CCNP 2: Remote Access

Transcription

1 Scope and Sequence CCNP 2: Remote Access Cisco Networking Academy Program Version 3.1

2 Table of Contents CCNP 2: REMOTE ACCESS...1 TABLE OF CONTENTS...2 TARGET AUDIENCE...3 PREREQUISITES...3 COURSE DESCRIPTION...3 COURSE OBJECTIVES...3 LAB REQUIREMENTS...4 CERTIFICATION ALIGNMENT...4 COURSE OVERVIEW...4 COURSE OUTLINE...5 Module 1. WANs...5 Module 2. Modems and Async Connections...6 Module 3. PPP...7 Module 4. ISDN and DDR...8 Module 5. Dialer Profiles...10 Module 6. Frame Relay...10 Module 7. Managing Frame Relay Traffic...11 Module 8. WAN Backup...12 Module 9. Managing and Optimizing Traffic...12 Module 10. Scaling IP Addressing with NAT...14 Module 11. Using AAA Scale Access Control...14 Module 12. Broadband Connections...15 Module 13. Virtual Private Networks...17 Case Study 1 Configure ISDN Connectivity between Remote Sites...19 Case Study 2 Configure ISDN Backup and VPN Connection CCNP 2: Remote Access v3.1 Copyright 2005, Cisco Systems, Inc.

3 Target Audience Those desiring to continue their post-ccna preparation for a career as a network administrator, Level 2 support engineer, Level 2 systems engineer, network technician, or deployment engineer. CCNA certified individuals pursuing CCNP, CCIP, CCSP, CCDP, or CCIE certifications. Prerequisites Students should have completed CCNA 1 4 or equivalent. CCNA Certification desired but not required. CCNP 1 desired but not required. Work experience beneficial. Course Description CCNP 2: Remote Access is the second of four courses leading to the Cisco Certified Network Professional (CCNP) designation. CCNP 2 introduces student to the implementation of Cisco routers in WAN applications. The course focuses on the selection and implementation of the appropriate Cisco IOS services required to build intranet remote access links. Students will develop skills with the specific WAN technologies of analog dialup, ISDN BRI and PRI, Frame Relay, broadband, and VPN. This hands-on, lab-oriented course stresses the design, implementation, operation, and level 1 troubleshooting of common WAN connectivity options. Course Objectives The CCNP certification indicates knowledge of networking for the small-office, home-office (SOHO) market and enterprise markets and the ability to work in businesses or organizations whose networks have between 100 and 500 nodes. A CCNP certified individual should be able to: Implement appropriate technologies to build a scalable routed network Build campus networks using multilayer switching technologies Improve traffic flow, reliability, redundancy, and performance for campus LANs, routed and switched WANs, and remote access networks Create and deploy a global intranet Troubleshoot an environment that uses Cisco routers and switches for multiprotocol client hosts and services Perform entry-level tasks in the planning, design, installation, operation and troubleshooting of Ethernet, TCP/IP networks. CCNP 2 is an integral step towards achieving CCNP Certification. Upon completion of this course, students will be have performed tasks related to: WANs 3 CCNP 2: Remote Access v3.1 Copyright 2005, Cisco Systems, Inc.

4 Modems and asynchronous connections PPP and serial connections ISDN BRI and PRI and DDR Frame Relay configuration and traffic shaping WAN backup, managing and optimizing traffic NAT and AAA Broadband connections VPNs Lab Requirements Please refer to CCNP Equipment Bundle Spreadsheets on Cisco Academy Connection (CAC) Certification Alignment The curriculum is aligned with ILSGs BCMSN course and the exam. Course The course is designed to be delivered in a 70 contact hour time frame. Approximately 45 hours will be designated to lab activities and 25 hours on curriculum content. A case study on remote access is required, but format and timing are determined by the Local Academy. What has changed from previous CCNP versions? Removal of X.25 Removal of ODR Revision of queuing Addition of Broadband module Addition of VPN module More than 40 elabs are included in the curriculum Focus is maintained on hands-on labs 4 CCNP 2: Remote Access v3.1 Copyright 2005, Cisco Systems, Inc.

5 Course Outline Module 1. WANs 1.1 Introduction to WANs WAN connection types Dedicated connections Dedicated connections Circuit-Switched connections Asynchronous dialup connections ISDN connections Packet-switched networks WAN encapsulation protocols 1.2 Choosing WAN Technologies Choosing a WAN connection Identifying site requirements and solutions Central site considerations Branch office considerations Telecommuter-site considerations 1.3 Selecting Cisco Remote Access Solutions Routers Determining the appropriate interfaces -- fixed interfaces Determining the appropriate interfaces -- modular interfaces 1.4 Assembling and Cabling WAN Components Network overview Central site equipment Branch-office router equipment Telecommuter-site router equipment International Travel Agency 1.5 Lab Exercises Lab: Getting started Lab: Capturing HyperTerminal and Telnet sessions Lab: ACL Basics and Extended Ping 5 CCNP 2: Remote Access v3.1 Copyright 2005, Cisco Systems, Inc.

6 Module 2. Modems and Async Connections 2.1 Modem Functions Digital to Analog Conversion The role of the modem Modem signaling and cabling The EIA/TIA-232 standard DTE communication termination Modem cabling components Connecting a modem to a router Connecting a modem to an access server, async lines Connecting a modem to a PC Directly connecting a DTE to another DTE -- null modem Modem modulation standards Error control and data compressions 2.2 Configuring Asynchronous Interfaces and Terminal Lines Connecting to the modem - reverse telnet Line types and numbering Configuring reverse telnet Asynchronous interfaces and line configuration Basic terminal line configuration Basic auxiliary port configuration Configuring the console port to use a modem Configuring a serial interface to use a modem Configuring asynchronous interfaces Asynchronous interface configuration example Introduction to DDR - Dialer List 2.3 Modem Configuration Modem configuration methods Manual configuration of modems with standard commands Manual configuration of modems with nonstandard modem commands Modem initialization strings Automatic configuration of modems Modem capability database Modem autodiscovery 6 CCNP 2: Remote Access v3.1 Copyright 2005, Cisco Systems, Inc.

7 2.3.8 Modem autoconfiguration Fine tuning modem autoconfiguration Chat scripts for async lines Configuring asynchronous connections between remote routers 2.4 Verifying Modem Autoconfiguration Verifying and debugging modem autoconfiguration Troubleshooting modem autoconfiguration 2.5 Lab Exercises Lab: Configuring an asynchronous dialup connection Lab: Configuring an asynchronous dialup connection on the AUX port Lab: Configuring an asynchronous dialup PPP Module 3. PPP 3.1 PPP Point-to-point links PPP architecture Configuring PPP Dialup PPP vs. dialup EXEC sessions Configuring dedicated PPP sessions Configuring interactive PPP sessions Configuring the interface addressing method for local devices Configuring the interface addressing method for remote devices PPP LCP Options 3.2 PPP Authentication PAP and CHAP authentication Configuring PAP authentication Configuring CHAP authentication Configuring CHAP and PAP authentication 3.3 PPP Callback Dialup PPP callback overview PPP callback operation Configuring the callback server 7 CCNP 2: Remote Access v3.1 Copyright 2005, Cisco Systems, Inc.

8 3.3.4 Configuring the callback client 3.4 PPP Compression Data compression Configuring compression Verifying compression 3.5 PPP Multilink PPP multilink overview Multilink PPP operation and configuration Multilink PPP example 3.6 Verifying PPP configuration Verifying and troubleshooting PPP PPP configuration example 3.7 Lab Exercises Lab: Configuring PPP interactive mode Lab: Configuring PPP options: Authentication and Compression Lab: Configuring PPP callback Module 4. ISDN and DDR 4.1 ISDN Architecture ISDN versus asynchronous dialup ISDN services and channelized E1 and T BRI call processing BRI functional groups and reference points Physical representation of BRI reference points PRI reference points 4.2 ISDN Protocol Layers ISDN Layer ISDN Layer 2 -- Q ISDN Layer 3 -- Q ISDN call setup ISDN call teardown 4.3 Configuring ISDN BRI ISDN BRI configuration overview Configuring the ISDN switch type Configuring the SPIDs 8 CCNP 2: Remote Access v3.1 Copyright 2005, Cisco Systems, Inc.

9 4.3.4 Configuring the encapsulation protocol 4.4 Configuring Dial-on-Demand Routing (DDR) DDR configuration overview Defining interesting traffic Assigning the dialer-list to an interface Defining destination parameters Defining optional call parameters 4.5 Static and Default Routing Use of static and default routes Configuring static routes Configuring default routes Configuring route redistribution Deactivating routing updates Snapshot routing Snapshot routing model Enabling snapshot routing Snapshot routing configuration example 4.6 Optional Configurations B-channel aggregation Cisco proprietary BOD Multilink PPP ISDN caller identification Called-party number answering ISDN rate adaptation ISDN BRI configuration example 4.7 Verifying ISDN BRI Operation The show interface bri command ISDN show commands Verifying and troubleshooting PPP multilink ISDN debug command 4.8 Configuring ISDN PRI PRI configuration tasks Selecting the PRI switch Configuring the T1/E1 controller for PRI Additional ISDN PRI configuration parameters PRI configuration example 9 CCNP 2: Remote Access v3.1 Copyright 2005, Cisco Systems, Inc.

10 4.8.6 ISDN BRI to PRI connection example using DDR 4.9 Lab Exercises Lab: Configuring ISDN BRI Lab: Configuring snapshot routing Lab: Using PPP multilink for ISDN B-Channel aggregation Lab: Configuring ISDN PRI Module 5. Dialer Profiles 5.1 Legacy DDR Legacy DDR with a single destination Legacy DDR with multiple destinations Rotary group overview Using rotary groups Configuring rotary groups Configuring ISDN for dialer rotary groups Asynchronous interface groups Legacy DDR limitations 5.2 Dialer Profiles of dialer profiles Configuring dialer profiles Dialer pools Placing calls with dialer profiles Receiving calls with dialer profiles Using dialer profiles with ISDN B channels Using dialer profiles with ISDN PRI Dialer map class 5.3 Lab Exercises Lab: Configuring ISDN using dialer profiles Lab: Using a dialer map-class with dialer profiles Module 6. Frame Relay 6.1 Frame Relay overview Frame Relay overview Frame Relay devices 10 CCNP 2: Remote Access v3.1 Copyright 2005, Cisco Systems, Inc.

11 6.1.3 Frame Relay operation Frame Relay DLCIs Frame Relay LMI Inverse ARP 6.2 Configuring Frame Relay Configuring Frame Relay encapsulation Configuring Frame Relay maps Configuring encapsulation per PVC Verifying Frame Relay interface configuration Verifying Frame Relay operation 6.3 Frame Relay topologies Frame Relay topologies Reachability issues with routing updates Solution for split horizon issue, subinterfaces Configuring Frame Relay subinterfaces 6.4 Lab Exercises Lab: Basic Frame Relay router and switch configuration Lab: Configuring full mesh Frame Relay Lab: Configuring full mesh Frame Relay with subinterfaces Lab: Configuring hub and spoke Frame Relay Module 7. Managing Frame Relay Traffic 7.1 Frame Relay Traffic Shaping Frame Relay traffic flow of Frame Relay traffic shaping Types of Frame Relay traffic management Configuring traffic shaping over Frame Relay Traffic shaping configuration steps Traffic shaping through rate enforcement Traffic shaping through dynamic rate enforcement Traffic shaping with queuing Verifying Frame Relay traffic shaping 7.2 Frame Relay Traffic Shaping Lab Exercises Lab: Frame Relay subinterfaces and traffic shaping 11 CCNP 2: Remote Access v3.1 Copyright 2005, Cisco Systems, Inc.

12 7.2.2 Lab: Frame Relay traffic shaping with CBWFQ Module 8. WAN Backup 8.1 Dial Backup Dial backup Example of dial backup for link failure Activating a dial backup to support primary line traffic Example of dial backup for excessive traffic load 8.2 Backup interface Operations Standby mode Dialer Profiles as backup interfaces Configuring dial backups with dialer profiles 8.3 Load backup IGRP and EIGRP Load backup with OSPF Load backup with IGRP and EIGRP 8.4 Verifying dial backup configuration Show interface type number command 8.5 Floating Static Routes Configuring floating static routes as backup 8.6 Dialer Watch Dialer watch overview Configuring dialer watch 8.7 Lab Exercises Lab: Configuring ISDN Dial backup Lab: Using secondary links for on-demand bandwidth Lab: Configuring dialer backup with dialer profiles Lab: Configuring DDR backup with BRI and dialer-watch Module 9. Managing and Optimizing Traffic 9.1 Queuing Options Queuing overview Effective use of traffic prioritization Establishing a queuing policy 12 CCNP 2: Remote Access v3.1 Copyright 2005, Cisco Systems, Inc.

13 9.1.4 Choosing a Cisco IOS queuing option 9.2 Configuring Weighted Fair Queuing Weighted fair queuing overview Weighted fair queuing operation Configuring weighted fair queuing 9.3 Class-Based Weighted Fair Queuing CBWFQ CBWFQ versus flow-based WFQ CBWFQ and tail drops Weighted random early detect (WRED) Configuring CBWFQ - Step Configuring CBWFQ - Step Configuring CBWFQ with WRED - Step Configuring CBWFQ default class - Step Configuring CBWF - Step CBWFQ Queuing Example Configuring Low Latency Queuing Low Latency Queuing (LLQ) Configuring Low Latency queuing 9.5 Verifying Queuing Operation Verifying queuing operation Queuing comparison summary 9.6 Optimizing traffic flow with data compression Implementing compression overview Link compression over a point-to-point connection Payload compression TCP/IP header compression Implementing MPPC Other compression considerations 9.7 Configuring Data Compression Configuring compression 9.8 Lab Exercises Managing network performance using content-based CBWFQ and LLQ 13 CCNP 2: Remote Access v3.1 Copyright 2005, Cisco Systems, Inc.

14 Module 10. Scaling IP Addressing with NAT 10.1 NAT NAT terminology Private addressing NAT terminology NAT functions 10.2 Configuring NAT Dynamic NAT Configuring dynamic NAT Dynamic NAT configuration example Static NAT Configuring static NAT NAT overload Configuring NAT overload TCP load distribution Configuring TCP load distribution TCP load distribution example Overlapping networks 10.3 Verifying NAT Configuration Verifying NAT translations Troubleshooting NAT translations Clearing NAT translations 10.4 NAT Considerations NAT advantages NAT disadvantages Traffic types supported by Cisco 10.5 Lab Exercises Lab: Configuring static NAT Lab: Configuring dynamic NAT Lab: Configuring NAT overload Lab: Configuring TCP load distribution Module 11. Using AAA Scale Access Control 14 CCNP 2: Remote Access v3.1 Copyright 2005, Cisco Systems, Inc.

15 11.1 Introduction to AAA Introduction to AAA Security protocols TACACS Radius Cisco Secure Access Control Server 11.2 Configuring AAA The aaa new-model command Configuring TACACS+ and RADIUS clients Configuring AAA authentication Configuring login authentication Enabling password protection at the privileged level Configuring PPP authentication using AAA Configuring AAA authorization IOS command privileged levels Configuring command authorization Configuring AAA accounting 11.3 Lab Exercises Lab: Router security and AAA authentication Lab: AAA authorization and accounting Lab: AAA TACACS+ server Module 12. Broadband Connections 12.1 Broadband Why broadband? Cable options DSL options Satellite options Wireless options 12.2 Cable Technology The original cable plant Data over cable Hybrid Fiber Coaxial (HFC) architecture Digital Signals over RF Channels 15 CCNP 2: Remote Access v3.1 Copyright 2005, Cisco Systems, Inc.

16 Identifying cable technology terms Cable standards and organizations RF signaling terms Putting cable technology all together Process for provisioning a cable modem 12.3 DSL Technology What is DSL? Types of DSL DSL limitations ADSL ADSL and POTS coexistence ADSL channels and encoding Data over ADSL: Bridging PPP over Ethernet How PPPoE works Data over ADSL: PPPoA 12.4 Configuring the CPE as the PPPoE Client Configuration tasks for DSL Configure PPPoE in a VPDN group Configure a PPPoE client Configure the PPPoE DSL dialer interface Configuring PAT PAT for use with DSL example Using DHCP to scale DSL Configuring a static default route 12.5 Configuring DSL with PPPoA Configuration tasks for DSL DSL Modulation configuration Configure the DSL ATM interface Configure the DSL dialer interface Configuring PAT PAT for use with DSL example Using DHCP to scale DSL Configuring a static default route 12.6 Troubleshooting DSL Is the 827 trained to the DSLAM? 16 CCNP 2: Remote Access v3.1 Copyright 2005, Cisco Systems, Inc.

17 Layer 1 issues Is the ATM interface in an administratively down state? Is the correct power supply being used? Is the DSL operating mode correct? Layer 2 Issues -- Correct PVC values Is data being received from the ISP? Is PPP negotiating properly? Module 13. Virtual Private Networks 13.1 VPN : Types, Tunnels, and Terms VPN overview Ttunneling and encryption VPN usage scenarios Selecting VPN Technologies: Identifying VPN and IPSec terms 13.2 Cisco IOS Cryptosystem Cryptosystem overview Symmetric encryption Asymmetric encryption Key Exchange - Diffie Hellman Hashing 13.3 IPSec Technologies IPSec Tunnel versus transport mode Security association Five steps of IPSec How IPSec uses IKE IKE and IPSec flowchart Tasks to configure IPSec 13.4 Task 1: Prepare for IKE and IPSec Task 1 -- Prepare for IKE and IPSec Step 1 - Determine IKE (IKE Phase 1) policy IKE Phase 1 policy parameters Step 2 Determine IPSec (IKE Phase 2) policy 17 CCNP 2: Remote Access v3.1 Copyright 2005, Cisco Systems, Inc.

18 IPSec Tranforms supported in Cisco IOS software IPSec policy example Identify IPSec peers Step 3 - Check current configuration Step 4 - Ensure the network works Step 5 - Ensure access lists are compatible with IPSec 13.5 Task 2: Configure IKE Task 2 - Configure IKE Step 1 - Enable IKE Step 2 - Create IKE policies Create IKE policies with crypto isakmp command IKE policy negotiation Step 3 - Configure ISAKMP identity Step 4 - Configure Pre-Shared keys Step 5 - Verify IKE configuration 13.6 Task 3: Configure IPSec Task 3 - Configure IPSec Step 1 - Configure transform set suites Transform set negotiation Step 2 - Configure global IPSec security association Lifetimes Purpose of crypto access lists Step 3 - Create crypto ACLs using extended access lists Configure symmetrical peer crypto access lists Purpose of crypto maps Crypto map parameters Step 4 - Configure IPSec crypto maps Example crypto map commands Step 5 - Apply crypto naps to interfaces IPSec configuration examples 13.7 Task 4: Test and Verify IPSec Task 4 - Test and verify IPSec The show crypto isakmp policy command The show crypto ipsec transform-set The show crypto ipsec sa command The show crypto map command 18 CCNP 2: Remote Access v3.1 Copyright 2005, Cisco Systems, Inc.

19 The clear commands The debug crypto commands Crypto system error messages for ISAKMP 13.8 Lab Exercise Configuring a site-to-site IPSec VPN using pre-shared keys Case Study 1 Configure ISDN Connectivity between Remote Sites Case Study 2 Configure ISDN Backup and VPN Connection 19 CCNP 2: Remote Access v3.1 Copyright 2005, Cisco Systems, Inc.