Enterprise Networking,

Security, and Automation

Companion Guide (CCNAv7)

Cisco Press
ii Enterprise Networking, Security, and Automation Companion Guide (CCNAv7)

Enterprise Networking, Security, and Editor-in-Chief

Mark Taub
Automation Companion Guide (CCNAv7) Alliances Manager,
Cisco Press
Cisco Networking Academy
Arezou Gol
Copyright© 2020 Cisco Systems, Inc.
Director, ITP Product
Published by: Management
Brett Bartow
Cisco Press
Senior Editor
All rights reserved. No part of this book may be reproduced or transmitted in any James Manly
form or by any means, electronic or mechanical, including photocopying, record-
ing, or by any information storage and retrieval system, without written permis- Managing Editor
Sandra Schroeder
sion from the publisher, except for the inclusion of brief quotations in a review.
Development Editor
ScoutAutomatedPrintCode Ellie Bru

Library of Congress Control Number: 2020935515 Senior Project Editor

Tonya Simpson
ISBN-13: 978-0-13-663432-4
Copy Editor
ISBN-10: 0-13-663432-X Kitty Wilson

Technical Editor
Warning and Disclaimer Bob Vachon

Editorial Assistant
This book is designed to provide information about the Cisco Networking Cindy Teeters
Academy Enterprise Networking, Security, and Automation (CCNAv7) course.
Every effort has been made to make this book as complete and as accurate as Cover Designer
Chuti Prasertsith
possible, but no warranty or fitness is implied.
Composition
The information is provided on an “as is” basis. The authors, Cisco Press, and codeMantra
Cisco Systems, Inc. shall have neither liability nor responsibility to any person
or entity with respect to any loss or damages arising from the information Indexer
Ken Johnson
contained in this book or from the use of the discs or programs that may
accompany it. Proofreader
Betty Pessagno
The opinions expressed in this book belong to the author and are not necessar-
ily those of Cisco Systems, Inc.
 iii

Trademark Acknowledgments
All terms mentioned in this book that are known to be trademarks or service marks have been appropri-
ately capitalized. Cisco Press or Cisco Systems, Inc., cannot attest to the accuracy of this information.
Use of a term in this book should not be regarded as affecting the validity of any trademark or service
mark.

Special Sales
For information about buying this title in bulk quantities, or for special sales opportunities (which
may include electronic versions; custom cover designs; and content particular to your business,
training goals, marketing focus, or branding interests), please contact our corporate sales department
at [email protected] or (800) 382-3419.
For government sales inquiries, please contact [email protected].
For questions about sales outside the U.S., please contact [email protected].

Feedback Information
At Cisco Press, our goal is to create in-depth technical books of the highest quality and value. Each
book is crafted with care and precision, undergoing rigorous development that involves the unique
expertise of members from the professional technical community.
Readers’ feedback is a natural continuation of this process. If you have any comments regarding how we
could improve the quality of this book, or otherwise alter it to better suit your needs, you can contact
us through email at [email protected]. Please make sure to include the book title and ISBN in
your message.
We greatly appreciate your assistance.

Americas Headquarters Asia Pacific Headquarters Europe Headquarters

Cisco Systems, Inc. Cisco Systems (USA) Pte. Ltd. Cisco Systems International BV Amsterdam,
San Jose, CA Singapore The Netherlands

Cisco has more than 200 offices worldwide. Addresses, phone numbers, and fax numbers are listed on the Cisco Website at www.cisco.com/go/offices.

Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks,
go to this URL: www.cisco.com/go/trademarks. Third party trademarks mentioned are the property of their respective owners. The use of the word partner does
not imply a partnership relationship between Cisco and any other company. (1110R)
iv Enterprise Networking, Security, and Automation Companion Guide (CCNAv7)

About the Contributing Authors

Bob Vachon is a professor at Cambrian College (Sudbury, Ontario) and Algonquin
College (Ottawa, Ontario). He has more than 30 years of computer, networking, and
information technology teaching experience and has collaborated on many Cisco
Networking Academy courses, including CCNA, CCNA Security, CCNP, Cybersecu-
rity, and more as team lead, lead author, and subject matter expert. Bob enjoys play-
ing guitar by a campfire with friends and family.
Allan Johnson entered the academic world in 1999, after 10 years as a business
owner/operator, to dedicate his efforts to his passion for teaching. He holds both an
M.B.A. and an M.Ed. in training and development. He taught CCNA courses at the
high school level for 7 years and has taught both CCNA and CCNP courses at Del
Mar College in Corpus Christi, Texas. In 2003, Allan began to commit much of his
time and energy to the CCNA Instructional Support Team, providing services to
Networking Academy instructors worldwide and creating training materials. He now
works full time for Cisco Networking Academy as Curriculum Lead.
 v

Contents at a Glance
Introduction xxxi

Chapter 1 Single-Area OSPFv2 Concepts 1

Chapter 2 Single-Area OSPFv2 Configuration 33

Chapter 3 Network Security Concepts 93

Chapter 4 ACL Concepts 163

Chapter 5 ACLs for IPv4 Configuration 187

Chapter 6 NAT for IPv4 225

Chapter 7 WAN Concepts 269

Chapter 8 VPN and IPsec Concepts 319

Chapter 9 QoS Concepts 351

Chapter 10 Network Management 389

Chapter 11 Network Design 453

Chapter 12 Network Troubleshooting 501

Chapter 13 Network Virtualization 581

Chapter 14 Network Automation 617

Appendix A Answers to the “Check Your Understanding” Questions 657

Glossary 677

Index 715
vi Enterprise Networking, Security, and Automation Companion Guide (CCNAv7)

Contents
Introduction xxxi

Chapter 1 Single-Area OSPFv2 Concepts 1

Objectives 1
Key Terms 1
Introduction (1.0) 3
OSPF Features and Characteristics (1.1) 3
Introduction to OSPF (1.1.1) 3
Components of OSPF (1.1.2) 4
Routing Protocol Messages 4
Data Structures 4
Algorithm 5
Link-State Operation (1.1.3) 6
1. Establish Neighbor Adjacencies 6
2. Exchange Link-State Advertisements 6
3. Build the Link-State Database 7
4. Execute the SPF Algorithm 8
5. Choose the Best Route 8
Single-Area and Multiarea OSPF (1.1.4) 9
Multiarea OSPF (1.1.5) 10
OSPFv3 (1.1.6) 12
OSPF Packets (1.2) 13
Types of OSPF Packets (1.2.2) 13
Link-State Updates (1.2.3) 14
Hello Packet (1.2.4) 15
OSPF Operation (1.3) 17
OSPF Operational States (1.3.2) 17
Establish Neighbor Adjacencies (1.3.3) 18
1. Down State to Init State 18
2. The Init State 19
3. Two-Way State 19
4. Elect the DR and BDR 20
Synchronizing OSPF Databases (1.3.4) 20
1. Decide First Router 21
2. Exchange DBDs 21
3. Send an LSR 22
The Need for a DR (1.3.5) 23
 vii

LSA Flooding with a DR (1.3.6) 24

Flooding LSAs 24
LSAs and DR 25
Summary (1.4) 27
OSPF Features and Characteristics 27
OSPF Packets 28
OSPF Operation 28
Practice 29
Check Your Understanding 29

Chapter 2 Single-Area OSPFv2 Configuration 33

Objectives 33
Key Terms 33
Introduction (2.0) 34
OSPF Router ID (2.1) 34
OSPF Reference Topology (2.1.1) 34
Router Configuration Mode for OSPF (2.1.2) 35
Router IDs (2.1.3) 36
Router ID Order of Precedence (2.1.4) 36
Configure a Loopback Interface as the Router ID (2.1.5) 37
Explicitly Configure a Router ID (2.1.6) 38
Modify a Router ID (2.1.7) 39
Point-to-Point OSPF Networks (2.2) 40
The network Command Syntax (2.2.1) 40
The Wildcard Mask (2.2.2) 41
Configure OSPF Using the network Command (2.2.4) 41
Configure OSPF Using the ip ospf Command (2.2.6) 43
Passive Interface (2.2.8) 44
Configure Passive Interfaces (2.2.9) 45
OSPF Point-to-Point Networks (2.2.11) 46
Loopbacks and Point-to-Point Networks (2.2.12) 48
Multiaccess OSPF Networks (2.3) 49
OSPF Network Types (2.3.1) 49
OSPF Designated Router (2.3.2) 49
OSPF Multiaccess Reference Topology (2.3.3) 51
Verify OSPF Router Roles (2.3.4) 52
viii Enterprise Networking, Security, and Automation Companion Guide (CCNAv7)

R1 DROTHER 52
R2 BDR 53
R3 DR 53
Verify DR/BDR Adjacencies (2.3.5) 54
R1 Adjacencies 55
R2 Adjacencies 55
R3 Adjacencies 56
Default DR/BDR Election Process (2.3.6) 56
DR Failure and Recovery (2.3.7) 58
R3 Fails 58
R3 Rejoins Network 59
R4 Joins Network 59
R2 Fails 59
The ip ospf priority Command (2.3.8) 61
Configure OSPF Priority (2.3.9) 61
Modify Single-Area OSPFv2 (2.4) 63
Cisco OSPF Cost Metric (2.4.1) 63
Adjust the Reference Bandwidth (2.4.2) 64
OSPF Accumulates Costs (2.4.3) 66
Manually Set OSPF Cost Value (2.4.4) 67
Test Failover to Backup Route (2.4.5) 69
Hello Packet Intervals (2.4.7) 69
Verify Hello and Dead Intervals (2.4.8) 70
Modify OSPFv2 Intervals (2.4.9) 71
Default Route Propagation (2.5) 73
Propagate a Default Static Route in OSPFv2 (2.5.1) 74
Verify the Propagated Default Route (2.5.2) 75
Verify Single-Area OSPFv2 (2.6) 77
Verify OSPF Neighbors (2.6.1) 77
Verify OSPF Protocol Settings (2.6.2) 79
Verify OSPF Process Information (2.6.3) 80
Verify OSPF Interface Settings (2.6.4) 81
Summary (2.7) 83
OSPF Router ID 83
Point-to-Point OSPF Networks 83
OSPF Network Types 84
Modify Single-Area OSPFv2 85
 ix

Default Route Propagation 86

Verify Single-Area OSPFv2 86
Practice 87
Check Your Understanding 88

Chapter 3 Network Security Concepts 93

Objectives 93
Key Terms 93
Introduction 95
Ethical Hacking Statement (3.0.3) 95
Current State of Cybersecurity (3.1) 95
Current State of Affairs (3.1.1) 95
Vectors of Network Attacks (3.1.2) 96
Data Loss (3.1.3) 97
Threat Actors (3.2) 98
The Hacker (3.2.1) 98
Evolution of Hackers (3.2.2) 99
Cyber Criminals (3.2.3) 100
Hacktivists (3.2.4) 100
State-Sponsored Hackers (3.2.5) 100
Threat Actor Tools (3.3) 101
Introduction to Attack Tools (3.3.2) 101
Evolution of Security Tools (3.3.3) 102
Attack Types (3.3.4) 104
Malware (3.4) 106
Overview of Malware (3.4.1) 106
Viruses and Trojan Horses (3.4.2) 106
Other Types of Malware (3.4.3) 108
Common Network Attacks (3.5) 109
Overview of Network Attacks (3.5.1) 109
Reconnaissance Attacks (3.5.3) 109
Access Attacks (3.5.5) 110
Trust Exploitation Example 111
Port Redirection Example 112
Man-in-the-Middle Attack Example 112
Buffer Overflow Attack 112
Social Engineering Attacks (3.5.6) 114
x Enterprise Networking, Security, and Automation Companion Guide (CCNAv7)

DoS and DDoS Attacks (3.5.9) 115

DoS Attack 116
DDoS Attack 116
IP Vulnerabilities and Threats (3.6) 117
IPv4 and IPv6 (3.6.2) 118
ICMP Attacks (3.6.3) 118
Amplification and Reflection Attacks (3.6.5) 119
Address Spoofing Attacks (3.6.6) 120
TCP and UDP Vulnerabilities (3.7) 122
TCP Segment Header (3.7.1) 122
TCP Services (3.7.2) 123
TCP Attacks (3.7.3) 124
TCP SYN Flood Attack 124
TCP Reset Attack 125
TCP Session Hijacking 126
UDP Segment Header and Operation (3.7.4) 126
UDP Attacks (3.7.5) 127
UDP Flood Attacks 127
IP Services 127
ARP Vulnerabilities (3.8.1) 127
ARP Cache Poisoning (3.8.2) 128
ARP Request 128
ARP Reply 129
Spoofed Gratuitous ARP Replies 130
DNS Attacks (3.8.4) 131
DNS Open Resolver Attacks 131
DNS Stealth Attacks 132
DNS Domain Shadowing Attacks 132
DNS Tunneling (3.8.5) 132
DHCP (3.8.6) 133
DHCP Attacks (3.8.7) 134
1. Client Broadcasts DHCP Discovery Messages 134
2. DHCP Servers Respond with Offers 134
3. Client Accepts Rogue DHCP Request 136
4. Rogue DHCP Acknowledges the Request 136
Network Security Best Practices (3.9) 137
Confidentiality, Integrity, and Availability (3.9.1) 137
The Defense-in-Depth Approach (3.9.2) 138
Firewalls (3.9.3) 139
 xi

IPS (3.9.4) 140

Content Security Appliances (3.9.5) 141
Cisco Email Security Appliance (ESA) 142
Cisco Web Security Appliance (WSA) 142
Cryptography (3.10) 143
Securing Communications (3.10.2) 143
Data Integrity (3.10.3) 144
Hash Functions (3.10.4) 145
MD5 with 128-Bit Digest 145
SHA Hashing Algorithm 146
SHA-2 146
SHA-3 146
Origin Authentication (3.10.5) 147
HMAC Hashing Algorithm 147
Creating the HMAC Value 148
Verifying the HMAC Value 149
Cisco Router HMAC Example 149
Data Confidentiality (3.10.6) 150
Symmetric Encryption (3.10.7) 151
Asymmetric Encryption (3.10.8) 152
Diffie-Hellman (3.10.9) 155
Summary (3.11) 157
Current State of Cybersecurity 157
Threat Actors 157
Threat Actor Tools 157
Malware 157
Common Network Attacks 158
IP Vulnerabilities and Threats 158
TCP and UDP Vulnerabilities 158
IP Services 158
Network Security Best Practices 159
Cryptography 159
Practice 159
Check Your Understanding 160

Chapter 4 ACL Concepts 163

Objectives 163
Key Terms 163
xii Enterprise Networking, Security, and Automation Companion Guide (CCNAv7)

Introduction (4.0) 164

Purpose of ACLs (4.1) 164
What Is an ACL? (4.1.1) 164
Packet Filtering (4.1.2) 165
ACL Operation (4.1.3) 166
Wildcard Masks in ACLs (4.2) 168
Wildcard Mask Overview (4.2.1) 168
Wildcard Mask Types (4.2.2) 169
Wildcard to Match a Host 169
Wildcard Mask to Match an IPv4 Subnet 169
Wildcard Mask to Match an IPv4 Address Range 170
Wildcard Mask Calculation (4.2.3) 170
Example 1 171
Example 2 171
Example 3 171
Example 4 172
Wildcard Mask Keywords (4.2.4) 172
Guidelines for ACL Creation (4.3) 173
Limited Number of ACLs per Interface (4.3.1) 173
ACL Best Practices (4.3.2) 174
Types of IPv4 ACLs (4.4) 175
Standard and Extended ACLs (4.4.1) 175
Numbered and Named ACLs (4.4.2) 176
Numbered ACLs 176
Named ACLs 177
Where to Place ACLs (4.4.3) 177
Standard ACL Placement Example (4.4.4) 179
Extended ACL Placement Example (4.4.5) 180
Summary (4.5) 182
Purpose of ACLs 182
Wildcard Masks 182
Guidelines for ACL Creation 183
Types of IPv4 ACLs 183
Practice 184
Check Your Understanding Questions 184
 xiii

Chapter 5 ACLs for IPv4 Configuration 187

Objectives 187
Key Term 187
Introduction (5.0) 188
Configure Standard IPv4 ACLs (5.1) 188
Create an ACL (5.1.1) 188
Numbered Standard IPv4 ACL Syntax (5.1.2) 188
Named Standard IPv4 ACL Syntax (5.1.3) 189
Apply a Standard IPv4 ACL (5.1.4) 190
Numbered Standard IPv4 ACL Example (5.1.5) 191
Named Standard IPv4 ACL Example (5.1.6) 193
Modify IPv4 ACLs (5.2) 195
Two Methods to Modify an ACL (5.2.1) 196
Text Editor Method (5.2.2) 196
Sequence Numbers Method (5.2.3) 197
Modify a Named ACL Example (5.2.4) 198
ACL Statistics (5.2.5) 199
Secure VTY Ports with a Standard IPv4 ACL (5.3) 200
The access-class Command (5.3.1) 200
Secure VTY Access Example (5.3.2) 200
Verify the VTY Port Is Secured (5.3.3) 202
Configure Extended IPv4 ACLs (5.4) 203
Extended ACLs (5.4.1) 203
Numbered Extended IPv4 ACL Syntax (5.4.2) 204
Protocols and Ports (5.4.3) 206
Protocol Options 206
Port Keyword Options 207
Protocols and Port Numbers Configuration Examples
(5.4.4) 208
Apply a Numbered Extended IPv4 ACL (5.4.5) 209
TCP Established Extended ACL (5.4.6) 210
Named Extended IPv4 ACL Syntax (5.4.7) 212
Named Extended IPv4 ACL Example (5.4.8) 212
Edit Extended ACLs (5.4.9) 213
xiv Enterprise Networking, Security, and Automation Companion Guide (CCNAv7)

Another Named Extended IPv4 ACL Example (5.4.10) 214

Verify Extended ACLs (5.4.11) 216
show ip interface 216
show access-lists 217
show running-config 218
Summary (5.5) 219
Configure Standard IPv4 ACLs 219
Modify IPv4 ACLs 219
Secure VTY Ports with a Standard IPv4 ACL 220
Configure Extended IPv4 ACLs 220
Practice 221
Check Your Understanding Questions 222

Chapter 6 NAT for IPv4 225

Objectives 225
Key Terms 225
Introduction (6.0) 226
NAT Characteristics (6.1) 226
IPv4 Private Address Space (6.1.1) 226
What Is NAT? (6.1.2) 227
How NAT Works (6.1.3) 228
NAT Terminology (6.1.4) 229
Inside Local 230
Inside Global 230
Outside Global 231
Outside Local 231
Types of NAT (6.2) 231
Static NAT (6.2.1) 231
Dynamic NAT (6.2.2) 232
Port Address Translation (6.2.3) 233
Next Available Port (6.2.4) 235
NAT and PAT Comparison (6.2.5) 236
NAT 236
PAT 237
Packets Without a Layer 4 Segment (6.2.6) 237
NAT Advantages and Disadvantages (6.3) 238
Advantages of NAT (6.3.1) 238
Disadvantages of NAT (6.3.2) 238
 xv

Static NAT (6.4) 239

Static NAT Scenario (6.4.1) 240
Configure Static NAT (6.4.2) 240
Analyze Static NAT (6.4.3) 241
Verify Static NAT (6.4.4) 242
Dynamic NAT (6.5) 244
Dynamic NAT Scenario (6.5.1) 244
Configure Dynamic NAT (6.5.2) 245
Analyze Dynamic NAT—Inside to Outside (6.5.3) 247
Analyze Dynamic NAT—Outside to Inside (6.5.4) 248
Verify Dynamic NAT (6.5.5) 249
PAT (6.6) 251
PAT Scenario (6.6.1) 251
Configure PAT to Use a Single IPv4 Address (6.6.2) 252
Configure PAT to Use an Address Pool (6.6.3) 253
Analyze PAT—PC to Server (6.6.4) 254
Analyze PAT—Server to PC (6.6.5) 255
Verify PAT (6.6.6) 256
NAT64 (6.7) 258
NAT for IPv6? (6.7.1) 258
NAT64 (6.7.2) 258
Summary (6.8) 260
NAT Characteristics 260
Types of NAT 260
NAT Advantages and Disadvantages 261
Static NAT 261
Dynamic NAT 262
PAT 262
NAT64 263
Practice 264
Check Your Understanding Questions 264

Chapter 7 WAN Concepts 269

Objectives 269
Key Terms 269
Introduction (7.0) 272
xvi Enterprise Networking, Security, and Automation Companion Guide (CCNAv7)

Purpose of WANs (7.1) 272

LANs and WANs (7.1.1) 272
Private and Public WANs (7.1.2) 273
WAN Topologies (7.1.3) 274
Point-to-Point Topology 274
Hub-and-Spoke Topology 275
Dual-homed Topology 276
Fully Meshed Topology 276
Partially Meshed Topology 277
Carrier Connections (7.1.4) 278
Single-Carrier WAN Connection 278
Dual-Carrier WAN Connection 278
Evolving Networks (7.1.5) 279
Small Network 279
Campus Network 280
Branch Network 281
Distributed Network 282
WAN Operations (7.2) 283
WAN Standards (7.2.1) 283
WANs in the OSI Model (7.2.2) 284
Layer 1 Protocols 284
Layer 2 Protocols 284
Common WAN Terminology (7.2.3) 285
WAN Devices (7.2.4) 287
Serial Communication (7.2.5) 289
Circuit-Switched Communication (7.2.6) 290
Packet-Switched Communications (7.2.7) 290
SDH, SONET, and DWDM (7.2.8) 291
Traditional WAN Connectivity (7.3) 292
Traditional WAN Connectivity Options (7.3.1) 293
Common WAN Terminology (7.3.2) 293
Circuit-Switched Options (7.3.3) 295
Public Service Telephone Network (PSTN) 295
Integrated Services Digital Network (ISDN) 295
Packet-Switched Options (7.3.4) 295
Frame Relay 295
Asynchronous Transfer Mode (ATM) 296
 xvii

Modern WAN Connectivity (7.4) 296

Modern WANs (7.4.1) 296
Modern WAN Connectivity Options (7.4.2) 297
Dedicated Broadband 297
Packet-Switched 298
Internet-Based Broadband 298
Ethernet WAN (7.4.3) 298
MPLS (7.4.4) 300
Internet-Based Connectivity (7.5) 301
Internet-Based Connectivity Options (7.5.1) 301
Wired Options 302
Wireless Options 302
DSL Technology (7.5.2) 302
DSL Connections (7.5.3) 303
DSL and PPP (7.5.4) 303
Host with PPPoE Client 304
Router PPPoE Client 304
Cable Technology (7.5.5) 305
Optical Fiber (7.5.6) 305
Wireless Internet-Based Broadband (7.5.7) 306
Municipal Wi-Fi 306
Cellular 306
Satellite Internet 307
WiMAX 307
VPN Technology (7.5.8) 308
ISP Connectivity Options (7.5.9) 309
Single-Homed 309
Dual-Homed 309
Multihomed 309
Dual-Multihomed 310
Broadband Solution Comparison (7.5.10) 311
Summary (7.6) 312
Purpose of WANs 312
WAN Operations 312
Traditional WAN Connectivity 313
Modern WAN Connectivity 314
Internet-Based Connectivity 314
Practice 315
Check Your Understanding Questions 316
xviii Enterprise Networking, Security, and Automation Companion Guide (CCNAv7)

Chapter 8 VPN and IPsec Concepts 319

Objectives 319
Key Terms 319
Introduction (8.0) 321
VPN Technology (8.1) 321
Virtual Private Networks (8.1.1) 321
VPN Benefits (8.1.2) 322
Site-to-Site and Remote-Access VPNs (8.1.3) 323
Site-to-Site VPN 323
Remote-Access VPN 324
Enterprise and Service Provider VPNs (8.1.4) 324
Types of VPNs (8.2) 325
Remote-Access VPNs (8.2.1) 325
SSL VPNs (8.2.2) 326
Site-to-Site IPsec VPNs (8.2.3) 327
GRE over IPsec (8.2.4) 328
Dynamic Multipoint VPNs (8.2.5) 330
IPsec Virtual Tunnel Interface (8.2.6) 331
Service Provider MPLS VPNs (8.2.7) 332
IPsec (8.3) 333
IPsec Technologies (8.3.2) 333
IPsec Protocol Encapsulation (8.3.3) 336
Confidentiality (8.3.4) 336
Integrity (8.3.5) 338
Authentication (8.3.6) 339
Secure Key Exchange with Diffie-Hellman (8.3.7) 342
Summary (8.4) 344
VPN Technology 344
Types of VPNs 344
IPsec 344
Practice 345
Check Your Understanding Questions 345

Chapter 9 QoS Concepts 351

Objectives 351
Key Terms 351
 xix

Introduction (9.0) 353

Network Transmission Quality (9.1) 353
Prioritizing Traffic (9.1.2) 353
Bandwidth, Congestion, Delay, and Jitter (9.1.3) 354
Packet Loss (9.1.4) 355
Traffic Characteristics (9.2) 357
Network Traffic Trends (9.2.2) 357
Voice (9.2.3) 358
Video (9.2.4) 358
Data (9.2.5) 360
Queuing Algorithms (9.3) 361
Queuing Overview (9.3.2) 361
First-In, First Out (9.3.3) 362
Weighted Fair Queuing (WFQ) (9.3.4) 362
Limitations of WFQ 363
Class-Based Weighted Fair Queuing (CBWFQ) (9.3.5) 364
Low Latency Queuing (LLQ) (9.3.6) 365
QoS Models (9.4) 366
Selecting an Appropriate QoS Policy Model (9.4.2) 366
Best Effort (9.4.3) 366
Integrated Services (9.4.4) 367
Differentiated Services (9.4.5) 369
QoS Implementation Techniques (9.5) 370
Avoiding Packet Loss (9.5.2) 371
QoS Tools (9.5.3) 371
Classification and Marking (9.5.4) 372
Marking at Layer 2 (9.5.5) 373
Marking at Layer 3 (9.5.6) 374
Type of Service and Traffic Class Field (9.5.7) 375
DSCP Values (9.5.8) 376
Class Selector Bits (9.5.9) 377
Trust Boundaries (9.5.10) 378
Congestion Avoidance (9.5.11) 379
Shaping and Policing (9.5.12) 380
QoS Policy Guidelines (9.5.13) 381
xx Enterprise Networking, Security, and Automation Companion Guide (CCNAv7)

Summary (9.6) 382

Network Transmission Quality 382
Traffic Characteristics 382
Queuing Algorithms 383
QoS Models 383
QoS Implementation Techniques 384
Practice 385
Check Your Understanding Questions 385

Chapter 10 Network Management 389

Objectives 389
Key Terms 389
Introduction (10.0) 390
Device Discovery with CDP (10.1) 390
CDP Overview (10.1.1) 390
Configure and Verify CDP (10.1.2) 391
Discover Devices by Using CDP (10.1.3) 393
Device Discovery with LLDP (10.2) 396
LLDP Overview (10.2.1) 396
Configure and Verify LLDP (10.2.2) 397
Discover Devices by Using LLDP (10.2.3) 397
NTP (10.3) 400
Time and Calendar Services (10.3.1) 400
NTP Operation (10.3.2) 401
Stratum 0 402
Stratum 1 402
Stratum 2 and Lower 402
Configure and Verify NTP (10.3.3) 402
SNMP 405
Introduction to SNMP (10.4.1) 405
SNMP Operation (10.4.2) 406
SNMP Agent Traps (10.4.3) 408
SNMP Versions (10.4.4) 409
Community Strings (10.4.6) 412
MIB Object ID (10.4.7) 415
SNMP Polling Scenario (10.4.8) 415
SNMP Object Navigator (10.4.9) 417
 xxi

Syslog (10.5) 418

Introduction to Syslog (10.5.1) 418
Syslog Operation (10.5.2) 420
Syslog Message Format (10.5.3) 421
Syslog Facilities (10.5.4) 422
Configure Syslog Timestamp (10.5.5) 422
Router and Switch File Maintenance (10.6) 423
Router File Systems (10.6.1) 424
The Flash File System 425
The NVRAM File System 425
Switch File Systems (10.6.2) 426
Use a Text File to Back Up a Configuration (10.6.3) 427
Use a Text File to Restore a Configuration (10.6.4) 428
Use TFTP to Back Up and Restore a Configuration (10.6.5) 428
USB Ports on a Cisco Router (10.6.6) 430
Use USB to Back Up and Restore a Configuration (10.6.7) 430
Restore Configurations with a USB Flash Drive 432
Password Recovery Procedures (10.6.8) 433
Password Recovery Example (10.6.9) 433
Step 1. Enter the ROMMON mode 433
Step 2. Change the configuration register 434
Step 3. Copy the startup-config to the running-config 434
Step 4. Change the password 435
Step 5. Save the running-config as the new
startup-config 435
Step 6. Reload the device 435
IOS Image Management 437
TFTP Servers as a Backup Location (10.7.2) 437
Backup IOS Image to TFTP Server Example (10.7.3) 438
Step 1. Ping the TFTP server 438
Step 2. Verify image size in flash 439
Step 3. Copy the image to the TFTP server 439
Copy an IOS Image to a Device Example (10.7.4) 439
Step 1. Ping the TFTP server 440
Step 2. Verify the amount of free flash 440
Step 3. Copy the new IOS image to flash 441
The boot system Command (10.7.5) 441
Summary (10.8) 443
Device Discovery with CDP 443
Device Discovery with LLDP 443
xxii Enterprise Networking, Security, and Automation Companion Guide (CCNAv7)

NTP 443
SNMP 444
Syslog 444
Router and Switch File Maintenance 445
IOS Image Management 446
Practice 446
Check Your Understanding Questions 447

Chapter 11 Network Design 453

Objectives 453
Key Terms 453
Introduction (11.0) 455
Hierarchical Networks (11.1) 455
The Need to Scale the Network (11.1.2) 455
Borderless Switched Networks (11.1.3) 458
Hierarchy in the Borderless Switched Network (11.1.4) 459
Three-Tier Model 460
Two-Tier Model 461
Access, Distribution, and Core Layer Functions (11.1.5) 462
Access Layer 462
Distribution Layer 462
Core Layer 462
Three-Tier and Two-Tier Examples (11.1.6) 462
Three-Tier Example 463
Two-Tier Example 464
Role of Switched Networks (11.1.7) 464
Scalable Networks (11.2) 465
Design for Scalability (11.2.1) 465
Redundant Links 466
Multiple Links 466
Scalable Routing Protocol 467
Wireless Connectivity 468
Plan for Redundancy (11.2.2) 469
Reduce Failure Domain Size (11.2.3) 470
Edge Router 470
AP1 471
S1 472
 xxiii

S2 472
S3 473
Limiting the Size of Failure Domains 474
Switch Block Deployment 474
Increase Bandwidth (11.2.4) 474
Expand the Access Layer (11.2.5) 475
Tune Routing Protocols (11.2.6) 476
Switch Hardware (11.3) 477
Switch Platforms (11.3.1) 477
Campus LAN Switches 477
Cloud-Managed Switches 478
Data Center Switches 478
Service Provider Switches 479
Virtual Networking 479
Switch Form Factors (11.3.2) 479
Fixed Configuration Switches 480
Modular Configuration Switches 480
Stackable Configuration Switches 481
Thickness 481
Port Density (11.3.3) 482
Forwarding Rates (11.3.4) 483
Power over Ethernet (11.3.5) 484
Switch 484
IP Phone 484
WAP 485
Cisco Catalyst 2960-C 485
Multilayer Switching (11.3.6) 485
Business Considerations for Switch Selection (11.3.7) 486
Router Hardware (11.4) 487
Router Requirements (11.4.1) 487
Cisco Routers (11.4.2) 488
Branch Routers 488
Network Edge Routers 488
Service Provider Routers 489
Industrial 490
Router Form Factors (11.4.3) 490
Cisco 900 Series 490
ASR 9000 and 1000 Series 490
5500 Series 491
Cisco 800 492
Fixed Configuration or Modular 492
xxiv Enterprise Networking, Security, and Automation Companion Guide (CCNAv7)

Summary (11.5) 493

Hierarchical Networks 493
Scalable Networks 493
Switch Hardware 494
Router Hardware 494
Practice 495
Check Your Understanding Questions 496

Chapter 12 Network Troubleshooting 501

Objectives 501
Key Terms 501
Introduction (12.0) 502
Network Documentation (12.1) 502
Documentation Overview (12.1.1) 502
Network Topology Diagrams (12.1.2) 503
Physical Topology 503
Logical IPv4 Topology 504
Logical IPv6 Topology 505
Network Device Documentation (12.1.3) 505
Router Device Documentation 505
LAN Switch Device Documentation 506
End-System Documentation Files 506
Establish a Network Baseline (12.1.4) 507
Step 1—Determine What Types of Data to Collect (12.1.5) 508
Step 2—Identify Devices and Ports of Interest (12.1.6) 508
Step 3—Determine the Baseline Duration (12.1.7) 509
Data Measurement (12.1.8) 510
Troubleshooting Process (12.2) 512
General Troubleshooting Procedures (12.2.1) 512
Seven-Step Troubleshooting Process (12.2.2) 513
Define the Problem 514
Gather Information 514
Analyze Information 514
Eliminate Possible Causes 514
Propose Hypothesis 514
Test Hypothesis 515
Solve the Problem 515
Question End Users (12.2.3) 515
 xxv

Gather Information (12.2.4) 516

Troubleshooting with Layered Models (12.2.5) 517
Structured Troubleshooting Methods (12.2.6) 518
Bottom-Up 518
Top-Down 519
Divide-and-Conquer 520
Follow-the-Path 521
Substitution 522
Comparison 522
Educated Guess 522
Guidelines for Selecting a Troubleshooting Method (12.2.7) 523
Troubleshooting Tools (12.3) 524
Software Troubleshooting Tools (12.3.1) 524
Network Management System Tools 524
Knowledge Bases 524
Baselining Tools 524
Protocol Analyzers (12.3.2) 525
Hardware Troubleshooting Tools (12.3.3) 525
Digital Multimeters 525
Cable Testers 526
Cable Analyzers 527
Portable Network Analyzers 528
Cisco Prime NAM 528
Syslog Server as a Troubleshooting Tool (12.3.4) 529
Symptoms and Causes of Network Problems (12.4) 531
Physical Layer Troubleshooting (12.4.1) 531
Data Link Layer Troubleshooting (12.4.2) 534
Network Layer Troubleshooting (12.4.3) 537
Transport Layer Troubleshooting—ACLs (12.4.4) 539
Transport Layer Troubleshooting—NAT for IPv4 (12.4.5) 542
Application Layer Troubleshooting (12.4.6) 543
Troubleshooting IP Connectivity (12.5) 545
Components of Troubleshooting End-to-End Connectivity
(12.5.1) 545
End-to-End Connectivity Problem Initiates Troubleshooting
(12.5.2) 547
IPv4 ping 547
IPv4 traceroute 548
IPv6 ping and traceroute 548
xxvi Enterprise Networking, Security, and Automation Companion Guide (CCNAv7)

Step 1—Verify the Physical Layer (12.5.3) 549

Input Queue Drops 550
Output Queue Drops 550
Input Errors 551
Output Errors 551
Step 2—Check for Duplex Mismatches (12.5.4) 551
Troubleshooting Example 552
Step 3—Verify Addressing on the Local Network (12.5.5) 553
Windows IPv4 ARP Table 553
Windows IPv6 Neighbor Table 554
IOS IPv6 Neighbor Table 555
Switch MAC Address Table 555
Troubleshoot VLAN Assignment Example (12.5.6) 556
Check the ARP Table 557
Check the Switch MAC Table 557
Correct the VLAN Assignment 557
Step 4—Verify Default Gateway (12.5.7) 558
Troubleshooting IPv4 Default Gateway Example 559
R1 Routing Table 559
PC1 Routing Table 559
Troubleshoot IPv6 Default Gateway Example (12.5.8) 560
R1 Routing Table 560
PC1 Addressing 560
Check R1 Interface Settings 561
Correct R1 IPv6 Routing 561
Verify PC1 Has an IPv6 Default Gateway 562
Step 5—Verify Correct Path (12.5.9) 562
Troubleshooting Example 566
Step 6—Verify the Transport Layer (12.5.10) 566
Troubleshooting Example 566
Step 7—Verify ACLs (12.5.11) 568
Troubleshooting Example 568
show ip access-lists 569
show ip interfaces 569
Correct the Issue 570
Step 8—Verify DNS (12.5.12) 570
Summary (12.6) 572
Network Documentation 572
Troubleshooting Process 572
Troubleshooting Tools 573
 xxvii

Symptoms and Causes of Network Problems 573

Troubleshooting IP Connectivity 574
Practice 577
Check Your Understanding Questions 577

Chapter 13 Network Virtualization 581

Objectives 581
Key Terms 581
Introduction (13.0) 583
Cloud Computing (13.1) 583
Cloud Overview (13.1.2) 583
Cloud Services (13.1.3) 584
Cloud Models (13.1.4) 584
Cloud Computing Versus Data Center (13.1.5) 585
Virtualization (13.2) 585
Cloud Computing and Virtualization (13.2.1) 585
Dedicated Servers (13.2.2) 586
Server Virtualization (13.2.3) 587
Advantages of Virtualization (13.2.4) 589
Abstraction Layers (13.2.5) 589
Type 2 Hypervisors (13.2.6) 591
Virtual Network Infrastructure (13.3) 592
Type 1 Hypervisors (13.3.1) 592
Installing a VM on a Hypervisor (13.3.2) 592
The Complexity of Network Virtualization (13.3.3) 594
Software-Defined Networking (13.4) 595
Control Plane and Data Plane (13.4.2) 595
Layer 3 Switch and CEF 596
SDN and Central Controller 597
Management Plane 598
Network Virtualization Technologies (13.4.3) 598
Traditional and SDN Architectures (13.4.4) 599
Controllers (13.5) 600
SDN Controller and Operations (13.5.1) 600
Core Components of ACI (13.5.3) 602
Spine-Leaf Topology (13.5.4) 603
xxviii Enterprise Networking, Security, and Automation Companion Guide (CCNAv7)

SDN Types (13.5.5) 604

Device-Based SDN 604
Controller-Based SDN 605
Policy-Based SDN 605
APIC-EM Features (13.5.6) 606
APIC-EM Path Trace (13.5.7) 606
Summary (13.6) 609
Cloud Computing 609
Virtualization 609
Virtual Network Infrastructure 610
Software-Defined Networking 610
Controllers 611
Practice 612
Check Your Understanding Questions 613

Chapter 14 Network Automation 617

Objectives 617
Key Terms 617
Introduction (14.0) 619
Automation Overview (14.1) 619
The Increase in Automation (14.1.2) 619
Thinking Devices (14.1.3) 620
Data Formats (14.2) 620
The Data Formats Concept (14.2.2) 620
Data Format Rules (14.2.3) 622
Compare Data Formats (14.2.4) 623
JSON Data Format (14.2.5) 624
JSON Syntax Rules (14.2.6) 624
YAML Data Format (14.2.7) 626
XML Data Format (14.2.8) 627
APIs (14.3) 628
The API Concept (14.3.2) 628
An API Example (14.3.3) 629
Open, Internal, and Partner APIs (14.3.4) 631
Types of Web Service APIs (14.3.5) 632
 xxix

REST (14.4) 633

REST and RESTful API (14.4.2) 633
RESTful Implementation (14.4.3) 634
URI, URN, and URL (14.4.4) 635
Anatomy of a RESTful Request (14.4.5) 636
RESTful API Applications (14.4.6) 638
Developer Website 638
Postman 638
Python 638
Network Operating Systems 638
Configuration Management Tools (14.5) 639
Traditional Network Configuration (14.5.2) 639
Network Automation (14.5.3) 641
Configuration Management Tools (14.5.4) 642
Compare Ansible, Chef, Puppet, and SaltStack (14.5.5) 642
IBN and Cisco DNA Center (14.6) 644
Intent-Based Networking Overview (14.6.2) 644
Network Infrastructure as Fabric (14.6.3) 644
Cisco Digital Network Architecture (DNA) (14.6.4) 647
Cisco DNA Center (14.6.5) 648
Summary (14.7) 651
Automation Overview 651
Data Formats 651
APIs 651
REST 651
Configuration and Management 652
IBN and Cisco DNA Center 652
Practice 652
Check Your Understanding Questions 653

Appendix A Answers to the “Check Your Understanding” Questions 657

Glossary 677

Index 715
xxx Enterprise Networking, Security, and Automation Companion Guide (CCNAv7)

Command Syntax Conventions

The conventions used to present command syntax in this book are the same conven-
tions used in the IOS Command Reference. The Command Reference describes these
conventions as follows:
■■ Boldface indicates commands and keywords that are entered literally as shown.
In actual configuration examples and output (not general command syntax),
boldface indicates commands that are manually input by the user (such as a show
command).
■■ Italic indicates arguments for which you supply actual values.
■■ Vertical bars (|) separate alternative, mutually exclusive elements.
■■ Square brackets ([ ]) indicate an optional element.
■■ Braces ({ }) indicate a required choice.
■■ Braces within brackets ([{ }]) indicate a required choice within an optional
element.
 xxxi

Introduction
Enterprise Networking, Security, and Automation Companion Guide (CCNAv7)
is the official supplemental textbook for the Cisco Network Academy CCNA Enter-
prise Networking, Security, and Automation version 7 course. Cisco Networking
Academy is a comprehensive program that delivers information technology skills to
students around the world. The curriculum emphasizes real-world practical applica-
tion and provides opportunities to gain the skills and hands-on experience needed to
design, install, operate, and maintain networks in small to medium-sized businesses
as well as enterprise and service provider environments.
This book provides a ready reference that explains the same networking concepts,
technologies, protocols, and devices as the online curriculum. This book emphasizes
key topics, terms, and activities and provides some alternative explanations and
examples to supplement the course. You can use the online curriculum as directed
by your instructor and then use this Companion Guide’s study tools to help solidify
your understanding of all the topics.

Who Should Read This Book

The book, like the course it accompanies, is designed as an introduction to data net-
work technology for those pursuing careers as network professionals as well as those
who need an introduction to network technology for professional growth. Topics are
presented concisely, starting with the most fundamental concepts and progressing
to a comprehensive understanding of network communication. The content of this
text provides the foundation for additional Cisco Networking Academy courses and
preparation for the CCNA certification.

Book Features
The educational features of this book focus on supporting topic coverage, readabil-
ity, and practice of the course material to facilitate your full understanding of the
course material.

Topic Coverage
The following list gives you a thorough overview of the features provided in each
chapter so that you can make constructive use of your study time:
■■ Objectives: Listed at the beginning of each chapter, the objectives reference the
core concepts covered in the chapter. The objectives match the objectives listed
in the corresponding chapters of the online curriculum; however, the question
xxxii Enterprise Networking, Security, and Automation Companion Guide (CCNAv7)

format in the Companion Guide encourages you to think about finding the
answers as you read the chapter.
■■ Notes: These are short sidebars that point out interesting facts, timesaving meth-
ods, and important safety issues.
■■ Summary: At the end of each chapter is a summary of the chapter’s key con-
cepts. It provides a synopsis of the chapter and serves as a study aid.
■■ Practice: At the end of each chapter is a full list of all the labs, class activities,
and Packet Tracer activities to refer to at study time.

Readability
The following features are provided to help you understand networking vocabulary:
■■ Key terms: Each chapter begins with a list of key terms, along with a page-num-
ber reference to find the term used inside the chapter. The terms are listed in the
order in which they are explained in the chapter. This handy reference allows you
to find a term, flip to the page where the term appears, and see the term used in
context. The Glossary defines all the key terms.
■■ Glossary: This book contains an all-new Glossary that defines more than 1000
terms.

Practice
Practice makes perfect. This Companion Guide offers you ample opportunities to
put what you learn into practice. You will find the following features valuable and
effective in reinforcing the instruction that you receive:
■■ Check Your Understanding questions and answer key: Review questions are
presented at the end of each chapter as a self-assessment tool. These questions
match the style of questions in the online course. Appendix A, “Answers to the
Check Your Understanding Questions,” provides an answer key to all the ques-
Interactive
tions and includes an explanation of each answer.
Graphic ■■ Labs and activities: Throughout each chapter, you are directed back to the
online course to take advantage of the activities provided to reinforce concepts.
Video In addition, at the end of each chapter is a “Practice” section that lists all the labs
and activities to provide practice with the topics introduced in this chapter.
■■ Page references to online course: After most headings is a number in parentheses—
for example, (1.1.2). This number refers to the page number in the online course
so that you can easily jump to that spot online to view a video, practice an activ-
ity, perform a lab, or review a topic.
 xxxiii

About Packet Tracer Software and Activities

Interspersed throughout the chapters, you’ll find a few Cisco Packet Tracer activities.
Packet Tracer allows you to create networks, visualize how packets flow in a network,
and use basic testing tools to determine whether a network would work. When you
see this icon, you can use Packet Tracer with the listed file to perform a task sug-
gested in this book. The activity files are available in the online course. Packet Tracer
software is available only through the Cisco Networking Academy website. Ask your
instructor for access to Packet Tracer.

How This Book Is Organized

This book corresponds closely to the Cisco Networking Academy Enterprise
Networking, Security, and Automation v7 course and is divided into 14 chapters, one
appendix, and a glossary of key terms:
■■ Chapter 1, “Single-Area OSPFv2 Concepts”: This chapter explains single-area
OSPF. It describes basic OSPF features and characteristics, packet types, and
single-area operation.
■■ Chapter 2, “Single-Area OSPFv2 Configuration”: This chapter explains how
to implement single-area OSPFv2 networks. It includes router ID configuration,
point-to-point configuration, DR/BDR election, single-area modification, default
route propagation, and verification of a single-area OSPFv2 configuration.
■■ Chapter 3, “Network Security Concepts”: This chapter explains how vulner-
abilities, threats, and exploits can be mitigated to enhance network security. It
includes descriptions of the current state of cybersecurity, tools used by threat
actors, malware types, common network attacks, IP vulnerabilities, TCP and UDP
vulnerabilities, network best practices, and cryptography.
■■ Chapter 4, “ACL Concepts”: This chapter explains how ACLs are used to filter
traffic, how wildcard masks are used, how to create ACLs, and the difference
between standard and extended IPv4 ACLs.
■■ Chapter 5, “ACLs for IPv4 Configuration”: The chapter explains how to imple-
ment ACLs. It includes standard IPv4 ACL configuration, ACL modifications
using sequence numbers, applying an ACL to vty lines, and extended IPv4 ACL
configuration.
■■ Chapter 6, “NAT for IPv4”: This chapter explains how to enable NAT services
on a router to provide IPv4 address scalability. It includes descriptions of the
purpose and function of NAT, the different types of NAT, and the advantages
and disadvantages of NAT. Configuration topics include static NAT, dynamic
NAT, and PAT. NAT64 is also briefly discussed.
xxxiv Enterprise Networking, Security, and Automation Companion Guide (CCNAv7)

■■ Chapter 7, “WAN Concepts”: This chapter explains how WAN access technolo-
gies can be used to satisfy business requirements. It includes descriptions of the
purpose of a WAN, how WANs operate, traditional WAN connectivity options,
modern WAN connectivity options, and internet-based connectivity options.
■■ Chapter 8, “VPN and IPsec Concepts”: This chapter explains how VPNs and
IPsec are used to secure communications. It includes descriptions of different
types of VPNs and an explanation of how the IPsec framework is used to secure
network traffic.
■■ Chapter 9, “QoS Concepts”: This chapter explains how network devices use
QoS to prioritize network traffic. It includes descriptions of network transmis-
sion characteristics, queuing algorithms, different queueing models, and QoS
implementation techniques.
■■ Chapter 10, “Network Management”: This chapter explains how to use a vari-
ety of protocols and techniques to manage a network, including CDP, LLDP,
NTP, SNMP, and Syslog. In addition, this chapter discusses the management of
configuration files and IOS images.
■■ Chapter 11, “Network Design”: This chapter explains the characteristics of
scalable networks. It includes descriptions of network convergence, consider-
ations for designing scalable networks, and switch and router hardware.
■■ Chapter 12, “Network Troubleshooting”: This chapter describes how to trou-
bleshoot networks. It includes explanations of network documentation, trouble-
shooting methods, and troubleshooting tools. The chapter also demonstrates
how to troubleshoot symptoms and causes of network problems using a layered
approach.
■■ Chapter 13, “Network Virtualization”: This chapter describes the purpose and
characteristics of network virtualization. It includes descriptions of cloud com-
puting, the importance of virtualization, network device virtualization, software-
defined network, and controllers used in network programming.
■■ Chapter 14, “Network Automation”: This chapter explains network automation.
It includes descriptions of automation, data formats, APIs, REST, configuration
management tools, and Cisco DNA Center.
■■ Appendix A, “Answers to the ‘Check Your Understanding’ Questions”: This
appendix lists the answers to the questions in the “Check Your Understanding
Questions” section at the end of each chapter.
■■ Glossary: The Glossary provides definitions for all the key terms identified in
each chapter.
 xxxv

Figure Credits
Figure 5-4, screenshot of Remote Access from PC1 © Tera Term Project
Figure 5-5, screenshot of Remote Access Attempt from PC2 © Tera Term Project
Figure 8-9, screenshot of Wireshark of Encapsulated Protocols © Wireshark
Figure 10-24, screenshot of Example of Using Tera Term to Backup a
Configuration © Tera Term Project
Figure 10-25, screenshot of Example of Using Tera Term to Send a
Configuration © Tera Term Project
Figure 12-16, screenshot of Wireshark Capture © Wireshark
Figure 13-1, screenshot of AWS Management Console © 2020, Amazon Web
Services, Inc
Figure 14-1, screenshot of HTML Example and Resulting Web Page © WHATWG
This page intentionally left blank
 CHAPTER 4

ACL Concepts

Objectives
Upon completion of this chapter, you will be able to answer the following questions:
■■ How do ACLs filter traffic? ■■ What are the differences between standard
and extended IPv4 ACLs?
■■ How do ACLs use wildcard masks?
■■ How do you create ACLs?

Key Terms
This chapter uses the following key terms. You can find the definitions in the Glossary.

access control entry (ACE) page 164 numbered ACL page 175
inbound ACL page 167 standard ACL page 175
outbound ACL page 167 extended ACL page 175
implicit deny page 167 named ACL page 176
wildcard mask page 168
164   Enterprise Networking, Security, and Automation Companion Guide (CCNAv7)

Introduction (4.0)
Say that you have arrived at your grandparents’ residence. It is a beautiful gated
community with walking paths and gardens. For the safety of the residents, no one is
permitted to get into the community without stopping at the gate and presenting the
guard with identification. You provide your ID, and the guard verifies that you are
expected as a visitor. He documents your information and lifts the gate. Imagine if
the guard had to do this for the many staff members who entered each day. The secu-
rity department has simplified this process by assigning a badge to each employee
that can be scanned to automatically raise the gate. You greet your grandparents,
who are anxiously awaiting you at the front desk. You all get back into the car to go
down the street for dinner. As you exit the parking lot, you must again stop and show
your identification so that the guard will lift the gate. Rules have been put in place
for all incoming and outgoing traffic.
Much like the guard in the gated community, an access control list (ACL) may be
configured to permit and deny network traffic passing through an interface. The
router compares the information within a packet against each access control entry
(ACE), in sequential order, to determine if the packet matches one of the ACEs. This
process is called packet filtering. Let’s learn more!

Purpose of ACLs (4.1)

This section describes how ACLs filter traffic in small- to medium-sized business
networks.

What Is an ACL? (4.1.1)

Routers make routing decisions based on information in each packet’s header.
Traffic entering a router interface is routed solely based on information in the routing
table. The router compares the destination IP address with routes in the routing table
to find the best match and then forwards a packet based on the best match route.
A similar process can be used to filter traffic using an access control list (ACL).
An ACL is a series of IOS commands that are used to filter packets based on infor-
mation found in the packet header. By default, a router does not have any ACLs
configured. However, when an ACL is applied to an interface, the router performs the
additional task of evaluating all network packets as they pass through the interface to
determine if each packet can be forwarded.
An ACL uses a sequential list of permit or deny statements known as access control
entries (ACEs).
 Chapter 4: ACL Concepts   165

Note
ACEs are also commonly called ACL statements.
When network traffic passes through an interface configured with an ACL, the router com-
pares the information within the packet against each ACE, in sequential order, to determine
whether the packet matches one of the ACEs. This process is called packet filtering.

Several tasks performed by routers require the use of ACLs to identify traffic.
Table 4-1 lists some of these tasks and provides examples.

Table 4-1 Tasks That Use ACLs

Task Example

Limit network ■■ A corporate policy prohibits video traffic on the network to

traffic to increase reduce the network load.
network performance
■■ A policy can be enforced using ACLs to block video traffic.

Provide traffic flow ■■ A corporate policy requires that routing protocol traffic be limited
control to certain links only.
■■ A policy can be implemented using ACLs to restrict the delivery of
routing updates to only those that come from a known source.

Provide a basic ■■ Corporate policy demands that access to the human resources
level of security for network be restricted to authorized users only.
network access
■■ A policy can be enforced using ACLs to limit access to specified
networks.

Filter traffic based ■■ Corporate policy requires that email traffic be permitted into a
on traffic type network but that Telnet access be denied.
■■ A policy can be implemented using ACLs to filter traffic by type.

Screen hosts to ■■ Corporate policy requires that access to some file types (such as
permit or deny FTP or HTTP) be limited to user groups.
access to network
■■ A policy can be implemented using ACLs to filter user access to
services
services.

Provide priority to ■■ Corporate traffic specifies that voice traffic be forwarded as fast as
certain classes of possible to avoid any interruption.
network traffic
■■ A policy can be implemented using ACLs and QoS to identify
voice traffic and process it immediately.

Packet Filtering (4.1.2)

Packet filtering controls access to a network by analyzing the incoming and/or
outgoing packets and forwarding them or discarding them based on given criteria.
Packet filtering can occur at Layer 3 or Layer 4, as shown in Figure 4-1.
166   Enterprise Networking, Security, and Automation Companion Guide (CCNAv7)

Figure 4-1 Packet Filtering in the OSI Model

Cisco routers support two types of ACLs:

■■ Standard ACLs: These ACLs only filter at Layer 3, using the source IPv4 address
only.
■■ Extended ACLs: These ACLs filter at Layer 3 using the source and/or destina-
tion IPv4 address. They can also filter at Layer 4 using TCP, UDP ports, and
optional protocol type information for finer control.

ACL Operation (4.1.3)

An ACL defines a set of rules that give added control for packets that enter inbound
interfaces, packets relayed through the router, and packets that exit outbound
interfaces of the router.
ACLs can be configured to apply to inbound traffic and outbound traffic, as shown
in Figure 4-2.

Figure 4-2 ACLs on Inbound and Outbound Interfaces

 Chapter 4: ACL Concepts   167

Note
ACLs do not act on packets that originate from the router itself.

An inbound ACL filters packets before they are routed to the outbound interface.
An inbound ACL is efficient because it saves the overhead of routing lookups if the
packet is discarded. If a packet is permitted by the ACL, it is processed for routing.
Inbound ACLs are best used to filter packets when the network attached to an
inbound interface is the only source of packets that need to be examined.
An outbound ACL filters packets after they are routed, regardless of the inbound
interface. Incoming packets are routed to the outbound interface, and they are then
processed through the outbound ACL. Outbound ACLs are best used when the same
filter will be applied to packets coming from multiple inbound interfaces before
exiting the same outbound interface.
When an ACL is applied to an interface, it follows a specific operating procedure.
For example, here are the operational steps used when traffic has entered a router
interface with an inbound standard IPv4 ACL configured:
Step 1. The router extracts the source IPv4 address from the packet header.
Step 2. The router starts at the top of the ACL and compares the source IPv4
address to each ACE, in sequential order.
Step 3. When a match is made, the router carries out the instruction, either permit-
ting or denying the packet, and the remaining ACEs in the ACL, if any, are
not analyzed.
Step 4. If the source IPv4 address does not match any ACEs in the ACL, the packet
is discarded because there is an implicit deny ACE automatically applied
to all ACLs.

The last ACE statement of an ACL is always an implicit deny that blocks all traffic.
By default, this statement is automatically implied at the end of an ACL even though
it is hidden and not displayed in the configuration.

Note
An ACL must have at least one permit statement; otherwise, all traffic will be denied due to
the implicit deny ACE statement.

Packet Tracer—ACL Demonstration (4.1.4)

Packet Tracer
Activity In this activity, you will observe how an ACL can be used to prevent a ping from
reaching hosts on remote networks. After removing the ACL from the configuration,
the pings will be successful.
168   Enterprise Networking, Security, and Automation Companion Guide (CCNAv7)

Check Your Understanding—Purpose of ACLs (4.1.5)

Interactive
Graphic Refer to the online course to complete this activity.

Wildcard Masks in ACLs (4.2)

A wildcard mask is similar to a subnet mask but the reverse. In this section, you will
learn how to calculate the inverse wildcard mask.

Wildcard Mask Overview (4.2.1)

In the previous section, you learned about the purpose of ACL. This section explains
how ACLs use wildcard masks. An IPv4 ACE uses a 32-bit wildcard mask to deter-
mine which bits of the address to examine for a match. Wildcard masks are also used
by the Open Shortest Path First (OSPF) routing protocol.
A wildcard mask is similar to a subnet mask in that it uses the ANDing process to
identify which bits in an IPv4 address to match. However, a wildcard mask and a sub-
net mask differ in the way they match binary 1s and 0s. Unlike with a subnet mask,
in which binary 1 is equal to a match, and binary 0 is not a match, with a wildcard
mask, the reverse is true.
Wildcard masks use the following rules to match binary 1s and 0s:
■■ Wildcard mask bit 0: Match the corresponding bit value in the address.
■■ Wildcard mask bit 1: Ignore the corresponding bit value in the address.

Table 4-2 lists some examples of wildcard masks and what they would match and
ignore.

Table 4-2 Examples of Wildcard Masks

Wildcard Last Octet Meaning (0—match, 1—ignore)

Mask (in Binary)

0.0.0.0 00000000 ■■ Match all octets.

0.0.0.63 00111111 ■■ Match the first three octets

■■ Match the 2 leftmost bits of the last octet
■■ Ignore the last 6 bits

0.0.0.15 00001111 ■■ Match the first three octets

■■ Match the 4 leftmost bits of the last octet
■■ Ignore the last 4 bits of the last octet
 Chapter 4: ACL Concepts   169

Wildcard Last Octet Meaning (0—match, 1—ignore)

Mask (in Binary)

0.0.0.248 11111100 ■■ Match the first three octets

■■ Ignore the 6 leftmost bits of the last octet
■■ Match the last 2 bits

0.0.0.255 11111111 ■■ Match the first three octets

■■ Ignore the last octet

Wildcard Mask Types (4.2.2)

Using wildcard masks takes some practice. The following sections provide examples
to help you learn how wildcard masks are used to filter traffic for one host, one
subnet, and a range IPv4 addresses.

Wildcard to Match a Host

In this example, the wildcard mask is used to match a specific host IPv4 address. Say
that ACL 10 needs an ACE that only permits the host with IPv4 address 192.168.1.1.
Recall that 0 equals a match, and 1 equals ignore. To match a specific host IPv4
address, a wildcard mask consisting of all zeros (that is, 0.0.0.0) is required.
Table 4-3 lists, in decimal and binary, the host IPv4 address, the wildcard mask, and
the permitted IPv4 address.

Table 4-3 Wildcard to Match a Host Example

Decimal Binary

IPv4 address 192.168.1.1 11000000.10101000.00000001.00000001

Wildcard mask 0.0.0.0 00000000.00000000.00000000.00000000

Permitted IPv4 address 192.168.1.1 11000000.10101000.00000001.00000001

The 0.0.0.0 wildcard mask stipulates that every bit must match exactly. Therefore,
when the ACE is processed, the wildcard mask will permit only the 192.168.1.1
address. The resulting ACE in ACL 10 would be access-list 10 permit 192.168.1.1
0.0.0.0.

Wildcard Mask to Match an IPv4 Subnet

In this example, ACL 10 needs an ACE that permits all hosts in the 192.168.1.0/24
network. The wildcard mask 0.0.0.255 stipulates that the very first three octets must
match exactly, but the fourth octet does not need to match.
170   Enterprise Networking, Security, and Automation Companion Guide (CCNAv7)

Table 4-4 lists, in decimal and binary, the host IPv4 address, the wildcard mask, and
the permitted IPv4 addresses.

Table 4-4 Wildcard Mask to Match an IPv4 Subnet Example

Decimal Binary

IPv4 address 192.168.1.1 11000000.10101000.00000001.00000001

Wildcard mask 0.0.0.255 00000000.00000000.00000000.11111111

Permitted IPv4 address 192.168.1.0/24 11000000.10101000.00000001.00000000

When the ACE is processed, the wildcard mask 0.0.0.255 permits all hosts in
the 192.168.1.0/24 network. The resulting ACE in ACL 10 would be access-list
10 permit 192.168.1.0 0.0.0.255.

Wildcard Mask to Match an IPv4 Address Range

In this example, ACL 10 needs an ACE that permits all hosts in the 192.168.16.0/24,
192.168.17.0/24, …, 192.168.31.0/24 networks. The wildcard mask 0.0.15.255 would
correctly filter that range of addresses.
Table 4-5 lists, in decimal and binary the host IPv4 address, the wildcard mask, and
the permitted IPv4 addresses.

Table 4-5 Wildcard Mask to Match an IPv4 Address Range Example

Decimal Binary

IPv4 address 192.168.16.0 11000000.10101000.00010000.00000000

Wildcard mask 0.0.15.255 00000000.00000000.00001111.11111111

Permitted IPv4 192.168.16.0/24 to 11000000.10101000.00010000.00000000

address 192.168.31.0/24 11000000.10101000.00011111.00000000

The highlighted wildcard mask bits identify which bits of the IPv4 address must
match. When the ACE is processed, the wildcard mask 0.0.15.255 permits all hosts
in the 192.168.16.0/24 to 192.168.31.0/24 networks. The resulting ACE in ACL 10
would be access-list 10 permit 192.168.16.0 0.0.15.255.

Wildcard Mask Calculation (4.2.3)

Calculating wildcard masks can be challenging. One shortcut method is to subtract
the subnet mask from 255.255.255.255. The following sections provide examples to
help you learn how to calculate the wildcard mask using the subnet mask.
 Chapter 4: ACL Concepts   171

Example 1
Say that you wanted an ACE in ACL 10 to permit access to all users in the
192.168.3.0/24 network. To calculate the wildcard mask, subtract the subnet mask
(that is, 255.255.255.0) from 255.255.255.255, as shown in Table 4-6.
The solution produces the wildcard mask 0.0.0.255. Therefore, the ACE would be
access-list 10 permit 192.168.3.0 0.0.0.255.

Table 4-6 Wildcard Mask Calculation—Example 1

Starting value 255.255.255.255

Subtract the subnet mask –255.255.255. 0

Resulting wildcard mask      0. 0. 0.255

Example 2
In this example, say that you wanted an ACE in ACL 10 to permit network access
for the 14 users in the subnet 192.168.3.32/28. Subtract the subnet (that is,
255.255.255.240) from 255.255.255.255, as shown in Table 4-7.
This solution produces the wildcard mask 0.0.0.15. Therefore, the ACE would be
access-list 10 permit 192.168.3.32 0.0.0.15.

Table 4-7 Wildcard Mask Calculation—Example 2

Starting value 255.255.255.255

Subtract the subnet mask –255.255.255.240

Resulting wildcard mask       0. 0. 0. 15

Example 3
In this example, say that you needed an ACE in ACL 10 to permit only net-
works 192.168.10.0 and 192.168.11.0. These two networks could be summarized
as 192.168.10.0/23, which is a subnet mask of 255.255.254.0. Again, you subtract
255.255.254.0 subnet mask from 255.255.255.255, as shown in Table 4-8.
This solution produces the wildcard mask 0.0.1.255. Therefore, the ACE would be
access-list 10 permit 192.168.10.0 0.0.1.255.

Table 4-8 Wildcard Mask Calculation—Example 3

Starting value 255.255.255.255

Subtract the subnet mask –255.255.254. 0

Resulting wildcard mask       0. 0. 1.255

172   Enterprise Networking, Security, and Automation Companion Guide (CCNAv7)

Example 4
Consider an example in which you need an ACL number 10 to match networks in the
range 192.168.16.0/24 to 192.168.31.0/24. This network range could be summarized
as 192.168.16.0/20, which is a subnet mask of 255.255.240.0. Therefore, subtract
255.255.240.0 subnet mask from 255.255.255.255, as shown in Table 4-9.
This solution produces the wildcard mask 0.0.15.255. Therefore, the ACE would be
access-list 10 permit 192.168.16.0 0.0.15.255.

Table 4-9 Wildcard Mask Calculation—Example 4

Starting value 255.255.255.255

Subtract the subnet mask – 255.255.240. 0

Resulting wildcard mask        0. 0. 15.255

Wildcard Mask Keywords (4.2.4)

Working with decimal representations of binary wildcard mask bits can be tedious.
To simplify this task, Cisco IOS provides two keywords to identify the most common
uses of wildcard masking. Keywords reduce ACL keystrokes and make it easier to
read an ACE.
The two keywords are
■■ host: This keyword substitutes for the 0.0.0.0 mask and indicates that all IPv4
address bits must match to filter just one host address.
■■ any: This keyword substitutes for the 255.255.255.255 mask and indicates to
ignore the entire IPv4 address or to accept any addresses.

In the command output in Example 4-1, two ACLs are configured. The ACL 10 ACE
permits only the 192.168.10.10 host, and the ACL 11 ACE permits all hosts.

Example 4-1 ACLs Configured Without Keywords

R1(config)# access-list 10 permit 192.168.10.10 0.0.0.0

R1(config)# access-list 11 permit 0.0.0.0 255.255.255.255
R1(config)#

Alternatively, the keywords host and any could be used to replace the highlighted
output. The commands in Example 4-2 accomplishes the same task as the commands
in Example 4-1.
 Chapter 4: ACL Concepts   173

Example 4-2 ACLs Configured Using Keywords

R1(config)# access-list 10 permit host 192.168.10.10

R1(config)# access-list 11 permit any
R1(config)#

Check Your Understanding—Wildcard Masks in ACLs (4.2.5)

Interactive
Graphic Refer to the online course to complete this activity.

Guidelines for ACL Creation (4.3)

This section provides guidelines for creating ACLs.

Limited Number of ACLs per Interface (4.3.1)

In a previous section, you learned about how wildcard masks are used in ACLs. This
section discusses guidelines for ACL creation. There is a limit on the number of ACLs
that can be applied on a router interface. For example, a dual-stacked (that is, IPv4
and IPv6) router interface can have up to four ACLs applied, as shown in Figure 4-3.

Figure 4-3 ACLs Limited on Interfaces

174   Enterprise Networking, Security, and Automation Companion Guide (CCNAv7)

Specifically, a dual-stacked router interface can have

■■ One outbound IPv4 ACL
■■ One inbound IPv4 ACL
■■ One inbound IPv6 ACL
■■ One outbound IPv6 ACL

Say that R1 has two dual-stacked interfaces that need to have inbound and outbound
IPv4 and IPv6 ACLs applied. As shown in Figure 4-4, R1 could have up to 8 ACLs
configured and applied to interfaces.

Figure 4-4 ACLs Limit Example

In this case, each interface would have four ACLs: two ACLs for IPv4 and two ACLs
for IPv6. For each protocol, one ACL is for inbound traffic and one for outbound
traffic.

Note
ACLs do not have to be configured in both directions. The number of ACLs and their direc-
tion applied to the interface will depend on the security policy of the organization.

ACL Best Practices (4.3.2)

Using ACLs requires attention to detail and great care. Mistakes can be costly in
terms of downtime, troubleshooting efforts, and network service. Basic planning is
required before configuring an ACL.
Table 4-10 presents some ACL best practices.
 Chapter 4: ACL Concepts   175

Table 4-10 Guidelines for ACLs

Guideline Benefit

Base ACLs on the organization’s security This will ensure that you implement
policies. organizational security guidelines.

Write out what you want an ACL to do. This will help you avoid inadvertently creating
potential access problems.

Use a text editor to create, edit, and save This will help you create a library of reusable
all your ACLs. ACLs.

Document ACLs by using the remark This will help you (and others) understand the
command. purpose of an ACE.

Test ACLs on a development network before This will help you avoid costly errors.
implementing them on a production network.

Check Your Understanding—Guidelines for ACL Creation (4.3.3)

Interactive
Graphic Refer to the online course to complete this activity.

Types of IPv4 ACLs (4.4)

This section compares IPv4 standard and extended ACLs.

Standard and Extended ACLs (4.4.1)

The previous sections describe the purpose of ACLs as well as guidelines for ACL
creation. This section covers standard and extended ACLs and named and numbered
ACLs, and it provides examples of placement of these ACLs.
There are two types of IPv4 ACLs:
■■ Standard ACLs: These ACLs permit or deny packets based only on the source
IPv4 address.
■■ Extended ACLs: These ACLs permit or deny packets based on the source IPv4
address and destination IPv4 address, protocol type, source and destination TCP
or UDP ports, and more.

For example, Example 4-3 shows how to create a standard ACL. In this example,
ACL 10 permits hosts on the source network 192.168.10.0/24. Because of the implied
“deny any” at the end, all traffic except for traffic coming from the 192.168.10.0/24
network is blocked with this ACL.
176   Enterprise Networking, Security, and Automation Companion Guide (CCNAv7)

Example 4-3 Standard ACL Example

R1(config)# access-list 10 permit 192.168.10.0 0.0.0.255

R1(config)#

In Example 4-4, the extended ACL 100 permits traffic originating from any host
on the 192.168.10.0/24 network to any IPv4 network if the destination host port is
80 (HTTP).

Example 4-4 Extended ACL Example

R1(config)# access-list 100 permit tcp 192.168.10.0 0.0.0.255 any eq www

R1(config)#

Notice that the standard ACL 10 is only capable of filtering by source address, while
the extended ACL 100 is filtering on the source and destination Layer 3 and Layer 4
protocol (for example, TCP) information.

Note
Full IPv4 ACL configuration is discussed in Chapter 5, “ACLs for IPv4 Configuration.”

Numbered and Named ACLs (4.4.2)

For IPv4, there are both numbered and named ACLs.

Numbered ACLs
ACLs 1 to 99 and 1300 to 1999 are standard ACLs, while ACLs 100 to 199 and 2000
to 2699 are extended ACLs, as shown in Example 4-5.

Example 4-5 Available ACL Numbers

R1(config)# access-list ?
<1-99> IP standard access list
<100-199> IP extended access list
<1100-1199>    Extended 48-bit MAC address access list
<1300-1999>    IP standard access list (expanded range)
<200-299>   Protocol type-code access list
<2000-2699>    IP extended access list (expanded range)
<700-799>    48-bit MAC address access list
rate-limit     Simple rate-limit specific access list
template   Enable IP template acls
Router(config)# access-list
 Chapter 4: ACL Concepts   177

Named ACLs
Using named ACLs is the preferred method when configuring ACLs. You can name
standard and extended ACLs to provide information about the purpose of each ACL.
For example, the extended ACL name FTP-FILTER is far easier to identify than the
ACL number 100.
The ip access-list global configuration command is used to create a named ACL, as
shown in Example 4-6.

Note
Numbered ACLs are created using the access-list global configuration command.

Example 4-6 Example of a Named ACL

R1(config)# ip access-list extended FTP-FILTER

R1(config-ext-nacl)# permit tcp 192.168.10.0 0.0.0.255 any eq ftp
R1(config-ext-nacl)# permit tcp 192.168.10.0 0.0.0.255 any eq ftp-data
R1(config-ext-nacl)#

The following are the general rules to follow for named ACLs:
■■ Assign a name to identify the purpose of the ACL.
■■ Names can contain alphanumeric characters.
■■ Names cannot contain spaces or punctuation.
■■ It is suggested that a name be written in CAPITAL LETTERS.
■■ Entries can be added or deleted within an ACL.

Where to Place ACLs (4.4.3)

Every ACL should be placed where it has the greatest impact on efficiency.
Figure 4-5 illustrates where standard and extended ACLs should be located in an
enterprise network.
Say that the objective is to prevent traffic originating in the 192.168.10.0/24 net-
work from reaching the 192.168.30.0/24 network. Extended ACLs should be located
as close as possible to the source of the traffic to be filtered. This way, undesir-
able traffic is denied close to the source network, without crossing the network
infrastructure.
178   Enterprise Networking, Security, and Automation Companion Guide (CCNAv7)

Figure 4-5 Example of Where to Place ACLs

Standard ACLs should be located as close to the destination as possible. If a standard

ACL were placed at the source of the traffic, the “permit” or “deny” would occur
based on the given source address, regardless of the traffic destination.
Placement of an ACL and, therefore, the type of ACL used, may also depend on a
variety of factors, as listed in Table 4-11.

Table 4-11 ACL Placement Factors

Factors Influencing Explanation

ACL Placement

The extent of ■■ Placement of the ACL can depend on whether the organiza-
organizational control tion has control of both the source and destination networks.

Bandwidth of the ■■ It may be desirable to filter unwanted traffic at the source to

networks involved prevent transmission of bandwidth-consuming traffic.

Ease of configuration ■■ It may be easier to implement an ACL at the destination, but

traffic will use bandwidth unnecessarily.
■■ An extended ACL could be used on each router where the
traffic originated. This would save bandwidth by filtering the
traffic at the source, but it would require creation of extended
ACLs on multiple routers.
 Chapter 4: ACL Concepts   179

Standard ACL Placement Example (4.4.4)

Following the guidelines for ACL placement, standard ACLs should be located as
close to the destination as possible.
In Figure 4-6, the administrator wants to prevent traffic originating in the
192.168.10.0/24 network from reaching the 192.168.30.0/24 network.

Figure 4-6 Standard ACL Example Topology

Following the basic placement guidelines, the administrator would place a standard
ACL on router R3. There are two possible interfaces on R3 to which to apply the
standard ACL:
■■ R3 S0/1/1 interface (inbound):The standard ACL can be applied inbound on the
R3 S0/1/1 interface to deny traffic from the .10 network. However, it would also
filter .10 traffic to the 192.168.31.0/24 (.31 in this example) network. Therefore,
the standard ACL should not be applied to this interface.
■■ R3 G0/0 interface (outbound):The standard ACL can be applied outbound on
the R3 G0/0/0 interface. This will not affect other networks that are reachable by
R3. Packets from the .10 network will still be able to reach the .31 network. This
is the best interface to place the standard ACL to meet the traffic requirements.
180   Enterprise Networking, Security, and Automation Companion Guide (CCNAv7)

Extended ACL Placement Example (4.4.5)

Extended ACLs should be located as close to the source as possible to prevent
unwanted traffic from being sent across multiple networks only to be denied when it
reaches its destination.
However, an organization can only place ACLs on devices that it controls. Therefore,
the extended ACL placement must be determined in the context of where organiza-
tional control extends.
In Figure 4-7, for example, Company A wants to deny Telnet and FTP traffic to
Company B’s 192.168.30.0/24 network from its 192.168.11.0/24 network while per-
mitting all other traffic.

Figure 4-7 Extended ACL Example Topology

There are several ways to accomplish these goals. An extended ACL on R3 would
accomplish the task, but the administrator does not control R3. In addition, this
solution would allow unwanted traffic to cross the entire network, only to be
blocked at the destination, which would affect overall network efficiency.
 Chapter 4: ACL Concepts   181

The solution is to place on R1 an extended ACL that specifies both source and desti-
nation addresses. There are two possible interfaces on R1 to apply the extended ACL:
■■ R1 S0/1/0 interface (outbound): The extended ACL can be applied outbound
on the S0/1/0 interface. However, this solution would process all packets leaving
R1, including packets from 192.168.10.0/24.
■■ R1 G0/0/1 interface (inbound): The extended ACL can be applied inbound on
the G0/0/1, and only packets from the 192.168.11.0/24 network are subject to
ACL processing on R1. Because the filter is to be limited to only those packets
leaving the 192.168.11.0/24 network, applying the extended ACL to G0/1 is the
best solution.

Check Your Understanding—Guidelines for ACL Placement (4.4.6)

Interactive
Graphic Refer to the online course to complete this activity.
182   Enterprise Networking, Security, and Automation Companion Guide (CCNAv7)

Summary (4.5)
The following is a summary of the sections in this chapter.

Purpose of ACLs
Several tasks performed by routers require the use of ACLs to identify traffic. An
ACL is a series of IOS commands that are used to filter packets based on information
found in the packet header. A router does not have any ACLs configured by default.
However, when an ACL is applied to an interface, the router performs the additional
task of evaluating all network packets as they pass through the interface to determine
whether the packets can be forwarded. An ACL uses a sequential list of permit or
deny statements, known as ACEs. Cisco routers support two types of ACLs: standard
ACLs and extended ACLs. An inbound ACL filters packets before they are routed
to the outbound interface. If a packet is permitted by the ACL, it is then processed
for routing. An outbound ACL filters packets after being routed, regardless of the
inbound interface. When an ACL is applied to an interface, it follows a specific
operating procedure:
Step 1. The router extracts the source IPv4 address from the packet header.
Step 2. The router starts at the top of the ACL and compares the source IPv4
address to each ACE, in sequential order.
Step 3. When a match is made, the router carries out the instruction, either permit-
ting or denying the packet, and the remaining ACEs in the ACL, if any, are
not analyzed.
Step 4. If the source IPv4 address does not match any ACEs in the ACL, the packet
is discarded because there is an implicit deny ACE automatically applied to
all ACLs.

Wildcard Masks
An IPv4 ACE uses a 32-bit wildcard mask to determine which bits of the address to
examine for a match. Wildcard masks are also used by the Open Shortest Path First
(OSPF) routing protocol. A wildcard mask is similar to a subnet mask in that it uses
the ANDing process to identify which bits in an IPv4 address to match. However, a
wildcard mask and a subnet mask differ in the way they match binary 1s and 0s.
Wildcard mask bit 0 matches the corresponding bit value in the address. Wildcard
mask bit 1 ignores the corresponding bit value in the address. A wildcard mask
is used to filter traffic for one host, one subnet, and a range of IPv4 addresses.
A shortcut for calculating a wildcard mask is to subtract the subnet mask from
255.255.255.255. Working with decimal representations of binary wildcard mask bits
 Chapter 4: ACL Concepts   183

can be simplified by using the Cisco IOS keywords host and any to identify the most
common uses of wildcard masking. Keywords reduce ACL keystrokes and make it
easier to read ACEs.

Guidelines for ACL Creation

There is a limit on the number of ACLs that can be applied on a router interface. For
example, a dual-stacked (that is, IPv4 and IPv6) router interface can have up to four
ACLs applied. Specifically, a router interface can have one outbound IPv4 ACL, one
inbound IPv4 ACL, one inbound IPv6 ACL, and one outbound IPv6 ACL. ACLs do
not have to be configured in both directions. The number of ACLs and the direc-
tion in which they are applied to the interface depend on the security policy of the
organization. Basic planning is required before configuring an ACL and includes the
following best practices:
■■ Base ACLs on the organization’s security policies.
■■ Write out what you want the ACL to do.
■■ Use a text editor to create, edit, and save all of your ACLs.
■■ Document ACLs by using the remark command.
■■ Test the ACLs on a development network before implementing them on a
production network.

Types of IPv4 ACLs

There are two types of IPv4 ACLs: standard ACLs and extended ACLs. Standard
ACLs permit or deny packets based only on the source IPv4 address. Extended
ACLs permit or deny packets based on the source IPv4 address and destination IPv4
address, protocol type, source and destination TCP or UDP ports, and more. ACLs 1
to 99 and 1300 to 1999 are standard ACLs. ACLs 100 to 199 and 2000 to 2699 are
extended ACLs. Using named ACLs is the preferred method when configuring ACLs.
Standard and extended ACLs can be named to provide information about the pur-
pose of each ACL.
The following are basic rules to follow for named ACLs:
■■ Assign a name to identify the purpose of an ACL.
■■ Names can contain alphanumeric characters.
■■ Names cannot contain spaces or punctuation.
■■ It is suggested that the name be written in CAPITAL LETTERS.
■■ Entries can be added or deleted within an ACL.
184   Enterprise Networking, Security, and Automation Companion Guide (CCNAv7)

Every ACL should be placed where it has the greatest impact on efficiency. Extended
ACLs should be located as close as possible to the source of the traffic to be filtered.
This way, undesirable traffic is denied close to the source network without crossing
the network infrastructure. Standard ACLs should be located as close to the des-
tination as possible. If a standard ACL were placed at the source of the traffic, the
“permit” or “deny” would occur based on the given source address, regardless of the
traffic destination. Placement of the ACL may depend on the extent of organizational
control, bandwidth of the networks, and ease of configuration.

Practice
The following Packet Tracer activity provides practice with the topics introduced in
this chapter. The instructions are available in the companion Enterprise Networking,
Security, and Automation Labs & Study Guide (CCNAv7) (ISBN 9780136634690).
There are no labs for this chapter.

Packet Tracer Activity

Packet Tracer
Activity Packet Tracer 4.1.4: ACL Demonstration

Check Your Understanding Questions

Complete all the review questions listed here to test your understanding of the topics
and concepts in this chapter. The appendix “Answers to the ‘Check Your Understand-
ing’ Questions” lists the answers.
1. What two functions describe uses of access control lists? (Choose two.)

A. ACLs assist a router in determining the best path to a destination.

B. ACLs can control which areas a host can access on a network.
C. ACLs provide a basic level of security for network access.
D. Standard ACLs can filter traffic based on source and destination network
addresses.
E. Standard ACLs can restrict access to specific applications and ports.

2. Which three statements describe how an ACL processes packets? (Choose three.)

A. A packet is compared with all ACEs in the ACL before a forwarding decision
is made.
B. A packet that has been denied by one ACE can be permitted by a subsequent
ACE.
 Chapter 4: ACL Concepts   185

C. An implicit deny at the end of an ACL rejects any packet that does not match
an ACE.
D. Each ACE is checked only until a match is detected or until the end of the
ACL.
E. If an ACE is matched, the packet is either rejected or forwarded, as directed
by the ACE.
F. If an ACE is not matched, the packet is forwarded by default.

3. Which three statements are best practices related to placement of ACLs?

(Choose three.)
A. Filter unwanted traffic before it travels onto a low-bandwidth link.
B. For every inbound ACL placed on an interface, ensure that there is a match-
ing outbound ACL.
C. Place extended ACLs close to the destination IP address of the traffic.
D. Place extended ACLs close to the source IP address of the traffic.
E. Place standard ACLs close to the destination IP address of the traffic.
F. Place standard ACLs close to the source IP address of the traffic.

4. Which two characteristics are shared by standard and extended ACLs?

(Choose two.)
A. Both filter packets for a specific destination host IP address.
B. Both include an implicit deny as a final entry.
C. Both permit or deny specific services by port number.
D. They both filter based on protocol type.
E. They can be created by using either descriptive names or numbers.

5. Which two statement describes a difference between the operation of inbound

and outbound ACLs? (Choose two.)
A. Inbound ACLs are processed before the packets are routed.
B. Inbound ACLs can be used in both routers and switches.
C. Multiple inbound ACLs can be applied to an interface.
D. Multiple outbound ACLs can be applied to an interface.
E. Outbound ACLs are processed after the routing is completed.
F. Outbound ACLs can be used only on routers.
G. Unlike outbound ACLs, inbound ACLs can be used to filter packets with
multiple criteria.
186   Enterprise Networking, Security, and Automation Companion Guide (CCNAv7)

6. In which configuration would an outbound ACL placement be preferred over an

inbound ACL placement?
A. When a router has more than one ACL
B. When an interface is filtered by an outbound ACL and the network attached
to the interface is the source network being filtered within the ACL
C. When an outbound ACL is closer to the source of the traffic flow
D. When the ACL is applied to an outbound interface to filter packets coming
from multiple inbound interfaces before the packets exit the interface

7. What wildcard mask will match networks 10.16.0.0 through 10.19.0.0?

A. 0.252.255.255
B. 0.0.255.255
C. 0.0.3.255
D. 0.3.255.255

8. What type of ACL offers increased flexibility and control over network traffic?

A. Extended
B. Extensive
C. Named standard
D. Numbered standard

9. Which statement describes a characteristic of standard IPv4 ACLs?

A. They can be configured to filter traffic based on both source IP addresses

and source ports.
B. They can be created with a number but not with a name.
C. They filter traffic based on destination IP addresses only.
D. They filter traffic based on source IP addresses only.

10. What wildcard mask will match network 10.10.100.64/26?

A. 0.0.0.15
B. 0.0.0.31
C. 0.0.0.63
D. 0.0.0.127
 Index

Numbers protocols, 206–209

TCP-established extended ACL, 210–211
3DES (Data Encryption Standard), 152, 338 verifying, 216–218
3G/4G/5G, 302, 307, 314 implicit denies, 167, 182
800 series routers, 492 inbound ACL filters, 166–167
802.11 (Wi-Fi), QoS traffic marking, 373 limits per interface, 173–174
900 series routers, 490 log keyword, 542
5500 series routers, 491 modifying, 195–196, 219
sequence numbers method, 197–198
A text method, 196–197
named ACL, 177
abstraction layers, virtualization, 589–590 modifying, 198–199
access named extended IPv4 ACL, 212–216
access attacks, 110–113 named standard IPv4 ACL, 189–190, 193–195
remote access Trojan horses, 107 NAT pools, 246
access control network traffic, 165
data loss, 98 numbered ACL, 176
troubleshooting, 541 numbered extended IPv4 ACL, 204–206,
access layer 209–210
hierarchical network design, 462 numbered standard IPv4 ACL, 188–189,
scalable networks, 475 191–193, 195
access points. See AP outbound ACL filters, 167
accumulating costs, single-area OSPF, 66–67 packet filtering, 164–166
ACI (Application Centric Infrastructure), 598, 602 placement of, 177–181
ANP, 602 purpose of, 164–168, 182
APIC, 602–603 standard ACL, 166, 175–176, 179, 190, 200–203,
APIC-EM, 606–608 219–220
Nexus 9000 series switches, 602 stateful firewall services, 210, 220
spine-leaf topologies, 603 statistics, 199
ACL (Access Control Lists), 164, 175, 188 tasks using ACL, 165
ACE, 164–165 traffic flows, 165
best practices, 174–175 transport layer, troubleshooting, 539–542
creating, 173–175, 183, 188 types of, 175–181, 183–184
defined, 164 verifying, 568–570
extended ACL, 166, 175–176, 180–181, 203–204, wildcard masks, 168, 182–183
220 calculating, 170–172
editing, 213–214 examples of, 168–169
named extended IPv4 ACL, 212–216 IPv4 address ranges, 170
numbered extended IPv4 ACL, 204–206, IPv4 subnets, 169–170
209–210 keywords, 172–173
ports, 207–209 matching hosts, 169–170
716 addresses

addresses APIC (Application Policy Infrastructure Controller),

mapping errors, troubleshooting, 536 602–603
spoofing attacks, 118, 120–121 APIC-EM (Application Policy Infrastructure
adjacencies Controller-Enterprise Module), 606–608
BDR, 51, 54–56 application layer
DR, 51, 54–56 DNS, 544
routers, 23–24 FTP, 544
troubleshooting, 539 HTTP, 544
adjacency databases, OSPF, 5 NFS, 544
adware, 108 POP, 544
AES (Advanced Encryption Standard), 152, 338 SMTP, 544
AF (Assured Forwarding) values, DSCP, 376–377 SNMP, 544
AH (Authentication Headers), 336 SSH, 544
algorithms telnet command, 544
OSPF, 5 TFTP, 544
QoS queueing algorithms, 361, 383 troubleshooting, 543–545
CBWFQ, 364 area ID
FIFO, 362 hello packets, 16
LLQ, 365 point-to-point OSPF networks, 40
WFQ, 362–364 ARP (Address Resolution Protocol)
SHA, 146–147, 339 cache poisoning, 128–130
SPF, 5, 8–9 commands, 553–554
amplification attacks, 118–120 process of, 128
analyzing spoofing attacks, 130
cable analyzers, 527 tables, 553–554, 557
dynamic NAT, 247–249 vulnerabilities, 127–130
information (troubleshooting process), 514 arrays, 625
PAT, 254–255 ASA (Adaptive Security Appliances), 140, 321
static NAT, 241–242 ASBR (Autonomous System Boundary Routers), 74
ANP (Application Network Profiles), 602 ASIC (Application-Specific Integrated Circuits),
Ansible, 643 485–486
AnyConnect Secure Mobility Client, 321 ASR 1000 series routers, 490–491
AP (Access Points), 288, 485 ASR 9000 series routers, 488–491
API (Application Programming Interface), 628–629, assets (security), defined, 96
631, 633, 651 assigning
calls, 630 router ID, 40
example of, 629–630 VLAN, troubleshooting, 556–558
internal (private) API, 632 asymmetric encryption, 152–156
JSON-RPC, 632–633 ATM (Asynchronous Transfer Mode), 296, 324
open (public) API, 631–632 attacks (security), 109, 158
partner API, 632 access attacks, 110–113
REST, 632–639, 651–652 address spoofing attacks, 118, 120–121
SOAP, 632 amplification attacks, 118–120
web service API, 632–633 baiting attacks, 114
XML-RPC, 632–633 buffer overflow attacks, 112–113
DDoS attacks, 116–117
 bandwidth 717

DoS attacks, 115–116 XML-RPC, 632–633

dumpster diving attacks, 114 benefits of, 619–620
ICMP attacks, 117–119 Cisco DNA, 647–648
impersonation attacks, 114 Cisco DNA Center, 648–650, 652
IP attacks, 117–122 concept of, 620–621
MITM attacks, 112–113, 118 configuration management tools, 639, 642–643, 652
password attacks, 111 Ansible, 643
phishing attacks, 114. See also spear phishing attacks Chef, 643
port redirection attacks, 112 CLI, 639
pretexting attacks, 114 network automation, 641
reconnaissance attacks, 109–110 Puppet, 643
reflection attacks, 118–120 SaltStack, 643
session hijacking attacks, 118 SNMP, 640–641
shoulder surfing attacks, 114 data formats, 620, 628
social engineering attacks, 114–115 JSON, 622–626
something for something (quid pro quo) attacks, 114 key/value pairs, 622–628
spam attacks, 114 rules of, 622
spear phishing attacks, 114. See also phishing attacks syntax, 622
spoofing attacks, 111 XML, 623, 627–628
tailgaiting attacks, 114 YAML, 623, 626–627
tools, 101–102 IBN, 644–646, 652
trust exploitation attacks, 111 JSON, 622–627
types of attacks, 104–105 arrays, 625
attenuation, troubleshooting, 533 format of, 623
authentication, 339–340 IPv4 addresses, 625–626
AH, 336 JSON-RPC, 632–633
HMAC, 147–149, 338–339 syntax, 624–626
MD5, 339 smart devices, 620
origin authentication, 144 XML, 623, 627–628
HMAC, 147–149 YAML, 623, 626–627
IPsec, 333, 335 availability, network security, 138
PSK, 339–340 AWA Management Console, 586
RSA, 340–342
SHA, 339
authoritative time sources, 401–402, 443–444
B
automation, 619, 641, 651 backbone networks, 287
API, 628–629, 631, 633, 651 backhaul networks, 287
calls, 630 backups
example of, 629–630 configurations from TFTP servers, 428–430, 436
internal (private) API, 632 IOS images, 437–442
JSON-RPC, 632–633 baiting attacks, 114
open (public) API, 631–632 bandwidth, 354
partner API, 632 DSL Internet connectivity, 302
REST, 632–639, 651–652 reference bandwidth, single-area OSPF, 64–66
SOAP, 632 scalable networks, 474–475
web service API, 632–633
718 baselines

baselines, 507–509 teleworking, 283, 302, 308, 312, 314

baselining tools, 524 wired Internet connectivity, 301–302
performance, troubleshooting, 532, 535 wireless Internet connectivity, 302
BDR (Backup Designated Routers), 17 wireless Internet-based broadband connectivity,
adjacencies, 51, 54–56 306–307
election broadcast multiaccess networks, 49, 84
in OSPF, 20, 23–24 broadcasts, troubleshooting, 536
process of, 56–59 buffer overflow attacks, 112–113
LSA, 24–26 buffered logging, 529
multiaccess OSPF networks, 49–51, 53, 56–59 building switch blocks, 474
router priorities, 61–63 business considerations for switch selection,
BE (Best Effort) values, DSCP, 376 486–487
best practices
ACL, 174–175
network security, 137, 159
C
availability, 138 cable analyzers, 527
confidentiality, 138 cable modems, 288
defense-in-depth approach, 138–139 cable testers, 526–527
firewalls, 139–140 cabling
IDS, 140–141 DOCSIS, 305
integrity, 138 faults, troubleshooting, 533
IPS, 140–141 fiber optic Internet connectivity, 305–306
layered approach, 138–139 HFC networks, cable modems, 305
best-effort QoS policy model, 366–367 Internet connectivity, 305
black hat hackers, 99 optical nodes, 305
blacklisting URL (Uniform Resource Locators), 142 SDH cabling standard, 291–292
boot sector viruses, 107 SONET cabling standard, 291–292
boot system, configuring IOS images, 441–442 calendar services, network management, 400
BOOTP, troubleshooting, 543 CAM tables, spoofing attacks, 121
borderless switched networks, 458–461 campus LAN switches, 477–478
bottlenecks/congestion (networks), troubleshooting, campus networks, 280
532 carrier protocols, 329
bottom-up troubleshooting method, 518–519 carrier WAN connections, 278
branch networks, 281 dual-carrier WAN connections, 278–279
branch routers, 488 single-carrier WAN connections, 278
breaches (security), 95 Catalyst 2960-C series switches, 485–486
broadband connectivity Catalyst 3560-C series switches, 485
dedicated broadband WAN connectivity, 297–298 causes of network problems, troubleshooting,
Internet-based broadband WAN connectivity, 298, 573–574
314–315 data link layer, 534–537
3G/4G/5G, 302, 307, 314 physical layer, 531–534
cable Internet connectivity, 305–306 CBWFQ (Class-Based Weight Fair Queuing), 364
DSL Internet connectivity, 302–304 CDP (Cisco Discovery Protocol), 390–396, 441–442
ISP Internet connectivity, 309–310 CEF (Cisco Express Forwarding), Layer 3 switches,
LTE, 307 596
solution comparisons, 311 cellular Internet connectivity, 306–307
 configuring 719

central controller and SDN, 597 serial network communications, 289

changing passwords, 435 SONET cabling standard, 291–292
Chef, 643 community clouds, 585
circuit-switched network communications, 290 community strings (SNMP), 412–415
circuit-switched WAN connectivity, 295 comparison troubleshooting method, 522
Cisco DNA Assurance, 648 compromised-key attacks, 105
Cisco DNA Center, 648–650, 652 confidentiality
Cisco DNA (Digital Network Architecture), 647–648 data confidentiality, 144, 150
Cisco DNA Security, 648 IPsec, 333–334, 336–338
classification/marking tools (QoS), 371–372 network security, 138
classifying traffic, 362–363, 368 configuration register, password recovery, 433–435,
CLI (Command Line Interface), 639 437
client-based VPN, 321, 326 configuring
clientless VPN, 326 CDP, 391–393
clock (software) configuration management tools, 639, 642–643, 652
setting manually, 400 Ansible, 643
source, displaying, 403 Chef, 643
cloud computing, 583, 585–586, 609 CLI, 639
cloud services, 584 network automation, 641
cloud-managed switches, 478 Puppet, 643
community clouds, 585 SaltStack, 643
data centers versus, 585 SNMP, 640–641
hybrid clouds, 584–585 dynamic NAT, 245–247, 251
IaaS, 584 LLDP, 397
PaaS, 584 NAT, 260
private clouds, 584 networks
public clouds, 584 CLI, 639
SaaS, 584 SNMP, 640–641
storage devices, data loss, 98 NTP, 402–405
CnC (Command and Control), 116–117, 132–133 OSPF
CO (Central Office), WAN, 286 ipospf command, 43–44
code delays, 355 network command, 41–43
collapsed core network design, 464 router priorities, 61–63
collecting data, IOS commands, 511–512 PAT
communications (network) address pools, 253
circuit-switched network communications, 290 single IP addresses, 252
demodulation, 288, 295 point-to-point OSPF networks, 49
DWDM multiplexing, 292 restoring configurations from, text files, 428–430
jitter, 291, 294, 355 routers
latency, 291, 294, 302, 314 copying configurations, 431
modulation, 288, 295 ID, 38–39
packet-switched network communications, 290–291 restoring configurations, 432
ATM, 296, 324 saving configurations, 435
Frame Relay networks, 295–296 verifying configurations, 432
parallel network communications, 289 static NAT, 240–241
SDH cabling standard, 291–292
720 configuring

switches control plane, SDN, 595

fixed configuration switches, 480 controller-based SDN, 605, 611–612
modular configuration switches, 480 converged networks, 458, 493
stackable configuration switches, 481 convergence
Syslog, 422–423 link-state operation, 6
Syslog traps, 530–531 OSPF routers, 17–26
congestion, 353–354 converters (optical), 288
avoidance tools, 371, 379–380 copying
management tools, 371, 379–380 IOS images to TFTP servers, 439–440
troublehooting, 532 router configurations to USB drives, 431–432
connectivity core devices (WAN), 288
IP connectivity, troubleshooting, end-to-end connec- core layer (hierarchical network design), 462
tivity, 545–549 CoS traffic marking, 373–374, 377–378
loss of, 532 cost metrics
troubleshooting, 535, 539 single-area OSPF, 63–64
WAN connectivity accumulating costs, 66–67
3G/4G/5G, 302, 307, 314 manually setting cost value, 66–67
cable Internet connectivity, 305–306 reference bandwidths, 65
circuit-switched WAN connectivity, 295 switches, 486
dedicated broadband WAN connectivity, VPN, 322
297–298 CPE (Customer Premises Equipment), 286
DSL Internet connectivity, 302–304 CPU (Central Processing Units)
Internet-based broadband WAN connectivity, high utilization rates, troubleshooting, 533
298, 301–311, 314–315 overloads, troubleshooting, 534
ISDN, 295 cryptography, 143, 156, 159
ISP Internet connectivity, 309–310 data confidentiality, 144, 150
leased-line WAN connectivity, 293–294 data integrity, 144–145
LTE, 307 data nonrepudiation, 144
Metro Ethernet WAN connectivity, 298–300, 332 encryption
modern WAN connectivity, 296–301, 314 3DES, 152
MPLS, 298, 300–301, 324, 332 AES, 152
packet-switched WAN connectivity, 298 asymmetric encryption, 152–156
PSTN, 295 DES, 152
solution comparisons, 311 DH, 154–156
teleworking, 283, 302, 308, 312, 314 DSA, 154
traditional WAN connectivity, 292–296, 312–313 DSS, 154
wired Internet connectivity, 301–302 ElGamal, 154
wireless Internet connectivity, 302 elliptic curve cryptography, 154
wireless Internet-based broadband connectivity, public key algorithms, 152–156
306–307 RC series algorithms, 152
wireless connectivity, scalable networks, 466–467 RSA, 154
console error messages, troubleshooting, 533 SEAL, 152
console logging, 529 symmetric encryption, 151–152
console messages, troubleshooting, 536 hash functions, 144
content security appliances MD5, 145
ESA, 142 SHA, 146–147
WSA, 142–143 origin authentication, 144, 147–149
 design limits 721

CS (Class Selector) bits, DSCP, 377–378 data nonrepudiation, 144

CSU (Channel Service Units), 288 data plane, SDN, 596
cybercriminals, 100 data sending Trojan horses, 107
cybersecurity (current state of), 95, 157. See also data structures, OSPF, 4–5
security data traffic, 357, 360–361
assets, 96 databases
breaches, 95 adjacency databases, 5
current state of affairs, 95–96 forwarding databases, 5
cybercriminals, 95 LSDB 5, 7
exploits, 96 OSPF, 5, 20–22
mitigation, 96 topology databases, troubleshooting, 539
risk, 96 DBD (Database Description) packets, 13–14, 21–22
threats, 96 DCE (Data Communications Equipment), 286–288
vectors of DDoS (Distributed Denial of Service) attacks,
data loss, 97–98 116–117
network attacks, 96–97 dead intervals, 16, 70–73
vulnerabilities, 96 debug command, 517
debuggers, 104

D dedicated broadband WAN connectivity, 297–298

dedicated servers, virtualization, 586–587
dark fiber, 297–298 default gateways, verifying, 558–560
data centers IPv4, 559
cloud computing versus, 585 IPv6, 560–562
switches, 478 defense-in-depth approach (network security),
data collection, IOS commands, 511–512 138–139
data confidentiality, 144, 150 defining problems (troubleshooting process), 514
data delays, 360–361 de-jitter delays, 355
data exfiltration, 97–98 delays, 353
data formats, 620, 628 code delays, 355
concept of, 620–621 data delays, 360–361
JSON, 622–624, 626–627 de-jitter delays, 355
arrays, 625 fixed delays, 355
IPv4 addresses, 625–626 jitter, 291, 294, 355
JSON-RPC, 632–633 packetization delays, 355
syntax, 624–626 playout delay buffers, 355–356
key/value pairs, 622–628 propagation delays, 355
rules of, 622 queuing delays, 355
syntax, 622, 624–626 serialization delays, 355
XML, 623, 627–628 variable delays, 355
YAML, 623 demarcation points, 286
data integrity, 144–145, 333, 335, 338–339 demodulation, 288, 295
data link layer (networks), troubleshooting, 534–537 Denial of Service. See DoS attacks
data loss vectors (security), 97–98 density (port), switches, 482, 486
data measurement, network documentation, departmental switch blocks, 474
510–512 DES (Data Encryption Standard), 152, 338
data modification attacks, 105 design limits, troubleshooting, 534
722 designing networks

designing networks, 455 Catalyst 3560-C series switches, 485

borderless switched networks, 458–461 cloud-managed switches, 478
collapsed core network design, 464 data center switches, 478
hierarchical networks, 493 fixed configuration switches, 480
access layer, 462, 475 form factors, 479–481
borderless switched networks, 458–461 forwarding rates, 483
core layer, 462 modular configuration switches, 480
distribution layer, 462 multilayer switching, 485–486
OSPF, 476–477 platforms, 477–479
scalability, 455–458 PoE, 484–486
switched networks, 464–465 port density, 482
three-tier network design, 455, 460, 463 RU, 481, 494
two-tier network design, 461, 464 service provider switches, 479
line cards, 480, 482 stackable configuration switches, 481
routers, 494–495 thickness of switches, 481
800 series routers, 492 virtual networks, 479
900 series routers, 490 wire speeds, 483
5500 series routers, 491 three-tier network design, 455, 460, 463
ASR 1000 series routers, 490–491 two-tier network design, 461, 464
ASR 9000 series routers, 490–491 virtual networks, switches, 479
branch routers, 488 destination ports, troubleshooting, 541
fixed configuration routers, 492 destructive Trojan horses, 107
form factors, 490–492 device discovery
industrial routers, 490, 492 CDP, 390–396, 443
modular routers, 492 LLDP, 396–400, 443
network edge routers, 488–489 device documentation (networks), 505, 512
requirements, 487–488 end-system documentation files, 506–507
service provider routers, 489 routers, 505–506
scalable networks, 465–466, 477, 493–494 switches, 506
access layer, 475 device-based SDN, 604–605
bandwidth, 474–475 DH (Diffie-Hellman), 154–156
failure domains, 469–474 DHCP (Dynamic Host Configuration Protocol), 133
hierarchical networks, 455–458 rogue DHCP servers, 121, 134–136
multiple links, 466–467 spoofing attacks, 134–136
redundancy plans, 469 troubleshooting, 543
redundant links, 466–467 dialup modems. See voiceband modems
scalable routing protocol, 467–468 Diffie-Hellman key exchanges, 333, 335, 342–343
tuning routing protocols, 476–477 DiffServ (Differentiated Services), 366, 369–370
wireless connectivity, 465–466 digital certificates, 327, 333, 335, 339, 341–342,
SFP devices, 482 344–345
switches, 477, 487, 494–495 digital multimeters (DMM), 525–526
ASIC, 485–486 Dijkstra’s algorithm, 5
business considerations for switch selection, disaster recovery, virtualization, 589
486–487 discovering devices
campus LAN switches, 477–478 CDP, 390–396, 443
Catalyst 2960-C series switches, 485–486 LLDP, 396–400, 443
 email 723

distributed networks, 282 DSA (Digital Signature Algorithm), 154

distribution layer (hierarchical network design), DSCP (Differentiated Services Code Points),
461–462, 493 375–378
divide-and-conquer troubleshooting method, DSL (Digital Subscriber Line) Internet connectivity,
520–521 302–303
DLCI (Data-Link Connection Identifiers), 296 bandwidth space allocation, 302
DMM (Digital Multimeters), 525–526 DSLAM, 303
DMVPN (Dynamic Multipoint VPN), 330–331 example of, 303
DNS (Domain Name System), 131, 544 modems, 288
domain shadowing attacks, 132 PPP, 303–304
open resolver attacks, 131 DSP (Digital Signal Processors), 357
stealth attacks, 132 DSS (Digital Signature Standard), 154
traffic analysis, 136 DSU (Data Service Units), 288
troubleshooting, 543 DTE (Data Terminal Equipment), 286–288
tunneling, 132–133 dual stacks, 259, 263
verifying, 570–571 dual-carrier WAN connections, 278–279
DOCSIS (Data Over Cable Service Interface Specifi- dual-homed ISP connectivity, 309
cation), 305 dual-homed WAN topology, 276
documentation, networks, 502, 572 dual-multihomed ISP connectivity, 310
baselines, 507–509 dumpster diving attacks, 114
device documentation, 505, 512 duplex mismatches, troubleshooting, 551–553
data measurement, 510–512 DWDM multiplexing, 292
end-system documentation files, 506–507 dynamic NAT (Network Address Translation), 232–
routers, 505–506 233, 244–245, 260–261
switches, 506 analyzing, 247–249
logical network topologies, 504–505 configuring, 245–247, 251
overview of, 502 topologies, 244–245
physical network topologies, 503 verifying, 249–251
domain shadowing attacks, 132
DoS (Denial of Service) attacks, 105, 107, 115–116
Down state, 17–19
E
DR (Designated Routers), 16 eavesdropping attacks, 105
adjacencies, 51, 54–56 E-carriers, 294
election edge routers, 74
in OSPF, 20, 23–24 failure domains, 470–471
process of, 56–59 network edge routers, 488–489
failures/recovery, 58–59 educated guess troubleshooting method, 522
LSA, 24–26 EF (Expedited Forwarding) values, DSCP, 376
multiaccess OSPF networks, 49–51, 53–54, 56–59 egress packets, 372
router priorities, 61–63 ElGamal, 154
single-area OSPF, router ID, 36 eliminating probable cause (troubleshooting process),
drives (USB) 514
copying router configurations to, 431–432 elliptic curve cryptography, 154
displaying contents of, 430 email
verifying connections, 430–431 data loss, 98
DROTHER, 25, 50–51, 52–53 POP, 544
SMTP, 544
724 EMI (Electromagnetic Interference), troubleshooting

EMI (Electromagnetic Interference), troubleshooting, Ethernet

534 CoS traffic marking, 373–374, 377–378
encapsulating Metro Ethernet WAN connectivity, 298–300, 332
errors, troubleshooting, 536 network adjacencies, 23–24
protocols (IPsec), 336 PoE, switches, 484–486
encryption PPPoE, DSL Internet connectivity, 303–304
3DES, 338 QoS traffic marking, 373
AES, 152, 338 WAN, 297–298
asymmetric encryption, 152–156 ethical hacking, 95
DES, 152, 338 excessive broadcasts, troubleshooting, 536
DH, 154–156 Exchange state, 18
DSA, 154 exfiltration of data, 97–98
DSS, 154 exploits (security), defined, 96
ElGamal, 154 ExStart state, 18
elliptic curve cryptography, 154 extended ACL (Access Control Lists), 166, 175–176,
encryption protocols, troubleshooting, 542 180–181, 203–204, 220
protocols, troubleshooting, 543 editing, 213–214
public key algorithms, 152–156 named extended IPv4 ACL, 212–216
RC series algorithms, 152 numbered extended IPv4 ACL, 204–206, 209–210
RSA, 154 ports, 207–209
SEAL, 152, 338 protocols, 206–209
symmetric encryption, 151–152 TCP-established extended ACL, 210–211
tools, 104 verifying, 216–218
end users (troubleshooting process), questioning,
515–516
endpoint groups (EPG), 602
F
end-system documentation files, 506–507 failover tests to backup routes, single-area OSPF, 69
end-to-end IP connectivity, troubleshooting failure domains
components of, 545–547 edge routers, 470–471
IPv4 scalable networks, 469–474
pinging, 547–548 failures/recovery
traceroute command, 548 routers, multiaccess OSPF networks, 58–59
IPv6 single point of failure, 275, 278
pinging, 548–549 FIB (Forwarding Information Base), 596
traceroute command, 548–549 fiber optic Internet connectivity, 305–306
reference topologies, 545–547 FIFO (First-In, First-Out), 362
enterprise networks, 458, 477, 487, 491, 493–494 file systems
enterprise VPN (Virtual-Private Networks), Flash file systems, 425
324–325 IOS File System, 424, 437–442
EoMPLS. See Metro Ethernet WAN connectivity NVRAM file systems, 425–426
EPG (Endpoint Groups), 602 restoring configurations from, text files, 428–430
error messages (console), troubleshooting, 533 router file systems, 423–425, 445–446
ESA (Email Security Appliance), 142 switch file systems, 426–427, 445–446
ESP (Encapsulation Security Protocol), 336 filtering
established keyword, troubleshooting, 542 network traffic with ACL
inbound ACL filters, 166–167
 hello packets 725

outbound ACL filters, 167

URL, 142
G
firewalls, 139–140, 210, 220 gateways (default), verifying, 558–560
firmware viruses, 107 IPv4, 559
fixed configuration routers, 492 IPv6, 560–562
fixed configuration switches, 480 gathering information (troubleshooting process),
fixed delays, 355 514, 516–517
Flash general network issues, troubleshooting, 539
backing up configurations from, 436 general troubleshooting procedures, 512–513
file systems, 425 get operations (SNMP), 406–407
IOS images, verifying size of, 439–441 global NAT addresses, 229–231
flexibility, borderless switched networks, 459 gray hat hackers, 99
flood attacks GRE (Generic Routing Encapsulation)
TCP SYN flood attacks, 124 GRE over IPsec, 328–329
UDP flood attacks, 127 mGRE, 330–331
flooding LSA, 23–24 group tables (switches), 602
flow control, TCP, 123
flow tables (switches), 601
flowcharts (troubleshooting), 512–513
H
follow-the-path troubleshooting method, 521–522 hackers, 98–100
forensic tools, 103 hacking
form factors OS, 104
routers, 490–492 tools, 103
SFP devices, 482 hacktivists, 100
switches, 479–481 half-duplex, 551–553, 575
forwarding databases, OSPF, 5 hard copies, data loss, 98
Forwarding Information Base (FIB), 596 hardware, troubleshooting
forwarding rates (switches), 483 faults, 533
frame buffers, switches, 487 tools
Frame Relay networks, 295–296 cable analyzers, 527
framing errors, troubleshooting, 537 cable testers, 526–527
FTP (File Transfer Protocol), 107, 544 DMM, 525–526
FTTB (Fiber-to-the-Building) Internet connectivity, portable network analyzers, 528
306 Prime NAM, 528
FTTH (Fiber-to-the-Home) Internet connectivity, Syslog server, 529–531
306 hash functions
FTTN (Fiber-to-the-Node/Neighborhood) Internet MD5, 145
connectivity, 306 SHA, 146–147
FTTx Internet connectivity, 305–306 headend, 305
Full state, 18 headers
full-duplex, 551–553 TCP headers, 122
fully meshed WAN topology, 276 UDP headers, 126
functionality, troubleshooting, 535 hello intervals, 16
fuzzers, 103 hello packets, 13–17
intervals, single-area OSPF, 69–73
neighbor adjacencies, OSPF link-state operation, 6
726 HFC networks, cable modems

HFC networks, cable modems, 305 IDS (Intrusion Detection Systems), network security,
hierarchical networks, 493 140–141
access layer, 462, 475 IEEE 802.1p. See CoS traffic marking
borderless switched networks, 458–461 IFS (IOS File System), 424, 437–442
core layer, 462 IKE (Internet Key Exchange), 335
designing, OSPF, 476–477 images (IOS), managing, 446
distribution layer, 461–462, 493 backups, 438–441
OSPF, 476–477 boot system configurations, 441–442
scalability, 455–458 TFTP backups, 437–442
switched networks, 464–465 impersonation attacks, 114
three-tier network design, 455, 460, 463 implicit denies, 167, 182, 541
two-tier network design, 461, 464 inbound ACL filters, 166–167
hierarchical topologies, multi-area OSPF, 11 industrial routers, 490, 492
high CPU utilization rates, troubleshooting, 533 information (troubleshooting process)
HMAC (Hash Message Authentication Code), 147– analyzing, 514
149, 338–339 gathering, 514, 516–517
HTTP (Hypertext Transfer Protocol), 544, 634–639 ingress packets, 372
hub routers, 275–276 Init state, 17–19
hub-and-spoke WAN topology, 275, 330–331 input errors, troubleshooting, 551
hybrid clouds, 584–585 input queue drops, 550
hypervisors, 588, 591–593 inside NAT addresses, 229–231
hypotheses (troubleshooting process) integrity
proposals, 514 of data, 144–145, 333, 335, 338–339
testing, 515 network security, 138
interfaces, show interfaces command, 549–550

I interference, troubleshooting, 534

internal (private) API, 632
IaaS (Infrastructure as a Service), 584 Internet-based broadband WAN connectivity, 298,
IBN (Intent-Based Networking), 644–646, 652 314–315
ICMP attacks, 117–119 3G/4G/5G, 302, 307, 314
ID cable Internet connectivity, 305–306
area ID, point-to-point OSPF networks, 40 DSL Internet connectivity, 302, 303
router ID, 16, 40, 83 bandwidth space allocation, 302
assigning, 40 DSLAM, 303
choosing, 36–37 example of, 303
configuration mode, 35 PPP, 303–304
configuring, 38–39 ISP Internet connectivity
DR election, 36 dual-homed ISP connectivity, 309
loopback interfaces, 37–38 dual-multihomed ISP connectivity, 310
modifying, 39–40 multihomed ISP connectivity, 309–310
order of precedence, 36–37 single-homed ISP connectivity, 309
reference topologies, 34–35, 38 LTE, 307
rid values, 37 microwave Internet connectivity. See WiMAX
synchronization of OSPF databases, 36 solution comparisons, 311
verifying, 38–39 teleworking, 283, 302, 308, 312, 314
wired Internet connectivity, 301–302
 IPv4 (Internet Protocol version 4) 727

wireless Internet connectivity, 302 IPsec (IP Security), 332–345. See also VPN
wireless Internet-based broadband connectivity, 306, AH, 336
308 authentication, 339–340
cellular Internet connectivity, 306–307 PSK, 339, 340
municipal Wi-Fi Internet connectivity, 306 RSA, 340–342
satellite Internet connectivity, 307 confidentiality, 333–334, 336–338
WiMAX, 307 data integrity, 333, 335, 338–339
interoperability areas (transport layer), Diffie-Hellman key exchanges, 333, 335, 342–343
troubleshooting, 542–543 ESP, 336
IntServ (Integrated Services), 366–368 framework of, 334–335
IOS commands GRE over IPsec, 328–329
data collection, 511–512 origin authentication, 333, 335
gathering information (troubleshooting process), protocol encapsulation, 336
516–517 SA, 334–335
IOS File System, 424, 437–442, 446 SSL comparisons, 326–327
IOS log messages, severity levels (Syslog), 530 transport and tunnel mode, 343
IP (Internet Protocol) VTI, 331–332
show ip interface brief command, 517 IPv4 (Internet Protocol version 4)
show ip route command, 517 ACL, 175, 188. See also extended ACL; named ACL;
IP addresses, attacks, 105, 117–122, 158. See also numbered ACL; standard ACL
security creating, 188
IP connectivity, troubleshooting, 574–576 modifying, 195–198, 219
ACL, verifying, 568–570 placement of, 177–181
DNS, verifying, 570–571 stateful firewall services, 210, 220
end-to-end connectivity statistics, 199
components of, 545–547 wildcard masks, 168–173
duplex mismatches, 551–553 addressing
IPv4 pinging, 547–548 ranges, wildcard masks, 170
IPv4 traceroute command, 548 troubleshooting, 541
IPv6 pinging, 548–549 ARP tables, 553–554
IPv6 traceroute command, 548–549 attacks, 117–118
reference topologies, 545–547 default gateways, 559
verifying physical layer, 549–551 extended ACL, 175–176, 180–181, 203–204, 220
local network addressing, end-to-end connectivity, editing, 213–214
553–556 named extended IPv4 ACL, 212–216
network paths, verifying, 562–566 numbered extended IPv4 ACL, 204–206,
transport layer, verifying, 566–567 209–210
verifying physical layer, 549–551 ports, 207–209
VLAN assignments, 556–562 protocols, 206–209
IP phone, PoE, 484 TCP-established extended ACL, 210–211
IP services, 127–130, 158 verifying, 216–218
ipospf command, point-to-point OSPF networks, JSON, 625–626
configuring OSPF, 43–44 logical network topologies, 504
ipospf priority command, 61 named ACL, 177
IPP (IP Precedence), 373, 375, 377–378 modifying, 198–199
IPS (Intrusion Prevention Systems), 140–141 named extended IPv4 ACL, 212–216
named standard IPv4 ACL, 189–190, 193–195
728 IPv4 (Internet Protocol version 4)

NAT, 226, 237 logical network topologies, 505

advantages of, 238, 261 NAT64, 258–259
configuring, 260 neighbor tables, 554–555
defined, 227–228 packet headers, 374–375
disadvantages of, 238–239, 261 pinging, 548–549
dynamic NAT, 232–233, 244–251, 260–261 QoS traffic marking, 373
global NAT addresses, 229–231 show ipv6 interface brief command, 517
inside global NAT addresses, 230 show ipv6 route command, 517
inside local NAT addresses, 230–231 traceroute command, 548–549
inside NAT addresses, 227–231 Traffic Class field, 375
local NAT addresses, 229–231 ISDN (Integrated Services Digital Networks), 295
NAT overload. See PAT ISP (Internet Service Providers)
NAT64, 258–259 Internet connectivity
NAT-PT, 259 dual-homed ISP connectivity, 309
operation of, 228–229 dual-multihomed ISP connectivity, 310
outside global NAT addresses, 231 MPLS VPN, 332
outside local NAT addresses, 231 multihomed ISP connectivity, 309–310
outside NAT addresses, 229, 231 single-homed ISP connectivity, 309
PAT, 233–234, 237, 251–257, 260–261 VPN, 324–325
pools, 245–247 routers, 489
private IPv4 addresses, 226–227 switches, 479
static NAT, 231–232, 239–244, 260–261 VPN, 324–325
stub networks, 228 ISR 4000 series routers, 488
terminology, 229–231
troubleshooting, 542–543
numbered ACL, 176
J
numbered extended IPv4 ACL, 204–206, jabber, 533
209–210 jitter, 291, 294, 355
numbered standard IPv4 ACL, 188–189, 191– JSON (JavaScript Object Notation), 622–624,
193, 195 626–627
packet headers, 374–375 arrays, 625
pinging, 547–548 format of, 623
private addresses, 226–227 IPv4 addresses, 625–626
QoS traffic marking, 373 JSON-RPC, 632–633
standard ACL, 175–176, 179, 190, 200–203, syntax, 624–626
219–220 JSON-RPC (JavaScript Object Notation-Remote Pro-
subnets, wildcard masks, 169–170 cedure Call), 632–633
traceroute command, 548
Type of Service field, 375
wildcard masks
K
address ranges, 170 keylogger attacks, 107
subnets, 169–170 keys (security), compromised-key attacks, 105
troubleshooting, 541 key/value pairs, 622–628
IPv6 (Internet Protocol version 6) knowledge bases, 524
attacks, 117–118
default gateways, 560–562
 managing networks 729

L loopback interfaces
point-to-point OSPF networks, 48
LAN (Local-Area Networks) router ID, 37–38
campus LAN switches, 477–478 loops
switches, device documentation, 506 local loops (last mile), 286
WAN comparisons, 272–273 STP loops, troubleshooting, 537
last mile (local loops), 286 LSA (Link-State Advertisements)
latency, 291, 294, 302, 314 BDR, 24–26
Layer 2 MPLS VPN, 324, 332, 344 DR, 24–26
Layer 2 QoS traffic marking, 373–374 exchanging, OSPF, 6–7
Layer 2 traffic marking, 373–374 flooding, 23–24
Layer 3 MPLS VPN, 324, 332, 334, 344 LSU packets, 14
Layer 3 switches, SDN, 596 LSAck (Link-State Acknowledgement) packets,
Layer 3 traffic marking, 374–375 13–14
layered approach (network security), 138–139 LSDB (Link-State Databases)
layered models, troubleshooting with, 517–518 OSPF, 5, 7
leased-line WAN connectivity, 293–294 topology tables, 7
legacy support, virtualization, 589 LSR (Label-Switched Routers), 300–301
line cards, 480, 482 LSR (Link-State Request) packets, 13–14, 22
links, scalable networks LSU (Link-State Update) packets, 13–14
multiple links, 466–467 LTE (Long-Term Evolution), 307
redundant links, 466–467
link-state operation
convergence, 6
M
OSPF, 6 MAC addresses
establishing neighbor adjacencies, 6 spoofing attacks, 120–121
LSA, 6–7 switch MAC address tables, 555–557
LSDB, 7 macros, viruses, 107
SPF algorithms, 8–9 malware, 106, 108–109, 157
SPF trees, 8–9 adware, 108
route selection, 8–9 overview of, 106
link-state routing protocols. See OSPF ransomware, 108
list of neighbors, 17 rootkits, 108
LLDP (Link Layer Discovery Protocol), 396–400, spyware, 108
443 Trojan horses, 106–107
LLQ (Low Latency Queuing), 365 viruses, 106–107
Loading state, 18 worms, 106, 108
local loops (last mile), 286 management plane, SDN, 598
local NAT addresses, 229–231 managing networks, 390
local network addressing, verifying, 553–556 calendar services, 400
log keyword, ACL, 542 CDP, 390–396, 443
logging configurations
buffered logging, 529 backups, 428–430, 436
console logging, 529 restoring from text files, 428–430
logging trap command, 530 IOS images, 424, 437–442
logical network topologies, 504–505 LLDP, 396–400, 443
730 managing networks

NTP, 400–405, 443–444 named ACL, 198–199

passwords sequence numbers method, 197–198
changing, 435 text method, 196–197
recovery, 433–437 router ID, 39–40
routers single-area OSPF, 85–86
copying configurations, 431 modular configuration switches, 480
file systems, 423–424, 445–446 modular routers, 492
restoring configurations, 432 modularity, borderless switched networks, 459
saving configurations, 435 modulation, 288, 295
USB ports, 430 MPLS (Multi-Protocol Label Switching), 298, 300–
verifying configurations, 432 301, 324
SNMP, 405–418, 444 Layer 2 MPLS VPN, 324, 332, 344
switch file systems, 426–427, 445–446 Layer 3 MPLS VPN, 324, 332, 334, 344
Syslog, 418–423, 444–445 QoS traffic marking, 373
time services, 400 VPN, 332
USB drives multiaccess OSPF networks, 49
copying router configurations to, 431–432 adjacencies, 54–56
displaying contents of, 430 designated routers, 49–51
verifying connections, 430–431 election process, 56–59
man-in-the-middle attacks. See MITM reference topologies, 51–52, 57
marking/classification tools (QoS), 371–372 router election process, 56–59
MD5 (Message-Digest 5), 339 router failures/recovery, 58–59
MD5 hash function, 145 router priorities, 61–63
measuring data, network documentation, 510–512 verifying router roles, 52–54
meter tables (switches), 602 multi-area OSPF, 9–11
Metro Ethernet WAN connectivity, 298–300, 332 multihomed ISP connectivity, 309–310
mGRE (Multipoint GRE), 330–331 multilayer switching, 485–486
MIB (Management Information Base) multimeters (digital), 525–526
OID, 415 multiple adjacencies, routers, 23–24
variables, SNMP agents, 407 multiple links, scalable networks, 466–467
microwave Internet connectivity. See WiMAX municipal Wi-Fi Internet connectivity, 306
mission-critical services, 455–456, 490
mitigation (security), defined, 96
MITM (Man-in-the-Middle) attacks, 105, 112–113,
N
118 NAM (Network Analysis Module), 528
modems named ACL (Access Control Lists), 177
cable Internet connectivity, 305 modifying, 198–199
cable modems, 288 named extended IPv4 ACL, 212–216
CSU, 288 named standard IPv4 ACL, 189–190, 193–195
dialup modems. See voiceband modems NAT (Network Address Translation), 226, 237
DSL modems, 288 advantages of, 238, 261
DSU, 288 characteristics of, 227–231
voiceband modems, 288 configuring, 260
modern WAN connectivity, 296–301, 314 defined, 227–228
modifying disadvantages of, 238–239, 261
ACL, 195–196, 219
 networks 731

dynamic NAT, 232–233, 244, 245–247, 249–251, Network Analysis Module (NAM), 528
260–261 network analyzers (portable), 528
analyzing, 247–249 network command, point-to-point OSPF networks
configuring, 251 command syntax, 40
topologies, 244–245 configuring OSPF, 41–43
global NAT addresses, 229–231 network edge routers, 488–489
inside global NAT addresses, 230 network layer, troubleshooting, 537–539
inside local NAT addresses, 230–231 network masks, hello packets, 16
inside NAT addresses, 229–231 networks
local NAT addresses, 229–231 ACL, 164, 165, 175, 188
NAT overload. See PAT ACE, 164–165
NAT64, 258–259 best practices, 174–175
NAT-PT, 259 creating, 173–175, 183, 188
operation of, 228–229 defined, 164
outside global NAT addresses, 231 extended ACL, 175–176, 180–181, 203–206,
outside local NAT addresses, 231 207–218, 220
outside NAT addresses, 229, 231 implicit denies, 167, 182
PAT, 233–234, 251, 260–261 limits per interface, 173–174
analyzing, 254–255 modifying, 195–196, 219
configuring, 252–253 modifying, sequence numbers method, 197–198
NAT comparisons, 236–237 modifying with text method, 196–197
next available port, 233–234 named ACL, 177, 189–190, 193–195, 198–199,
source port assignments, 235 212–216
verifying, 256–257 numbered ACL, 176, 188–189, 191–193, 195,
pools, 245–247 204–206, 209–210
private IPv4 addresses, 226–227 packet filtering, 164–168
routers, private/public IPv4 address translations, 227 placement of, 177–181
static NAT, 231–232, 239–240, 242–244, 260–261 purpose of, 164–168, 182
analyzing, 241–242 standard ACL, 175–176, 179, 190, 200–203,
configuring, 240–241 219–220
topology, 240 stateful firewall services, 210, 220
stub networks, 228 statistics, 199
terminology, 229–231 types of, 175–181, 183–184
troubleshooting, 542–543 wildcard masks, 168–173, 182–183
NBAR (Network Based Application Recognition), ATM, 296, 324
372 attacks,109, 117, 158. See also security
NBMA (Non-Broadcast Multiaccess) networks, 70 access attacks, 110–113
NCS 6000 series routers, 489 address spoofing attacks, 118, 120–121
neighbor adjacencies amplification attacks, 118–120
establishing, 18–20 ARP vulnerabilities/attacks, 127–130
OSPF link-state operation, 6 baiting attacks, 114
troubleshooting, 539 best practices, 137–143, 159
neighbor tables (IPv6), 554–555 buffer overflow attacks, 112–113
neighbors, list of, 17 DDoS attacks, 116–117
NETCONF, 638–639 DHCP attacks, 134–136
network addresses, prefixes, 12 DNS attacks, 131–133
732 networks

DoS attacks, 115–116 borderless switched networks, 458–461

dumpster diving attacks, 114 bottlenecks/congestion, troubleshooting, 532
ICMP attacks, 117–119 branch networks, 281
impersonation attacks, 114 broadcast multiaccess networks, 49, 84
IP attacks, 117–122 campus networks, 280
IP service attacks, 127–136 Cisco DNA, 647–648
MITM attacks, 112–113, 118 Cisco DNA Assurance, 648
password attacks, 111 Cisco DNA Center, 648–650, 652
phishing attacks 114. See also spear phishing Cisco DNA Security, 648
attacks CLI, 639
port redirection attacks, 112 communications
pretexting attacks, 114 ATM, 296, 324
reconnaissance attacks, 109–110 circuit-switched network communications, 290
reflection attacks, 118–120 demodulation, 288, 295
session hijacking attacks, 118 DWDM multiplexing, 292
shoulder surfing attacks, 114 Frame Relay networks, 295–296
social engineering attacks, 114–115 jitter, 291, 294, 355
something for something (quid pro quo) attacks, latency, 291, 294, 302, 314
114 modulation, 288, 295
spam attacks, 114 packet-switched network communications, 290–
spear phishing attacks, 114. See also phishing 291, 295–296
attacks parallel network communications, 289
spoofing attacks, 111 SDH cabling standard, 291–292
tailgaiting attacks, 114 serial network communications, 289
TCP vulnerabilities/attacks, 122–126, 158 SONET cabling standard, 291–292
trust exploitation attacks, 111 configuring
UDP vulnerabilities/attacks, 122, 126–127, 158 CLI, 639
vectors of, 96–97 SNMP, 640–641
zombies, 116 congestion, 353–354
automation, 619, 641, 651 converged networks, 458, 493
API, 628–639, 651–652 data link layer, troubleshooting, 534–537
benefits of, 619, 620 delays, 353
Cisco DNA, 647–648 code delays, 355
Cisco DNA Center, 648–650, 652 data delays, 360–361
concept of, 620–621 de-jitter delays, 355
configuration management tools, 639–643, 652 fixed delays, 355
data formats, 620–628 jitter, 291, 294, 355
IBN, 644–646, 652 packetization delays, 355
JSON, 622–626, 632–633 propagation delays, 355
smart devices, 620 queuing delays, 355
XML, 623, 627–628 serialization delays, 355
YAML, 623, 626–627 variable delays, 355
backbone networks, 287 designing, 455
backhaul networks, 287 borderless switched networks, 458–461
bandwidth, 354 collapsed core network design, 464
baselines, 408, 507–509, 524 hierarchical networks, 455–465, 475
 networks 733

line cards, 480, 482 IOS images, 424, 437–442

routers, 487–492 LLDP, 396–400, 443
scalable networks, 455–458, 465–477 NTP, 400–405, 443–444
SFP devices, 482 password recovery, 433–436, 437
switch hardware, 477–487 restoring configurations from text files, 428–430
three-tier network design, 455, 460, 463 router configurations, 431–432
two-tier network design, 461, 464 router file systems, 423–424, 445–446
distributed networks, 282 routers, USB ports, 430–432
documentation, 502, 572 SNMP, 405–418, 444
baselines, 507–509 switch file systems, 426–427, 445–446
data measurement, 510–512 Syslog, 418–423, 444–445
device documentation, 505–507, 512 time services, 400
logical network topologies, 504–505 USB drives, 430–432
overview of, 502 multiaccess OSPF networks, 49–51
physical network topologies, 503 NBMA, 70
enterprise networks, 458, 477, 487, 491, 493, 494 network layer, troubleshooting, 537–539
Ethernet networks, adjacencies, 23–24 NMS
evolution of, 279–282 SNMP, 405, 444
firewalls, 139–140 tools, 524
Frame Relay networks, 295–296 NOC, 457
hacking tools, 103 OSPF, network types, 84–85
HFC networks, cable modems, 305 paths, verifying, 562–566
hierarchical networks, 493 physical layer
access layer, 462, 475 troubleshooting, 531–534
borderless switched networks, 458–461 verifying, 549–551
core layer, 462 point-to-point OSPF networks, 40, 83–84
distribution layer, 462 area ID, 40
distribution layer switches, 461, 462, 493 configuring, 49
OSPF, 476–477 configuring with ipospf command, 43–44
scalability, 455–458 configuring with network command, 41–43
switched networks, 464–465 ipospf command, 43–44
three-tier network design, 455, 460, 463 loopback interfaces, 48
two-tier network design, 461, 464 network command, 40, 41–43
IBN, 644–646, 652 passive interfaces, 44–46
ISDN, 295 verifying network type, 46–48
knowledge bases, 524 wildcard masks, 40, 41, 42–43
LAN prioritizing traffic, 353–354
campus LAN switches, 477–478 PSTN, 295
WAN comparisons, 272–273 router hardware, 487–492
line cards, 480, 482 routers, 494–495
local network addressing, verifying, 553–556 scalable networks, 493–494
managing, 390 designing, 465–477
backing up configurations, 428–430, 436 hierarchical networks, 455–458
calendar services, 400 scanning tools, 103
CDP, 390–396, 443 SD-Access, 647
changing passwords, 435 SDN, 595, 598, 600, 610–611
734 networks

ACI, 598, 602–603 hacking tools, 103

CEF, 596 hacktivists, 100
central controller, 597 hash functions, 144–147
control plane, 595 IDS, 140–141
controller-based SDN, 605, 611–612 integrity, 138
controllers, 600–602 IPS, 140–141
data plane, 596 layered approach, 138–139
device-based SDN, 604–605 malware, 106–109
framework, 599 mitigation, 96
Layer 3 switches, 596 origin authentication, 144, 147–149
management plane, 598 packet crafting tools, 103
OpenFlow, 598 packet sniffers, 103
OpenStack, 598 password crackers, 103
policy-based SDN, 605 penetration testing tools, 102–104
traditional architectures and, 599 ransomware, 108
SD-WAN, 648 risk, 96
security, 95, 157. See also attacks; VPN rootkit detectors, 103
adware, 108 rootkits, 108
ASA, 140 scanning tools, 103
assets, 96 script kiddies, 100
attack tools, 101–102 spyware, 108
attack types, 104–105 threat actors, 98–101, 157
availability, 138 threats, 96
best practices, 137–143 Trojan horses, 106, 107
blacklisting URL, 142 URL filtering, 142
breaches, 95 vectors of data loss, 97–98
confidentiality, 138 vectors of network attacks, 96–97
content security appliances, 141–143 viruses, 106–107
cryptography, 143–146, 159 vulnerabilities, 96
cybercriminals, 95, 100 vulnerability brokers, 100
cybersecurity, current state of, 95–98 vulnerability exploitation tools, 104
data confidentiality, 144, 150 vulnerability scanners, 104
data integrity, 144, 145 wireless hacking tools, 103
data nonrepudiation, 144 worms, 106, 108
debuggers, 104 WSA, 142–143
defense-in-depth approach, 138–139 SFP devices, 482
encryption, 104, 151–156 small networks, 279–280
ESA, 142 SNMP, 640–641
ethical hacking, 95 stub networks, NAT and, 228
evolution of tools, 102–104 switch hardware, 477–487
exploits, 96 switched networks, borderless switched networks,
firewalls, 139–140 458–461, 464–465
forensic tools, 103 switches, 481, 494–495
fuzzers, 103 toll networks, 286
hackers, 98–100 topologies
hacking OS, 104 logical network topologies, 504–505
physical network topologies, 503
 networks 735

traffic testing hypotheses, 515

data traffic, 357, 360–361 top-down troubleshooting method, 519–520
video traffic, 357–360 virtual networks, 592–593
voice traffic, 357–358 complexity of, 594–595, 610
transmission quality, 353, 382 switches, 479
congestion, 353–354 UCS Manager, 593–594
delays, 353, 355 virtualization, 583, 609
packet loss, 355–357 abstraction layers, 589–590
prioritizing traffic, 353–354 advantages of, 589
troubleshooting AWA Management Console, 586
analyzing information, 514 cloud computing, 583–586
application layer, 543–545 dedicated servers, 586–587
bottom-up troubleshooting method, 518–519 disaster recovery, 589
buffered logging, 529 hypervisors, 588, 591–593
comparison troubleshooting method, 522 legacy support, 589
console logging, 529 prototyping, 589
data link layer, 534–537 SDN, 595–598, 610–611
defining problems, 514 servers, 587–589
divide-and-conquer troubleshooting method, virtual network infrastructure, 592–595, 610
520–521 VLAN, 556–558, 594
documentation, 502–512, 572 VNI, 357
educated guess troubleshooting method, 522 VPN, 283, 308, 321, 344. See also IPsec
eliminating probable cause, 514 AnyConnect Secure Mobility Client, 321
flowcharts, 512–513 ASA, 321
follow-the-path troubleshooting method, 521–522 authentication, 339–342
gathering information, 514, 516–517 benefits of, 322–323
general troubleshooting procedures, 512–513 client-based VPN, 321, 326
hardware troubleshooting tools, 525–528 clientless VPN, 326
IP connectivity, 574–576 cost metrics, 322
layered models, 517–518 data integrity, 338–339
network layer, 537–539 digital certificates, 327, 333, 335, 339, 341–342,
physical layer, 531–534 344–345
process of, 512–523 DMVPN, 330–331
proposing hypotheses, 514 enterprise VPN, 324–325
protocol analyzers, 525 GRE over IPsec, 328–329
questioning end users, 515–516 MPLS VPN, 332
selecting troubleshooting method, 523 PKI, 327, 344
seven-step troubleshooting process, 513–515 remote access VPN, 283, 308, 312, 314–315, 324,
SNMP traps, 530 325–326
software troubleshooting tools, 524 scalability, 323
solving problems, 515 service provider VPN, 324–325
structured troubleshooting methods, 518–522 site-to-site VPN, 283, 308, 312, 314–315, 323,
substitution troubleshooting method, 522 327–328
symptoms/causes of network problems, 531–545, SOHO, 321
573–574 SSL VPN, 326–327
terminal lines, 529 VTI, 331–332
736 networks

VRF, 595 packet-switched WAN connectivity, 298

WAN parallel network communications, 289
3G/4G/5G, 302, 307, 314 POP, 286
AP, 288 private WAN, 273
ATM, 296, 324 PSTN, 295
backbone networks, 287 public WAN, 273
backhaul networks, 287 purpose of, 272–282, 312
branch networks, 281 SDH cabling standard, 291–292
cable Internet connectivity, 305–306 serial network communications, 289
cable modems, 288 small networks, 279–280
campus networks, 280 SONET cabling standard, 291–292
circuit-switched network communications, 290 standards, 283
circuit-switched WAN connectivity, 295 T-carriers, 294
CO, 286 teleworking, 283, 302, 308, 312, 314
connectivity, 292–301 terminology, 285–287
core devices, 288 toll networks, 286
CPE, 286 topologies, 274–277
CSU, 288 traditional WAN connectivity, 292–296,
DCE, 286–288 312–313
dedicated broadband WAN connectivity, voiceband modems, 288
297–298 wired Internet connectivity, 301–302
demarcation points, 286 wireless Internet connectivity, 302
devices, 287–289 wireless Internet-based broadband connectivity,
distributed networks, 282 306–307
DSL Internet connectivity, 302–304 wireless routers, 288
DSL modems, 288 next available port (PAT), 235–236
DSU, 288 Nexus 9000 series switches, 602
DTE, 286–288 NFS (Network File System), 544
DWDM multiplexing, 292 NMS (Network Management System)
E-carriers, 294 SNMP, 405, 444
Frame Relay networks, 295–296 agent traps, 408–409
Internet-based broadband WAN connectivity, community strings, 412–415
298, 301–311, 314–315 MIB OID, 415
ISDN, 295 Object Navigator, 417–418
ISP Internet connectivity, 309–310 operation of, 406–407
LAN comparisons, 272–273 snmpget utility, 417
leased-line WAN connectivity, 293–294 tools, 524
local loops (last mile), 286 NOC (Network Operations Center), 457
LTE, 307 noise, troubleshooting, 534
Metro Ethernet WAN connectivity, 298–300, 332 nonrepudiation of data, 144
modern WAN connectivity, 296–301, 314 NTP (Network Time Protocol), 400, 443–444
MPLS, 298, 300–301, 324, 332 authoritative time sources, 401–402, 443–444
operation of, 283–292, 312–313 calendar services, 400
optical converters, 288 client topologies, 402–403
OSI model, 284–285 configuring, 402–405
packet-switched network communications, operation of, 401–402
290–291, 295–296
 OSPF (Open Shortest Path First) 737

server topologies, 402–403 election process, 56–59

strata, 401–402 failures/recovery, 58–59
stratum, 401–405, 443–444 multiaccess OSPF networks, 49–51, 53–54, 56–59
time services, 400 router priorities, 61–63
verifying, 403–405 DR election, 20, 23–24
numbered ACL (Access Control Lists), 176 Exchange state, 18
numbered extended IPv4 ACL, 204–206, 209–210 ExStart state, 18
numbered standard IPv4 ACL, 188–189, 191–193, Full state, 18
195 hierarchical networks, 476–477
NVRAM, file systems, 425–426 Init state, 17–19
introduction to, 3
O link-state operation, 6
establishing neighbor adjacencies, 6
Object Navigator (SNMP), 417–418 LSA, 6–7
OC (Optical Carriers), 294 LSDB, 7
OID (Object ID), MIB OID, 415 route selection, 8–9
open (public) API, 631–632 SPF algorithms, 8–9
open resolver attacks (DNS), 131 SPF trees, 8–9
OpenFlow, 598 Loading state, 18
OpenStack, 598 LSA
optical converters, 288 BDR, 24–26
optical fiber Internet connectivity, 305–306 DR, 24–26
optical nodes, 305 flooding, 23–24
Optical Time-Domain Reflectometers (OTDR), 527 multiaccess OSPF networks, 49
order of precedence, router ID, 36–37 adjacencies, 54–56
origin authentication, 144 designated routers, 49–51
HMAC, 147–149 reference topologies, 51–52, 57
IPsec, 333, 335 router election process, 56–59
OS (Operating Systems), hacking, 104 router priorities, 61–63
OSI model verifying router roles, 52–54
common devices, 517–518 multi-area OSPF, 9–11
WAN, 284–285 neighbor adjacencies, 6, 18–20
OSPF (Open Shortest Path First), 17 network types, 84–85
adjacencies, 23–24 operational states, 17–18
algorithms, 5 OSPFv2, 12
BDR OSPFv3, 12–13
adjacencies, 51, 54–56 OSPFv4, 12
election process, 20, 23–24, 56–59 overview of, 3
multiaccess OSPF networks, 49–51, 53, 56–59 packets, 4, 13–14, 17
router priorities, 61–63 hello packets, 15–17
components of, 4–5 LSU packets, 14
data structures, 4–5 point-to-point OSPF networks, 40, 83–84
databases, 5, 20–22 area ID, 40
Down state, 17, 18–19 configuring, 49
DR configuring with ipospf command, 43–44
adjacencies, 51, 54–56 configuring with network command, 41–43
738 OSPF (Open Shortest Path First)

ipospf command, 43–44 LSAck packets, 13–14

loopback interfaces, 48 LSR packets, 13–14, 22
network command, 40, 41–43 LSU packets, 13–14
passive interfaces, 44–46 OSPF packets, 4, 13–17
verifying network type, 46–48 queuing. See delay
wildcard masks, 40–43 sniffers, 103
routers packet-switched network communications, 290–291
configuration mode, 35 ATM, 296, 324
convergence, 6, 17–26 Frame Relay networks, 295–296
designated routers, 49–51 packet-switched WAN connectivity, 298
ID, 34–40, 83 parallel network communications, 289
routing protocol messages, 4 partially meshed WAN topology, 277
single-area OSPF, 9, 10, 34, 38 partner API, 632
cost metrics, 63–67 passive interfaces, point-to-point OSPF networks,
dead intervals, 70–73 44–46
default route propagation, 73–77, 86 passwords
hello packet intervals, 69–73 attacks, 105, 111
modifying, 85–86 changing, 435
point-to-point OSPF networks, 40–49 configuration register, 433–435, 437
reference bandwidth adjustments, 64–66 password crackers, 103
reference topologies, 34–35 plaintext passwords, 415
router ID, 34–40 recovery, 433–436, 437
static routes, 73–77 ROMMON mode, 433–434
test failover to backup routes, 69 PAT (Port Address Translation), 233–234, 251,
verifying, 77–82, 86–87 260–261
Two-Way state, 18, 19–20 analyzing, 254–255
OTDR (Optical Time-Domain Reflectometers), 527 configuring
outbound ACL filters, 167 address pools, 253
output errors, troubleshooting, 551 single IP addresses, 252
output queue drops, 550 NAT comparisons, 236–237
outside global NAT addresses, 231 next available port, 233–234
outside local NAT addresses, 231 source port assignments, 235
outside NAT addresses, 229, 231 verifying, 256–257
paths (network), verifying, 562–566

P penetration testing tools, 102–104

performance, troubleshooting, 532, 535
packetization delays, 355 phishing attacks, 114. See also spear phishing
packets attacks
crafting tools, 103 physical layer (networks)
DBD packets, 13–14, 21–22 troubleshooting, 531–534
filtering, 164–166 verifying, 549–551
hello packets, 13–14, 15–17 physical network topologies, 503
ingress packets, 372 pinging, 532, 534
IPv4 packet headers, 374–375 gathering information (troubleshooting process), 517
IPv6 packet headers, 374–375 IPv4, 547–548
loss, 355–357, 371 IPv6, 548–549
TFTP servers, 438, 440
 QoS (Quality of Service) 739

PKI (Public Key Infrastructure), 327, 344 private (internal) API, 632
plaintext passwords, 415 private clouds, 584
playout delay buffers, 355–356 private IPv4 addresses, 226–227
PoE (Power over Ethernet), switches, 484–486 private WAN (Wide-Area Networks), 273
point-to-point OSPF networks, 40, 83–84 probable cause (troubleshooting process),
area ID, 40 eliminating, 514
configuring, 49 problems (troubleshooting process)
ipospf command, 43–44 defining, 514
network command, 41–43 solving, 515
ipospf command, configuring OSPF, 43–44 program viruses, 107
loopback interfaces, 48 propagating
network command delays, 355
configuring OSPF, 41–43 static routes
syntax, 40 default route propagation, 73–77, 86
passive interfaces, 44–46 single-area OSPF, 73–77
verifying network type, 46–48 proposing hypotheses (troubleshooting process), 514
wildcard masks, 40–43 protocols
point-to-point WAN topology, 274–275 analyzers, 525
policing traffic, QoS, 380–381 encapsulation (IPsec), 336
policy-based SDN, 605 prototyping, virtualization, 589
polling scenarios, SNMP, 415–417 proxy Trojan horses, 107
POP (Point of Presence), 286, 312, 544 PSK (Pre-Shared Keys), 339–340
portable network analyzers, 528 PSTN (Public Service Telephone Networks), 295
ports public clouds, 584
density, switches, 482, 486 public key algorithms, 152–156
destination ports, troubleshooting, 541 public (open) API, 631–632
next available port (PAT), 235–236 public WAN (Wide-Area Networks), 273
redirection attacks, 112 Puppet, 643
source ports PVC (Permanent Virtual Circuits), 295–296
assigning, 235 Python, 638
troubleshooting, 541
speeds, switches, 487
USB ports on routers, 430
Q
VTY port security, standard IPv4 ACL, QoS (Quality of Service)
200–203, 220 classification/marking tools, 371–372
wire speeds, 483 congestion
Postman, 638 avoidance tools, 371, 379–380
power supplies, troubleshooting, 533 management tools, 371, 379–380
PPP (Point-to-Point Protocol), DSL Internet connec- DSP, 357
tivity, 303–304 egress packets, 372
precedence (router ID), order of, 36–37 implementation techniques, 384–385
prefixes, 12 ingress packets, 372
pretexting attacks, 114 IPP, 373, 375, 377–378
PRI (Priority) fields, 373 models, 383–384
Prime NAM (Network Analysis Module), 528 network traffic
prioritizing network traffic, 353–354 data traffic, 357, 360–361
740 QoS (Quality of Service)

video traffic, 357–360

voice traffic, 357, 358
R
network transmissions, 353, 382 rack units (RU), 481, 494
congestion, 353–354 ransomware, 108
delays, 353, 355 RC (Rivest Cipher) series algorithms, 152
packet loss, 355–357 reconnaissance attacks, 109–110
prioritizing traffic, 353–354 recovery, passwords, 433–437
packet loss, avoiding, 371 redundancy
playout delay buffers, 355–356 network design, 469
policy guidelines, 381 scalable networks, 469
policy models redundant links, scalable networks, 466–467
best-effort QoS policy model, 366–367 reference bandwidths, single-area OSPF, 64–66
DiffServ, 366, 369–370 reference topologies
IntServ, 366–368 end-to-end IP connectivity, troubleshooting,
selecting, 366 545–547
queueing algorithms, 361, 383 multiaccess OSPF networks, 51–52, 57
CBWFQ, 364 single-area OSPF, 34–35, 38, 74
FIFO, 362 reflection attacks, 118–120
LLQ, 365 rejoins, routers, multiaccess OSPF networks, 58–59
WFQ, 362–364 reliability, switches, 486
RSVP, 368, 370 remote access Trojan horses, 107
tool usage, sequence of, 372 remote access VPN (Virtual Private Networks), 283,
ToS values, 363, 374–375, 377, 383 308, 312, 314–315, 324–326
traffic removable media, data loss, 98
characteristics, 382–383 reset attacks (TCP), 125–126
classification, 362–363, 368 resiliency, borderless switched networks, 459
marking, 372–379, 382–383 REST (Representational State Transfer), 632–639,
policing, 380–381 651–652
shaping, 380–381 RESTful API, 633–639
WRED, 371 restoring configurations
questioning end users (troubleshooting process), router configurations, 432
515–516 from text files, 428–430
queue drops rid values, 37
input queue drops, 550 risk (security), defined, 96
output queue drops, 550 rogue DHCP servers, 121, 134–136
queueing algorithms (QoS), 383 ROMMON mode, 433–434
CBWFQ, 364 rootkit detectors, 103
FIFO, 362 rootkits, 108
LLQ, 365 routers, 494–495
overview of, 361 800 series routers, 492
WFQ, 362–364 900 series routers, 490
queuing delays, 355 5500 series routers, 491
queuing packets. See delay ASBR, 74
quid pro quo (something for something) attacks, 114 ASR 1000 series routers, 490–491
ASR 9000 series routers, 488–491
BDR, 17
 Ruby 741

election in OSPF, 20, 23–24 LSR packets, 22

LSA, 24–26 modular routers, 492
multiaccess OSPF networks, 49–51, 53, 56–59 MPLS routers, 300–301
branch routers, 488 NAT routers, private/public IPv4 address translations,
configurations 227
copying, 431 NCS 6000 series routers, 489
restoring, 432 network edge routers, 488–489
saving, 435 OSPF
verifying, 432 database synchronization, 20–21
convergence, 6, 17–26 designated routers, 49–51
DBD packets, 21–22 priorities, 16, 61–63
device documentation, 505–506 requirements, 487–488
Dijkstra’s algorithm, 5 service provider routers, 489
DR, 16 software clock, setting manually, 400
election in OSPF, 20, 23–24 SPF algorithms, 10–11
failures/recovery, 58–59 spoke routers, 275–276
LSA, 24–26 USB ports, 430
multiaccess OSPF networks, 49–51, 53–54, 56–59 wireless routers, 288
router ID, 36 routing
DROTHER, 50–53 GRE
edge routers, 74, 470–471, 488–489 GRE over IPsec, 328–329
failover tests to backup routes, single-area OSPF, 69 mGRE, 330–331
file systems, 423–424, 445–446 OSPF
Flash file systems, 425 default route propagation, 73–77, 86
NVRAM file systems, 425–426 link-state operation, route selection, 8–9
fixed configuration routers, 492 protocols
form factors, 490–492 failover tests to backup routes, single-area OSPF,
hub routers, 275–276 69
ID, 16, 34, 40, 83 link-state routing protocols. See OSPF
assigning, 40 messages, 4
choosing, 36–37 scalable routing protocol, 467–468
configuration mode, 35 show ip route command, 517
configuring, 38–39 show ipv6 route command, 517
DR election, 36 tables, troubleshooting, 539
loopback interfaces, 37–38 tuning protocols, scalable networks, 476–477
modifying, 39–40 VRF, 595
order of precedence, 36–37 RPC (Remote Procedure Calls)
reference topologies, 34–35 JSON-RPC, 632
rid values, 37 XML-RPC, 632
synchronization of OSPF databases, 36 RSA (Rivest, Shamir, Adleman)
verifying, 38–39 authentication, 340–342
industrial routers, 490, 492 encryption algorithms, 154
ISR 4000 series routers, 488 RSVP (Resource Reservation Protocol), 368, 370
list of neighbors, 17 RU (Rack Units), 481, 494
LSR, 300–301 Ruby, 643
742 SA (Security Associations)

S OpenFlow, 598
OpenStack, 598
SA (Security Associations), 334–335 policy-based SDN, 605
SaaS (Software as a Service), 584 traditional architectures and, 599
SaltStack, 643 SD-WAN, 648
satellite Internet connectivity, 307 SEAL (Software-Optimized Encryption Algorithm),
saving router configurations, 435 152, 338
scalability security. See also VPN
switches, 487 AnyConnect Secure Mobility Client, 321
VPN, 323 ASA, 140, 321
scalable networks, 493–494 attack tools, 101–102
designing, 465–466, 477 attack types, 104–105
access layer, 475 authentication, 339–340
bandwidth, 474–475 HMAC, 338–339
failure domains, 469–474 MD5, 339
multiple links, 466–467 PSK, 339, 340
redundancy plans, 469 RSA, 340–342
redundant links, 466–467 SHA, 339
scalable routing protocol, 467–468 cryptography, 143, 156, 159
tuning routing protocols, 476–477 data confidentiality, 144, 150
wireless connectivity, 468 data integrity, 144–145
hierarchical networks, 455–458 data nonrepudiation, 144
scalable routing protocol, 467–468 encryption, 151–156
scanning tools, 103–104 hash functions, 144–147
script kiddies, 100 origin authentication, 144, 147–149
script viruses, 107 data confidentiality, 144, 150
SD-Access, 647 data integrity, 144–145
SDH cabling standard, 291–292 data nonrepudiation, 144
SDN (Software-Defined Networking), 595, 598, 600, encryption
610–611 3DES, 152, 338
ACI, 598, 602 AES, 152, 338
ANP, 602 asymmetric encryption, 152–156
APIC, 602–603 DES, 152, 338
APIC-EM, 606–608 DH, 154–156
Nexus 9000 series switches, 602 DSA, 154
spine-leaf topologies, 603 DSS, 154
CEF, 596 ElGamal, 154
central controller, 597 elliptic curve cryptography, 154
control plane, 595 public key algorithms, 152–156
controller-based SDN, 605, 611–612 RC series algorithms, 152
controllers, 600–602 RSA, 154
data plane, 596 SEAL, 152, 338
device-based SDN, 604–605 symmetric encryption, 151–152
framework, 599 ESA, 142
Layer 3 switches, 596 firewalls, 139–140, 210, 220
management plane, 598 GRE over IPsec, 328–329
 security 743

hash functions, 144 content security appliances, 141–143

MD5, 145 cybercriminals, 95
SHA, 146–147 cybersecurity, current state of, 95–98
HMAC, 338–339 DDoS attacks, 116–117
IDS, 140–141 defense-in-depth approach, 138–139
IKE, 335 DHCP attacks, 134–136
IPS, 140–141 DNS attacks, 131–133
IPsec, 333, 344–345. See also VPN DoS attacks, 115–116
AH, 336 dumpster diving attacks, 114
authentication, 339–342 ethical hacking, 95
confidentiality, 333–334, 336–338 exploits, 96
data integrity, 333–335, 338–339 firewalls, 139–140
Diffie-Hellman key exchanges, 333–335, 342–343 ICMP attacks, 117–119
ESP, 336 IDS, 140–141
framework of, 334–335 impersonation attacks, 114
GRE over IPsec, 328–329 integrity, 138
protocol encapsulation, 336 IP attacks, 117–122
SA, 334–335 IP service attacks, 127–136
SSL comparisons, 326–327 IPS, 140–141
transport and tunnel mode, 343 layered approach, 138–139
VTI, 331–332 mitigation, 96
keys, compromised-key attacks, 105 MITM attacks, 112–113, 118
malware, 106, 108–109, 157 password attacks, 111
adware, 108 phishing attacks, 114. See also spear phishing
overview of, 106 attacks
ransomware, 108 port redirection attacks, 112
rootkits, 108 pretexting attacks, 114
spyware, 108 reconnaissance attacks, 109–110
Trojan horses, 106–107 reflection attacks, 118–120
viruses, 106–107 risk, 96
worms, 106, 108 session hijacking attacks, 118
MD5, 339 shoulder surfing attacks, 114
networks, 95, 109, 117, 158 social engineering attacks, 114–115
access attacks, 110–113 something for something (quid pro quo) attacks,
address spoofing attacks, 118, 120–121 114
amplification attacks, 118–120 spam attacks, 114
ARP vulnerabilities/attacks, 127–130 spear phishing attacks, 114. See also phishing
ASA, 140 attacks
assets, 96 spoofing attacks, 111
availability, 138 tailgaiting attacks, 114
baiting attacks, 114 TCP vulnerabilities/attacks, 122–126, 158
best practices, 137–143, 159 threats, 96
blacklisting URL, 142 trust exploitation attacks, 111
breaches, 95 UDP vulnerabilities/attacks, 122, 126–127, 158
buffer overflow attacks, 112–113 URL filtering, 142
confidentiality, 138 vectors of data loss, 97–98
744 security

vectors of network attacks, 96–97 exploitation tools, 104

vulnerabilities, 96 fuzzers, 103
zombies, 116 scanners, 104
origin authentication, 144, 147–149 vulnerability brokers, 100
passwords WSA, 142–143
changing, 435 sequence numbers method, modifying ACL,
configuration register, 433–437 197–198
recovery, 433–437 serial network communications, 289
ROMMON mode, 433–434 serialization delays, 355
SA, 334–335 servers
SHA, 339 DHCP servers, rogue DHCP servers, 121, 134–136,
software disablers, 107 158
SSL sprawl, 587, 609
IPsec comparisons, 326–327 Syslog server
SSL VPN, 326 messages, 419
stateful firewall services, 210, 220 as troubleshooting tool, 529–531
Syslog security levels, 421 TFTP servers
threat actors, 98, 157 backing up configurations from, 428–430, 436
attack tools, 102–104 IOS image backups, 437–442
cybercriminals, 100 pinging, 438, 440
hackers, 98, 100 virtualization, 589
hacktivists, 100 dedicated servers, 586–587
script kiddies, 100 examples of, 587–588
vulnerability brokers, 100 service providers. See ISP
TLS, VPN, 326 services
tools cloud services, 584
debuggers, 104 IaaS, 584
encryption tools, 104 PaaS, 584
evolution of, 102–104 SaaS, 584
forensic tools, 103 stateful firewall services, 210, 220
fuzzers, 103 session hijacking attacks, 118, 126
hacking OS, 104 SET (Social Engineering Toolkits), 115
hacking tools, 103 set operations (SNMP), 406–407
packet crafting tools, 103 seven-step troubleshooting process, 513–515
packet sniffers, 103 severity levels (Syslog), 444–445, 530
password crackers, 103 SFP (Small Form-Factor Pluggable) devices, 482
penetration testing tools, 102–104 SHA (Secure Hash Algorithm), 146–147, 339
rootkit detectors, 103 shaping traffic, QoS, 380–381
scanning tools, 103 shoulder surfing attacks, 114
SET, 115 show interfaces command, 549–550
vulnerability exploitation tools, 104 show ip interface brief command, 517
vulnerability scanners, 104 show ip route command, 517
wireless hacking tools, 103 show ipv6 interface brief command, 517
VTY ports, standard IPv4 ACL, 200–203, 220 show ipv6 route command, 517
vulnerabilities single point of failure, 275, 278
defined, 96 single-area OSPF, 9, 10, 34
 spine-leaf topologies 745

cost metrics, 63–64 SMTP (Simple Mail Transfer Protocol), 544

accumulating costs, 66–67 sniffer attacks, 105
manually setting cost value, 67–69 SNMP (Simple Network Management Protocol), 405,
reference bandwidths, 65 444, 544, 640–641
dead intervals, 70–73 agent traps, 408–409
default route propagation, 73–77, 86 agents, 406–409
hello packet intervals, 69–73 community strings, 412–415
modifying, 85–86 get operations, 406–407
point-to-point OSPF networks, 40 messages, exchanging, 409
area ID, 40 MIB OID, 415
configuring, 49 NMS, 405
configuring with ipospf command, 43–44 nodes, 405–406
configuring with network command, 41–43 Object Navigator, 417–418
ipospf command, 43–44 operation of, 406–407
loopback interfaces, 48 polling scenario, 415–417
network command, 40–43 set operations, 406–407
passive interfaces, 44–46 SNMP manager, 405–406, 407
verifying network type, 46–48 snmpget utility, 417
wildcard masks, 40–43 traps, 530
reference bandwidth adjustments, 64–66 troubleshooting, 543
reference topologies, 34–35, 38 versions of, 409–412
router ID, 34, 40 SOAP (Simple Object Access Protocol), 632
assigning, 40 social engineering attacks, 114–115
choosing, 36–37 social networking, data loss, 98
configuration mode, 35 software
configuring, 38–39 clock
DR election, 36 displaying clock source, 403
loopback interfaces, 37–38 setting manually, 400
modifying, 39–40 security software disablers, 107
order of precedence, 36–37 troubleshooting tools, 524
reference topologies, 34–35, 38 baselining tools, 524
synchronization of OSPF databases, 36 knowledge bases, 524
verifying, 38–39 NMS tools, 524
routers, test failover to backup routes, 69 protocol analyzers, 525
verifying, 86–87 SOHO (Small Office, Home Office), VPN, 321
interface settings, 81–82 solving problems (troubleshooting process), 515
neighbors, 77–79 something for something (quid pro quo) attacks, 114
process information, 80–81 SONET cabling standard, 291–292
protocol settings, 79–80 source ports
single-carrier WAN connections, 278 assigning, 235
single-homed ISP connectivity, 309 troubleshooting, 541
site-to-site VPN (Virtual-Private Networks), 283, spam attacks, 114
308, 312, 314–315, 323–324, 327–328 spear phishing attacks, 114. See also phishing
SLA (Service Level Agreements), 278 attacks
small networks, 279–280 SPF (Shortest-Path First) algorithm, 5, 8–9, 10–11
smart devices, 620 spine-leaf topologies, 603
746 spoke routers

spoke routers, 275–276 ASIC, 485–486

spoke-to-spoke tunnels, 331 business considerations for switch selection,
spoofing attacks, 105, 111 486–487
address spoofing attacks, 118, 120–121 campus LAN switches, 477–478
ARP, 130 Catalyst 2960-C series switches, 485–486
CAM tables, 121 Catalyst 3560-C series switches, 485
DHCP, 134–136 cloud-managed switches, 478
MAC addresses, 120–121 configuring
sprawl (servers), 587, 609 fixed configuration switches, 480
spyware, 108 modular configuration switches, 480
SSH (Secure Shell), 544 stackable configuration switches, 481
ssh -1 command, 517 cost metrics, 486
SSL (Secure Socket Layer) data center switches, 478
IPsec comparisons, 326–327 device documentation, 506
VPN, 326–327 distribution layer switches, 461, 462, 493
stackable configuration switches, 481 file systems, 426–427, 445–446
standard ACL (Access Control Lists), 166, 175, fixed configuration switches, 480
175–176, 179, 190, 200–203, 219–220 flow tables, 601
stateful firewall services, 210, 220 form factors, 479–481
state-sponsored hackers, 100 forwarding rates, 483
static NAT (Network Address Translation), 231–232, frame buffers, 487
239–240, 260–261 group tables, 602
analyzing, 241–242 LAN switches, device documentation, 506
configuring, 240–241 Layer 3 switches, SDN, 596
topology, 240 MAC address tables, 555–557
verifying, 242–244 meter tables, 602
stealth attacks (DNS), 132 modular configuration switches, 480
storage devices (cloud), data loss, 98 multilayer switching, 485–486
STP failures/loops, troubleshooting, 537 network design, 477–487
stratum (NTP), 401–405, 443–444 business considerations for switch selection,
structured troubleshooting methods, 518 486–487
bottom-up troubleshooting method, 518–519 campus LAN switches, 477–478
comparison troubleshooting method, 522 Catalyst 2960-C series switches, 485–486
divide-and-conquer troubleshooting method, Catalyst 3560-C series switches, 485
520–521 cloud-managed switches, 478
educated guess troubleshooting method, 522 data center switches, 478
follow-the-path troubleshooting method, 521–522 fixed configuration switches, 480
selecting, 523 forwarding rates, 483
substitution troubleshooting method, 522 modular configuration switches, 480
top-down troubleshooting method, 519–520 multilayer switching, 485–486
stub networks, NAT, 228 platforms, 477–479
subnet masks, prefix lengths, 12 PoE, 484–485, 486
substitution troubleshooting method, 522 port density, 482
switch blocks, failure domains, 474 service provider switches, 479
switched networks, 464–465 stackable configuration switches, 481
switches, 494–495 switch form factors, 479–481
 tools (security) 747

thickness of switches, 481 headers, 122

virtual networks, 479 reset attacks, 125–126
Nexus 9000 series switches, 602 services, 123
PoE, 484–486 session hijacking attacks, 126
port density, 482, 486 TCP-established extended ACL, 210–211
port speeds, 487 TCP SYN flood attacks, 124
reliability, 486 vulnerabilities, 122–123, 158
RU, 481, 494 TDR (Time-Domain Reflectometers), 527
scalability, 487 teleworking, 283, 302, 308, 312, 314
service provider switches, 479 telnet command, 517, 544
stackable configuration switches, 481 Tera Term, configuration backups from TFTP
thickness of, 481 servers, 427–428, 436
virtual networks, 479 terminal lines, 529
wire speeds, 483 testing
symmetric encryption, 151–152 cable testers, 526–527
symptoms/causes of network problems, failover to backup routes, single-area OSPF, 69
troubleshooting, 573–574 hypotheses (troubleshooting process), 515
data link layer, 534–537 portable network analyzers, 528
physical layer, 531–534 Prime NAM, 528
synchronizing OSPF databases, 20–22 text files, restoring configurations from, 428–430
syntax text method, modifying ACL, 196–197
data formats, 622 TFTP (Trivial File Transfer Protocol), 544
JSON, 624–626 backing up configurations from, 428–430, 436
Syslog servers
configuring, 422–423 IOS image backups, 437–442
introduction to, 418–419 pinging, 438, 440
messages thickness of switches, 481
destination of, 420 threat actors (security), 98, 157
facilities, 422 attack tools, 101–102
format of, 421 cybercriminals, 100
server messages, 419 hackers, 98, 100
timestamps, 422–423 hacktivists, 100
operation of, 420 script kiddies, 100
security levels, 421 vulnerability brokers, 100
severity levels, 444–445, 530 threats (security), defined, 96
Syslog server as troubleshooting tool, 529–531 three-tier network design, 455, 460, 463
traps, configuring, 530–531 time, authoritative time sources, 401–402, 443–444
time services, network management, 400

T Time-Domain Reflectometers. See TDR

timestamps, Syslog messages, 422–423
tailgaiting attacks, 114 TLS (Transport Layer Security), SSL VPN, 326
Talos, ESA, 142 toll networks, 286
T-carriers, 294 tools (security)
TCI (Tag Control Information) fields, 373 attack tools, 101–102
TCP (Transmission Control Protocol) debuggers, 104
flow control, 123 encryption tools, 104
748 tools (security)

evolution of, 102–104 traffic (networks)

forensic tools, 103 classification, 362, 363, 368. See also classification/
fuzzers, 103 marking tools
hacking OS, 104 data traffic, 357, 360–361
hacking tools, 103 flows
packet crafting tools, 103 ACL, 165
packet sniffers, 103 troubleshooting, 541
password crackers, 103 marking, QoS, 373, 382–383
penetration testing tools, 102–104 DSCP, 375–377
rootkit detectors, 103 Ethernet, 373
scanning tools, 103 IPv4, 373, 375
SET, 115 IPv6, 373, 375
vulnerability exploitation tools, 104 Layer 2, 373–374
vulnerability scanners, 104 Layer 3, 374–375
wireless hacking tools, 103 MPLS, 373
top-down troubleshooting method, 519–520 NBAR classifications, 372
topologies Traffic Class field (IPv6), 375
databases, troubleshooting, 539 trust boundaries, 378–379
dynamic NAT, 244–245 Type of Service field (IPv4), 375
hierarchical topologies, multi-area OSPF, 11 Wi-Fi (802.11), 373
logical network topologies, 504–505 policing, QoS, 380–381
MPLS, 300 shaping, QoS, 380–381
NAT terminology, 230 video traffic, 357, 358–360
physical network topologies, 503 voice traffic, 357, 358
reference topologies Traffic Class field (IPv6), 375
multiaccess OSPF networks, 51–52, 57 transmission quality, networks, 353, 382
single-area OSPF, 34–35, 38, 74 congestion, 353, 354
troubleshooting end-to-end IP connectivity, delays, 353
545–547 code delays, 355
spine-leaf topologies, 603 data delays, 360–361
tables, LSDB, 7 de-jitter delays, 355
VPN, 323 fixed delays, 355
remote access VPN, 324 jitter, 291, 294, 355
site-to-site VPN, 327–328 packetization delays, 355
WAN, 274 propagation delays, 355
dual-homed WAN topology, 276 queuing delays, 355
fully meshed WAN topology, 276 serialization delays, 355
hub-and-spoke WAN topology, 275, 330–331 variable delays, 355
partially meshed WAN topology, 277 packet loss, 355–357
point-to-point WAN topology, 274–275 prioritizing traffic, 353–354
ToS (Type of Service) values, 363, 374–375, 377, transport and tunnel mode (IPsec), 343
383 transport layer
traceroute command, 517 troubleshooting
IPv4, 548 ACL, 539–542
IPv6, 548–549 interoperability areas (common), 542–543
traditional WAN connectivity, 292–296, 312–313 NAT for IPv4, 542–543
verifying, 566–567
 troubleshooting 749

transport protocols, 329 high CPU utilization rates, 533

Trojan horses, 106, 107 implicit denies, 541
troubleshooting input errors, 551
access control, 541 input queue drops, 550
address mapping errors, 536 interference, 534
application layer, 543–545 interference configuration errors, 534
attenuation, 533 IP connectivity, 574–576
BOOTP, 543 end-to-end connectivity, 545–549
bottlenecks/congestion, 532 local network addressing, 553–556
broadcasts, 536 verifying ACL, 568–570
cable analyzers, 527 verifying default gateways, 558–562
cable testers, 526–527 verifying DNS, 570–571
cabling faults, 533 verifying network paths, 562–566
connectivity, 535, 539 verifying physical layer, 549–551
connectivity, loss of, 532 verifying transport layer, 566–567
console error messages, 533 VLAN assignments, 556–558
console messages, 536 IPv4 addressing, 541
CPU overloads, 534 NAT for IPv4, 542–543
design limits, 534 neighbor adjacencies, 539
destination ports, 541 networks
DHCP, 543 analyzing information, 514
DNS, 543 application layer, 543–545
EMI, 534 bottom-up troubleshooting, 518–519
encapsulation errors, 536 buffered logging, 529
encryption protocols, 542, 543 comparison troubleshooting method, 522
end-to-end IP connectivity console logging, 529
components of, 545–547 data link layer, 534–537
duplex mismatches, 551–553 defining problems, 514
IPv4 pinging, 547–548 divide-and-conquer troubleshooting method,
IPv4 traceroute command, 548 520–521
IPv6 pinging, 548–549 documentation, 502–512, 572
IPv6 traceroute command, 548–549 educated guess troubleshooting method, 522
reference topologies, 545–547 eliminating probable cause, 514
verifying physical layer, 549–551 flowcharts, 512–513
established keyword, 542 follow-the-path troubleshooting method, 521–522
framing errors, 537 gathering information, 514, 516–517
functionality, 535 general troubleshooting procedures, 512–513
general network issues, 539 hardware troubleshooting tools, 525–528
hardware faults, 533 IP connectivity, 574–576
hardware troubleshooting tools layered models, 517–518
cable analyzers, 527 network layer, 537–539
cable testers, 526–527 physical layer, 531–534
DMM, 525–526 process of, 512–523
portable network analyzers, 528 proposing hypotheses, 514
Prime NAM, 528 protocol analyzers, 525
Syslog server, 529–531 questioning end users, 515–516
750 troubleshooting

selecting troubleshooting method, 523 two-tier network design, 461, 464

seven-step troubleshooting process, 513–515 Two-Way state, 18–20
SNMP traps, 530 Type of Service field (IPv4), 375
software troubleshooting tools, 524
solving problems, 515
structured troubleshooting methods, 518–522
U
substitution troubleshooting method, 522 UCS Manager, 593–594
symptoms/causes of network problems, 531–545, UDP (User Datagram Protocol), 122, 127, 158
573–574 flood attacks, 127
terminal lines, 529 headers, 126
testing hypotheses, 515 unencrypted devices, data loss, 98
top-down troubleshooting method, 519–520 URI (Universal Resource Identifiers), 635, 636
noise, 534 URL (Uniform Resource Locators), 635
output errors, 551 blacklisting, 142
output queue drops, 550 filtering, 142
performance, 532, 535 URN (Uniform Resource Names), 635
physical layer, verifying, 549–551 USB (Universal Serial Buses)
portable network analyzers, 528 backing up configurations from, 436
power supplies, 533 drives
Prime NAM, 528 copying router configurations to, 431–432
process of, 572–573 displaying contents of, 430
protocol analyzers, 525 verifying connections, 430–431
routing tables, 539 routers and USB ports, 430
SNMP, 543
software troubleshooting tools, 524
baselining tools, 524
V
knowledge bases, 524 variable delays, 355
NMS tools, 524 vectors of
protocol analyzers, 525 data loss, 97–98
source ports, 541 network attacks, 96–97
STP failures/loops, 537 verifying
Syslog server, 529–531 ACL, 568–570
tools, 573 CDP, 391–393
topology databases, 539 dead intervals, single-area OSPF, 70–71
traffic flows, 541 default gateways, 558–560
transport layer IPv4, 559
ACL, 539–542 IPv6, 560–562
NAT for IPv4, 542–543 default route propagation, single-area OSPF, 75–77
tunneling protocols, 543 DNS, 570–571
VPN protocols, 542 dynamic NAT, 249–251
wildcard masks, 541 extended ACL, 216–218
trust boundaries, QoS traffic marking, 378–379 extended ACL edits, 213–214
trust exploitation attacks, 111 hello intervals, single-area OSPF, 70–71
tunneling IOS image size in Flash, 439, 440–441
DNS tunneling, 132–133 LLDP, 397
protocols, troubleshooting, 543 local network addressing, 553–556
network paths, 562–566
 VPN (Virtual Private Networks) 751

NTP, 403–404, 405 device-based SDN, 604–605

OSPF network type, 46–48 framework, 599
PAT, 256–257 Layer 3 switches, 596
physical layer, 549–551 management plane, 598
router configurations to USB drives, 432 OpenFlow, 598
router ID, 38–39 OpenStack, 598
single-area OSPF, 86–87 policy-based SDN, 605
interface settings, 81–82 traditional architectures and, 599
neighbors, 77–79 servers, 589
process information, 80–81 dedicated servers, 586–587
protocol settings, 79–80 examples of, 587–588
transport layer, 566–567 virtual network infrastructure, 592–593
video traffic, 357–360 complexity of, 594–595, 610
virtual circuits, 275–276, 295–296 UCS Manager, 593–594
virtual machines (VM), VLAN, 594 VRF, 595
virtual networks, 610 viruses, 106–107
complexity of, 594–595 VLAN (Virtual Local Area Networks),
hypervisors, 592–593 556–558, 594
switches, 479 VM (Virtual Machines), VLAN, 594
UCS Manager, 593–594 VNI (Visual Networking Index), 357
VRF, 595 voice traffic, 357–358
virtualization, 583, 609 voiceband modems, 288
abstraction layers, 589–590 VoIP (Voice over Internet Protocol), 294
advantages of, 589 VPLS. See Metro Ethernet WAN connectivity
AWA Management Console, 586 VPN (Virtual Private Networks), 283, 308, 321, 344.
cloud computing, 583, 585–586, 609 See also IPsec
cloud services, 584 AnyConnect Secure Mobility Client, 321
community clouds, 585 ASA, 321
data centers versus, 585 authentication, 339–340
hybrid clouds, 584–585 PSK, 339–340
IaaS, 584 RSA, 340–342
PaaS, 584 benefits of, 322–323
private clouds, 584 client-based VPN, 321, 326
public clouds, 584 clientless VPN, 326
SaaS, 584 cost metrics, 322
disaster recovery, 589 data integrity, 338–339
hypervisors, 588, 591–593 digital certificates, 327, 333, 335, 339, 341–342,
legacy support, 589 344–345
prototyping, 589 DMVPN, 330–331
SDN, 592–593, 598, 600, 610–611 enterprise VPN, 324–325
ACI, 598, 602–603 GRE over IPsec, 328–329
CEF, 596 MPLS VPN, 331–332
central controller, 597 Layer 2 MPLS VPN, 324, 332–344
control plane, 595 Layer 3 MPLS VPN, 324, 332–334
controller-based SDN, 605, 611–612 PKI, 327, 344
controllers, 600–602 protocols, troubleshooting, 542
data plane, 596
752 VPN (Virtual Private Networks)

remote access VPN, 283, 308, 312, 314–315, 324, serial network communications, 289
325–326 SONET cabling standard, 291–292
scalability, 323 connectivity
service provider VPN, 324–325 3G/4G/5G, 302, 307, 314
site-to-site VPN, 283, 308, 312, 314–315, 323–324, cable Internet connectivity, 305, 306
327–328 circuit-switched WAN connectivity, 295
SOHO, 321 dedicated broadband WAN connectivity,
SSL VPN, 326–327 297–298
VTI, 331–332 DSL Internet connectivity, 302–304
VRF (Virtual Routing and Forwarding), 595 Internet-based broadband WAN connectivity,
VTI (Virtual Tunnel Interfaces), 331–332 298, 301–311, 314–315
VTY port security, standard IPv4 ACL, 200–203, ISDN, 295
220 ISP Internet connectivity, 309–310
vulnerabilities (security) leased-line WAN connectivity, 293–294
defined, 96 LTE, 307
exploitation tools, 104 Metro Ethernet WAN connectivity, 298–300, 332
fuzzers, 103 modern WAN connectivity, 296–301, 314
scanners, 104 MPLS, 298, 300–301, 324, 332
vulnerability brokers, 100 packet-switched WAN connectivity, 298
PSTN, 295
W solution comparisons, 311
teleworking, 283, 302, 308, 312, 314
WAN (Wide-Area Networks) traditional WAN connectivity, 292–296, 312–313
AP, 288 wired Internet connectivity, 301–302
backbone networks, 287 wireless Internet connectivity, 302
backhaul networks, 287 wireless Internet-based broadband connectivity,
branch networks, 281 306–307
cable modems, 288 core devices, 288
campus networks, 280 CPE, 286
carrier WAN connections, 278 CSU, 288
dual-carrier WAN connections, 278–279 DCE, 286–288
single-carrier WAN connections, 278 demarcation points, 286
CO, 286 devices, 287–289
communications distributed networks, 282
ATM, 296, 324 DSL modems, 288
circuit-switched network communications, 290 DSU, 288
demodulation, 288, 295 DTE, 286–288
DWDM multiplexing, 292 E-carriers, 294
Frame Relay networks, 295–296 evolution of, 279–282
jitter, 291, 294, 355 LAN comparisons, 272–273
latency, 291, 294, 302, 314 local loops (last mile), 286
modulation, 288, 295 operation of, 283–292, 312–313
packet-switched network communications, optical converters, 288
290–291, 295–296 OSI model, 284–285
parallel network communications, 289 POP, 286
SDH cabling standard, 291–292 private WAN, 273
 zombies 753

public WAN, 273 VPN, 283, 308, 321, 344

purpose of, 272–282, 312 AnyConnect Secure Mobility Client, 321
small networks, 279–280 ASA, 321
standards, 283 authentication, 339–342
T-carriers, 294 benefits of, 322–323
terminology, 285–287 client-based VPN, 321, 326
toll networks, 286 clientless VPN, 326
topologies, 274 cost metrics, 322
dual-homed WAN topology, 276 data integrity, 338–339
fully meshed WAN topology, 276 digital certificates, 327, 333, 335, 339, 341–342,
hub-and-spoke WAN topology, 275, 330–331 344–345
partially meshed WAN topology, 277 DMVPN, 330–331
point-to-point WAN topology, 274–275 enterprise VPN, 324–325
voiceband modems, 288 GRE over IPsec, 328–329
wireless routers, 288 MPLS VPN, 332
WAP (Wireless Access Points), PoE, 485 PKI, 327, 344
web service API, 632–633 remote access VPN, 283, 308, 312, 314–315,
JSON-RPC, 632–633 324–326
REST, 632–633, 651–652 scalability, 323
RESTful API, 633–639 service provider VPN, 324–325
SOAP, 632 site-to-site VPN, 283, 308, 312, 314–315, 323,
XML-RPC, 632–633 327–328
WFQ (Weight Fair Queuing), 362–364 SOHO, 321
white hat hackers, 99 SSL VPN, 326–327
Wi-Fi (802.11), QoS traffic marking, 373 VTI, 331–332
wildcard masks, 168, 182–183 VPN. See also IPsec
calculating, 170–172 WiMAX, 307
examples of, 168–169 wireless routers, 288
IPv4 worms, 106, 108
address ranges, 170 WRED (Weighted Random Early Detection), 371
subnets, 169–170 WSA (Web Security Appliance), 142–143
keywords, 172–173
matching hosts, 169–170
point-to-point OSPF networks, 40–43
X
troubleshooting, 541 XML (Extensible Markup Language), 623, 627–628
WiMAX (Worldwide Interoperability Microwave XML-RPC (Extensible Markup Language-Remote
Access), 307 Procedure Call), 632–633
wire speeds, 483
wired Internet connectivity, 301–302
wireless connectivity, scalable networks, 466–467
Y
wireless hacking tools, 103 YAML (YAML Ain’t Markup Language), 623,
wireless Internet connectivity, 302 626–627
wireless Internet-based broadband connectivity, 306
cellular Internet connectivity, 306–307
municipal Wi-Fi Internet connectivity, 306
Z
satellite Internet connectivity, 307 zombies, 116