21 - Wireless LAN - Frequencies and 802.11 Standards

Only short notes, as this is covered in the CCNA ...

NOTICE, that the extending your network you have your APs on DIFFERENT channels:

22 - Wireless LAN - Understanding the Hardware

awesome game that cisco wireless explorer! lol

23 - The Switches Domain - Additional Life-Saving Technology

etherchannel example
with loopguard, if x1 goes unidrection, it will detect a missed BPDU and disable the whole etherchannel
whereas with UDLD it will just pull out the bad link.

However loopguard does auto recover, will UDLD it is err-disabled so you need an admin to clear.
there is a err-disabled timeout you can configure  ... its a global thing, but its an option

vlan 10, stays within building B's floor, it doesn't go across distribution switches!

cisco say if you can design your network right, logically in blocks (keep it simple) it helps you

use all these technologies/features/best practices as they should be and it will be easy to implement these.

24 - Monitoring - Your Pulse on the Network

SLA (Service Level Assurance) Can also assign tracks to the sla monitors ..... (kept this brief as i use alot of snmp/syslog and IP SLA monitors at work) but these tracks can be assigned to static routes for example, so we can pull routes out of the table and the higher metric route can be used instead, when the ping/reachabilty comes back the tracker installs the route again (which is being tracked) and the higher metric static goes back out of the routing table - PRETTY SWEET

the SLA monitors do all sorts, from dhcp/dns/icmp/voice codes etc also can configure responsders (another router, for more accurate results ie the endpoint in the network)

19 - Wireless LAN - Foundation Concepts and Design 1

Only 1 person can send or receive at a time, more users joining the wireless network the less the performance you get.

The unlicensed bands is an issue (one of the downfalls) ... as there are only 3 clean channels (b+g)

not much you can do if other networks/peoples APs use these channels.... other than changing

over to another wireless standard, but point being is no governing authority you can go to.

We all remember CSMA/CD (just about from our NA studies) which would listen first to see if the wire was free then send data, well with wireless it uses CA (collision avoidance) - sounds familiar right, dig deep in that head, yes thats right, the same as token ring! lol

 

20 - Wireless LAN - Foundation Concepts and Design 2

client joins ap 1, gets 172.16.1.50 then comes into radius of ap 2, the client joins ap 2 ...(but how i hear you ask ...as if we assign him a new ip, all his existing connections with be severed..)

he then pretty much becomes vpn enabled (almost) he gets an encapsulated IP address (so he keeps 172.16.1.50 - thats retained, which is encapsulated within the 2.50 packet) kinda vpn styleeee (kinda on the fly) and vice versa when he goes back into AP1 he is decapsulated.

this keeps all connections ...koooool

18 - Campus VoIP - Overview, Considerations, and AutoQoS

Alot to squeeze in here, but a quick nugget on the world of VoIP and Qos and other considerations needed to support the infrastructure.

There are different migration paths to changing the phone system, but a 2 phase plan could consist of the above/below:

If companies have invested heavily in the existing PBX, they may not want to change and WHY?! ...well you could keep the pbx and instead upgrade the WAN routers to support voice ports (3600 etc) which can then plug into the PBX systems which make the PBX systems believe there are directly connected to each other, however they are going via the cisco routers and over the WAN, with the added benefit of the voice codecs / voice compression.

Eventually everything then moves onto phase 2.....where everything starts life in an IP packet lol

You can have some of the offices in phase 1 and some in phase 2 thats the beauty, there is no rush as the routers will talk to the PBXs and keep the interoperability

The below slide shows how the magic works:

lets say we are using cisco 7960 ip phone (using stock image running skinny protocol)

phone sends msg to cisco call manager (ccm) / distributed architecture

the phone is dumb terminal

cisco uses skinny protocol (cisco propriety) but can use sip etc just need different image

need to get that RTP (audio) across the network as fast a possible (not issue over LAN with gig ports etc)

RTP = little delay is possible, issue arises when going over WAN

RTP flows between bob and sally

GOAL is to prioritise the RTP audio

A few things we need to know about:

so lets look at the dual VLANs, we can do this with the below config (if the IP phones support CDP)

daisy chain PC from Phone (only needs 1 cat5 data port)

need separate voice vlan to separate voice and data, otherwise HUGE security risk (tap the phone etc)

voice vlan

the switch uses cdp to talk/detect the ip phones via CDP

so when the ip phone is detected via CDP the packets are tagged in the voice vlan, if the phone is removed the CDP messages fail and it uses the access vlan configuration .... SWEET!

If the phone does not support CDP, you will have to go to each phone and manually config the voice VLAN

Now cisco knows that not everyone is going to know eveything about QoS, but they do allow you some simple commands to get started which setup a base level for QoS 

trusting cos markings

under interface

mls qos trust cos

Does what the command says, cisco phones can mark there own layer2/3 packets with cos/tos

by typing in this command it will trust the markings, so the router and switch dont need to inspect the packet ....... (however this could be a security issue)

so use the below command

mls qos trust device cisco-phone

the above only works with IP phones that use CDP...

however that is QoS done, we can now use autoqos (deploys all recommended/best pratices qos settings under the interface)

wrr (weighted round robin)

So AutoQos works on an interface by interface level ..... and lets you config QoS without really knowing all the ins and outs

16 - Campus Security - STP Attacks and Other Security Considerations

Alot of this i already covered in the CCNA-S exam, so some brief notes:

there is nothing to stop someone bring in there own switch and becoming root bridge of the network,

so we have 2 major features:

any port set for port-fast, should be set as bpdu-guard - if it detects a bpdu

it will shut down the port (as we have declard this a port-fast ie a host, there shold

not be any bpdu's)

To enable this:

inter fas0/1

spanning-tree bpduguard enable

enable same way as you would any port-security feat ..... shut, no shut

Also have a system for the good ports - to prevent a mis-configured switch from becoming the root.

We can enable root-guard

on any port connected to a switch that is NOT to become a root, this feature you would

only enable on the root switch and/or backup root switch.

inter fa0/2

spanning-tree guard root

means there will never be a switch that connects to this port, will ever become the root

but when it shuts down a port it doesn't go into err-disable, it becomes a inconstant port

17 - Campus Security - VACLs

VACL - can also redirect traffic! - more common use for using vacl

3550

only allow you to permit and deny, whereas the 6500

it could:

match this subnet and redirect it to an IPS sensor/blade etc

vlan 10

vlan 30

very similar to route-maps .... sequencing etc

access-list 10

permit 10.1.10.0 0.0.0.255

mac access-list extended SERVER

permit any host 1111.1111.2222

access-list 30

permit 10.1.30.0 0.0.0.255

vlan access-map <NAME> demo <seq number>

match ip address 10

action forward

vlan access-map demo 20

action drop

As you can see very simialar to route-map (match and set etc)

NOW TO APPLY IT

vlan filter demo vlan-list 10 (can use - or commons etc)

vlan access-map demo1 10

match ip address 30

action forward

vlan access-map demo1 20

action drop

vlan filter demo1 vlan-list 30 

SO as you can see, its a simple demo, BUT you can use extended access-lists and combine

them all together in the vlan access-maps

PACLs

access-list applied to a port (Layer2, ie no no switchport, otherwise its just an ACL on a port)

can only be applied inbound (like the asic of the switch)

int fa0/3

ip access-group 1 in

or do mac access-group <name> in

15 - Campus Security - VLAN and Spoofing Attacks

remember every port by default is set to "switchport mode dynamic desirable"

if switch sees another trunk then dynamic desirable will become trunk, but from intruders perspective it is not good, well for him it is, but for us it is not! as he has now trunked with our switch and he can see all VLANs and move himself into our VoIP VLAN and start a packet sniffer etc.

SO simple but effect, hard-code them access ports!

SO what are PVLANS?


There are vlans with vlans

You have a primary vlan - defines the subnet and is a vlan
with vlan 5 we can add sub vlans

so we can now isolate these sub vlans betweem themselves.

3 types of sub vlans/ports


Lets look at the below scenario:


FTP server as an isolated port (port that is in the vlan but cannot speak to anyone else in the vlan, so how does it reach the DG etc, well we configure the route port as a promiscous port (can be reach by anything within the private vlan - sub vlans)


community port
so www and sql can be in this in this port, which is truly a subvlan, can reach over things within the community and reach the promiscuous port (DG)

So if the FTP gets comprimised it cannot reach any other hosts/clients/servers

So going back to the original diagram (with Jeremy and his cable modem) we can make each port an isolated port and the router out (DG) will be a promiscuous port - very powerful stuff

So PVLANS provide isolation and segmentation within 1 VLAN


Right lets lab this:

The FTP will be isolated from the Community ports but can talk to the Prom port,
the Community ports can talk to the Prom port but not the Isolated port.



1 primary/parent VLAN which in our case will be vlan200
a vlan = subnet

pvlans will be part of the primary/subnet
Can only have 1 isolated VLAN per Primary, but you can have many ports in that isolated vlan
(so you could have loads of servers in the isolated vlan, which cannot talk to each other)


*note to self 3950 does not support pvlans*

PVLANS can only be configured on VTP transparent mode

CONFIGURATION

vtp mode transparent

vlan 200
private-vlan primary

vlan 205
private-vlan community

vlan 210
private-vlan isolated

So now i need to associate these vlans with the primary

vlan 200
private-vlan association 205,210

Next part will be assigning ports:


inter fa4/24
switchport mode private-vlan host 
switchport mode private-vlan host-association <primary vlan> <secondary vlan/sub vlan>

so in our case

switchport mode private-vlan host-association 200 205

int fa4/25
switchport mode private-vlan host 
switchport mode private-vlan host-association 200 205


int fa4/26
switchport mode private-vlan host 
switchport mode private-vlan host-association 200 

Now lets setup the Promiscuous port, we need to configure the private-vlan mappings, so we need to
tell the port which of the ports it will be talking to, first we define the primary vlan then the sub vlans.

int fa4/26
switchport mode private-vlan promiscuous 
switchport private-vlan mapping 200 205,210

lets confirm:

So if this is the first time that the client and the server have spoken, an ARP asking for the server MAC will be sent out, the attacker can then reply back with the MAC of his PC, the attacker can then forward off the traffic to the server .... so no one is none the wiser.

dhcp snooping also helps protect from ARP attacks (DAI) - as covered in the CCNA-S (so brief notes as covered before)

enable via

ip dhcp snooping

configure the trusted ports with 

ip dhcp snooping trust

this database can then track IP bindings (the DHCP requests/replies)

it will build a database that the DAI feature can use.

it can be seen via

show ip dhcp snooping binding

port can then be shutdown if a violation occurs.

3750 etc have ip source guard (which is one step up from DAI) it watches the dhcp reply and then creates

an access list for that port that only allows that IP/MAC coming in on that port.

however if you have alot of clients your switch can take a performance hit and it might end of switching over to software switching  ....

go under the port:

ip verify source vlan dhcp snoopingport-security