates through topology changes. Small LSPs passed to all other routers, or to a multicast group of routers result in a faster time to converge on an internetwork topology change. Distance Vector Overview Distance vector based routing algorithms pass periodic copies of a routing table from router to router. Each router receives a routing table from its direct neighbor only. Assume Router 1 knows about network A and B, and Router 2 knows about B and C. After the next periodic exchange, Router 1 will know about networks A, B, and C and the distance is incremented in Router 1 to get to network C because it now has to go through the neighboring router. This process occurs in all directions between direct neighbor routers. If during the next transmission, a better path exists the routing table will be updated. Distance vector algorithms do not allow a router to know the exact topology of an internetwork. Examples include RIP (Routing Information Protocols) and IGRP (Interior Gateway Routing Protocol) Benefits include: ı Easy to implement – It takes very little configuration to get it up and running ı Widely supported – Most devices support some type of Distance Vector routing protocols Potential Problems: ı Counting to infinity This condition continuously loops packets around the network, despite the fundamental fact that the destination network is down. While the routers are counting to infinity, the invalid information allows a routing loop to exist. ı Routing Loops Routing Loops can occur if the internetwork's slow convergence on a new configuration causes inconsistent routing entries. Implemented Solutions: ı Split Horizon If you learn a protocol's route on an interface, do not send information about that route back out that interface. ı Defining a Maximum Specify a maximum distance vector metric as infinity. ı Hold Down Timers Routers ignore network update information for some period. ı Route poisoning Router keeps an entry for the network down state, allowing time for other routers to recompute for the topology change. Link State Overview These are designed for larger networks and address the shortcomings of Distance Vector algorithms. This is because LSP’s map the entire network topology unlike DVP’s. A “link” can be defined as a network interface on a router. A “link-state” is the status between two router interfaces. For routing updates, each router running an LSP locates routers directly connected to it. It then sends out link-state advertisements (LSAs) in its area, listing its neighbor’s names and route cost to each neighbor. Cost is the value that indicates relative speed of the link as indicated by the bandwidth on the link. A router that receives LSAs then forwards them to neighbor routers in the network cloud. The lowest cost paths are optimal yet multiple optimal paths allow load balancing. A router running a Link-State algorithm uses a hello packet to establish a formal connection with each directly connected together. Examples include OSPF (Open Shortest Path First). Benefits include: ı Qu ick Convergence – Incorporates route changes into the network and performs new route computation immediately ı Support for VLSM – Allows multiple-level sub-networked IP addresses within a single network ı Increased network node access – Supports large numbers of network nodes far beyond the previous 15-hop limitation ı Sending of periodic routing updates – Only sends updates when there is a change in the topology ı Optimizing route selection – Uses composite routing methods. Potential Problems: ı Processing and memory required – More memory is required due to the large amount of network information that needs to be managed. Recall that each router has a complete picture of the network. ı Bandwidth consumed for initial link state “flood” – A lot of bandwidth is consumed during initial link-state startup. This issue is called flooding. This is caused from all routers trying to converge the network and understand the network topology. ı Unsynchronized updates and inconsistent path decisions – This often happens when links become unavailable and the LSP has to be reconstructed. During the calculation other links go down as other come up. This creates problems. ı Large network synchronization – This adds to the problems due to the complete network topology that each router contains. Larger networks will run Hybrid protocols. Implemented Solutions: ı Reduce the need for resources ı Co-ordinate link-state updates Describe the benefits of network segmentation with routers Routers segment traffic and create manageable broadcast domains at the network layer, which is at a higher level than bridges. Recall that bridges provide traffic management at the data-link layer. They provide WAN link interfacing, filtering and security through the processing and control of network information. If multiple paths exist to destinations, routers will provide path selection and determination and forwarding. Due to operation at higher levels, they come at a higher performance cost. Performance of a router may decrease throughput anywhere from 20 to 40% or greater than that of a bridge. ı Multiple active paths – Routers allow the use of a network topology that can use more than one path between stations. Because they operate at the network layer, routers examine protocols, destination service access point (DSAP) and source service access point (SSAP) and path metric information. They can then use that information when making path determination, forwarding or filtering decisions. ı Functionality Routers are available to the end stations and thus can implement mechanisms to provide flow control, error and congestion control, fragmentation and reassembling services, and explicit packet time-to-live controls. ı Manageability – Multiple protocols operating among routers give network administrators more overall control over path selection and network routing behavior Configure standard and extended access lists to filter IP traffic Standard access lists filter at layer 3 meaning source networks and host addresses and they can deny or permit the networks and hosts but NOT transport layer information such as protocol UDP and TCP or specific ports. When standard access lists don’t cut it for the specific filtering you need on your router, Extended Access Lists may be the answer. This type of layer 4 filtering may be required for firewall purposes and therefore extended access lists may be the answer you’re looking for. Extended IP access list statements can filter for source address and for destination address with additional control by specifying optionally the TCP or UDP protocol port number. How to associate access lists to interfaces: ı Place standard access lists close to the destination ı Place extended access lists close to the source Enabling and Disabling Standard Access Lists Router (config)# access list access list number {permit I deny} source [source mask] ı IP standard access lists use 1 to 99 The access list command creates an entry in a standard traffic filter list. Parameter descriptions are as follows: access list number Identifies the list to which the entry belongs; a number from 1 to 99. {permit I deny} Indicates whether this entry allows or blocks traffic from the specified address. source Identifies source IP address source mask Identifies which bits in the address field are matched. A 1 in positions indicates to leave alone and a 0 in a position indicates instructions to be followed. Router (config)#no access list access list number ı Removes the access list Router (config-if)#ip access group access list number {in | out} ı Activates the list on the interface The ip access group command links an existing access list to an outbound interface. Only one access list per port per protocol per direction is allowed. access list number Indicates the number of the access list to be linked to this Interface. {in I out} Selects whether the access list is applied to the incoming or Outgoing interface If in or out is not specified, out is the Default Router (config-if)#no ip access group access list number {in | out} ı De-activates the list on the interface Standard Access List Example #1: Objective: Allow all traffic from the 172.16.0.0 networks to be forwarded while blocking all non-172.16.0.0 traffic. image\ebd_ebd10.gif Router (config)# access list 1 permit 172.16.0.0 0.0.255.255 implicit deny all not visible in the list ı access list 1 deny 0.0.0.0 255.255.255.255 Router (config)# interface ethernet 0 Router (config-if)# ip access group 1 out Router (config)# interface ethernet 1 Router (config-if)# ip access group 1 out Access List Command Explanation 1 Access list number Permit Traffic that matches will be forwarded 172.16.0.0 IP address used to identify the source network 0.0.255.255 Wildcard mask; 0 indicates positions must match, 1s indicate not checked Ip access-group 1 out Applies the access list to an interface, OUT is the default Standard Access List Example #2: Objective: Block traffic from address 172.16.2.2, and allow all other traffic to be forwarded on the interface Ethernet 0 image\ebd_ebd11.gif Router (config)# access list 1 deny host 172.16.2.2 Router (config)# access list 1 permit 0.0.0.0 255.255.255.255 implicit deny all not visible in the list ı access list 1 deny 0.0.0.0 255.255.255.255 Router (config)# interface ethernet 0 Router (config-if)# ip access group 1 out Access List Commands Explanation 1 Access list number Deny host Traffic that matches will NOT be forwarded 172.16.2.2 IP address used to identify the source host 0.0.0.0 Wildcard mask; 0 indicates positions must match, 1s indicate not checked 1 Access list number Permit Traffic that matches will be forwarded 0.0.0.0 IP address used to identify the source host 255.255.255.255 Wildcard mask; 0 indicates positions must match, 1s indicate not checked Ip access-group 1 out Applies the access list to an interface, OUT is the default Standard Access List Example #3: Objective: Block traffic from subnet 172.16.2.0 and permit the forwarding of all other traffic image\ebd_ebd12.gif Router (config)# access list 1 deny 172.16.2.0 0.0.0.255 Router (config)# access list 1 permit any implicit deny all not visible in the list ı access list 1 deny 0.0.0.0 255.255.255.255 Router (config)# interface ethernet 0 Router (config-if)# ip access group 1 out Access List Command Explanation 1 Access list number Deny Traffic that matches will NOT be forwarded 172.16.2.0 IP address used to identify the source network 0.0.0.255 Wildcard mask; 0 indicates positions must match, 1s indicate not checked 1 Access list number Permit Traffic that matches will be forwarded Any Abbreviation for 0.0.0.0 255.255.255.255 Ip access-group 1 out Applies the access list to an interface, OUT is the default Enabling and Disabling Extended Access Lists In summary, Extended Access lists (range 100-199) over Standard Access lists (range 1-99) allow on to: ı Check source and destination IP address ı Specify an optional IP protocol port number. “Well-Known” ports are listed below: Well-know ports IP protocol 20 File Transfer Protocol (FTP) data 21 FTP Program 23 Telnet 25 Simple Mail Transfer Protocol (SMTP) 69 Trivial File Transfer Protocol (TFTP) 53 Domain Name System (DNS) 80 Hypertext Transport Protocol (HTTP) 110 Post Office Protocol (POP3) 119 Network News Transport Protocol (NNTP) Enabling and Disabling Extended Access Lists Router(config)# access list access list number {permit I deny} protocol source source mask destination destination mask [operator operand] [established] access list number IP Access List Ranges ı <1-99> IP standard access list ı <100-199> IP extended access list ı <1100-1199> Extended 48-bit MAC address access list ı <1300-1999> IP standard access list (expanded range) ı <200-299> Protocol type-code access list ı <2000-2699> IP extended access list (expanded range) ı <700-799> 48-bit MAC address access list permit I deny Allow or block the specified address protocol ı <0-255> An IP protocol number ı ahp -Authentication Header Protocol ı eigrp -Cisco's EIGRP routing protocol ı esp -Encapsulation Security Payload ı gre -Cisco's GRE tunneling ı icmp -Internet Control Message Protocol ı igmp -Internet Gateway Message Protocol ı igrp -Cisco's IGRP routing protocol ı ip – Any Internet Protocol ı ipinip -IP in IP tunneling ı nos -KA9Q NOS compatible IP over IP tunneling ı ospf -OSPF routing protocol ı pcp -Payload Compression Protocol ı tcp – Transmission Control Protocol ı udp -User Datagram Protocol source and destination Identifies source and destination IP addresses source mask and destination mask Wildcard mask; Os indicate positions that must match, Is indicate "don't care" positions operator and operand ı Ack -Match on the ACK bit ı eq -Match only packets on a given port number ı fin -Match on the FIN bit ı gt -Match only packets with a greater port number ı log -Log matches against this entry ı log-input -Log matches against this entry, including input interface ı lt -Match only packets with a lower port number ı neq -Match only packets not on a given port number ı precedence -Match packets with given precedence value ı psh -Match on the PSH bit ı range -Match only packets in the range of port numbers ı rst -Match on the RST bit ı syn -Match on the SYN bit ı time-range -Specify a time-range ı tos -Match packets with given TOS value ı urg -Match on the URG bit established Match established connections Router(config-if)# ip access group access list number [in | out] access list number Number of the access list to be linked to this interface. [in I out] Access list is applied to the incoming or outgoing interface. If in or out is not specified, out is the default Extended Access List Example #1: Objective: Deny FTP for E0 and allow all other traffic from subnet 172.16.2.0 to be forwarded to all other networks or subnets via interface E0. image\ebd_ebd13.gif Router (config)# access list 101 deny tcp 172.16.2.0 0.0.0.255 172.16.1.0 0.0.0.255 eq 21 Router (config)# access list 101 deny tcp 172.16.2.0 0.0.0.255 172.16.1.0 0.0.0.255 eq 20 Router (config)# access list 101 permit ip 172.16.2.0 0.0.0.255 0.0.0.0 255.255.255.255 Router (config)# implicit deny all not visible in the list Router (config)# interface ethernet 0 Router (config-if)# ip access group 101 Access List Command Explanation 101 Access list number Deny Traffic that matches will not be forwarded Tcp Transmission Control Protocol 172.16.2.0 and 0.0.0.255 Source address 172.16.1.0 and 0.0.0.255 Destination address Eq 20 FTP Eq 21 FTP data Extended Access List Example #2: Objective: Allow only SMTP (Mail) from 172.16.2.0 to be sent out interface E0 and deny any other traffic image\ebd_ebd14.gif Router (config)# access list 101 permit tcp 172.16.2.0 0.0.0.255 any eq 25 Router (config)# implicit deny all not visible in the list Router (config)# interface ethernet 0 Router (config-if)# ip access group 101 Access List Command Explanation 101 Access list number Permit Traffic that matches will be forwarded Tcp Transmission Control Protocol 172.16.2.0 and 0.0.0.255 Source address Any Destination Eq 25 FTP Monitor and verify selected access list operations on the router IP and IPX access can be viewed with commands: Show access-lists [interface] Show access lists on specific interfaces Show access-lists Show all access lists IP and IPX can be monitored using the following commands: Show IPX interface IPX status and parameters including information on IPX addressing, SAP and SAP GNS information, RIP, and statistics. Show IPX traffic Statistics on IPX traffic, numbers relating to traffic including the quantity and type of each packet Show IPX servers Shows the server list from the routers SAP table Show IPX route Shows the IPX routing table content Show IP interface Example Router#show ip int e0 Ethernet0 is administratively down, line protocol is down Internet address is 192.168.100.35/27 Broadcast address is 255.255.255.255 Address determined by setup command MTU is 1500 bytes Helper address is not set Directed broadcast forwarding is disabled Outgoing access list is 1 Inbound access list is not set Proxy ARP is enabled Security level is default Split horizon is enabled ICMP redirects are always sent ICMP unreachables are always sent ICMP mask replies are never sent IP fast switching is enabled IP fast switching on the same interface is disabled IP Null turbo vector IP multicast fast switching is disabled IP multicast distributed fast switching is disabled Router Discovery is disabled IP output packet accounting is disabled IP access violation accounting is disabled TCP/IP header compression is disabled Probe proxy name replies are disabled Policy routing is disabled Network address translation is disabled Web Cache Redirect is disabled BGP Policy Mapping is disabled Router# IP and IPX can be also monitored real-time using debug commands: Debug IPX routing activity Show RIP table information updates Debug IPX SAP Shows SAP update packets Debug IP routing Shows Routing Table events Debug IP RIP Shows IP RIP information Describe the advantages of LAN segmentation Networks can be divided into smaller segments thereby reducing the number of users per segment. This segmentation will effectively increase the bandwidth available to all users in the particular segment. Each new segment is considered a different collision domain as opposed to routers, which create new broadcast domains. The new segments will support traffic movement between network nodes without interfering with traffic patterns on other collision segments. When a user is communicating within their segment with others, they will effectively have better communication to backbone segment hosts such as servers. Another key point is that segmentation still ALLOWS non-routed protocols to communicate throughout all segments because all segments are contained in a single broadcast domain. Broad cast domains are different subneet linked via routing devices. Describe LAN segmentation using bridges Bridges segment LANs into “collision domains” by using the network device MAC addresses. The nice thing about MAC address is that the source MAC will appear in each frame so when a device sends a frame on the network, a bridge can examine the frame and effectively “learn” which MAC address are on which ports. This storage of MAC information will now allow a bridge to determine whether or not to forward a frame to another segment or whether to drop it. Of course a common drawback of bridging is that broadcast information is forwarded to all collision domains on the bridge. Some bridges will employ flooding controls and blocking algorithms to control unwanted or problematic traffic on a network. MAC address learning is defined in the IEEE 802.1 standard. Bridged networks can also have redundant bridged links when using the Spanning Tree Protocol discussed in its own objective. A Spanning Tree Enabled bridge or switch will both send out bridge protocol data units (BPDUs) and listen to BPDUs of other bridges. The BPDU configuration contains enough information so that all bridges can perform the following: ı Select a single bridge that will act as the "root" of the spanning tree ı Calculate the distance, of the shortest path from itself to the root bridge ı For each LAN segment, designate one of the bridges as the closest one to the root. That bridge will handle all communication from that LAN to the root bridge and will be known as the "designated bridge." ı Let each bridge choose one of its interfaces as its root interface, which gives the best path to the root bridge ı Allow each bridge to mark the root interface and any other inter faces on it that have been elected as designated bridges for the LAN to which it is connected as being included in the spanning tree Describe LAN Segmentation using routers LAN segmentation using routers is simply a router between sub-nets or networks. Each network is considered its own broadcast domain meaning broadcast messages are not forwarded across routed segments. Network segmentation is performed at layer-3 (Network layer) compared to bridging which is done at layer-2 (Data Link Layer). Routers segment traffic and create manageable broadcast domains at the network layer, which is at a higher level than bridges. Recall that bridges provide traffic management at the data-link layer. They provide WAN link interfacing, filtering and security through the processing and control of network information. If multiple paths exist to destinations, routers will provide path selection and determination and forwarding. Due to operation at higher levels, they come at a higher performance cost. Performance of a router may decrease throughput anywhere from 20 to 40% or greater than that of a bridge.

Public Domain

views:334

downloads:45

rating:not rated

reviews:0

posted:11/12/2007

language:English