Spanning Tree Protocol

The Spanning Tree Protocol was created by DEC (Digital Equipment Corporation) now Compaq. This is not compatible with the IEEE 802.1d version which Cisco use.

The Spanning Tree Protocol:

Prevents loops, loops cause broadcast storms
Allows redundant links
Resilient to topology changes
STA (Spanning Tree Algorithm) - Used to calculate loop-free path
BPDUs (Bridge Protocol Data Units) are sent and received by switches in the network every 2 seconds (default) to determine spanning tree topology.
Bridge Priority - Numerical value held by switches. All Catalyst switches are 32768
Bridge ID = MAC Address



Spanning Tree States
Blocking No frames forwarded, BPDUs heard
Listening No frames forwarded, listening for frames
Learning No frames forwarded, learning addresses
Forwarding Frames forwarded, learning addresses
Disabled No frames forwarded, no BPDUs heard



STA - Spanning Tree Algorithm
Spanning Tree Algorithm is used to calculate a loop-free path.

All switch ports are in blocking mode to begin with. It takes approx 30 seconds until packets can be forwarded.

Step 1 : Elect Root Bridge - Lowest bridge priority, if there is a tie then switch with lowest bridge ID
Step 2 : Elect Root Ports - Locate redundant paths to root bridge; block all but on root. Root Path Cost is cumulative cost of path to root bridge. Ports directly connected to Root Bridge will be root ports, otherwise lowest root path cost used.
Step 3 : Elect Designated Ports - Single port that sends and receives traffic from a switch to and from Root Bridge - Lowest cost path to Root Bridge.






Spanning Tree Overview
 There can only be one Root Bridge.
 Root-Bridge ports are called 'Designated' and are set to send and receive traffic (forwarding state). All other redundant links to the root bridge are shutdown.
 Blocked ports still receive BPDUs.
 Convergence occurs when switches have transitioned to either forwarding or blocking states. No other data is forwarded during this time.
 Forward delay - Time taken for a switch to go from Listening to Learning (50 seconds default).
 IEEE default priority = 32,768, this is true for all devices running STP IEEE version.
 Port Fast Mode - Immediately brings a port from blocking to forwarding state by eliminating forward delays.
 Bridges can only have one spanning tree instance compared to switches which can have many.
 Bridge Protocol Data Units send confirmation messages using multicast frames.

ARP-Address Resolution Protocol

ARP is a protocol broadcasting locally, meaning works only on local LAN or local subnet.
PC1 send ping to PC2.

1. PC1 looks in its ARP cache for default gateway IP address. If does not have it, it sends ARP request (hey, you with IP 1.1.1.1, what is your MAC?)
2. Switch1 gets it, frame is ARP broadcast, so Switch1 processes the frame. Adds MAC source address and interface # it came in.
3. ARP request's target IP address does not match the receiving port's IP address on Switch1 's VLAN 1, so Switch 1 sends out the frame to all ports in the same VLAN except the receiving port. (Frame is not move to upper layers in OSI, instead Data link takes care of it)
4. Broadcast ARP reaches your Router.Router accepts frame since target IP address matches the receiving port's IP address.
5. Router updates its ARP table with received information and replies to the request with the receiving port's MAC address. (I am 1.1.1.1, my MAC is 00-11-22-33-44-55)
6. Frame ARP replay now is going back to PC1.
7. Switch1 has MAC of PC1, but adds MAC of Router and sends frame ONLY to PC1.
8. PC1 receives APR replay and puts info into his ARP cache. (5 minutes on Windows)
9. Now, whatever you were trying do in the first place, PC1 takes MAC of d.g stored in cache and builds packet with upper layer (ICMP, HTTP, FTP) protocols.
10. PC1 sends packet to PC2. Source IP is PC1, Dest IP is PC2, source MAC is PC1, Dest. MAC is Router's D.G.
11. Switch receives packet and forwards out of port connected to Router. It does not do anything special now.
12. Router looks at MAC Dest. It is for him, process the frame to look at IP Dest. IP dest. is directly connected, so it will process the packet (knows about network that PC2 is connected).
13. If router does not have MAC address of PC2 in his cache, it will send ARP broadcast on the interface connected to PC2. Router waits for ARP replay from PC2, not from switch 2, although ARP frame will pass through the Switch2 on the way to PC2 and back.
14. With PC2's MAC in cache, Router will process packet by adding PC2's MAC address as dest. and his outgoing interface MAC as a source. The IPs in the packet are the same.
15. Switch 2 receives frame, adds MAC address (if not already in the table).
16. Switch 2 (and switch 1 for that matter) will process frames if ports are access ports and are on the same VLAN. Two conditions are often omitted in our discussions.
17. Assuming router and PC2 are on the same VLAN, Switch 2 will forward frame to PC2.
18. PC2 receives frame, reads dest. MAC, strips Ethernet header and trailer, and looks at dest. IP. OK, it is for me and processes.
19. If, for example, packet is an ICMP packet. The ICMP process processes it by sending Echo Replay message.
20. IP addresses are reversed. Source IP (PC1) becomes destination; destination IP (PC2) becomes source. Data link layer takes packet and encapsulates it with PC2's MAC as source and MAC of default gateway on Router (destination IP is on different network).

DYNAMIPS TUTORIAL

DOWNLOAD NOW

BIG COLLECTIONS OF CCNA LABS

FREE DOWNLOAD NOW

CCNA INTERVIEW Q&A

Q. What is a router?
A. A router is a device that connects more than one physical network, or segments of a network, using IP routing software. As packets reach the router, the router reads them and forwards them to their destination.

Q. Discuss wireless networking.
A. This is a network configured to use communication techniques such as infrared, cellular, or microwave, so that cable connections are not required.

Q. Discuss WAN (wide area network).
A. A WAN is extended over longer distances that a LAN (local area network). It can range from a few miles to across the world. TCP/IP is the primary WAN protocol and was developed to provide reliable, secure data transmissions over long distances.

Q. What is OSPF?
A. Open Shortest Path First is a routing protocol that supports the concept of a core area to which everything attaches.

Q. What is BGP?
A. Border Gateway Protocol is used for routing between networks on the Internet core, and it supports many advanced routing features.

Q. What is an autonomous system?
A. An autonomous system is a community of interest. Used in conjunction with routing protocols, it breaks up parts of the network into manageable chunks.

Q. What is dial on demand?
A. Dial on demand is a technology that only activates network connection when “interesting” packets are to be sent across the infrastructure.

Q. What mask would you use to supernet two class C addresses?
A. The subnet would be 255.255.254.0.

Q. What is VLANing?
A. Virtual LAN is used on large LANs to break up the network into smaller broadcast domains. This creates communities of interest. These communities can be based around organizational structures.

Q. What is CIDR?
A. Classless Internet domain routing is used in conjunction with classless routing protocols to summarize the Internet into smaller routing tables.

Q. What is VLSM?
A. Variable Length Subnet Mask is used to allocate the amount of address space required by the end network.

Q. What is a class D IP address?
A. Class D addresses are multicast addresses.

Q. What addresses do multicasts start with?
A. Multicasts start with the address 224.0.0.0.

Q. Which name resolution system is implemented with TCP/IP by default?
A. Although WINS is a name resolution that is implemented by TCP/IP by default, it only works on Windows-based networks. The only true name resolution system that almost every TCP/IP networks uses is DNS.

Q. You are the administrator of a 100-station Ethernet network. Your users are complaining of slow network speeds. What could you replace your hub with to increase your network throughput?
A. A switch would increase performance by making virtual, direct connections between sender and receiver. A bridge and router would actually decrease performance because these devices introduce latency into the communication.

Q. Which TCP/IP utility is most often used to test whether an IP host is up and functional?
A. The Ping utility is the most often used TCP/IP utility because it allows you to test individual hosts.

Q. Which utility can you use to find the MAC and TCP/IP address of your Windows NT or 2000 workstation?
A. The ipconfig utility is available for both these operating systems. It displays information like the MAC and TCP/IP address of your workstation as well as other TCP/IP configuration information.

Q. Which utility can you use to verify a packet’s path?
A. The tracert utility traces the route from the source IP host to the destination host.

Q. Which WAN technology uses digital signaling from sender to receiver?
A. The T-series of WAN connection (such as T1, T3, and so on) uses digital signaling from sending hardware to receiving hardware.

Q. You are setting up a workstation for remote access to the office. The office has a modem pool configured, and it is working correctly. The required results are that the workstation and modem bank must establish a connection and that the server at the office must authenticate the workstation. Optionally, the workstation and office must be able to communicate by using a single protocol, and the workstation must be able to access all network devices at the office. The proposed solution is to install a POTS telephone line, modem cable, and modem connected to the workstation. How would you configure the protocols to achieve the desired results?
A. This question tests your ability to configure protocols and select the best one to meet the connectivity requirements. The recommended protocol here would be TCP/IP since it can be used across the different access methods.

Q. Which remote access protocol can run over both serial and parallel connections?
A. Because PPP doesn’t contain a physical layer specification as part of the protocol, it can run over any kind of medium.

Q. What Microsoft TCP/IP protocol can be used over the Internet to create a secure, virtual network?
A. The Point-to-Point Tunneling Protocol (PPTP) allows you to create a secure, virtual connection between two points by tunneling one protocol inside another. Usually, a PPP connection is opened over a TCP/IP link.

Q. Which type of firewall checks for a current communication and the next packet needed?
A. A proxy provides firewall services by keeping track of all communications sessions and “prefetching” the next packets.

Q. Which type of security uses a file that identifies predefined IP addresses that are allowed to send data through a router?
A. Access Control List security uses a file (the ACL) that identifies which addresses can send data through a particular firewall or router.

IP Access Control List (ACL)

Standard IP Access Control Lists

Filtering logic could be configured on any router and on any of its interfaces. Cisco IOS software applies the filtering logic of an ACL either as a packet enters an interface or as it exits the interface. In other words, IOS associates an ACL with an interface, and specifically for traffic either entering or exiting the interface. After you have chosen the router on which you want to place the access list, you must choose the interface on which to apply the access logic, as well as whether to apply the logic for inbound or outbound packets.

The key features of Cisco ACLs are:

. Packets can be filtered as they enter an interface, before the routing decision.
. Packets can be filtered before they exit an interface, after the routing decision.
. Deny is the term used in Cisco IOS software to imply that the packet will be filtered.
. Permit is the term used in Cisco IOS software to imply that the packet will not be filtered.
. The filtering logic is configured in the access list.
. If a packet does not match any of your access list statements, it is blocked.

Access lists have two major steps in their logic: matching, which determines whether it matches the access-list statement; and action, which can be either deny or permit. Deny means to discard the packet, and permit implies that the packet should be allowed. However, the logic that IOS uses with a multiple-entry ACL can be much more complex. Generally, the logic can be summarized as follows:

Step 1: The matching parameters of the access-list statement are compared to the packet.

Step 2: If a match is made, the action defined in this access-list statement (permit or deny) is performed.

Step 3: If a match is not made in Step 2, repeat Steps 1 and 2 using each successive statement in the ACL until a match is made.

Step 4: If no match is made with an entry in the access list, the deny action is performed.
Wildcard Masks

IOS IP ACLs match packets by looking at the IP, TCP, and UDP headers in the packet. Standard IP access lists can also examine only the source IP address. You can configure the router to match the entire IP address or just a part of the IP address. When defining the ACL statements you can define a wildcard mask along with the IP address. The wildcard mask tells the router which part of the IP address in the configuration statement must be compared with the packet header. The wildcard masks look similar to subnet masks, in that they represent a 32-bit number. However, the wildcard mask’s 0 bits tell the router that those corresponding bits in the address must be compared when performing the matching logic. The binary 1s in the wildcard mask tell the router that those bits do not need to be compared. Thus, wildcard mask 0.0.0.0, which in binary form is 00000000.00000000.00000000.00000000, indicates that the entire IP address must be matched, while wildcard mask 0.0.0.255, which in binary form is 00000000.00000000.00000000.11111111, indicates that the first 24 bits of the IP address must be matched, and wildcard mask 0.0.31.255, which in binary form is 00000000.00000000.00011111.11111111, indicates that the first 24 bits of the IP address must be matched.
Standard IP Access List Configuration

A standard access list is used to match a packet and then take the directed action. Each standard ACL can match all, or only part, of the packet’s source IP address. The only two actions taken when an access-list statement is matched are to either deny or permit the packet.

The configuration commands required are:
. ip access-group {number | action [in | out]}, in which action can be either permit of deny and is used to enable access lists; and
. access-class number | action [in | out], which can be used to enable either standard or extended access lists.

The standard access list configuration can be verified using the following show commands:
. show ip interface[type number], which includes a reference to the access lists enabled on the interface;
. show access-lists [access-list-number | access-list-name], which shows details of configured access lists for all protocols; and
. show ip access-list [access-list-number | access-list-name], which shows the access lists.
Extended IP Access Control Lists

Extended IP access lists are similar to standard IP ACLs in that you enable extended access lists on interfaces for packets either entering or exiting the interface. IOS then searches the list sequentially. The first statement matched stops the search through the list and defines the action to be taken. The key difference between the extended ACLs and standard ACLs is the variety of fields in the packet that can be compared for matching by extended access lists. A single extended ACL statement can examine multiple parts of the packet headers, requiring that all the parameters be matched correctly in order to match that one ACL statement. That matching logic is what makes extended access lists both much more useful and much more complex than standard IP ACLs. You can configure extended ACL to match the IP protocol type, which identifies what header follows the IP header. You can specify all IP packets, or those with TCP headers, UDP headers, ICMP, etc, by checking the Protocol field. You can also check the source and destination IP addresses, as well as the TCP source and destination port numbers.

An extended access list is more complex than standard access lists. Therefore the configuration commands are more complex. The configuration command for extended access lists is:
. access-list access-list-number action protocol source source-wildcard destination destination-wildcard [log | log-input], which can be used to enable access lists;
Named IP Access Lists

Named ACLs can be used to match the same packets, with the same parameters, you can match with standard and extended IP ACLs. Named IP ACLs do have some differences, however. The most obvious difference is that IOS identifies named ACLs using names you assign them as opposed to numbers. Named ACLs also have another key feature that numbered ACLs do not: You can delete individual lines in a named IP access list.

In addition, two important configuration differences exist between numbered and named access lists. One key difference is that named access lists use a global command that places the user in a named IP access list submode, under which the matching and permit or deny logic is configured. The other key difference is that when a named matching statement is deleted, only that one statement is deleted. With numbered lists, the deletion of any statement in the list deletes all the statements in the list.
Controlling Telnet Access with ACLs

Access into and out of the virtual terminal line (vty) ports of the Cisco IOS software can also be controlled by IP access lists. IOS uses vtys to represent a user who has Telnetted to a router, as well as for Telnet sessions a user of a router has created to other devices. You can use ACLs to limit the IP hosts that can Telnet into the router, and you can also limit the hosts to which a user of the router can Telnet.

CISCO IOS DHCP

To configure Cisco IOS DHCP, follow these steps, which include sample commands:

1. Configure an IP address on the router's Ethernet port, and bring up the interface. (On an existing router, you would have already done this.)

Router(config)# interface ethernet0/0

Router(config-if)#ip address 1.1.1.1 255.0.0.0

Router(config-if)# no shutdown

2. Create a DHCP IP address pool for the IP addresses you want to use.

Router(config)# ip dhcp pool mypool

3. Specify the network and subnet for the addresses you want to use from the pool.

Router(dhcp-config)# network 1.1.1.0 /8

4. Specify the DNS domain name for the clients.

Router(dhcp-config)#domain-name mydomain.com

5. Specify the primary and secondary DNS servers.

Router(dhcp-config)#dns-server 1.1.1.10 1.1.1.11

6. Specify the default router (i.e., default gateway).

Router(dhcp-config)#default-router 1.1.1.1

7. Specify the lease duration for the addresses you're using from the pool.

Router(dhcp-config)#lease 7

8. Exit Pool Configuration Mode.

Router(dhcp-config)#exit

BIG CISCO IOS COLLECTIONS.

DOWNLOAD NOW

Access VPNs & tunneling technology

http://rapidshare.com/files/141259134/Access_VPNs___tunneling_technology.rar.html