CCNP - SWITCH - Planning topics

Discussions on the web indicate that the CCNP SWITCH exam asks much more about 'Planning' your deployments.

A good point of reference is - http://dhucaby.wordpress.com - written by Dave Hucaby who wrote the Official CCNP SWITCH Certification guide, the blog expands on the topics outline in his book particularly on Planning.

It appears that some of the official Cisco material may be lacking in this area so brush up any gaps via Dave's blog and you shouldn't go wrong.

New Year, New Job!

It's been a while since my last entry. We've had Christmas, New Year, family time, work, and studies. I've also had a recruitment process to contend with.

Last week I was pleased to find that I was successful in my application to become a Cisco specialist at an ISP based in North Yorkshire.

My current role is in doubt and so I decided to jump before I was pushed. In my new role i will be getting to develop those skills learned at the Cisco Networking Academy and I'll be able to get hands on with Service Provider technologies such as MPLS VPNs and BGP.

I start in February and I can't wait :o) , the team I'll be working with are really nice and friendly and already I feel I'm going to enjoy working there.

Game On...

IKE - Functions - Dead Peer Detection

Dead Peer Detection -  use to detect a dead IKE peer and perform IKE peer failover
- If a dead IKE peer is detected then the IKE SA and IPSec SA to that peer is torn down.
- DPD has 2 modes of function:
    A) Defualt setting - where a DPD hello is sent every 10 seconds (unless the router receives a hello
        message from the peer first) but does lead to increased network activity from all the hellos.

    b) On demand - the router sends a DPD hello packet in advance of sending some data. This option    reduces uncessary network traffic but could result in you only finding out there is a network issue when data needs to be sent, not prior.

- Implemented using  -
  #crypto isakmp keepalives [frequency] [retries] [periodic | on-demand]-
   where frequency = number of seconds between DPD messages
             retries = number of seconds between DPD retries id the DPD message fails
             periodic = DPD messages are sent at regular intervals
            on-demand = DPD retries are sent on demand - this is default behaviour.

E.g - #crypto isakmp keepalives 10 3 periodic

By implementiung this you can then specifiy a second remote peer within your IPsexc crypto map to establish your SA:
for example - #crypto map TEST 10 ispec-isakmp
          # set peer 172.31.1.100 default
          # set peer 172.31.1.200

The Default option indicates that this should be used first to establish an SA, the second peer is used if the first remote peer is detected to be dead.

Cisco studies - What next...

Since I attained my CCNP I've been looking at what to do next. Should I continue on to the CCIE? or look at exploring some of the specialisms Cisco has developed in the time it took for me to go through CCNA and then CCNP?

At first I thought I would continue straight on the CCIE R&S but I'm struggling to get over the shear volume of knowledge required to go for the written (yes I appreciate it's supposed to be hard but I've got a young family to factor in...) So after a few very interesting weeks at work I've decided to go for CCDA then CCDP.

Starting in January my next posts will be aligned to the CCDA certification. Here goes...

IPSec - the basics

Following on from GRE (which I'll come back to on another occasion), IPSec is an IETF standard (RFC 2401 - 2412) which can be considered to be a 'suite' of protocols.

IPsec operates at the Nework layer of the OSI model, and authenticates every packet, offers data integrity for every packet, and provides confidentiality.

IPsec is available from IOS 11.3(T) and PIX OS 5.0 or later.

IPsec is main up of 3 components:

1. Internet Key Exchange (IKE) - UDP 500, which is a framework for negotiating security parameters and authentication keys.
2. Encapsulation Security Payload (ESP)  - IP port 50, encrypts (using DES, 3DES, AES), secures (MD5 or SHA-1), and authenticates data (MD5 or SHA-1).
3.  Authentication Header (AH) - IP port 51, offers secures data and offers authentication (MD5 or SHA-1).

 IPsec creates secure tunnels, known as Security Associations (SA), between 2 peers such as routers. Tunnels are unidirectional and are established via ESP or AH.

Internet Key Exchange Overview
IPsec uses IKE to authenticate peers and generate symmetrical encryption keys for data communications
Symmetrical keys are generated by Diffe Helman (DH)

IKE also manages the negotiation between peers for settings such as what data to be protected, key strengths, hash method to use (outlined later).

You can manually set the parameters in IPSec for the generation of keys, refresh interval of the keys, an SA characteristics however it's much easier to have IKE configure this automatically. IKE achieves this using ISAKMP or Internet Security Association and Key Management Protocol.

IKE has 2 phases in its method for setting up an IPSec tunnel.
Phase1 - Authenticates the actual peer so each peer knows the other peer is who it says it is. Operates in either 'Main Mode' or 'Agressive Mode'
Phase1.5 - is optional and it is at this stage you can authenticate an actual user. This may be via a RADIUS server, local accounts on the terminating peer (i.e router), or other means.
Phase2 - Establishes the actual IPSec tunnel and operates in 'Quick Mode'

IKE Modes
Main Mode - consists of 3 exchanges, the initiator sends a propsal to the peer containing what encryption, authentication, key duration settings to use (amoungst others).
The remote peer selects an appropriate proposal and replies
DH public keys and then exchanged resulting in all further comms being encryped in the inital IKE tunnel (SA)
A 3rd exchange authenticates the ISAKMP session.
Once complte phase 2 ocurs.
Aggressive Mode - Everything is sent over in a single exchange and the remote peer then responds accordingly
Quick Mode - Within IKE phase2, the IPSec SA is established but comms are protected by the IKE SA configured in Phase1.
Quick mode negotiates the SA for data to be exchanged.

Welcome to NetworkStudies.co.uk

The new home of CiscoStudies.co.uk

Thanks

Jonathan

Generic Routing Encapsulation – GRE

• GRE is IP protocol 47 (that's Protocol NOT port)
  
• GRE can encapsulate a wide variety of protocol packets inside IP tunnels
• Creates virtual Point-to-Point links to Cisco router (proprietary)
• Uses IP for transport
• Additional Header supports any other layer3 protocol in the payload (eg IPX, AppleTalk, et al)
• Stateless – Tunnel end point doesn’t keep any information on the state/availability of the remote end point.
• Offers NO security, confidentiality, integrity checking, data authentication
• Uses 24-byte overhead by default – 20-byte IP header plus 4-byte GRE header
• 4-byte header contains GRE flag setting out a checksum, key (if used), sequence number, version number, protocol type id field.
• Protocol typre id field is used to identify the protocol of the payload, e.g, 0x800 indicates IP. This is the field that allows GRE to tunnel any protocol.

 Benefits:

•  Good at tunneling
•  Supports multiple protocols
• Allows routing protocols (OSPF, EIGRP) to be used

Costs:

• Poor security – only plain text authentication used
• Cannot accommodate confidentiality, integrity, and data authentication

GRE and IPSEC

•  GRE can be used in conjunction with IPSEC
•  IPSEC offers confidentiality via 3DES or AES (for example)
•  Authentication is provided via a HMAC such as MD5 or SHA-1
•  Integrity is via MD5 or SHA-1
•  IPSEC is not perfect though, older IOS’ don’t support IP multicast
•  IPSEC was designed to support IP only

 Configure a basic GRE tunnel in IOS

•  Here is a typical GRE tunnel config.
• Each router needs needs a tunnel interface on the end points of the tunnel
• Simplest type of tunnel

 R1(config)#int tu0
R1(config-if)#tunnel source S0/0
R1(config-if)#tunnel dest 192.168.20.1
R1(config-if)#ip address 172.16.10.1 255.255.255.0

R2(config)#int tu0
R2(config-if)#tunnel source s0/1
R2(config-if)#tunnel dest 192.168.10.1
R2(config-if)#ip address 172.16.10.2 255.255.255.0

*use the ? to inspect further options in tunnel interface mode

Note

• The ‘int tu0’ cmd creates the GRE tunnel
• ‘ip address’ is a network used exclusively by the tunnel end points
•  ‘tunnel source’ is a physical interface on the route
•  ‘tunnel dest’ is the ip of the physical interface on the remote router
•  Default mode of the tunnel is GRE and so we have not needed to configure the mode in this example
• GRE can pass OSPF/EIGRP so you use this in association with IPSEC (which cannot) if you are wishing to distribute routing information
• Where you use IPSEC and GRE the ipsec crypto map will be assigned to the physical interface NOT the tunnel interface
• IPSEC will be discussed in further detail later.

Cisco Service Orientated Network Architecture - SONA

courtesy of cisco.com

Right then, the first topic you'll cover off in each of the CCNP courses is SONA or how Cisco would like you to set up your network in order to sell you everything in their portfilio :o)

It details the common services deployed in the network and aims to reduce the gap between resources and applications.

Advantages include:

• Offers a structured path to IIN (the Intelligent Information Network - discussed later)
• Provides an outline to build integrated systems across a converged network through 3 phases
• it increases the flexibility and efficiency in the business

SONA incorpates a Network Infrastructure layer, Interactive Services layer, and Application layer.

That's about it. Visit cisco.com for more information.

Collision Domains vs Broadcast Domains

Collision Domains

layer 1 of the OSI model

A hub is an entire collision domain since it forwards every bit it receives from one interface on every other interfaces

A bridge is a two interfaces device that creates 2 collision domains, since it forwards the traffic it receives from one interface only to the interface where the destination layer 2 device (based on his mac address) is connected to.

A bridge is considered as an "intelligent hub" since it reads the destination mac address in order to forward the traffic only to the interface where it is connected

A switch is a multi-interface hub, every interface on a switch is a collision domain. A 24 interfaces switch creates 24 collision domains (assuming every interface is connected to something, VLAN don't have any importance here since VLANs are a layer 2 concept, not layer 1 like collision domains)

Broadcast Domains

Layer 2 of the OSI model

A switch creates an entire broadcast domain (provided that there's only one VLAN) since broadcasts are a layer 2 concept (mac address related) routers don't forward layer 2 broadcasts, hence they separate broadcast domains

With all this information, you can say that on your diagram, there are 2 broadcast domains (1 router that separates 2 LAN segments composed by one or many switches, with only 1 VLAN per segment).

There are 8 collision domains, one per pair of devices connected to each other (switch to router, switch to switch, switch to computer etc...) since we are talking about layer 1 concept (physical connection).

Administrative Distance

Administrative distance is the measure used by Cisco routers to select the best path when there are two or more different routes to the same destination from two different routing protocols. Administrative distance defines the reliability of a routing protocol. Each routing protocol is prioritized in order of most to least reliable (believable) using an administrative distance value. A lower numerical value is preferred, e.g. an OSPF route with an administrative distance of 110 will be chosen over a RIP route with an administrative distance of 120.
The following tables gives the default administrative distances used by Cisco routers.

Protocol	Administrative distance
Directly connected route / static route using exit interface	0
Static route with next-hop IP address	1
EIGRP summary route	5
External BGP	20
Internal EIGRP	90
IGRP	100
OSPF	110
IS-IS	115
RIP	120
EGP	140
ODR	160
External EIGRP	170
Internal BGP	200
Unknown	255