Pages

Sunday, February 12, 2012

The ccna cram Guide !!!

OSI Model

7. Application Layer
Provides Services to lower layers. Enables program to program communication and
determines if sufficient resources exist for communication. Examples are e-mail gateways (SMTP), TFTP, FTP and SNMP, BGP.

6. Presentation Layer
Presents information to the Application layer. Compression, data conversion, encryption
and standard formatting occur here. Contains data formats JPEG, MPEG, MIDI, TIFF.

5. Session Layer
Establishes and maintains communication ‘sessions’ between applications (dialogue
control). Sessions can be simplex (one direction only), half-duplex (one direction at a
time) or full duplex (both ways simultaneously). Session layer keeps different
applications data separate from other applications. Protocols include NFS, SQL, X
Window, RPC, ASP, and NetBIOS Names.

4. Transport Layer
Responsible for end to end integrity of data transmissions and establishes a logical
connection between sending and receiving hosts via ‘virtual circuits’. Windowing works
at this level to control how much information is transferred before acknowledgement is
required. Data is segmented and reassembled at this layer. Port numbers are used to
keep track of different conversations crossing the network at the same time. Supports
TCP. UDP, SPX, NBP, Segmentation works here (Segments) and error correction (not
detection).

3. Network Layer
Routes data from one node to another and determines the best path to take. Routers
operate at this level. Network addresses are used here which are used for routing
(Packets). Routing tables, subnetting and control of network congestion occur here.
Routing protocols regardless of which protocol the run over reside here. RIP, IP, IPX,
ARP, IGRP, Appletalk.

2. Data Link Layer
Sometimes referred to as the LAN layer. Responsible for the physical transmission of
data from one node to another. Error detection occurs here. Packets are translated into
frames here and hardware address is added. Bridges and switches operate at this layer.
Logical Link Control sub layer (LLC) 802.2:- manages communications between devices
over a single link on a network. Uses Service Access Points (SAPs) to help lower layers
talk to the Network Layer.
Media Access Control (MAC) 802.3:- builds frames from the 1’s and 0’s that the
Physical Layer (address = 6-byte/48 bit) picks up from the wire as a digital signal and
runs a Cyclic Redundancy Check (CRC) to assure no bits were lost or corrupted.

1. Physical Layer
Puts data onto the wire and takes it off, physical layer specifications such as the
connectors, voltage, physical data rates, and DTE/DCE interfaces. Some common
implementations include Ethernet/IEEE 802.3, Fast Ethernet, and Token Ring/IEEE
802.5.

Cisco Hierarchical Model
Core Layer – purpose is to switch traffic as quickly as possible. Fast transport to
enterprise services (internet etc). No packet manipulation, VLANs, access-lists. High
speed access required such as FDDI, ATM.
Distribution Layer – time sensitive manipulation such as routing, filtering and wan
access. Broadcast/Multicast, media translations, security.
Access Layer – switches and routers, segmentation occurs here and workgroup access.
Static (not dynamic) routing.

TCP/IP
Port Numbers
These are used to connect to various services and applications and piggy back onto IP
addresses. Common port numbers are:
20 - File Transfer Protocol – Data (TCP)
21 - File Transfer Protocol – Control (TCP) (Listens on this port)
22 - SSH (TCP)
23 - Telnet (TCP)
25 - Simple Mail Transfer Protocol (TCP)
53 - Domain Name Service (TCP/UDP)
69 - Trivial File Transfer Protocol (UDP)
80 - HTTP/WWW (TCP)
110 - Post Office Protocol 3 (TCP)
119 - Network News Transfer Protocol (TCP)
123 - Network Time Protocol (UDP)
161/162 - Simple Network Management Protocol (UDP)
443 - HTTP over Secure Sockets Layer (TCP)
TCP – (protocol 6) reliable, sequenced connection-oriented delivery, 20-byte header.
UDP – (protocol 17) connectionless, unsequenced best effort delivery, 8-byte header.
Sends data but does not check to see if it is received.
Telnet – used to connect to a remote device (TCP). A password and username is required
to connect. Telnet tests all seven layers of the OSI model.
FTP – connection orientated (TCP) protocol used to transfer large files.
TFTP – connectionless (UDP) protocol used for file transfer.
SNMP – allows remote management of network devices.
ICMP – supports packets containing error, control, and informational messages. Ping
uses ICMP to test network connectivity.
ARP – used to map an IP address to a physical (MAC) address. A host wishing to obtain a physical address broadcasts an ARP request onto the TCP/IP network. The host replies with its physical address.
DNS – resolves hostnames to IP addresses (not the other way around).
To configure the router to use a host on the network use the command
ROUTER(config)#ip nameserver 4.2.2.2 and to configure DNS the command
ip name-server is usually already turned on for the router config by default. If you want hosts on the network to use the router as a proxy DNS server put the command ROUTER(config)#ip dns server onto the router.
DHCP – involves a central server or devices which relays TCP information to hosts on a
network. You can configure a router to be a DHCP server with the below config. You
must have hosts on the same LAN as the router interface:
Router(config)#ip dhcp pool E00_DHCP_Pool
Router(dhcp-config)#network 10.10.10.0 255.255.255.0
Router(dhcp-config)#dns-server 24.196.64.39 24.196.64.40
Router(dhcp-config)#domain-name mydomain.com
Router(dhcp-config)#default-router 10.10.10.254
Router(dhcp-config)#lease 1

Cisco IOS
Six modes
User EXEC:- Router>
Privileged EXEC:- Router#
Global Configuration:- Router(config)#
ROM Monitor:- > or rommon>
Setup:- series of questions
RXBoot:- Router
Editing Commands
Ctrl+W - Erases a word
Ctrl+U - Erases a line
Ctrl+A - Moves cursor to begin of line
Ctrl+E - Moves cursor to end of line
Ctrl+F - (or right arrow) – Move forward one character
Ctrl+B - (or left arrow) – Move back one character
Ctrl+P - (or up arrow) – Recalls previous commands from buffer
Ctrl+N - (or down arrow) – Return to more recent commands in buffer
Esc+B - Move back one word
Esc+F - Move forward one word
Tab - completes a command you have started
Router# copy ru _ press tab key after the ‘u’
Router# copy running-configuration
? gives you the command options
Router#copy ?
flash: Copy from flash: file system
ftp: Copy from ftp: file system
nvram: Copy from nvram: file system
running-config Copy from current system configuration
startup-config Copy from startup configuration
system: Copy from system: file system
tftp: Copy from tftp: file system (truncated to save space)
or the commands beginning with the letters you have typed:
Router#a?
access-enable access-profile access-template

Router Elements
DRAM – working area for the router. Contains routing tables, ARP cache, packet buffers,
IOS and running config. Some routers run the IOS from DRAM.
show version – shows information about IOS in RAM and displays how much physical
memory is installed. Also shows the config register setting.
show process – shows info about programs running in DRAM.
show running-configuration – shows active configuration in DRAM.
show memory/stacks/buffers – to view tables and buffers
NVRAM – stores routers start up configuration. Does not lose data when powered off
due to a battery power source.
show startup-configuration
erase startup-configuration
copy running-configuration startup-configuration (copy run start)
Config register 0x2142 skips start up config file in NVRAM (for password recovery)
Config register 0x2102 loads start up config files from NVRAM
Flash – (EEPROM or PCMCIA card) holds the compressed operating system image
(IOS). This is where software upgrades are stored.
show flash
dir flash:
ROM – contains power-on diagnostics, a bootstrap program and a mini IOS (rommon).
You can specify which file the routers boots from if you have more than one in flash
memory.
Router(config)#boot system flash {IOS filename}
Or that it boots from a TFTP server if for example the image is too large to fit in flash.
Router(config)#boot system tftp {IOS filename}{tftp address)
You can also back up the flash image for emergency use.
Router(config)#copy flash tftp

Router Management
Console port: a PC connected to the console port via a rollover cable. Used for initial
configuration or disaster recovery.
Virtual Terminals: normally accessed by telnetting to the router. Five lines available
numbered 0-4
Auxiliary port: normally a modem connected to this port.
TFTP server: the router can get its configs or IOS from a server (PC for example)
running TFTP software and holding the necessary files.
NMS: network management station. Uses SNMP to manage the router normally via a
web style interface.

CDP
Cisco Discovery Protocol runs only on Cisco devices (proprietary), it allows you to
gather information about other routers and switches. It is enabled by default.
Router#show cdp neighbors (note: Cisco uses US spelling conventions)
This command displays the null router or switches hostname, hardware
platform, port identifier and capabilities list.
Router#show cdp neighbors detail
This command displays more detail than the previous one. You can view IP address, IOS
release and duplex setting.
To turn CDP off an interface use the command:
Router(config-if)#no cdp enable
To turn CDP off on your entire router or switch use the command:
Router(config)#no cdp run

LAN Switching
A LAN switch has three primary functions:
1. Address Learning – maintains a table (CAM – Content Addressable Memory) table of
addresses and which port they can be reached on.
2. Forward/filter decision – forwards frames only out of the relevant port.
3. Loop avoidance - STP
Broadcast frames are forwarded out of all ports. Because ethernet hosts can all transmit
at the same time this can lead to collisions thus slowing down the network considerably.

Transmitting Frames Through a Switch
Store-and-Forward – switch copies the entire frame into its buffer and computes the
CRC. Frame is discarded if there is an error. High latency.
Cut-through – reads only the destination address (first 6 bytes after preamble), looks up
address and forwards frame. Lower latency.
Fragment null – switch reads first 64 bytes before forwarding the frame. Collisions
normally occur within the first 64 bytes.

Spanning Tree Protocol (STP) IEEE 802.1d
STP is a link management protocol that provides path redundancy whilst preventing
undesirable loops in the network. For communication to work correctly on an ethernet
network there can only be one path between two destinations. STP uses Bridge Protocol
Data Units (BPDU) received by all switches to determine the spanning-tree topology. A
port on a switch is either in forwarding or blocking state. Forwarding ports provide the
lowest cost path to the root bridge, a port will remain in blocking the state from startup if
spanning tree determines there is a better path.

Rapid Spanning Tree Protocol (RSTP) IEEE 802.1w
Spanning tree takes up to 50 seconds to converge to a stable network whereas RSTP takes 2 seconds. RSTP port roles are root port, designated port, backup port, alternate port and disabled. Most implementations of RSTP use PVST+, Per VLAN Spanning Tree+, here multiple instances of Spanning Tree are running so the load on the CPU is higher but we can load share over the links.

To enable RSTP for each VLAN in our switched network we use the following
command:
Switch(config)#spanning-tree mode rapid-pvst

Bridging / Switching
Bridges are primarily software based and have one spanning-tree instance per bridge.
Normally 16 ports per bridge. LAN Switches are primarily hardware based. Many
spanning-tree instances per switch and up to 100 ports.

Virtual LAN (VLAN)
A VLAN is a switched network that consists of logically segmented communities without
regard to physical location. Each port on a switch can belong to a VLAN. VLAN ports
share broadcasts. A router is needed to route traffic between VLANs
devices do not use IP addresses. Reduces admin costs, tighter security and better control of broadcasts

Subnetting
Max # of Subnets = 2(to the power of masked bits) (– 2 if subnet zero not allowed)
Max # of Hosts (per subnet) = 2(to the power of unmasked bits) – 2
Easy Subnetting
What network is host 172.16.5.68 255.255.255.240 on?
256-240 = 16 so you have the subnets going up in increments of 16 starting with zero (if
subnet zero is permitted in the exam). Each subnet will need to have a subnet and a
broadcast number so this leaves 14 hosts per subnet. The subnets start at 0,16,32,48, 64,
80….224, 240 (the 0 and 240 are only valid if subnet zero is allowed).

IPV6
An IPv6 address consists of 128 bits represented in hexadecimal format separated into
eight parts e.g. EEDE:AC89:4323:5445:FE32:BB78:7856:2022. There are no broadcast
packets, only anycast – multicast – unicast.
The two methods of migrating from IPv4 to IPv6 are dual stack and tunneling. Cisco
IOS support IPv6 commands in version 12.2(2)T and later.

IP Routing
Routers must have some means of learning networks that are not directly connected.
Static routing:
Router(config)#ip route {destination network}{mask}{next hop address}
e.g ip route 172.16.5.2 255.255.255.0 172.16.12.8
Dynamic addressing is done by using a routing protocol:
for RIP v2
Router(config)#router rip
Router(config-router)#version 2
Router(config-router)#network 172.16.0.0
Router(config-router)#no auto-summary _ optional
for EIGRP
Router(config)# router eigrp 20
Router(config-router)#network 172.16.0.0
Router(config-router)#no auto-summary _ optional
for OSPF
Router(config)#router ospf 20
Router(config-router)#network 172.16.0.0 0.0.255.255 area 0
Facts

RIP v2
Uses UDP port 520
Classless
Max hop count 15
Multicasts route updates to 224.0.0.9
Supports authentication
Update timer 30 seconds
Invalid 90 seconds
Hold down 180 seconds
Flush 270 seconds

EIGRP
Uses IP protocol 88
Classless
Hybrid of distance vector and link state
Multicasts updates to 224.0.0.10
Uses feasible successors to determine alternative routes to networks.
The feasible successor is a backup route based upon the topology table.

OSPF
Uses IP protocol 89
Classless
Uses Dijkstras shortest path algorithm (SFP)
Router ID is the highest IP address but loopback address used if present
Backbone area is area 0
All nonbackbone areas must connect directly to area 0
Areas can be numbered from 0 to 65535
Multicasts on 224.0.0.5
OSPF uses cost as a metric (see below - * indicates the most common)

Interface                                                                               Cost (108/Bandwidth)
ATM, Fast Ethernet, Gigabit Ethernet, FDDI (> 100 Mbps)   1
HSSI (45Mbps)                                                                         2
16 Mbps Token Ring                                                                  6
10 Mbps Ethernet                                                                      10
4 Mbps Token Ring                                                                   25
T1 (1.544 Mbps)*                                                                     64
DS-0 (64k)*                                                                              1562
56k                                                                                            1785

Distance Vector
Distance Vector protocols understand the direction and distance to any given network
connections. Algorithms calculate the cost to reach the connection and pass this
information to every neighbor router. Examples are RIP and IGRP. Problems with
distance vector protocols include routing loops and counting to infinity.
To overcome these problems the following can be implemented:
Defining a maximum number of hops, 15 for RIP and 255 for IGRP
Split Horizon – if the router learns a route on an interface do not advertise it out of the
same interface.
Route Poisoning – Information passed out of an interface is marked as unreachable by
setting the hop count to 16 (for RIP).
Hold Down Timers – ignores new routing updates until a determined time has passed.
Triggered Updates – instead of routing updates being sent at the default intervals; a
triggered update is sent every time to indicate a change in the routing table.

Link State
These have a picture of the entire network from link state advertisements (LSA) and link
state packets (LSP). Once these have all been passed only changes to the network are
sent out reducing network traffic.
Link state protocols do require a lot of CPU time and bandwidth when LSAs are flooded
out. Examples are OSPF and ISIS.
Routers use administrative distances to determine how believable the route learned is
depending upon the protocol it learns the router from.

Source                                         Default Distance
Directly Connected Interface               0
Static hop to next router                      1
EIGRP Summary                                5
External BGP                                     20
EIGRP (Internal)                                90
OSPF                                                110
IS-IS                                                 115
RIP                                                   120
Exterior Gateway Protocol (EGP)      140
External EIGRP                                 170
Internal BGP                                     200
Unknown                                          255
An administrative distance of 0 is most preferred. So a router running RIP and OSPF will prefer the OSPF routes most and install these in the routing table.
Routing protocols maintain a table of hosts and which interface they can be reached by.
Examples RIP, OSPF
BGP is an exterior gateway protocol. It is used to connect autonomous systems together.
Routed protocols are used to transport traffic from source to destination. Examples: IP,
IPX, Appletalk.
When a packet traverses the network from device to device (hop to hop) the IP address
remains constant, the hardware (MAC) address changes.

NAT
Network Address Translation will convert an address from the inside of your network to
another address on the outside of your network and vice versa. It is most commonly used to convert a non-routable address to a routable address.
For all configs, you must specify which interfaces are internal for NAT and which are
external:
Router(config-if)#ip nat inside/outside
Static NAT – maps one address to one address such as 192.168.1.1 to 200.1.1.1
Router(config)#ip nat inside source static 192.168.1.1 200.1.1.1
Dynamic NAT – maps a number of internal addresses to a pool of external addresses. The below config creates a pool of 10 addresses with a mask (prefix length) of 255.255.255.0
and the name ‘ad_team.’ The hosts to be NATted are on the 192.168.1.0 network. The
access list (source list) tells the router which addresses to NAT.
Router(config)#ip nat pool ad_team 10.0.0.1 10.0.0.10 prefix-length 24
Router(config)#ip nat inside source list 1 pool ad_team out
Router(config)#access-list 1 permit 192.168.1.0 0.0.0.255
Overload NAT – (or PAT) maps private internal addresses to one or more external
addresses using port numbers. The below config creates a pool of ten addresses (it could be more) and the command ‘overload’ tells the router to use port address translation.
Router(config)#ip nat pool ad_team 10.0.0.1 10.0.0.10 prefix-length 24
Router(config)#ip nat inside source list 1 pool ad_team out overload
Router(config)#access-list 1 permit 192.168.1.0 0.0.0.255

Wireless Networking
Wireless Basics
Wireless clients connect to access points. The two wireless modes are ad-hoc and
infrastructure. Ad hoc is similar to peer-to-peer networking where nodes connect directly
to each other. They must have the same SSID and channel for this to work. In
infrastructure mode, the clients connect to the access point. They can be via basic service set (BSS – 1 access point and multiple clients) or extended service set (ESS – 2 or more BSS’).

Wireless Security
The two methods for wireless authentication are open system and shared a key. In open
system the host sends an association request to the wireless access point and it will be
sent a success or failure message. With shared key, a key or passphrase is configured on both the host and access point.

There are three types of shared key authentication WEP,
WPA and WPA2.
WEP is an encryption algorithm built in the 802.11 standard. It uses RC4 40bit or 104 bit
keys and a 24bit initialization vector.
WPA uses dynamic key management, adds a stronger encryption cipher and is built on
the EAP/802.1X mechanism. It uses TKIP, Temporal Key Integrity Protocol and the
Initialization Vector is increased to 48bit (more than 500 trillion key combinations). It is
used with RADIUS in the enterprise.
WPA2 is the next generation in wireless security. It uses even stronger encryption than
WPA and this is achieved by using AES, Advanced Encryption Standard. Also WPA2
creates a new key for every new association this has a benefit over WPA that the client's
keys are unique and specific to that client.

Network Security
Access Lists
Access lists are a set of conditions that permit or deny access to or through a routers
interface.
Range                     Usage
1-99                        IP Standard
1300-1999              IP Standard (Expanded Range)
100-199                  IP Extended
2000-2699              IP Extended (Expanded Range)
Standard Access Lists
Standard IP access lists check only the source address of the packet and permits or denies
the entire TCP/IP suite. You cannot choose a particular port or application to block.
Cisco recommends that they are placed as close to the destination as possible.
Router(config)#access-list{number 1-99}{permit/deny}{source address}
access-list 10 permit 172.16.5.2 _ address can be a host or network
Extended Access Lists
These allow for a lot more granularity when filtering IP traffic. They can filter packets
based upon source or destination, a particular IP protocol, and port number. Cisco
recommends that they are placed as close to the source as possible.
Router(config)#access-list {number 100-99}{permit/deny}{protocol}
{source}{destination}{port}
access-list 112 permit tcp host 172.16.5.2 host 172.16.10.2 eq www
Named Access Lists
Router(config)#ip access-list {standard/extended} name
Router(config)#ip access-list extended no_ftp
Access lists applied to inbound interfaces save the router having to process the packet,
denied packets will be dropped at the interface. Outbound access lists will be processed
by the router and then dropped at the outbound interface if they match the access list.
Access lists can be applied to multiple interfaces but there can only be one access list per
protocol per direction per interface.
Wildcard masks tell the router which parts of the address to look at and which to
disregard.
access-list 12 permit 172.16.5.0 0.0.0.255
This would permit any host on network 172.16.5.x
Access lists are applied to interfaces:
Router(config)#access-list 1 permit 172.16.5.2
Router(config)#interface e0
Router(config-if)#ip access-group 1 in
Use the term ‘access-class’ if applying to console/aux/vty lines
show ip access-lists
show access-list 1
Packets are processed by the access list and then routed.
Passwords (command ‘service password-encryption’ encrypts all passwords)
Enable: used to get from user exec to privileged exec. Not encrypted.
Router(config)# enable password {password}
Enable Secret: Encrypts password (only use enable or enable secret not both)
Router(config)# enable secret {password}
VTY: needed if telnet access is required.
Router(config)#line vty 0 4
Router(config-line)#password cisco
Router(config-line)#login
Auxiliary: allows modem access to the aux port.
Router(config)#line aux 0
Router(config-line)#password cisco
Router(config-line)#login
Console: used to allow console access
Router(config)#line console 0
Router(config-line)#password cisco
Router(config-line)#login
Protecting the Network
Firewalls divide your network into three zones – trusted, semi-trusted and un-trusted.
A VPN allows information to be send securely over an insecure medium (e.g. the
internet). A VPN can be site to site (e.g. WAN) or access (e.g. home worker).
Security Device Manager (SDM)
SDM is a GUI web based tool which will allow you to configure and manage your Cisco
routers. It can be installed on your router or your PC. To install and configure SDM you
will need to refer to www.howtonetwork.net or the CCNA theory guide because there are
a huge amount of parameters and screens to navigate.

Wan Protocols and Services
HDLC – Cisco default on serial WAN connections. No authentication available.
PPP – data link. Uses PAP (clear text) and CHAP (secure hash) authentication.
Authentication is optional. Use PPP if connecting a Cisco router to a non-cisco router.
Router(config)#hostname paul password cisco _ case sensitive
Router(config)#interface serial 0
Router(config-if)#encapsulation ppp
Router(config-if)# ppp authentication chap
Frame Relay
Based upon x.25 protocol but with less error checking so is quicker. Normally 56k to
2mb so ideal for SMEs. Works at the physical & data link layers. DLCI’s are used to
identify the circuit. Each router uses LMIs for keepalives on the line between the router
and frame relay switch. LMI type is Cisco by default. You must use another type such
as ansi if connecting to a non-cisco router.
Router(config-if)#encapsulation frame-relay
Router(config-if)#frame-relay map ip 2.2.2.2 100
Here the router is told to get to ip address 2.2.2.2 use dlci 100.
Frame Relay Problems include:
Incorrect LMI setting
Incorrect DCLI
Split horizon preventing routing updates leaving interface
Use frame relay sub-interfaces if point-to-point or multipoint connection is needed. IP
address applied to sub-interfaces for these and NOT the main interface.
Frame relay uses backward explicit congestion notification (BECN) on returning frames
to warn of congestion and forward explicit congestion notification (FECN) is set by the
DCE end to warn of congestion from the sending end.

Troubleshooting
Always use a systematic and methodical approach to troubleshooting.
The first command to issue is ‘show ip interface brief’ to establish if the interfaces
are down or up. There are only a handful of ways to break any network in the exam.
Layer 1
Ensure that there is a clock rate on the DCE interface (use the ‘show controllers
serial X’ command to check what type of cable is attached – where X is the serial
interface number).
Ensure that the ‘no shut’ command has been applied to the interface.
Layer 2
Ensure that the correct encapsulation type is on the interface i.e. HDLC, PPP etc (use the
show interface serial X’ command to check).
If it is not then go into interface configuration mode and change it.
Layer 3
Ensure that the correct IP address AND subnet mask is applied to the interface.
Ensure that the correct networks are being advertised by the routing protocol (‘show ip
protocols’).
Always ensure that you can ping across directly connected router interfaces BEFORE
applying routing protocols and access lists. You have been warned.

Characteristic
OSPF
RIPv2
RIPv1
Type of protocol
Link state
Distance vector
Distance vector
Classless support
Yes
Yes
No
VLSM support
Yes
Yes
No
Auto-summarization
No
Yes
Yes
Manual summarization
Yes
No
No
Discontiguous support
Yes
Yes
No
Route propagation
Multicast on change
Periodic multicast
Periodic broadcast
Path metric
Bandwidth
Hops
Hops
Hop count limit
None
15
15
Convergence
Fast
Slow
Slow
Peer authentication
Yes
Yes
No
Hierarchical network
Yes (using areas)
No (flat only)
No (flat only)
Updates
Event triggered
Route table updates
Route table updates
Route computation
Dijkstra
Bellman-Ford
Bellman-Ford

No comments:

Post a Comment