CCNA Cisco Certified Network Associate Review Guide

Transcription

1

2

3 CCNA Cisco Certified Network Associate Review Guide Todd Lammle

4 Senior Acquisitions Editor: Jeff Kellum Development Editor: Kathi Duggan Technical Editors: Troy McMillan and Dax Michelson Production Editor: Christine O Connor Copy Editor: Kathy Grider-Carlyle Editorial Manager: Pete Gaughan Production Manager: Tim Tate Vice President and Executive Group Publisher: Richard Swadley Vice President and Publisher: Neil Edde Media Project Manager 1: Laura Moss-Hollister Media Associate Producer: Marilyn Hummel Media Quality Assurance: Doug Kuhn Book Designer: Happenstance Type-O-Rama Compositor: Craig Woods, Happenstance Type-O-Rama Proofreader: Louise Watson, Word One New York Indexer: Robert Swanson Project Coordinator, Cover: Katherine Crocker Cover Designer: Ryan Sneed Copyright 2011 by Wiley Publishing, Inc., Indianapolis, Indiana Published simultaneously in Canada ISBN: ISBN: (ebk.) ISBN: (ebk.) ISBN: (ebk.) No part of this publication may be reproduced, stored in a retrieval system or transmitted in any form or by any means, electronic, mechanical, photocopying, recording, scanning or otherwise, except as permitted under Sections 107 or 108 of the 1976 United States Copyright Act, without either the prior written permission of the Publisher, or authorization through payment of the appropriate per-copy fee to the Copyright Clearance Center, 222 Rosewood Drive, Danvers, MA 01923, (978) , fax (978) Requests to the Publisher for permission should be addressed to the Permissions Department, John Wiley & Sons, Inc., 111 River Street, Hoboken, NJ 07030, (201) , fax (201) , or online at Limit of Liability/Disclaimer of Warranty: The publisher and the author make no representations or warranties with respect to the accuracy or completeness of the contents of this work and specifically disclaim all warranties, including without limitation warranties of fitness for a particular purpose. No warranty may be created or extended by sales or promotional materials. The advice and strategies contained herein may not be suitable for every situation. This work is sold with the understanding that the publisher is not engaged in rendering legal, accounting, or other professional services. If professional assistance is required, the services of a competent professional person should be sought. Neither the publisher nor the author shall be liable for damages arising herefrom. The fact that an organization or Web site is referred to in this work as a citation and/or a potential source of further information does not mean that the author or the publisher endorses the information the organization or Web site may provide or recommendations it may make. Further, readers should be aware that Internet Web sites listed in this work may have changed or disappeared between when this work was written and when it is read. For general information on our other products and services or to obtain technical support, please contact our Customer Care Department within the U.S. at (877) , outside the U.S. at (317) or fax (317) Wiley also publishes its books in a variety of electronic formats and by print-on-demand. Not all content that is available in standard print versions of this book may appear or be packaged in all book formats. If you have purchased a version of this book that did not include media that is referenced by or accompanies a standard print version, you may request this media by visiting For more information about Wiley products, visit us at Library of Congress Cataloging-in-Publication Data is available from the Publisher. TRADEMARKS: Wiley, the Wiley logo, and the Sybex logo are trademarks or registered trademarks of John Wiley & Sons, Inc. and/or its affiliates, in the United States and other countries, and may not be used without written permission. CCNA is a registered trademark of Cisco Technology, Inc. All other trademarks are the property of their respective owners. Wiley Publishing, Inc., is not associated with any product or vendor mentioned in this book

5 Dear Reader, Thank you for choosing CCNA: Cisco Certified Network Associate Review Guide. This book is part of a family of premium-quality Sybex books, all of which are written by outstanding authors who combine practical experience with a gift for teaching. Sybex was founded in More than 30 years later, we re still committed to producing consistently exceptional books. With each of our titles, we re working hard to set a new standard for the industry. From the paper we print on, to the authors we work with, our goal is to bring you the best books available. I hope you see all that reflected in these pages. I d be very interested to hear your comments and get your feedback on how we re doing. Feel free to let me know what you think about this or any other Sybex book by sending me an at nedde@wiley.com. If you think you ve found a technical error in this book, please visit Customer feedback is critical to our efforts at Sybex. Best regards, Neil Edde Vice President and Publisher Sybex, an Imprint of Wiley

6

7 Acknowledgments To my best editor, Kathi Duggan: You came in and helped me knock this out with great enthusiasm. Thank you! Thanks to Jeff Kellum, who always keeps me working hard and makes sure I am headed in the right direction. This is no easy task for Jeff! And thanks to Christine O Connor, who somehow made sense of my work and helped me put it together in a great, easy-to-study format. And as always, Troy McMillian was instrumental in helping me put this book together, as well as tech editing it. Thank you all!

8 About the Author Todd Lammle CCSI, CCNA/CCNP/CCSP, MCSE, CEH/CHFI, FCC RF Licensed, is the authority on Cisco Certification internetworking. He is a world-renowned author, speaker, trainer, and consultant. Todd has over 30 years of experience working with LANs, WANs, and large licensed and unlicensed wireless networks. He is president of GlobalNet Training and Consulting, Inc., a network integration and training firm based in Dallas, Texas. You can reach him through GlobalNet Training Solutions, Inc. at or through his online forum at

9 Contents at a Glance Introduction xiii Chapter 1 Describe How a Network Works 1 Chapter 2 Chapter 3 Chapter 4 Chapter 5 Chapter 6 Chapter 7 Configure, Verify, and Troubleshoot a Switch with VLANs and Interswitch Communications 57 Implement an IP Addressing Scheme and IP Services to Meet Network Requirements in a Medium-Sized Enterprise Branch Office Network 119 Configure, Verify, and Troubleshoot Basic Router Operation and Routing on Cisco Devices 153 Explain and Select the Appropriate Administrative Tasks Required for a WLAN 235 Identify Security Threats to a Network and Describe General Methods to Mitigate Those Threats 255 Implement, Verify, and Troubleshoot NAT and ACLs in a Medium-Sized Enterprise Branch Office Network 269 Chapter 8 Implement and Verify WAN Links 299 Appendix About the Companion CD 325 Index 329

10

11 Contents Introduction xiii Chapter 1 Describe How a Network Works 1 Describe the Purpose and Functions of Various Network Devices 2 Use the OSI and TCP/IP Models and Their Associated Protocols to Explain How Data Flows in a Network 8 Describe Common Networked Applications, Including Web Applications 10 Describe the Purpose and Basic Operation of the Protocols in the OSI and TCP Models 15 Describe the Impact of Applications (Voice over IP and Video over IP) on a Network 19 Interpret Network Diagrams 23 Determine the Path between Two Hosts across a Network 31 Describe the Components Required for Network and Internet Communications 35 Identify and Correct Common Network Problems at Layers 1, 2, 3, and 7 Using a Layered Model Approach 39 Differentiate between LAN/WAN Operation and Features 42 Review Questions 54 Answers to Review Questions 56 Chapter 2 Configure, Verify, and Troubleshoot a Switch with VLANs and Interswitch Communications 57 Select the Appropriate Media, Cables, Ports, and Connectors to Connect Switches to Other Network Devices and Hosts 59 Explain the Technology and Media Access Control Method for Ethernet Networks 62 Explain Network Segmentation and Basic Traffic Management Concepts 67 Explain Basic Switching Concepts and the Operation of Cisco Switches 69 Perform and Verify Initial Switch Configuration Tasks, Including Remote Access Management 74 Verify Network Status and Switch Operation Using Basic Utilities (Including ping, traceroute, Telnet, SSH, arp, and ipconfig) and SHOW and DEBUG Commands 77 Identify, Prescribe, and Resolve Common Switched Network Media Issues, Configuration Issues, Auto Negotiation, and Switch Hardware Failures 83 Describe Enhanced Switching Technologies (Including VTP, RSTP, VLAN, PVSTP, and 802.1q) 84

12 x Contents Describe How VLANs Create Logically Separate Networks and the Need for Routing between Them 88 Configure, Verify, and Troubleshoot VLANs 92 Configure, Verify, and Troubleshoot Trunking on Cisco Switches 95 Configure, Verify, and Troubleshoot InterVLAN Routing 99 Configure, Verify, and Troubleshoot VTP 103 Configure, Verify, and Troubleshoot RSTP Operation 109 Interpret the Output of Various SHOW and DEBUG Commands to Verify the Operational Status of a Cisco Switched Network 111 Implement Basic Switch Security (Including Port Security, Trunk Access, Management VLAN Other Than VLAN 1, Etc.) 111 Review Questions 114 Answers to Review Questions 118 Chapter 3 Chapter 4 Implement an IP Addressing Scheme and IP Services to Meet Network Requirements in a Medium-Sized Enterprise Branch Office Network 119 Describe the Operation and Benefits of Using Private and Public IP Addressing 121 Explain the Operation and Benefits of Using DHCP and DNS 124 Configure, Verify, and Troubleshoot DHCP and DNS Operation on a Router (Including CLI/SDM) 124 Implement Static and Dynamic Addressing Services for Hosts in a LAN Environment 127 Calculate and Apply an Addressing Scheme, Including VLSM IP Addressing Design, to a Network 132 Determine the Appropriate Classless Addressing Scheme Using VLSM and Summarization to Satisfy Addressing Requirements in a LAN/WAN Environment 134 Describe the Technological Requirements for Running IPv6 in Conjunction with IPv4 (Including Protocols, Dual Stack, Tunneling, Etc.) 142 Describe IPv6 Addresses 145 Identify and Correct Common Problems Associated with IP Addressing and Host Configurations 149 Review Questions 150 Answer to Review Questions 152 Configure, Verify, and Troubleshoot Basic Router Operation and Routing on Cisco Devices 153 Describe Basic Routing Concepts (Including Packet Forwarding and the Router Lookup Process) 155

13 Contents xi Describe the Operation of Cisco Routers (Including the Router Bootup Process, POST, and Router Components) 158 Select the Appropriate Media, Cables, Ports, and Connectors to Connect Routers to Other Network Devices and Hosts 160 Configure, Verify, and Troubleshoot RIPv2 162 Access and Utilize the Router to Set Basic Parameters (Including CLI/SDM) 165 Connect, Configure, and Verify the Operational Status of a Device Interface 175 Verify Device Configuration and Network Connectivity Using ping, traceroute, Telnet, SSH, or Other Utilities 189 Perform and Verify Routing Configuration Tasks for a Static or Default Route Given Specific Routing Requirements 189 Manage IOS Configuration Files (Including Save, Edit, Upgrade, and Restore) 192 Manage Cisco IOS 196 Compare and Contrast Methods of Routing and Routing Protocols 200 Configure, Verify, and Troubleshoot OSPF 202 Configure, Verify, and Troubleshoot EIGRP 211 Verify Network Connectivity (Including Using ping, traceroute, and Telnet or SSH) 216 Troubleshoot Routing Issues 216 Verify Router Hardware and Software Operation Using the show and debug Commands 221 Implement Basic Router Security 227 Review Questions 231 Answers to Review Questions 233 Chapter 5 Explain and Select the Appropriate Administrative Tasks Required for a WLAN 235 Describe Standards Associated with Wireless Media (Including IEEE, Wi-Fi Alliance, and ITU/FCC) 236 Identify and Describe the Purpose of the Components in a Small Wireless Network (Including SSID, BSS, and ESS) 243 Identify the Basic Parameters to Configure on a Wireless Network to Ensure That Devices Connect to the Correct Access Point 246 Compare and Contrast Wireless Security Features and Capabilities of WPA Security (Including Open, WEP, and WPA-1/2) 248 Identify Common Issues with Implementing Wireless Networks (Including Interfaces and Misconfigurations) 251 Review Questions 252 Answers to Review Questions 254

14 xii Contents Chapter 6 Chapter 7 Identify Security Threats to a Network and Describe General Methods to Mitigate Those Threats 255 Describe Today s Increasing Network Security Threats and Explain the Need to Implement a Comprehensive Security Policy to Mitigate the Threats 256 Explain General Methods to Mitigate Common Security Threats to Network Devices, Hosts, and Applications 260 Describe the Functions of Common Security Appliances and Applications 261 Describe Security Recommended Practices, Including Initial Steps to Secure Network Devices 264 Review Questions 266 Answers to Review Questions 268 Implement, Verify, and Troubleshoot NAT and ACLs in a Medium-Sized Enterprise Branch Office Network 269 Describe the Purpose and Types of ACLs 270 Configure and Apply ACLs Based on Network Filtering Requirements (Including CLI/SDM) 270 Configure and Apply ACLs to Limit Telnet and SSH Access to the Router Using (Including SDM/CLI) 283 Verify and Monitor ACLs in a Network Environment 285 Troubleshoot ACL Issues 288 Explain the Basic Operation of NAT 288 Configure NAT for Given Network Requirements Using (Including CLI/SDM) 290 Troubleshoot NAT Issues 293 Review Questions 295 Answers to Review Questions 297 Chapter 8 Implement and Verify WAN Links 299 Describe Different Methods for Connecting to a WAN 300 Configure and Verify a Basic WAN Serial Connection 301 Configure and Verify Frame Relay on Cisco Routers 304 Troubleshoot WAN Implementation Issues 310 Describe VPN Technology (Including Importance, Benefits, Role, Impact, and Components) 314 Configure and Verify a PPP Connection between Cisco Routers 315 Review Questions 319 Answers to Review Questions 323 Appendix About the Companion CD 325 Index 329

15 Introduction Welcome to the exciting world of Cisco certification! You picked up this book because you want something better namely, a better job with more satisfaction. Rest assured that you made a good decision. Cisco certification can help you get your first networking job, or more money and a promotion if you are already in the field. Cisco certification can also improve your understanding of the internetworking of more than just Cisco products. By studying the material in this book, you will develop a complete understanding of networking and how different network topologies work together to form a network. This is beneficial to every networking job and is the reason Cisco certification is in such high demand, even at companies with few Cisco devices. Cisco is the king of routing and switching, the Microsoft of the internetworking world. The Cisco certifications reach beyond the popular certifications, such as the MCSE, to provide you with an indispensable factor in understanding today s network insight into the Cisco world of internetworking. By deciding that you want to become Cisco certified, you are saying that you want to be the best the best at routing and the best at switching. This book will lead you in that direction. What Is CCNA Certification? The CCNA certification was the first in the new line of Cisco certifications and was the precursor to all current Cisco certifications. Now you can become a Cisco Certified Network Associate for the meager cost of this book and either one exam or two exams However, the CCNA exams are extremely hard and cover a lot of material, so you have to really know your stuff. Taking a Cisco class or spending months getting hands-on experience is not out of the norm. Once you have your CCNA certification, you don t have to stop there. You can continue your studies and achieve a higher certification, called the Cisco Certified Network Professional (CCNP). Someone with a CCNP certification has all the skills and knowledge he or she needs to attempt the Routing and Switching CCIE lab. Just becoming a CCNA can land you the job you ve dreamed about. This book covers everything CCNA related. For up-to-date information on Todd Lammle Cisco Authorized CCNA, CCNP, CCSP, CCVP, and CCIE bootcamps, please see and/or

16 xiv Introduction Is This Book For You? CCNA: Cisco Certified Network Associate Review Guide is designed to be a succinct, portable exam review guide that can be used in conjunction with a more complete study guide such as the CCNA: Cisco Certified Network Associate Study Guide, 7th Edition or CCNA: Cisco Certified Network Associate Deluxe Study Guide, 6th Edition (Sybex, 2011), Todd Lammle Video Series, and a CBT courseware, and a classroom/lab environment. It can also be used as an exam review for those who don t feel the need for more extensive test preparation. It isn t my goal to give away the answers, but rather to identify those topics on which you can expect to be tested and to provide sufficient coverage of those topics. Perhaps you ve been working with information technologies for years. The thought of paying lots of money for a specialized IT exam-preparation course probably doesn t sound appealing. What can they teach you that you don t already know, right? Be careful, though many experienced network administrators have walked confidently into the test center only to sheepishly walk out of it after failing an IT exam. After you ve finished reading this book, you should have a clear idea of how your understanding of the technologies involved matches up with the expectations of the CCNA test makers. Perhaps you re relatively new to the world of IT, drawn to it by the promise of challenging work and higher salaries. You ve just waded through an 800-page study guide or taken a week-long class at a local training center. That is a lot of information to keep track of, isn t it? Well, by organizing this book according to Cisco s exam objectives, and by breaking up the information into concise, manageable pieces, we ve created what we think is the handiest exam review guide available. Throw it in your briefcase and carry it to work with you. As you read the book, you ll be able to quickly identify those areas you know best and those that require a more in-depth review. How Is This Book Organized? This book is organized according to the official objectives list prepared by Cisco for the CCNA exam. The chapters correspond with the eight broad objective categories: Chapter 1: Describe How a Network Works Chapter 2: Configure, Verify, and Troubleshoot a Switch with VLANs and Interswitch Communications Chapter 3: Implement an IP Addressing Scheme and IP Services to Meet Network Requirements in a Medium-Size Enterprise Branch Office Network Chapter 4: Configure, Verify, and Troubleshoot Basic Router Operation and Routing on Cisco Devices Chapter 5: Explain and Select the Appropriate Administrative Tasks Required for a WLAN Chapter 6: Identify Security Threats to a Network and Describe General Methods to Mitigate Those Threats

17 Introduction xv Chapter 7: Implement, Verify, and Troubleshoot NAT and ACLs in a Medium-Sized Enterprise Branch Office Network Chapter 8: Implement and Verify WAN Links Within each chapter, the individual exam objectives are addressed. Each section of a chapter covers one exam objective. For each objective, the critical information is first presented, and then there are several Exam Essentials for each exam objective. Additionally, each chapter ends with a section of Review Questions. Here is a closer look at each of these components: Exam Objectives The individual exam objective sections present the greatest level of detail on information that is relevant to the CCNA exam. This is the place to start if you re unfamiliar with or uncertain about the technical issues related to the objective. Exam Essentials Here you are given a short list of topics that you should explore fully before taking the exam. Included in the Exam Essentials areas are notations of the key information you should take out of the exam objective section. Review Questions This section ends every chapter and provides 10 questions to help you gauge your mastery of the chapter. On the CD We ve included several testing features on the CD that accompanies this book. These tools will help you retain vital exam content as well as prepare you to sit for the actual exams: Two CCNA Practice Exams The CD contains the Sybex Test Engine, with two exclusive CCNA bonus practice exams. Using this custom test engine, you can identify weak areas up front and then develop a solid studying strategy using each of these robust testing features. Our thorough readme file will walk you through the quick, easy installation process. Electronic Flashcards You ll find flashcard questions on the CD for on-the-go review. These are short questions and answers, just like the flashcards you probably used to study in school. Glossary of Terms in PDF The CD contains a very useful Glossary of Terms in PDF (Adobe Acrobat) format, so you can easily read it on any computer. If you have to travel and brush up on any key terms, and you have a laptop with a CD drive, you can do so with this useful resource. Tips for Taking Your CCNA Exam The CCNA exam contains about 55 questions or more, to be completed in about 90 minutes or less. This can change per exam. You must get a score of about 85 percent to pass this exam, but again, each exam can be different. Many questions on the exam have answer choices that at first glance look identical especially the syntax questions! Remember to read through the choices carefully, because

18 xvi Introduction close doesn t cut it. If you get commands in the wrong order or forget just one character, you ll get the question wrong. So, to practice, do the hands-on exercises at the end of the chapters in this book over and over again until they feel natural to you. Also, never forget that the right answer is the Cisco answer. In many cases, more than one appropriate answer is presented, but the correct answer is the one that Cisco recommends. The exam always tells you to pick one, two, or three answers (never choose all that apply ). The CCNA exam includes the following test formats: Multiple-choice single answer Multiple-choice multiple answer Drag-and-drop Fill-in-the-blank Router simulations Here are some general tips for exam success: Arrive early at the exam center, so you can relax and review your study materials. Read the questions carefully. Don t jump to conclusions. Make sure you re clear about exactly what each question asks. When answering multiple-choice questions that you re not sure about, use the process of elimination to get rid of the obviously incorrect answers first. Doing this greatly improves your odds if you need to make an educated guess. You can no longer move forward and backward through the Cisco exams so doublecheck your answer before clicking Next, because you can t change your mind. After you complete an exam, you ll get immediate, online notification of your pass or fail status, a printed Examination Score Report that indicates your pass or fail status, and your exam results by section. (The test administrator will give you the printed score report.) Test scores are automatically forwarded to Cisco within five working days after you take the test, so you don t need to send your score to them. If you pass the exam, you ll receive confirmation from Cisco, typically within two to four weeks. The CCNA Exam Objectives Cisco has posted eight categories with specific objectives within each category. As mentioned previously, these exam objectives form the outline for this book. Following are Cisco s objectives for the CCNA exam: Exam objectives are subject to change at any time without prior notice and at Cisco s sole discretion. Please visit the CCNA page of Cisco s website ( for the most current listing of exam objectives.

19 Introduction xvii Describe how a network works Describe the purpose and functions of various network devices Select the components required to meet a network specification Use the OSI and TCP/IP models and their associated protocols to explain how data flows in a network Describe common networked applications, including web applications Describe the purpose and basic operation of the protocols in the OSI and TCP models Describe the impact of applications (Voice over IP and Video over IP) on a network Interpret network diagrams Determine the path between two hosts across a network Describe the components required for network and Internet communications Identify and correct common network problems at layers 1, 2, 3, and 7 using a layered model approach Differentiate between LAN/WAN operation and features Configure, verify, and troubleshoot a switch with VLANs and interswitch communications Select the appropriate media, cables, ports, and connectors to connect switches to other network devices and hosts Explain the technology and media access control method for Ethernet networks Explain network segmentation and basic traffic management concepts Explain basic switching concepts and the operation of Cisco switches Perform and verify initial switch configuration tasks, including remote access management Verify network status and switch operation using basic utilities (including ping, traceroute, Telnet, SSH, arp, and ipconfig) and SHOW and DEBUG commands Identify, prescribe, and resolve common switched network media issues, configuration issues, auto negotiation, and switch hardware failures Describe enhanced switching technologies (including VTP, RSTP, VLAN, PVSTP, and 802.1q) Describe how VLANs create logically separate networks and the need for routing between them Configure, verify, and troubleshoot VLANs Configure, verify, and troubleshoot trunking on Cisco switches Configure, verify, and troubleshoot intervlan routing Configure, verify, and troubleshoot VTP

20 xviii Introduction Configure, verify, and troubleshoot RSTP operation Interpret the output of various Show and Debug commands to verify the operational status of a Cisco switched network Implement basic switch security (including port security, trunk access, management VLAN other than VLAN 1, etc.) Implement an IP addressing scheme and IP Services to meet network requirements in a medium-size Enterprise branch office network Describe the operation and benefits of using private and public IP addressing Explain the operation and benefits of using DHCP and DNS Configure, verify, and troubleshoot DHCP and DNS operation on a router (including CLI/SDM) Implement static and dynamic addressing services for hosts in a LAN environment Calculate and apply an addressing scheme, including VLSM IP addressing design, to a network Determine the appropriate classless addressing scheme using VLSM and summarization to satisfy addressing requirements in a LAN/WAN environment Describe the technological requirements for running IPv6 in conjunction with IPv4 (including protocols, dual stack, tunneling, etc.) Describe IPv6 addresses Identify and correct common problems associated with IP addressing and host configurations Configure, verify, and troubleshoot basic router operation and routing on Cisco devices Describe basic routing concepts (including packet forwarding and the router lookup process) Describe the operation of Cisco routers (including the router bootup process, POST, and router components) Select the appropriate media, cables, ports, and connectors to connect routers to other network devices and hosts Configure, verify, and troubleshoot RIPv2 Access and utilize the router to set basic parameters (including CLI/SDM) Connect, configure, and verify the operational status of a device interface Verify device configuration and network connectivity using ping, traceroute, Telnet, SSH, or other utilities Perform and verify routing configuration tasks for a static or default route given specific routing requirements

21 Introduction xix Manage IOS configuration files. (including save, edit, upgrade, and restore) Manage Cisco IOS Compare and contrast methods of routing and routing protocols Configure, verify, and troubleshoot OSPF Configure, verify, and troubleshoot EIGRP Verify network connectivity (including using ping, traceroute, and telnet or SSH) Troubleshoot routing issues Verify router hardware and software operation using the SHOW and DEBUG commands Implement basic router security Explain and select the appropriate administrative tasks required for a WLAN Describe standards associated with wireless media (including IEEE WI-FI Alliance and ITU/FCC) Identify and describe the purpose of the components in a small wireless network (including SSID, BSS, and ESS) Identify the basic parameters to configure on a wireless network to ensure that devices connect to the correct access point Compare and contrast wireless security features and capabilities of WPA security (including open, WEP, and WPA-1/2) Identify common issues with implementing wireless networks (including interfaces and misconfigurations) Identify security threats to a network and describe general methods to mitigate those threats Describe today s increasing network security threats and explain the need to implement a comprehensive security policy to mitigate the threats Explain general methods to mitigate common security threats to network devices, hosts, and applications Describe the functions of common security appliances and applications Describe security recommended practices, including initial steps to secure network devices Implement, verify, and troubleshoot NAT and ACLs in a medium-size Enterprise branch office network Describe the purpose and types of ACLs Configure and apply ACLs based on network filtering requirements (including CLI/SDM) Configure and apply ACLs to limit Telnet and SSH access to the router using (including SDM/CLI) Verify and monitor ACLs in a network environment

22 xx Introduction Troubleshoot ACL issues Explain the basic operation of NAT Configure NAT for given network requirements using (including CLI/SDM) Troubleshoot NAT issues Implement and verify WAN links Describe different methods for connecting to a WAN Configure and verify a basic WAN serial connection Configure and verify Frame Relay on Cisco routers Troubleshoot WAN implementation issues Describe VPN technology (including importance, benefits, role, impact, components) Configure and verify a PPP connection between Cisco routers

23 Chapter 1 Describe How a Network Works The Cisco CCNA exam objectives covered in this chapter include the following: ÛÛDescribe the purpose and functions of various network devices. ÛÛSelect the components required to meet a network specification. ÛÛUse the OSI and TCP/IP models and their associated protocols to explain how data flows in a network. ÛÛDescribe common networked applications, including web applications. ÛÛDescribe the purpose and basic operation of the protocols in the OSI and TCP models. ÛÛDescribe the impact of applications (Voice over IP and Video over IP) on a network. ÛÛInterpret network diagrams. ÛÛDetermine the path between two hosts across a network. ÛÛDescribe the components required for network and Internet communications. ÛÛIdentify and correct common network problems at layers 1, 2, 3, and 7 using a layered model approach. ÛÛDifferentiate between LAN/WAN operation and features.

24 In this chapter, we will review the basics of internetworking. First, we will examine what an internetwork is; next, we will look at the Open Systems Interconnection (OSI) model and review each part. We will also review the difference between TCP and UDP with regard to VoIP and video streaming. Our review will also include PDU encapsulation, TCP/IP troubleshooting, Ethernet, and WAN connections. Describe the Purpose and Functions of Various Network Devices It is likely that at some point you ll have to break up one large network into a bunch of smaller ones because user response will have dwindled to a slow crawl as the network grows and grows. With all that growth, your LAN s traffic congestion will have reached epic proportions. The best way to handle this will be to break up your large network into several smaller networks something called network segmentation. You can do this by using devices like routers, switches, and bridges. Figure 1.1 displays a network that s been segmented with a switch so each network segment connected to the switch is a separate collision domain. But make note of the fact that this network is still one broadcast domain. Keep in mind that the hub used in Figure 1.1 just extended the one collision domain from the switch port. Here s a list of some of the things that commonly cause LAN traffic congestion: Too many hosts in a broadcast domain Broadcast storms Multicasting Low bandwidth Adding hubs for connectivity to the network Routers are used to connect networks together and route packets of data from one network to another. Cisco became the de facto standard of routers because of its high-quality router products, great selection, and fantastic service. Routers, by default, break up a broadcast domain the set of all devices on a network segment that hear all the broadcasts sent on that segment. Figure 1.2 shows a router in a little network that creates an internetwork and breaks up broadcast domains.

25 Describe the Purpose and Functions of Various Network Devices 3 Figure 1.1 A switch can replace the hub, breaking up collision domains. Switch (Hub) Figure 1.2 Routers create an internetwork. Switch Serial 0 Switch A router creates an internetwork and provides connections to WAN services. The network in Figure 1.2 shows that each host is connected to its own collision domain, and the router has created two broadcast domains and don t forget that the router provides connections to WAN services as well. The router uses something called a serial interface for WAN connections specifically, a V.35 physical interface on a Cisco router.

26 4 Chapter 1 N Describe How a Network Works Breaking up a broadcast domain is important because when a host or server sends a network broadcast, every device on the network must read and process that broadcast unless you have a router. When the router s interface receives this broadcast, it can respond by discarding the broadcast without forwarding it to other networks. Even though routers are known for breaking up broadcast domains by default, it s important to remember that they break up collision domains as well. Here are two advantages of using routers in your network: They don t forward broadcasts by default. They can filter the network based on layer 3 (Network layer) information (such as an IP address). Four router functions in your network can be listed as follows: Packet switching Packet filtering Internetwork communication Path selection Routers are actually layer 3 switches (we ll talk about layers later in this chapter). Unlike layer 2 switches, which forward or filter frames, routers (layer 3 switches) use logical addressing and provide what is called packet switching. When routers connect two or more networks together and use logical addressing (IP or IPv6), this is called an internetwork. Last, routers use a routing table (map of the internetwork) to make path selections and to forward packets to remote networks. Conversely, switches don t break up broadcast domains to create internetworks. The main purpose of a switch is to optimize a LAN s performance and provide more bandwidth for its users. And switches don t forward packets to other networks as routers do. Instead, they only switch frames from one port to another within the switched network. By default, switches break up collision domains. This is an Ethernet term used to describe a network scenario wherein one particular device sends a packet on a network segment, forcing every other device on that same segment to pay attention to it. At the same time, a different device tries to transmit, leading to a collision, after which both devices must retransmit, one at a time, which is not very efficient. This situation is typically found in a hub environment where each host segment connects to a hub that represents only one collision domain and only one broadcast domain. By contrast, each and every port on a switch represents its own collision domain. Switches create separate collision domains but a single broadcast domain. Routers provide a separate broadcast domain for each interface. The term bridging was introduced before routers, switches, and hubs were implemented, so it s pretty common to hear people referring to bridges as switches. That s because bridges and switches basically do the same thing: they break up collision domains on a LAN. (In reality, you cannot buy a physical bridge these days; you can buy only LAN switches, but they use bridging technologies, so Cisco still calls them multiport bridges.)

27 Select the Components Required to Meet a Network Specification 5 A switch is basically a multiple-port bridge with greatly enhanced management capabilities and features. Also, while bridges may have up to 16 ports, switches can have hundreds! You would use a switch/bridge in a network to reduce collisions within broadcast domains and to increase the number of collision domains in your network. Doing this provides more bandwidth for users. Keep in mind that using hubs in your network can contribute to congestion on your Ethernet network. As always, plan your network design carefully! Exam Essentials Understand the difference between a hub, a bridge, a switch, and a router. Hubs create one collision domain and one broadcast domain. Bridges break up collision domains but create one large broadcast domain. They use hardware addresses to filter the network. Switches are really just multiple-port bridges with more intelligence. They break up collision domains but create one large broadcast domain by default. Switches use hardware addresses to filter the network. Routers break up broadcast domains (and collision domains) and use logical addressing to filter the network. Identify the functions and advantages of routers. Routers perform packet switching, filtering, and path selection; and they facilitate internetwork communication. One advantage of routers is that they reduce broadcast traffic. Remember the possible causes of LAN traffic congestion. Too many hosts in a broadcast domain, broadcast storms, multicasting, and low bandwidth are all possible causes of LAN traffic congestion. Understand the difference between a collision domain and a broadcast domain. Collision domain is an Ethernet term used to describe a network collection of devices in which one particular device sends a packet on a network segment, forcing every other device on that same segment to pay attention to it. On a broadcast domain, a set of all devices on a network segment hears all broadcasts sent on that segment. Select the Components Required to Meet a Network Specification As mentioned in the previous objective, routers, bridges, and switches are used in an internetwork. Figure 1.3 shows how a network would look with all these internetwork devices in place. Remember that the router will not only break up broadcast domains for every LAN interface, but it will also break up collision domains.

28 6 Chapter 1 N Describe How a Network Works figure 1.3 Internetworking devices Bridge Switch Router When you looked at Figure 1.3, you may have noticed that the router is at center stage and that it connects each physical network together. This type of layout is necessary because of the older technologies involved bridges and hubs. On the top internetwork in Figure 1.3, you ll notice that a bridge was used to connect the hubs to a router. The bridge breaks up collision domains, but all the hosts connected to both hubs are still crammed into the same broadcast domain. Also, the bridge created only two collision domains, so each device connected to a hub is in the same collision domain as every other device connected to that same hub. This is still better than having one collision domain for all hosts. Also, notice that the three hubs at the bottom are connected to the router, creating one collision domain and one broadcast domain. This makes the bridged network work much better. Although bridges/switches are used to segment networks, they will not isolate broadcast or multicast packets.

29 Select the Components Required to Meet a Network Specification 7 In Figure 1.3, the best network connected to the router is the LAN switch network on the left. This is because each port on that switch breaks up collision domains. But it s not all good all devices are still in the same broadcast domain. Do you remember why this can be a really bad thing? Because all devices must listen to all broadcasts transmitted, that s why. If your broadcast domains are too large, users have less bandwidth and are required to process more broadcasts, and network response time will slow to an unacceptable level. Once you have only switches in your network, things change a lot! Figure 1.4 shows the network that is typically found today. Figure 1.4 Switched networks creating an internetwork Router Here, the LAN switches are placed at the center of the network world so that the routers are connecting only logical networks together. If this kind of setup is implemented, virtual LANs (VLANs) are created. But it is really important to understand that even though you have a switched network, you still need a router to provide your inter-vlan communication, or internetworking. Obviously, the best network is one that s correctly configured to meet the business requirements of the company it serves. LAN switches with routers, correctly placed in the network, are the best network design. This book will help you understand the basics of routers and switches, so you can make tight, informed decisions on a case-by-case basis. Let s go back to Figure 1.3. Looking at the figure, how many collision domains and broadcast domains are in this internetwork? Hopefully, you answered nine collision domains and three broadcast domains. The broadcast domains are definitely the easiest to see because only routers break up broadcast domains by default. Because there are three connections, that gives you three broadcast domains. The all-hub network is one collision domain; the bridge network equals three collision domains. Add in the switch network of five collision domains one for each switch port and you ve got a total of nine collision domains. So now that you ve reviewed internetworking and the various devices in an internetwork, it s time to head into internetworking models.

30 8 Chapter 1 N Describe How a Network Works Exam Essentials Understand which devices create a LAN and which separate and connect LANs. Switches and bridges are used to create LANs. While they do separate collision domains, they do not create separate LANs (collision domain and LAN are not the same concept). Routers are used to separate LANs and connect LANs (broadcast domains). Understand the difference between a hub, a bridge, a switch, and a router. Hubs create one collision domain and one broadcast domain. Bridges break up collision domains but create one large broadcast domain. They use hardware addresses to filter the network. Switches are really just multiple-port bridges with more intelligence. They break up collision domains but create one large broadcast domain by default. Switches use hardware addresses to filter the network. Routers break up broadcast domains (and collision domains) and use logical addressing to filter the network. Use the OSI and TCP/IP Models and Their Associated Protocols to Explain How Data Flows in a Network The Department of Defense (DoD) model is basically a condensed version of the OSI model it s composed of the following four (instead of seven) layers: N Process/Application layer Host-to-Host layer N Internet layer Network Access layer Figure 1.5 shows a comparison of the DoD model and the OSI reference model. As you can see, the two are similar in concept, but each has a different number of layers with different names. When the different protocols in the IP stack are discussed, the layers of the OSI and DoD models are interchangeable. In other words, the Internet layer and the Network layer describe the same thing, as do the Host-to-Host layer and the Transport layer. A vast array of protocols combine at the DoD model s Process/Application layer to integrate the various activities and duties spanning the focus of the OSI s corresponding top three layers (Application, Presentation, and Session). We ll be looking closely at those protocols in the next part of this chapter. The Process/Application layer defines protocols for node-tonode application communication and controls user-interface specifications.