21 - Wireless LAN - Frequencies and 802.11 Standards

Only short notes, as this is covered in the CCNA ...

NOTICE, that the extending your network you have your APs on DIFFERENT channels:

22 - Wireless LAN - Understanding the Hardware

awesome game that cisco wireless explorer! lol

23 - The Switches Domain - Additional Life-Saving Technology

etherchannel example
with loopguard, if x1 goes unidrection, it will detect a missed BPDU and disable the whole etherchannel
whereas with UDLD it will just pull out the bad link.

However loopguard does auto recover, will UDLD it is err-disabled so you need an admin to clear.
there is a err-disabled timeout you can configure  ... its a global thing, but its an option

vlan 10, stays within building B's floor, it doesn't go across distribution switches!

cisco say if you can design your network right, logically in blocks (keep it simple) it helps you

use all these technologies/features/best practices as they should be and it will be easy to implement these.

24 - Monitoring - Your Pulse on the Network

SLA (Service Level Assurance) Can also assign tracks to the sla monitors ..... (kept this brief as i use alot of snmp/syslog and IP SLA monitors at work) but these tracks can be assigned to static routes for example, so we can pull routes out of the table and the higher metric route can be used instead, when the ping/reachabilty comes back the tracker installs the route again (which is being tracked) and the higher metric static goes back out of the routing table - PRETTY SWEET

the SLA monitors do all sorts, from dhcp/dns/icmp/voice codes etc also can configure responsders (another router, for more accurate results ie the endpoint in the network)

19 - Wireless LAN - Foundation Concepts and Design 1

Only 1 person can send or receive at a time, more users joining the wireless network the less the performance you get.

The unlicensed bands is an issue (one of the downfalls) ... as there are only 3 clean channels (b+g)

not much you can do if other networks/peoples APs use these channels.... other than changing

over to another wireless standard, but point being is no governing authority you can go to.

We all remember CSMA/CD (just about from our NA studies) which would listen first to see if the wire was free then send data, well with wireless it uses CA (collision avoidance) - sounds familiar right, dig deep in that head, yes thats right, the same as token ring! lol

 

20 - Wireless LAN - Foundation Concepts and Design 2

client joins ap 1, gets 172.16.1.50 then comes into radius of ap 2, the client joins ap 2 ...(but how i hear you ask ...as if we assign him a new ip, all his existing connections with be severed..)

he then pretty much becomes vpn enabled (almost) he gets an encapsulated IP address (so he keeps 172.16.1.50 - thats retained, which is encapsulated within the 2.50 packet) kinda vpn styleeee (kinda on the fly) and vice versa when he goes back into AP1 he is decapsulated.

this keeps all connections ...koooool

18 - Campus VoIP - Overview, Considerations, and AutoQoS

Alot to squeeze in here, but a quick nugget on the world of VoIP and Qos and other considerations needed to support the infrastructure.

There are different migration paths to changing the phone system, but a 2 phase plan could consist of the above/below:

If companies have invested heavily in the existing PBX, they may not want to change and WHY?! ...well you could keep the pbx and instead upgrade the WAN routers to support voice ports (3600 etc) which can then plug into the PBX systems which make the PBX systems believe there are directly connected to each other, however they are going via the cisco routers and over the WAN, with the added benefit of the voice codecs / voice compression.

Eventually everything then moves onto phase 2.....where everything starts life in an IP packet lol

You can have some of the offices in phase 1 and some in phase 2 thats the beauty, there is no rush as the routers will talk to the PBXs and keep the interoperability

The below slide shows how the magic works:

lets say we are using cisco 7960 ip phone (using stock image running skinny protocol)

phone sends msg to cisco call manager (ccm) / distributed architecture

the phone is dumb terminal

cisco uses skinny protocol (cisco propriety) but can use sip etc just need different image

need to get that RTP (audio) across the network as fast a possible (not issue over LAN with gig ports etc)

RTP = little delay is possible, issue arises when going over WAN

RTP flows between bob and sally

GOAL is to prioritise the RTP audio

A few things we need to know about:

so lets look at the dual VLANs, we can do this with the below config (if the IP phones support CDP)

daisy chain PC from Phone (only needs 1 cat5 data port)

need separate voice vlan to separate voice and data, otherwise HUGE security risk (tap the phone etc)

voice vlan

the switch uses cdp to talk/detect the ip phones via CDP

so when the ip phone is detected via CDP the packets are tagged in the voice vlan, if the phone is removed the CDP messages fail and it uses the access vlan configuration .... SWEET!

If the phone does not support CDP, you will have to go to each phone and manually config the voice VLAN

Now cisco knows that not everyone is going to know eveything about QoS, but they do allow you some simple commands to get started which setup a base level for QoS 

trusting cos markings

under interface

mls qos trust cos

Does what the command says, cisco phones can mark there own layer2/3 packets with cos/tos

by typing in this command it will trust the markings, so the router and switch dont need to inspect the packet ....... (however this could be a security issue)

so use the below command

mls qos trust device cisco-phone

the above only works with IP phones that use CDP...

however that is QoS done, we can now use autoqos (deploys all recommended/best pratices qos settings under the interface)

wrr (weighted round robin)

So AutoQos works on an interface by interface level ..... and lets you config QoS without really knowing all the ins and outs

16 - Campus Security - STP Attacks and Other Security Considerations

Alot of this i already covered in the CCNA-S exam, so some brief notes:

there is nothing to stop someone bring in there own switch and becoming root bridge of the network,

so we have 2 major features:

any port set for port-fast, should be set as bpdu-guard - if it detects a bpdu

it will shut down the port (as we have declard this a port-fast ie a host, there shold

not be any bpdu's)

To enable this:

inter fas0/1

spanning-tree bpduguard enable

enable same way as you would any port-security feat ..... shut, no shut

Also have a system for the good ports - to prevent a mis-configured switch from becoming the root.

We can enable root-guard

on any port connected to a switch that is NOT to become a root, this feature you would

only enable on the root switch and/or backup root switch.

inter fa0/2

spanning-tree guard root

means there will never be a switch that connects to this port, will ever become the root

but when it shuts down a port it doesn't go into err-disable, it becomes a inconstant port

17 - Campus Security - VACLs

VACL - can also redirect traffic! - more common use for using vacl

3550

only allow you to permit and deny, whereas the 6500

it could:

match this subnet and redirect it to an IPS sensor/blade etc

vlan 10

vlan 30

very similar to route-maps .... sequencing etc

access-list 10

permit 10.1.10.0 0.0.0.255

mac access-list extended SERVER

permit any host 1111.1111.2222

access-list 30

permit 10.1.30.0 0.0.0.255

vlan access-map <NAME> demo <seq number>

match ip address 10

action forward

vlan access-map demo 20

action drop

As you can see very simialar to route-map (match and set etc)

NOW TO APPLY IT

vlan filter demo vlan-list 10 (can use - or commons etc)

vlan access-map demo1 10

match ip address 30

action forward

vlan access-map demo1 20

action drop

vlan filter demo1 vlan-list 30 

SO as you can see, its a simple demo, BUT you can use extended access-lists and combine

them all together in the vlan access-maps

PACLs

access-list applied to a port (Layer2, ie no no switchport, otherwise its just an ACL on a port)

can only be applied inbound (like the asic of the switch)

int fa0/3

ip access-group 1 in

or do mac access-group <name> in