2024s2 Cisco ITICT104A Internetworking 2 Week 12 Exam Review PDF

ITICT104A Internetworking 2 Week 12 – revision and final exam review Theory Exam  Please note that the following information about the Final Exam is preliminary and subject to change. It may be updated upon review and final approval Number of Marks per...

ITICT104A Internetworking 2 Week 12 – revision and final exam review Theory Exam  Please note that the following information about the Final Exam is preliminary and subject to change. It may be updated upon review and final approval Number of Marks per Section Question Type Total Mark Questions Question Multiple Choice 1 36 0.5 18 Questions Missing Words, Drag & 2 12 Varied 30 Drop Questions 3 Essay Questions 7 6 42 Total 90 © 2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 2 1 Theory Exam (90 marks)  Contribute 30% to the total score  Exam Date: Tuesday, 12 November 2024  Exam Time: 9.30 am – 12.30 pm  Duration 2 hours 20 mins  Consists of 3 parts:-  Part 1: Multiple choice questions  Part 2: Missing words and Drag & Drop questions  Part 3: Essay questions (Read the questions carefully. Make sure you pay attention to key words like in detail, with examples, etc.)  This is a closed-book exam; no additional materials are allowed © 2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 3 Part 1: Multiple Choice Part 2: Missing words and Drag & Drop  36 questions  12 questions  0.5 mark each  Variable marks  Total 18 marks  Total 30 marks  Negative marking applies to multi-answer multiple choice Part 3: Essay Questions questions  7 questions – some questions from wireless, OSPF, ACL and troubleshooting modules  6 marks each  Total 42 marks © 2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 4 2 Practical Exam (100 marks)  Contribute 25% to the total score  Exam Date: Tuesday, 19 November 2024  Exam Time: 9.30 am – 12.30 pm  Duration 2 hours 20 mins  Handwritten journals are permitted for the exam, whereas loose paper is not considered a journal and therefore is not allowed. © 2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 5 Practical Exam Instructions  Arrive and enter the Exam room at least 15 mins before the Exam starts.  Read and agree on the 'Academic Integrity Statement‘ when it is available.  Download the PT file from Moodle as instructed.  Make sure you have PT v8.2.2 or the latest version installed: 1. open the PT file you have just downloaded 2. in the User Profile box, type you full name and click OK. − (you may need to locate the User Profile box and you can not start until you type your name in) 3. you can then start the exam. The timer will start timing you. − Make sure that you don’t use more than 2 hours and 20 minutes. Overtime will be penalised. 4. save the file as Final_Skills_Your-FirstName_Your-LastName. 5. save your work often in case there are any power/hardware problems 6. submit your work before the end of the exam. 7. Late submission will be penalised. © 2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 6 3 Practical Exam Instructions Topology Assessed areas:  Basic configuration  IPv4 and IPv6 addressing  VLANs  Inter-vlan routing  EtherChannels  STP and DHCP  Basic routing and OSPF  NAT & ACLs © 2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 7 Examinable material  Cisco Academy on-line materials  Lectures  Practicals Labs  Assignments  In-class demo  Discussions © 2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 8 4  Module 5: STP Concepts Switching, Routing and Wireless Essentials v7.0 (SRWE) STP Concepts Redundant paths in a switched Ethernet network may cause both physical and logical Layer 2 loops. A Layer 2 loop can result in MAC address table instability, link saturation, and high CPU utilization on switches and end-devices. This results in the network becoming unusable. STP is a loop-prevention network protocol that allows for redundancy while creating a loop-free Layer 2 topology. Without STP, Layer 2 loops can form, causing broadcast, multicast and unknown unicast frames to loop endlessly, bringing down a network. Using the STA, STP builds a loop-free topology in a four-step process: elect the root bridge, elect the root ports, elect designated ports, and elect alternate (blocked) ports. During STA and STP functions, switches use BPDUs to share information about themselves and their connections. BPDUs are used to elect the root bridge, root ports, designated ports, and alternate ports. When the root bridge has been elected for a given spanning tree instance, the STA determines the best paths to the root bridge from all destinations in the broadcast domain. The path information, known as the internal root path cost, is determined by the sum of all the individual port costs along the path from the switch to the root bridge. After the root bridge has been determined the STA algorithm selects the root port. The root port is the port closest to the root bridge in terms of overall cost, which is called the internal root path cost. © 2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 10 5 STP Concepts After each switch selects a root port, switches will select designated ports. The designated port is a port on the segment (with two switches) that has the internal root path cost to the root bridge. If a port is not a root port or a designated port, then it becomes an alternate (or backup) port. Alternate ports and backup ports are in discarding or blocking state to prevent loops. When a switch has multiple equal-cost paths to the root bridge, the switch will determine a port using the following criteria: lowest sender BID, then the lowest sender port priority, and finally the lowest sender port ID. STP convergence requires three timers: the hello timer, the forward delay timer, and the max age timer. Port states are blocking, listening, learning, forwarding, and disabled. In PVST versions of STP, there is a root bridge elected for each spanning tree instance. This makes it possible to have different root bridges for different sets of VLANs. STP is often used to refer to the various implementations of spanning tree, such as RSTP and MSTP. RSTP is an evolution of STP that provides faster convergence than STP. RSTP port states are learning, forwarding and discarding. PVST+ is a Cisco enhancement of STP that provides a separate spanning tree instance for each VLAN configured in the network. PVST+ supports PortFast, UplinkFast, BackboneFast, BPDU guard, BPDU filter, root guard, and loop guard. Cisco switches running IOS 15.0 or later, run PVST+ by default. © 2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 11 STP Concepts Rapid PVST+ is a Cisco enhancement of RSTP that uses PVST+ and provides a separate instance of 802.1w per VLAN. When a switch port is configured with PortFast, that port transitions from blocking to forwarding state immediately, bypassing the STP listening and learning states and avoiding a 30 second delay. Use PortFast on access ports to allow devices connected to these ports, such as DHCP clients, to access the network immediately, rather than waiting for STP to converge on each VLAN. Cisco switches support a feature called BPDU guard which immediately puts the switch port in an error- disabled state upon receipt of any BPDU to protect against potential loops. Over the years, Ethernet LANs went from a few interconnected switches that were connected to a single router, to a sophisticated hierarchical network design. Depending on the implementation, Layer 2 may include not only the access layer, but also the distribution or even the core layers. These designs may include hundreds of switches, with hundreds or even thousands of VLANs. STP has adapted to the added redundancy and complexity with enhancements as part of RSTP and MSTP. Layer 3 routing allows for redundant paths and loops in the topology, without blocking ports. For this reason, some environments are transitioning to Layer 3 everywhere except where devices connect to the access layer switch. © 2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 12 6 STP Terms and Commands Spanning Tree Protocol (STP) short path cost Spanning Tree Algorithm (STA) long path cost IEEE 802.1D root path cost IEEE 802.1w Rapid STP (RSTP) Broadcast Storm port priority Root Bridge Hello timer Root Port Max Age timer Designated Port Forward Delay timers Alternate (Blocked) Port Blocking Learning Forwarding Listening Discarding Bridge ID (BID) Per-VLAN Spanning Tree (PVST) Root ID PVST+ Bridge Protocol Data Unit (BPDU) Rapid PVST+ Bridge Priority Multiple Spanning Tree Protocol (MSTP) Extended System ID Multiple Spanning Tree (MST) PortFast BPDU Guard © 2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 13 Module 6: EtherChannel Switching, Routing and Wireless Essentials v7.0 (SRWE) 7 EtherChannel Concepts To increase bandwidth or redundancy, multiple links could be connected between devices. However, STP will block redundant links to prevent switching loops. EtherChannel is a link aggregation technology that allows redundant links between devices that will not be blocked by STP. EtherChannel groups multiple physical Ethernet links together into one single logical link. It provides fault- tolerance, load sharing, increased bandwidth, and redundancy between switches, routers, and servers. When an EtherChannel is configured, the resulting virtual interface is called a port channel. EtherChannels can be formed through negotiation using one of two protocols, PAgP or LACP. These protocols allow ports with similar characteristics to form a channel through dynamic negotiation with adjoining switches. When an EtherChannel link is configured using Cisco-proprietary PAgP, PAgP packets are sent between EtherChannel-capable ports to negotiate the forming of a channel. Modes for PAgP are On, PAgP desirable, and PAgP auto. LACP performs a function similar to PAgP with Cisco EtherChannel. Because LACP is an IEEE standard, it can be used to facilitate EtherChannels in multivendor environments. Modes for LACP are On, LACP active, and LACP passive. © 2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 15 EtherChannel Concepts To increase bandwidth or redundancy, multiple links could be connected between devices. However, STP will block redundant links to prevent switching loops. EtherChannel is a link aggregation technology that allows redundant links between devices that will not be blocked by STP. EtherChannel groups multiple physical Ethernet links together into one single logical link. It provides fault- tolerance, load sharing, increased bandwidth, and redundancy between switches, routers, and servers. When an EtherChannel is configured, the resulting virtual interface is called a port channel. EtherChannels can be formed through negotiation using one of two protocols, PAgP or LACP. These protocols allow ports with similar characteristics to form a channel through dynamic negotiation with adjoining switches. When an EtherChannel link is configured using Cisco-proprietary PAgP, PAgP packets are sent between EtherChannel-capable ports to negotiate the forming of a channel. Modes for PAgP are On, PAgP desirable, and PAgP auto. LACP performs a function similar to PAgP with Cisco EtherChannel. Because LACP is an IEEE standard, it can be used to facilitate EtherChannels in multivendor environments. Modes for LACP are On, LACP active, and LACP passive. © 2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 16 8  EtherChannel Concepts The following guidelines and restrictions are useful for configuring EtherChannel: All Ethernet interfaces on all modules must support EtherChannel with no requirement that interfaces be physically contiguous, or on the same module. Configure all interfaces in an EtherChannel to operate at the same speed and in the same duplex mode. All interfaces in the EtherChannel bundle must be assigned to the same VLAN or be configured as a trunk. An EtherChannel supports the same allowed range of VLANs on all the interfaces in a trunking EtherChannel. Configuring EtherChannel with LACP requires three steps: Step 1. Specify the interfaces that compose the EtherChannel group using the interface range interface global configuration mode command. Step 2. Create the port channel interface with the channel-group identifier mode active command in interface range configuration mode. Step 3. To change Layer 2 settings on the port channel interface, enter port channel interface configuration mode using the interface port-channel command, followed by the interface identifier. © 2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 17 EtherChannel Concepts There are a number of commands to verify an EtherChannel configuration including show interfaces port-channel, show etherchannel summary, show etherchannel port-channel, and show interfaces etherchannel. Common EtherChannel issues include the following: Assigned ports in the EtherChannel are not part of the same VLAN, or not configured as trunks. Ports with different native VLANs cannot form an EtherChannel. Trunking was configured on some of the ports that make up the EtherChannel, but not all of them. If the allowed range of VLANs is not the same, the ports do not form an EtherChannel even when PAgP is set to the auto or desirable mode. The dynamic negotiation options for PAgP and LACP are not compatibly configured on both ends of the EtherChannel. © 2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 18 9 EtherChannel Terms and Commands Link Aggregation EtherChannel Port Channel Port Aggregation Protocol (PAgP) Link Aggregation Control Protocol (LACP) PAgP desirable PAgP auto LACP active LACP passive channel-group X mode [ desirable | auto | active | passive ] interface port-channel X show interfaces port-channel show etherchannel summary show etherchannel port-channel show interfaces etherchannel © 2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 19 Module 12: WLAN Concepts Switching, Routing and Wireless Essentials v7.0 (SRWE) 10 WLAN Concepts A Wireless LANs (WLANs) are based on IEEE standards and can be classified into four main types: WPAN, WLAN, WMAN, and WWAN. Wireless technology uses the unlicensed radio spectrum to send and receive data. Examples of this technology are Bluetooth, WiMAX, Cellular Broadband, and Satellite Broadband. WLAN networks operate in the 2.4 GHz frequency band and the 5 GHz band. The three organizations influencing WLAN standards are the ITU-R, the IEEE, and the Wi-Fi Alliance. CAPWAP is an IEEE standard protocol that enables a WLC to manage multiple APs and WLANs. DTLS is a protocol provides security between the AP and the WLC. Wireless LAN devices have transmitters and receivers tuned to specific frequencies of radio waves to communicate. Ranges are then split into smaller ranges called channels: DSSS, FHSS, and OFDM. The 802.11b/g/n standards operate in the 2.4 GHz to 2.5GHz spectrum. The 2.4 GHz band is subdivided into multiple channels. Each channel is allotted 22 MHz bandwidth and is separated from the next channel by 5 MHz. Wireless networks are susceptible to threats, including: data interception, wireless intruders, DoS attacks, and rogue APs. To keep wireless intruders out and protect data, two early security features are still available on most routers and APs: SSID cloaking and MAC address filtering. © 2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 21 There are four shared key authentication techniques available: WEP, WPA, WPA2, and WPA3. WLAN Terms and Commands WPAN Ad hoc mode WLAN Infrastructure mode WMAN Tethering WWAN Basic Service Set (BSS) Bluetooth Extended Service Set (ESS) 802.11 Control and Provisioning of Wireless Access Electromagnetic spectrum Points (CAPWAP) protocol ITU Datagram Transport Layer Security (DTLS) IEEE FlexConnect Lightweight AP (LAP) Direct-Sequence Spread Spectrum (DSSS) Lightweight Access Point Protocol (LWAPP) Frequency-Hopping Spread Spectrum (FHSS) Wireless LAN Controller (WLAC) Orthogonal Frequency-Division Multiplexing SSID (OFDM) Autonomous AP Wired Equivalent Privacy (WEP) Controller-based AP Wi-Fi Protected Access (WPA) Omni directional antenna WPA2 Directional antenna WPA3 MIMO antenna Temporal Key Integrity Protocol (TKIP) Advanced Encryption Standard © 2016 Cisco and/or its (AES) affiliates. All rights reserved. Cisco Confidential 22 11  Module 13: WLAN Configuration Switching, Routing, and Wireless Essentials v7.0 (SRWE) WLAN Configuration Remote workers, small branch offices, and home networks often use a wireless router, which typically include a switch for wired clients, a port for an internet connection (sometimes labeled “WAN”), and wireless components for wireless client access. Most wireless routers are preconfigured to be connected to the network and provide services. The wireless router uses DHCP to automatically provide addressing information to connected devices. Your first priority should be to change the username and password of your wireless router. If you want to extend the range beyond approximately 45 meters indoors and 90 meters outdoors, you can add wireless access points. The router will use a process called Network Address Translation (NAT) to convert private IPv4 addresses to internet-routable IPv4 addresses. By configuring QoS, you can guarantee that certain traffic types, such as voice and video, are prioritized over traffic that is not as time-sensitive, such as email and web browsing. Lightweight APs (LAPs) use the Lightweight Access Point Protocol (LWAPP) to communicate with a WLAN controller (WLC). © 2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 24 12 WLAN Configuration Configuring a wireless LAN controller (WLC) is similar to configuring a wireless router except that a WLC controls APs and provides more services and management capabilities. Use the WLC interface to view an overall picture of the AP’s system information and performance, to access advanced settings and to configure a WLAN. SNMP is used monitor the network. The WLC is set to forward all SNMP log messages, called traps, to the SNMP server. For WLAN user authentication, a RADIUS server is used for authentication, accounting, and auditing (AAA) services. Individual user access can be tracked and audited. Use the WLC interface to configure SNMP server and RADIUS server information, VLAN interfaces, DHCP scope, and a WPA2 Enterprise WLAN. There are six steps to the troubleshooting process. When troubleshooting a WLAN, a process of elimination is recommended. Common problems are: no connectivity and poorly performing wireless connection when the PC is operational. To optimize and increase the bandwidth of 802.11 dual-band routers and APs, either: upgrade your wireless clients or split the traffic. Most wireless routers and APs offer upgradable firmware. Firmware releases may contain fixes for common problems reported by customers as well as security vulnerabilities. You should periodically check the router or AP for updated firmware. © 2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 25 WLAN Configuration Terms and Commands Network Address Translation (NAT)  Wireless Mesh Network (WMN) Port Forwarding Port Triggering © 2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 26 13  Module 1: Single-Area OSPFv2 Concepts Enterprise Networking, Security, and Automation v7.0 (ENSA) OSPF Concepts Open Shortest Path First (OSPF) is a link-state routing protocol that was developed as an alternative for the distance vector Routing Information Protocol (RIP). OSPF is a link-state routing protocol that uses the concept of areas for scalability. A link is an interface on a router. A link is also a network segment that connects two routers, or a stub network such as an Ethernet LAN that is connected to a single router. All link-state information includes the network prefix, prefix length, and cost. All routing protocols use routing protocol messages to exchange route information. The messages help build data structures, which are then processed using a routing algorithm. Routers running OSPF exchange messages to convey routing information using five types of packets: the Hello packet, the database description packet, the link-state request packet, the link- state update packet, and the link-state acknowledgment packet. OSPF messages are used to create and maintain three OSPF databases: the adjacency database creates the neighbor table, the link-state database (LSDB) creates the topology table, and the forwarding database creates the routing table. The router builds the topology table using results of calculations based on the Dijkstra SPF (shortest-path first) algorithm. The SPF algorithm is based on the cumulative cost to reach a destination. In OSPF, cost is used to determine the best path to the destination. © 2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 28 14 OSPF Concepts To maintain routing information, OSPF routers complete a generic link-state routing process to reach a state of convergence: Establish Neighbor Adjacencies, Exchange Link-State Advertisements, Build the Link State Database, Execute the SPF Algorithm, Choose the Best Route With single-area OSPF any number can be used for the area, best practice is to use area 0. Single-area OSPF is useful in smaller networks with few routers. With multiarea OSPF, one large routing domain can be divided into smaller areas, to support hierarchical routing. Routing still occurs between the areas (interarea routing), while many of the processor intensive routing operations, such as recalculating the database, are kept within an area. OSPFv3 is the OSPFv2 equivalent for exchanging IPv6 prefixes. Recall that in IPv6, the network address is referred to as the prefix and the subnet mask is called the prefix-length. OSPF uses the following link-state packets (LSPs) to establish and maintain neighbor adjacencies and exchange routing updates: 1 Hello, 2 DBD, 3 LSR, 4 LSU, and 5 LSAck. LSUs are also used to forward OSPF routing updates, such as link changes. Hello packets are used to: Discover OSPF neighbors and establish neighbor adjacencies, Advertise parameters on which two routers must agree to become neighbors, and Elect the Designated Router (DR) and Backup Designated Router (BDR) on multiaccess networks like Ethernet. Point-to- point links do not require DR or BDR. © 2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 29 OSPF Concepts Some important fields in the Hello packet are type, router ID, area ID, network mask, hello interval, router priority, dead interval, DR, BDR and list of neighbors. The states that OSPF progresses through to do reach convergence are down state, init state, two- way state, ExStart state, Exchange state, loading state, and full state. When OSPF is enabled on an interface, the router must determine if there is another OSPF neighbor on the link by sending a Hello packet that contains its router ID out all OSPF-enabled interfaces. The Hello packet is sent to the reserved All OSPF Routers IPv4 multicast address 224.0.0.5. Only OSPFv2 routers will process these packets. When a neighboring OSPF-enabled router receives a Hello packet with a router ID that is not within its neighbor list, the receiving router attempts to establish an adjacency with the initiating router. After the Two-Way state, routers transition to database synchronization states, which is a three step process: Multiaccess networks can create two challenges for OSPF regarding the flooding of LSAs: the creation of multiple adjacencies and extensive flooding of LSAs. © 2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 30 15 OSPF Concepts A dramatic increase in the number of routers also dramatically increases the number of LSAs exchanged between the routers. This flooding of LSAs significantly impact the operation of OSPF. If every router in a multiaccess network had to flood and acknowledge all received LSAs to all other routers on that same multiaccess network, the network traffic would become quite chaotic. This is why DR and BDR election is necessary. On multiaccess networks, OSPF elects a DR to be the collection and distribution point for LSAs sent and received. A BDR is also elected in case the DR fails. © 2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 31 OSPF Terms and Commands single-area OSPFv2 OSPFv3 Address Families multiarea OSPF link-state advertisement OSPFv3 router ID link-state routing protocol designated router distance vector routing protocol backup designated router hello packet down state database descriptor packet (DBD) Init state link-state request packet (LSR) two-way state link-state update packet (LSU) ExStart state link-state acknowledgment packet (LSAck) Exchange state link-state database loading state adjacency database full state forwarding database Dijkstra shortest-path first (SPF) neighbor adjacency © 2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 32 16  Module 2: Single-Area OSPFv2 Configuration Enterprise Networking, Security, and Automation v7.0 (ENSA) OSPF Configuration OSPFv2 is enabled using the router ospf process-id global configuration mode command. The process-id value represents a number between 1 and 65,535 and is selected by the network administrator. An OSPF router ID is a 32-bit value, represented as an IPv4 address. The router ID is used by an OSPF-enabled router to synchronize OSPF databases and participate in the election of the DR and BDR. Cisco routers derive the router ID based on one of three criteria, in this order: 1) Router ID is explicitly configured using the OSPF router-id rid router configuration mode command, 2) the router chooses the highest IPv4 address of any of configured loopback interfaces or 3) the router chooses the highest active IPv4 address of any of its physical interfaces. The basic syntax for the network command is network network-address wildcard-mask area area- id. Any interfaces on a router that match the network address in the network command can send and receive OSPF packets. When configuring single-area OSPFv2, the network command must be configured with the same area-id value on all routers. The wildcard mask is typically the inverse of the subnet mask configured on that interface, but could also be a quad zero wildcard mask, which would specify the exact interface. © 2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 34 17 OSPF Configuration To configure OSPF directly on the interface, use the ip ospf interface configuration mode command. The syntax is ip ospf process-id area area-id. Use the passive-interface router configuration mode command to stop transmitting routing messages through a router interface, but still allow that network to be advertised to other routers. The DR/ BDR election process is unnecessary as there can only be two routers on the point-to- point network between R1 and R2. Use the interface configuration command ip ospf network point-to-point on all interfaces where you want to disable the DR/BDR election process. By default, loopback interfaces are advertised as /32 host routes. To simulate a real LAN, the Loopback 0 interface is configured as a point-to-point network. OSPF Network Types The DR is responsible for collecting and distributing LSAs. The DR uses the multicast IPv4 address 224.0.0.5 which is meant for all OSPF routers. If the DR stops producing Hello packets, the BDR promotes itself and assumes the role of DR. All other routers become a DROTHER. DROTHERs use the multiaccess address 224.0.0.6 (all designated routers) to send OSPF packets to the DR and BDR. Only the DR and BDR listen for 224.0.0.6. To verify the roles of the OSPFv2 router, use the show ip ospf interface command. © 2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 35 OSPF Configuration To verify the OSPFv2 adjacencies, use the show ip ospf neighbor command. The state of neighbors in multiaccess networks can be: FULL/DROTHER, FULL/DR. FULL/BDR, or 2- WAY/DROTHER. The OSPF DR and BDR election decision is based on the router with the highest interface priority as the DR. The router with the second highest interface priority is elected as the BDR. If the interface priorities are equal, then the router with the highest router ID is elected the DR. The router with the second highest router ID is the BDR. The interface priority can be configured to be any number between 0 – 255. If the interface priority value is set to 0, that interface cannot be elected as DR nor BDR. The default priority of multiaccess broadcast interfaces is 1. OSPF DR and BDR elections are not pre-emptive. If the DR fails, the BDR is automatically promoted to DR. To set the priority of an interface, use the command ip ospf priority value, where value is 0 to 255. If the value is 0, the router will not become a DR or BDR. If the value is 1 to 255, then the router with the higher priority value will more likely become the DR or BDR on the interface. OSPF uses cost as a metric. A lower cost indicates a better path than a higher cost. The formula used to calculate the OSPF cost is: Cost = reference bandwidth / interface bandwidth. © 2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 36 18 OSPF Configuration Because the OSPF cost value must be an integer, FastEthernet, Gigabit Ethernet, and 10 GigE interfaces share the same cost. To correct this situation, you can adjust the reference bandwidth with the auto-cost reference-bandwidth command on each OSPF router, or manually set the OSPF cost value with the ip ospf cost command. The cost of an OSPF route is the accumulated value from one router to the destination network. OSPF cost values can be manipulated to influence the route chosen by OSPF. To change the cost value report by the local OSPF router to other OSPF routers, use the interface configuration command ip ospf cost value. If the Dead interval expires before the routers receive a Hello packet, OSPF removes that neighbor from its link-state database (LSDB). The router floods the LSDB with information about the down neighbor out all OSPF-enabled interfaces. Cisco uses a default of 4 times the Hello interval or 40 seconds on multiaccess and point-to-point networks. To verify the OSPFv2 interface intervals, use the show ip ospf interface command. OSPFv2 Hello and Dead intervals can be modified manually using the following interface configuration mode commands: ip ospf hello-interval and ip ospf dead-interval. © 2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 37 OSPF Configuration In OSPF terminology, the router located between an OSPF routing domain and a non-OSPF network is called the ASBR. To propagate a default route, the ASBR must be configured with a default static route using the ip route 0.0.0.0 0.0.0.0 [next-hop-address | exit-intf] command, and the default-information originate router configuration command. Verify the default route settings on the ASBR using the show ip route command. Additional commands for determining that OSPF is operating as expected include: show ip ospf neighbor, show ip protocols, show ip ospf, and show ip ospf interface. Use the show ip ospf neighbor command to verify that the router has formed an adjacency with its neighboring routers. © 2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 38 19 OSPF Configuration Terms and Commands router ospf process-id show ip ospf neighbor router ID ip ospf priority router-id rid clear ip ospf process show ip protocols metric show ip ospf cost network network-address wildcard-mask area area-id auto-cost reference-bandwidth Mbps ip ospf process-id area area-id ip ospf cost value passive interface ip ospf hello-interval value passive-interface intf-id ip ospf dead-interval value show ip ospf interface intf-id default-information originate ip ospf network point-to-point host route designated router (DR) backup designated router (BDR) DROTHER © 2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 39 Module 4: ACL Concepts Enterprise Networking, Security, and Automation v7.0 (ENSA) 20 ACL Concepts An ACL is a series of IOS commands that are used to filter packets based on information found in the packet header. A router does not have any ACLs configured by default. When an ACL is applied to an interface, the router performs the additional task of evaluating all network packets as they pass through the interface to determine if the packet can be forwarded. An ACL uses a sequential list of permit or deny statements, known as ACEs. Cisco routers support two types of ACLs: standard ACLs and extended ACLs. An inbound ACL filters packets before they are routed to the outbound interface. If the packet is permitted by the ACL, it is then processed for routing. An outbound ACL filters packets after being routed, regardless of the inbound interface. An IPv4 ACE uses a 32-bit wildcard mask to determine which bits of the address to examine for a match. A wildcard mask is similar to a subnet mask in that it uses the ANDing process to identify which bits in an IPv4 address to match. However, they differ in the way they match binary 1s and 0s. Wildcard mask bit 0 matches the corresponding bit value in the address. Wildcard mask bit 1 ignores the corresponding bit value in the address. © 2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 41 ACL Concepts A shortcut to calculating a wildcard mask is to subtract the subnet mask from 255.255.255.255. Working with decimal representations of binary wildcard mask bits can be simplified by using the Cisco IOS keywords host and any to identify the most common uses of wildcard masking. There is a limit on the number of ACLs that can be applied on a router interface. ACLs do not have to be configured in both directions. The number of ACLs and their direction applied to the interface will depend on the security policy of the organization. Standard ACLs permit or deny packets based only on the source IPv4 address. Extended ACLs permit or deny packets based on the source IPv4 address and destination IPv4 address, protocol type, source and destination TCP or UDP ports and more. ACLs numbered 1-99, or 1300-1999, are standard ACLs. ACLs numbered 100-199, or 2000-2699, are extended ACLs. Named ACLs is the preferred method to use when configuring ACLs. Specifically, standard and extended ACLs can be named to provide information about the purpose of the ACL. Every ACL should be placed where it has the greatest impact on efficiency. © 2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 42 21 ACL Concepts Extended ACLs should be located as close as possible to the source of the traffic to be filtered. This way, undesirable traffic is denied close to the source network without crossing the network infrastructure. Standard ACLs should be located as close to the destination as possible. If a standard ACL was placed at the source of the traffic, the "permit" or "deny" will occur based on the given source address no matter where the traffic is destined. Placement of the ACL may depend on the extent of organizational control, bandwidth of the networks, and ease of configuration. © 2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 43 ACL Terms and Commands access control list (ACL) access control element (ACE) packet filtering standard ACLs extended ACLs wildcard mask host keyword any keyword numbered ACLs named ACLs © 2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 44 22  Module 5: ACLs for IPv4 Configuration Enterprise Networking, Security, and Automation v7.0 (ENSA) ACL Configuration To create a numbered standard ACL, use the use the ip access-list standard access-list- name global configuration command. Use the no access-list access-list-number global configuration command to remove a numbered standard ACL. Use the show ip interface command to verify if an interface has an ACL applied to it. To create a named standard ACL, use the ip access-list standard access-list-name global configuration command. Use the no ip access-list standard access-list-name global configuration command to remove a named standard IPv4 ACL. To bind a numbered or named standard IPv4 ACL to an interface, use the ip access-group {access-list-number | access-list-name} { in | out } global configuration command. To remove an ACL from an interface, first enter the no ip access-group interface configuration command. To remove the ACL from the router, use the no access-list global configuration command. © 2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 46 23 ACL Configuration Extended ACLs can filter on source address, destination address, protocol (i.e., IP, TCP, UDP, ICMP), and port number. To create a numbered extended ACL, use the Router(config)# access-list access-list-number {deny | permit | remark text} protocol source source-wildcard [operator [port]] destination destination-wildcard [operator [port]] [established] [log] global configuration command. ALCs can also perform basic stateful firewall services using the TCP established keyword. The show ip interface command is used to verify the ACL on the interface and the direction in which it was applied. To modify an ACL, use a text editor or use sequence numbers. An ACL ACE can also be deleted or added using the ACL sequence numbers. Sequence numbers are automatically assigned when an ACE is entered. © 2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 47 ACL Configuration Terms and Commands numbered extended ACL named extended ACL numbered standard ACL named standard ACL ip access-list standard no ip access-list standard ip access-list extended ip access-list ip access-group show access-lists clear access-list counters access-class established © 2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 48 24  Module 6: NAT for IPv4 Enterprise Networking, Security, and Automation v7.0 (ENSA) NAT Concepts There are not enough public IPv4 addresses to assign a unique address to each device connected to the internet. The primary use of NAT is to conserve public IPv4 addresses. In NAT terminology, the inside network is the set of networks that is subject to translation. The outside network refers to all other networks. NAT terminology is always applied from the perspective of the device with the translated address. Inside address are the address of the device which is being translated by NAT. Outside address are the address of the destination device. Local address is any address that appears on the inside portion of the network. Global address is any address that appears on the outside portion of the network. Static NAT uses a one-to-one mapping of local and global addresses. Dynamic NAT uses a pool of public addresses and assigns them on a first-come, first-served basis. © 2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 50 25 NAT Concepts Port Address Translation (PAT), also known as NAT overload, maps multiple private IPv4 addresses to a single public IPv4 address or a few addresses. NAT increases forwarding delays because the translation of each IPv4 address within the packet headers takes time. NAT complicates the use of tunneling protocols, such as IPsec, because NAT modifies values in the headers, causing integrity checks to fail. The show ip nat translations command displays all static translations that have been configured and any dynamic translations that have been created by traffic. To clear dynamic entries before the timeout has expired, use the clear ip nat translation privileged EXEC mode command. IPv6 was developed with the intention of making NAT for IPv4 with translation between public and private IPv4 addresses unnecessary. IPv6 unique local addresses (ULA) are similar to RFC 1918 private addresses in IPv4 but have a different purpose. IPv6 does provide for protocol translation between IPv4 and IPv6 known as NAT64. © 2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 51 NAT Terms and Commands RFC1918 inside local address inside global address outside local address outside global address static NAT dynamic NAT PAT ip nat inside source static show ip nat translations show ip nat statistics ip nat outside ip nat inside ip nat pool clear ip nat translation * Overload NAT 64 © 2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 52 26  Module 7: WAN Concepts Enterprise Networking, Security, and Automation v7.0 (ENSA) WAN Concepts A Wide Area Network (WAN) is required to connect beyond the boundary of the LAN. A private WAN is a connection that is dedicated to a single customer. A public WAN connection is typically provided by an ISP or telecommunications service provider using the internet. WANs are implemented using the following logical topologies: Point-to-Point, Hub-and- Spoke, Dual-homed, Fully Meshed, and Partially Meshed. A dual-carrier connection provides redundancy and increases network availability. The organization negotiates separate SLAs with two different service providers. Site-to-site and remote access Virtual Private Networks (VPNs) enable the company to use the internet to securely connect with employees and facilities around the world. Modern WAN standards are defined and managed by a number of recognized authorities: TIA/EIA, ISO, and IEEE. Layer 1 optical fiber protocol standards include SDH, SONET, and DWDM. Layer 2 protocols define how data will be encapsulated into a frame. Layer 2 protocols include broadband, wireless, Ethernet WAN, MPLS, PPP, HDLC. © 2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 54 27 WAN Concepts Serial communication transmits bits sequentially over a single channel. In contrast, parallel communications simultaneously transmit several bits using multiple wires. The two most common types of circuit-switched WAN technologies are PSTN and ISDN. Common types of packet-switched WAN technologies are Ethernet WAN and MPLS. There are two optical fiber OSI layer 1 standards. SDH/SONET define how to transfer multiple data, voice, and video communications over optical fiber using lasers or LEDs over great distances. Circuit-switched connections were provided by PSTN carriers. ISDN is a circuit-switching technology that enables the PSTN local loop to carry digital signals. Packet switching segments data into packets that are routed over a shared network. Frame Relay is a simple Layer 2 NBMA WAN technology used to interconnect enterprise LANs. ATM technology is capable of transferring voice, video, and data through private and public networks. It is built on a cell-based architecture rather than on a frame-based architecture. © 2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 55 WAN Concepts Modern WAN connectivity options include dedicated broadband, Ethernet WAN and MPLS (packet-switched), along with various wired and wireless version of internet-based broadband. MPLS is a high-performance service provider WAN routing technology to interconnect clients. MPLS supports a variety of client access methods (e.g., Ethernet, DSL, Cable, Frame Relay). MPLS can encapsulate all types of protocols including IPv4 or IPv6 traffic. Internet-based broadband connectivity is an alternative to using dedicated WAN options. Examples of wired broadband connectivity are Digital Subscriber Line (DSL), cable connections, and optical fiber networks. Examples of wireless broadband include cellular 3G/4G/5G or satellite internet services. DSL is a high-speed, always-on, connection technology that uses existing twisted-pair telephone lines to provide IP services to users. Cable technology is a high-speed always-on connection technology that uses a cable company coaxial cable to provide IP services to users. © 2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 56 28 WAN Concepts Newer developments in wireless technology include Municipal Wi-Fi, Cellular, Satellite internet, and WiMAX. VPN tunnels are routed through the internet from the private network of the company to the remote site or employee host. ISP connectivity options include single-homed, dual-homed, multihomed, and dual- multihomed. © 2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 57 WAN Terms and Commands public WAN Voiceband modem private WAN DSL modem single-carrier WAN connection cable modem dual-carrier WAN connection CSU/DSU Synchronous Digital Hierarchy (SDH) optical converter Synchronous Optical Networking (SONET) serial communication Dense Wavelength Division Multiplexing (DWDM) synchronous Digital Hierarchy (SDH) data terminal equipment (DTE) synchronous Optical Networking (SONET) date communication equipment (DCE) Dense Wavelength Division Multiplexing (DWDM) customer premises equipment (CPE) T-carrier point-of-presence E-carrier demarcation point frame relay local loop asynchronous transfer mode (ATM) last mile dark fiber central office (CO) metropolitan Ethernet (Metro E) toll network Ethernet over MPLS (EoMPLS) backhaul network Virtual Private LAN service (VPLS) © 2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 58 29 WAN Terms and Commands label switched routers (LSRs) Customer edge (CE) router Provider edge (PE) router Internal provider (P) router DSL access multiplexer (DSLAM) PPP over Ethernet (PPPoE) Data over Cable Service Interface Specification (DOCSIS) hybrid fiber-coaxial (HFC) Cable Modem Termination System (CMTS) Fiber to the x (FTTx) Fiber to the Home (FTTH) Fiber to the Building (FTTB) Fiber to the Node/Neighborhood (FTTN) Municipal Wi-Fi © 2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 59 Module 10: Network Management Enterprise Networking, Security, and Automation v7.0 (ENSA) 30 Network Management Concepts Cisco Discovery Protocol (CDP) is a Cisco proprietary Layer 2 protocol that is used to gather information about Cisco devices which share the same data link. CDP can be used as a network discovery tool to determine the information about the neighboring devices. This information gathered from CDP can help build a logical topology of a network when documentation is missing or lacking in detail. On Cisco devices, CDP is enabled by default. To enable CDP globally for all the supported interfaces on the device, enter cdp run in the global configuration mode. To enable CDP on the specific interface, enter the cdp enable command. To verify the status of CDP and display a list of neighbors, use the show cdp neighbors command in the privileged EXEC mode. Cisco devices also support Link Layer Discovery Protocol (LLDP), which is a vendor-neutral neighbor discovery protocol similar to CDP. To enable LLDP globally on a Cisco network device, enter the lldp run command in the global configuration mode. © 2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 61 Network Management Concepts With LLDP enabled, device neighbors can be discovered by using the show lldp neighbors command. When more details about the neighbors are needed, the show lldp neighbors detail command can provide information, such as the neighbor IOS version, IP address, and device capability. When the time is not synchronized between devices, it will be impossible to determine the order of the events and the cause of an event. You can manually configure the date and time, or you can configure the NTP, which allows devices on the network to synchronize their time settings with an NTP server. NTP networks use a hierarchical system of time sources and each level in this system is called a stratum. Authoritative time sources, also referred to as stratum 0 devices, are high-precision timekeeping devices. Stratum 1 devices are directly connected to the authoritative time sources. Stratum 2 devices, such as NTP clients, synchronize their time by using the NTP packets from stratum 1 servers. The ntp server ip-address command is issued in global configuration mode to configure a device as the NTP server. © 2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 62 31 Network Management Concepts To verify the time source is set to NTP, use the show clock detail command. The show ntp associations and show ntp status commands are used to verify that a device is synchronized with the NTP server. SNMP is an application layer protocol that provides a message format for communication between managers and agents. The SNMP system consists of three elements: SNMP manager, SNMP agents, and the MIB. The SNMP manager can collect information from an SNMP agent by using the “get” action and can change configurations on an agent by using the “set” action. SNMP agents can forward information directly to a network manager by using “traps”. SNMPv1, SNMPv2c, and SNMPv3 are all versions of SNMP. SNMPv1 is a legacy solution. Both SNMPv1 and SNMPv2c use a community-based form of security. SNMPv3 provides for both security models and security levels. The MIB organizes variables hierarchically. OIDs uniquely identify managed objects in the MIB hierarchy. The Cisco SNMP Navigator on the http://www.cisco.com website allows a network administrator to research details about a particular OID. The syslog protocol uses UDP port 514 to allow networking devices to send their system messages across the network to syslog servers. © 2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 63 Network Management Concepts The syslog logging service provides three primary functions: gather logging information for monitoring and troubleshooting, select the type of logging information that is captured, and specify the destinations of captured syslog messages. Destinations for syslog messages include the logging buffer (RAM inside a router or switch), console line, terminal line, and syslog server. Syslog facilities identify and categorize system state data for error and event message reporting. Common syslog message facilities reported on Cisco IOS routers include: IP, OSPF protocol, SYS operating system, IPsec, and IF. The default format of syslog messages on Cisco IOS software is: %facility-severity-MNEMONIC: description. Use the command service timestamps log datetime to force logged events to display the date and time. The Cisco IFS lets the administrator navigate to different directories and list the files in a directory, and to create subdirectories in flash memory or on a disk. Use the show file systems command to view the file systems on a Catalyst switch or a Cisco router. © 2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 64 32 Network Management Concepts Configuration files can be saved to a text file by using Tera Term. A configuration can be copied from a file and then directly pasted to a device. Configuration files can be stored on a TFTP server, or a USB drive. To save the running configuration or the startup configuration to a TFTP server, use either the copy running-config tftp or copy startup-config tftp command. Cisco IOS Software images and configuration files can be stored on a central TFTP server to control the number of IOS images and the revisions to those IOS images, as well as the configuration files that must be maintained. Select a Cisco IOS image file that meets the requirements in terms of platform, features, and software. Download the file from cisco.com and transfer it to the TFTP server. To upgrade to the copied IOS image after that image is saved on the router's flash memory, configure the router to load the new image during bootup by using the boot system command. © 2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 65 Network Management Terms and Commands  Cisco Discovery Protocol (CDP)  Network Time Protocol (NTP)  cdp run  Stratum  cdp enable  show clock  show cdp  show clock detail  show cdp interface  ntp server ip-address  show cdp neighbors  show ntp associations  show cdp neighbors detail  show ntp status  Link Layer Discovery Protocol (LLDP)  Simple Network Management Protocol (SNMP)  lldp run  Network Management System (NMS)  lldp enable  SNMP Manager  lldp transmit  SNMP Agent  lldp receive  Management Information Base (MIB)  show lldp  Object Identifier (OID)  show lldp neighbors  get-request  show lldp neighbors detail  get-next-request  clock set hh:mm:ss mm dd yyyy  get-bulk-request  get-response  set-request © 2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 66 33 Network Management Terms and Commands  MIB Variable  bootflash  SNMP Agent Trap  pwd  SNMPv1  copy running-config tftp  SNMPv2c  copy tftp running-config  SNMPv3  copy running-config usbflash0:  noAuthNoPriv  ROMMON  authNoPriv  confreg  authPriv  config-register  Community Strings  copy tftp: flash:  snmpget  boot system  Cisco SNMP Object Navigator  Syslog  Syslog Facility  service timestamps log datetime  Cisco Integrated File System (IFS)  show file systems © 2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 67 Module 12: Network Troubleshooting Enterprise Networking, Security, and Automation v7.0 (ENSA) 34 Network Troubleshooting Concepts Common network documentation includes physical and logical network topologies, network device documentation, and network performance baseline documentation. The troubleshooting process should be guided by structured methods such as the seven-step troubleshooting process: (i.e., 1. Define the problem, 2. Gather information, 3. Analyze information, 4. Eliminate possible causes, 5. Propose hypothesis, 6. Test hypothesis, and 7. Solve the problem). Troubleshooting tools include NMS tools, knowledge bases, baselining tools, protocol analyzer, digital multimeters, cable testers, cable analyzers, portable network analyzers, Cisco Prime NAM, and syslog servers. Physical layer problems cause failures and suboptimal conditions. Data link layer problems are typically caused by encapsulation errors, address mapping errors, framing errors, and STP failures or loops. Network layer problems include IPv4, IPv6, routing protocols (such as EIGRP, OSPF, etc.). Transport layer problems can be misconfigured NAT or ACLs. Application layer problems can result in unreachable or unusable resources. © 2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 69 Network Troubleshooting Concepts A bottom-up troubleshooting method can be used to solve connectivity problems. Start verifying the physical layer, check for duplex mismatches, verify addressing and default gateway, verify that the correct path is taken, and verify the transport layer. © 2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 70 35 Network Troubleshooting Terms and Commands Network topology diagram Network management system (NMS) tools Physical topology Protocol analyzers Logical topology Digital multimeters Network device documentation Cable testers Network baseline Cable analyzers Troubleshooting processes Portable Network Analyzers Seven-step troubleshooting process Cisco Prime NAM Bottom-up troubleshooting approach Syslog Top-down troubleshooting approach Divide-and-Conquer troubleshooting approach Follow-the-Path troubleshooting approach Substitution troubleshooting approach Comparison troubleshooting approach Educated Guess troubleshooting approach © 2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 71 Good Luck for your Exams ! 36