CCNA: Fast Pass phần 2 potx

1.3 Selecting an Appropriate Routing Protocol Based on User Requirements 23 DUAL provides EIGRP with possibly the fastest route convergence time among all protocols. The key to EIGRP’s speedy convergence is twofold: first, EIGRP routers maintain a copy of all of their neighbors’ routes, which they use to calculate their own cost to each remote network. If the best path goes down, it may be as simple as examining the contents of the topology table to select the best replacement route. Secondly, if there isn’t a good alternative in the local topology table, EIGRP routers very quickly ask their neighbors for help finding one—they aren’t afraid to ask directions! Relying on other routers, and leveraging the information they provide accounts for the “diffusing” character of DUAL. As I said, the whole idea of the Hello messages is to enable the rapid detection of new or dead neighbors. RTP answers this call by providing a reliable mechanism for conveying and sequencing messages. Building upon this solid foundation, DUAL is responsible for selecting and maintaining information about the best paths. Multiple AS EIGRP uses autonomous system numbers (ASNs) to identify the collection of routers that share route information. Only routers that have the same ASN share routes. In large networks, you can easily end up with really complicated topology and route tables, and that can markedly slow convergence during diffusing computation operations. So what’s an administrator to do to mitigate the impact of managing really big networks? Well, it’s possible to divide the network into multiple distinct EIGRP AS. Each AS is populated by a contiguous series of routers, and route information can be shared among the different AS via redistribution. The use of redistribution within EIGRP leads us to another interesting feature. Normally, the administrative distance of EIGRP routes is 90, but this is true only for what are known as internal EIGRP routes. These are routes originated within a specific autonomous system by EIGRP routers that are members of the same autonomous system. The other type of route is called an external EIGRP route and it has an administrative distance of 170, which is not so good. These routes appear within EIGRP route tables courtesy of either manual or auto- matic redistribution, and they represent networks that originated outside of the EIGRP auton- omous system. It doesn’t matter if the routes originated from another EIGRP autonomous system or from another routing protocol like OSPF—they’re all considered external routes when they are redistributed within EIGRP. VLSM Support and Summarization As one of the more sophisticated classless routing protocols, EIGRP supports the use of VLSMs. This support is really important because it allows address space to be conserved through the use of subnet masks that more closely fit the host requirements—like using 30-bit subnet masks for point-to-point networks. Because the subnet mask is propagated with every route update, EIGRP also supports the use of discontinuous subnets, something that gives you a lot more flex- ibility when you are designing your network’s IP address plan. What’s a discontinuous subnet? It’s one that has two classful networks connected together by a different class of networks. Figure 1.6 displays a typical discontinuous network. 4309c01.fm Page 23 Thursday, October 23, 2003 4:37 PM 24 Chapter 1  Planning & Designing FIGURE 1.6 Discontiguous network In this figure, the subnets 172.16.10.0 and 172.16.20.0 are connected with a 10.3.1.0 network. Each router thinks it has the entire 172.16.0.0 class B network by default. EIGRP also supports the manual creation of summaries at any and all EIGRP routers, which can substantially reduce the size of the route table. However, EIGRP automatically summarizes networks at their classful boundaries. Figure 1.7 shows how an EIGRP network would see the network plus the boundaries that it would auto summarize. FIGURE 1.7 EIGRP Auto Summarization Obviously, this would never work by default! 172.16.20.1/24 E0 Host_B 172.16.20.2/24 Lab_A 172.16.10.1/24 E0 S0 S0 Lab_B Host_A 172.16.10.2/24 172.16.10.0/24 172.16.20.0/24 10.3.1.2/2410.3.1.1/24 10.3.1.0/24 172.16.20.1/24 E0 Host_B 172.16.20.2/24 Lab_A 172.16.10.1/24 E0 S0 S0 Lab_B Host_A 172.16.10.2/24 172.16.10.0/24 172.16.20.0/24 10.3.1.2/24 Network 172.16.0.0 is over here! 10.3.1.1/24 Network 172.16.0.0 is over here! 10.3.1.0/24 4309c01.fm Page 24 Thursday, October 23, 2003 4:37 PM 1.3 Selecting an Appropriate Routing Protocol Based on User Requirements 25 Link State (OSPF) In link-state protocols, also called shortest path first protocols, the routers each create three sep- arate tables. One of these tables keeps track of directly attached neighbors, one determines the topology of the entire internetwork, and one is used as the routing table. Link-state routers know more about the internetwork than any distance-vector routing protocol. OSPF is an IP routing protocol that is completely link state. Link state protocols send updates containing the state of their own link to all other routers on the network. OSPF is an open standards routing protocol that’s been implemented by a wide variety of network vendors, including Cisco. If you have multiple routers, and not all of them are Cisco (what?!) then you can’t use EIGRP, now can you? So your remaining options are basically RIP, RIPv2, or OSPF. If it’s a large network, then really, your only options are OSPF, or something called route redistribution—a translation service between routing protocols. OSPF works by using the Dijkstra algorithm. First, a shortest path first tree is constructed, and then the routing table is populated with the resulting best paths. OSPF converges quickly, although perhaps not as quickly as EIGRP, and it supports multiple, equal-cost routes to the same destination. But unlike EIGRP, it only supports IP routing—not really a negative to using OSPF, if you ask me! OSPF is the first link-state routing protocol that most people are introduced to, so it’s useful to see how it compares to more traditional distance-vector protocols like RIPv1. Table 1.4 compares these two protocols. TABLE 1.4 Comparing OSPF and RIP Characteristic OSPF RIPv1 Type of protocol Link-state Distance-vector Classless support Yes No VLSM support Yes No Auto summarization No Yes Manual summarization Yes No Route propagation Multicast on change Periodic broadcast Path metric Bandwidth Hops Hop count limit None 15 Convergence Fast Slow 4309c01.fm Page 25 Thursday, October 23, 2003 4:37 PM 26 Chapter 1  Planning & Designing OSPF has many features beyond the few I’ve listed in Table 1.4, and all of them contribute to a fast, scalable, and robust protocol that can be actively deployed in thousands of production networks. OSPF is supposed to be designed in a hierarchical fashion, which basically means that you can separate the larger internetwork into smaller internetworks called areas. This is the best design for OSPF. The reasons for creating OSPF in a hierarchical design are as follows:  To decrease routing overhead  To speed up convergence  To confine network instability to single areas of the network This does not make configuring OSPF easier. Figure 1.8 shows a typical OSPF simple design: FIGURE 1.8 OSPF design example Notice how each router connects to the backbone—called area 0, or the backbone area. OSPF must have an area 0, and all routers should connect to this area if at all possible, but routers that connect other areas within an AS together are called area border routers (ABRs). Still, at least one interface must be in area 0. OSPF runs inside an AS, but it can also connect multiple AS together. The router that connects these AS together is called an autonomous system boundary router (ASBR). Ideally, you would create other areas of networks to help keep route updates to a minimum, and to keep problems from propagating throughout the network. Peer authentication Yes No Hierarchical network Yes (using areas) No (flat only) Route computation Dijkstra Bellman-Ford TABLE 1.4 Comparing OSPF and RIP (continued) Characteristic OSPF RIPv1 172.16.10.0 172.16.20.0 172.16.30.0 172.16.40.0 172.16.50.0 S0E0 2501A F0/0 2621A S1S0 E0 2501B E0S0 2501C 4309c01.fm Page 26 Thursday, October 23, 2003 4:37 PM 1.4 Designing a Simple Internetwork Using Cisco Technology 27 Exam Essentials Understand the differences between distance-vector, link state, and hybrid routing protocols. Each technology has its own characteristics and methods for sharing routing information between routers. Be prepared to identify problems and solutions common to all distance-vector routing protocols. Know what type of routing protocol RIP, IGRP, EIGRP, and OSPF are, and know their prop- erties. Rip and IGRP are distance-vector routing protocols, EIGRP is a hybrid, and OSPF is link state. IGRP and EIGRP are Cisco proprietary, RIP and OSPF are industry standard. 1.4 Designing a Simple Internetwork Using Cisco Technology As I already mentioned, an internetwork is simply a collection of connected networks. In this section, I will show you one method of creating a simple internetwork by connecting multiple virtual LANs (VLANs). Introduction to VLANs Layer 2 switched networks are typically designed as a flat networks from a broadcast perspective, as you can see from Figure 1.9. Every broadcast packet that is transmitted is seen by every device on the network, regardless of whether the device needs to receive that data or not. FIGURE 1.9 Flat network structure By default, routers allow broadcasts only within the originating network, but switches forward broadcasts to all segments. The reason it’s called a flat network is because it’s one broadcast domain, not because its design is physically flat. Host A 4309c01.fm Page 27 Thursday, October 23, 2003 4:37 PM 28 Chapter 1  Planning & Designing In Figure 1.9, you can see Host A sending a broadcast and all ports on all switches forwarding this broadcast, except the port that originally received it. Now look at Figure 1.10, which shows a switched network. It shows Host A sending a frame with Host D as its destination, and as you can see, that frame is only forwarded out the port where Host D is located. This is a huge improvement over the old hub networks, unless having one collision domain by default is what you really want. FIGURE 1.10 The benefit of a switched network You already know that the largest benefit gained by having a Layer 2 switched network is that it creates individual collision domain segments for each device plugged into the switch. This scenario frees you from the Ethernet distance constraints, so now you can build larger networks. But with each new advance, you often encounter new issues—the larger the number of users and devices, the more broadcasts and packets each switch must handle. And here’s another benefit—security! This one’s a real problem because within the typical Layer 2 switched internetwork, all users can see all devices by default. In addition, you can’t stop devices from broadcasting, nor users from trying to respond to broadcasts. Your security options are dismally limited to placing passwords on the servers and other devices. But not if you create a virtual LAN (VLAN), my friend! Yes, indeed, you can solve many of the problems associated with layer-2 switching with VLANs—as you’ll soon see! Here are several ways that VLANs simplify network management:  The VLAN can group several broadcast domains into multiple logical subnets.  You can accomplish network additions, moves, and changes by configuring a port into the appropriate VLAN.  You can place a group of users who need high security into a VLAN so that no users outside of the VLAN can communicate with them.  As a logical grouping of users by function, VLANs can be considered independent from their physical or geographic locations.  VLANs can enhance network security.  VLANs increase the number of broadcast domains while decreasing their size. Host A Host D 4309c01.fm Page 28 Thursday, October 23, 2003 4:37 PM 1.4 Designing a Simple Internetwork Using Cisco Technology 29 Broadcast Control Broadcasts occur in every protocol, but how often they occur depends upon three things:  The type of protocol  The application(s) running on the internetwork  How these services are used Since switches have become more cost-effective lately, many companies are replacing their flat hub networks with a pure switched network and VLAN environment. All devices in a VLAN are members of the same broadcast domain and receive all broadcasts. The broadcasts, by default, are filtered from all ports on a switch that are not members of the same VLAN. This is great because it offers all the benefits you gain with a switched design without the serious anguish you would experience if all your users were in the same broadcast domain! Security It seems that there’s always a catch, though, so let’s get back to those security issues. A flat inter- network’s security used to be tackled by connecting hubs and switches together with routers— so, basically, it was the router’s job to maintain security. This arrangement was pretty ineffective for several reasons:  First, anyone connecting to the physical network could access the network resources located on that physical LAN.  Secondly, all anyone had to do to observe any and all traffic happening in that network was simply plug a network analyzer into the hub. And in that same vein, users could join a workgroup by just plugging their workstations into the existing hub. So basically, this was non-security! This is why VLANs are so cool. By building them and creating multiple broadcast groups, administrators can now have control over each port and user! The days where users could just plug their workstations into any switch port and gain access to network resources are history because the administrator now has control over each port and whatever resources that port can access. Also, because you can create VLANs in accordance with the network resources a user requires, you can configure switches to inform a network management station of any unauthorized access to network resources. And if you need inter-VLAN communication, you can implement restric- tions on a router to achieve it. You can also place restrictions on hardware addresses, protocols, and applications—now we’re talking security! VLANs and Switches Layer 2 switches only read frames for filtering—they don’t look at the Network layer protocol. Also, by default, switches forward all broadcasts, but if you create and implement VLANs, you’re essentially creating smaller broadcast domains at Layer 2. This means that broadcasts sent out from a node in one VLAN won’t be forwarded to ports configured to be in a different VLAN. So by assigning switch ports or users to VLAN groups on a switch or group of connected switches (called a switch fabric), you gain the flexibility to add 4309c01.fm Page 29 Thursday, October 23, 2003 4:37 PM 30 Chapter 1  Planning & Designing only the users you want into that broadcast domain regardless of their physical location! This setup can also work to block broadcast storms caused by a faulty NIC as well as prevent an application from propagating the storms throughout the entire internetwork. Those evils can still happen on the VLAN where the problem originated, but the disease will be quarantined to only that ailing VLAN. Another advantage of segmenting with VLANs is that when a single VLAN gets too big, you can create multiple VLANs to keep the broadcasts from consuming too much bandwidth—the fewer users in a VLAN, the fewer users are affected by broadcasts. This is all well and good, but you must keep network services in mind and understand how the users connect to these services when you create your VLAN. It’s a good idea to try and keep all services, except for the e-mail and Internet access that everyone needs, local to all users when possible. To understand how a VLAN works within a switch, begin by looking at a traditional net- work. Figure 1.11 shows how a network can be created by connecting physical LANs using hubs to routers. FIGURE 1.11 Physical LANs connected to routers Here you can see that each network was attached with a hub port to the router (each segment also had its own logical network number, although this is not obvious from the figure). Each node attached to a particular physical network had to match that network number in order to be able to communicate on the internetwork. Notice that each department had its own LAN, so if you needed to add new users to Sales, for example, you would just plug them into the Sales LAN and they would have automatically been part of the Sales collision and broadcast domain. This design really did work well for many years. But there was one major flaw: what happened if the hub for Sales was full and you needed to add another user to the Sales LAN? Or, what would you have done if there was no more physical space in the location where the Sales team was located for this new employee? Well, as an example, let’s say that there happens to be plenty of room in the Finance section of the building. That new Sales team member will have to sit on the same side of the building Finance Management Engineering Sales MarketingShipping Hubs 4309c01.fm Page 30 Thursday, October 23, 2003 4:37 PM 1.4 Designing a Simple Internetwork Using Cisco Technology 31 as the Finance people, and we’ll plug the poor soul into the hub for Finance. Doing this obviously makes that the new user part of the Finance LAN, which is bad for many reasons. First and foremost, you now have a security issue because this new user is a member of the Finance broadcast domain and can therefore see all the same servers and network services that all of the Finance folks can. Secondly, for this user to access the Sales network services they need to get the job done, they would need to go through the router to login to the Sales server—not exactly efficient! Now take a look at what a switch accomplishes. Figure 1.12 demonstrates how switches remove the physical boundary to solve our problem. FIGURE 1.12 Using switches to remove physical boundaries Figure 1.12 shows how six VLANs (numbered 2–7) were used to create a broadcast domain for each department. Each switch port was then administratively assigned a VLAN membership, depending on the host and which broadcast domain it must be in. So now, if I need to add another user to the Sales VLAN (VLAN 7), I can just assign the port I need to VLAN 7, regardless of where the new Sales team member is physically located—nice! This illustrates one of the sweetest advantages to designing your network with VLANs over the old collapsed backbone design. Now, cleanly and simply, each host that needs to be in the Sales VLAN is merely assigned to VLAN 7. Notice that I started assigning VLANs with VLAN number 2. The number is irrelevant, but you might be wondering what happened to VLAN 1. That VLAN is an administrative VLAN, and even though it can be used for a workgroup, Cisco recommends that you use it for admin- istrative purposes only. You can’t delete or change the name of VLAN 1, and by default, all ports on a switch are members of VLAN 1 until you change them. VLAN2 VLAN3 VLAN4 VLAN2 VLAN7 VLAN3 VLAN3 VLAN6 VLAN5 VLAN5 VLAN6 VLAN4 Provides inter-VLAN communication and WAN services Marketing VLAN2 172.16.20.0/24 Shipping VLAN3 172.16.30.0/24 Engineering VLAN4 172.16.40.0/24 Finance VLAN5 172.16.50.0/24 Management VLAN6 172.16.60.0/24 Sales VLAN7 172.16.70.0/24 4309c01.fm Page 31 Thursday, October 23, 2003 4:37 PM 32 Chapter 1  Planning & Designing Each VLAN is considered a broadcast domain, so it must also have its own subnet number, as shown in Figure 1.12. And if you’re also using IPX, then you must assign each VLAN its own IPX network number. Now let’s get back to that “because of switches, we don’t need routers anymore” miscon- ception. In Figure 1.12, notice that there are seven VLANs or broadcast domains, counting VLAN 1. The nodes within each VLAN can communicate with each other, but not with any- thing in a different VLAN, because the nodes in any given VLAN “think” that they’re actually in a collapsed backbone, as in Figure 1.11. And what handy little tool do you need to enable the hosts in Figure 1.11 to communicate to a node or host on a different network? You guessed it—a router! Those nodes must go through a router, or some other Layer 3 device, just like when they were configured for VLAN communication (as shown in Figure 1.12). It’s the same as if you are trying to connect different physical networks. Communication between VLANs must go through a Layer 3 device, so don’t expect routers to disappear anytime soon! VLAN Memberships VLANs are usually created by an administrator who then assigns switch ports to each VLAN. Such a VLAN is called a static VLAN. If the administrator wants to do a little more work up front and assign all the host devices’ hardware addresses into a database, they can configure the switches to assign VLANs dynamically whenever a host is plugged into a switch. Static VLANs In most implementations, you will usually use static. This type of VLAN is also the most secure. The switch port to which you assign a VLAN association always maintains that association until you manually change that port assignment. This type of VLAN configuration is comparatively easy to set up and monitor, and it works well in a network where the movement of users within the network is controlled. Although it can be helpful to use network management software to configure the ports, it’s not mandatory. In Figure 1.12, each switch port was configured with a VLAN membership by an adminis- trator based on which VLAN the host needed to be a member of—the device’s actual physical location doesn’t matter. The broadcast domain the hosts will become a member of is an admin- istrative choice. Remember that each host must also have the correct IP address information. For example, each host in VLAN 2 must be configured into the 172.16.20.0/24 network. It is also important to remember that if you plug a host into a switch, you must verify the VLAN membership of that port. If the membership is different than what that host needs, the host will not be able to reach the needed network services, such as a workgroup server. Dynamic VLANs A dynamic VLAN determines a node’s VLAN assignment automatically. Using intelligent management software, you can enable hardware (media access control [MAC]) addresses, protocols, or even applications to create dynamic VLANs; it’s up to you. For example, suppose MAC addresses have been entered into a centralized VLAN management application. If a node 4309c01.fm Page 32 Thursday, October 23, 2003 4:37 PM [...]... High-Level Data Link Control (HDLC), the MAC layer protocol that encapsulates the packets Review Questions Review Questions 1 What is the address range of a class C network address? A 0– 127 B 1– 126 C 128 –191 D 1 92 22 3 2 What is the result of using a hierarchical addressing scheme? A Increased number of addresses B Decreased amount of routers needed C Increased memory usage on routers D No routing tables... Protocols (such as IP, IPX, AppleTalk) 3 Network Control Protocol (NCP) (specific to each Network-layer protocol) 2 Link Control Protocol (LCP) High-Level Data Link Control Protocol (HDLC) 1 Physical layer (such as EIA/TIA -23 2, V .24 , V.35, ISDN) PPP contains four main components: EIA/TIA -23 2-C A Physical layer international standard for serial communication HDLC A method for encapsulating datagrams over... refers to those terminals that understand ISDN standards and can plug right into an ISDN network TE2 A terminal equipment type 2 (TE2) device refers to those terminals that predate ISDN standards To use a TE2, you have to use a terminal adapter (TA) to be able to plug into an ISDN network An example of a TE2 device would be a serial interface on a router or a standard PC NT1 The network termination 1... connects into the telco I’ll talk about reference points next NT2 The network termination 2 (NT2) device is typically a provider’s equipment, like a switch or private branch exchange (PBX) It also provides Data Link and Network layer implementation It’s very rare to find these on a customer’s premises TA A terminal adapter (TA) converts TE2 non-ISDN signaling to signaling that’s used by the ISDN switch... (1.544Mbps) and a CIR of 25 6Kbps By doing this, you get the first 25 6Kbps of traffic you send guaranteed to be delivered Anything beyond that is called a burst, which is a transmission that exceeds your guaranteed 25 6Kbps and can be any amount up to the T1 access rate In a perfect world this always works beautifully—but remember that little word guarantee—as in the guaranteed rate of 25 6Kbps, to be exact?... For transmission keepalives to ensure that the PVC does not shut down because of inactivity Answers to Review Questions 57 Answers to Review Questions 1 D The address range of a class C network is 1 92 22 3 2 A The designers created a hierarchical addressing scheme when they created the IP address so that more addresses would be available to each network 3 A, E Bridges break up collision domains, which... the router and the local ISDN switch comes up 2 The ISDN switch uses the SS7 signaling technique to set up a path to a remote switch 3 The remote switch sets up the D-channel link to the remote router 4 The B channels are then connected end-to-end Primary Rate Interface (PRI) In North America and Japan, the ISDN PRI service (also known as 23 B+D1) delivers 23 64Kbps B channels and one 64Kbps D channel,... adding switches to your VTP domain, you can include passwords, but don’t forget that every switch must be set up with the same password—this can get ugly Switches detect the additional VLANs within a VTP advertisement and then prepare to receive information on their trunk ports with the newly defined VLAN in tow This information would be either VLAN ID, 8 02. 10 SAID fields, or LANE information Updates are... devices on a segment are part of a different broadcast domain D One device per segment can concurrently send frames to the switch 5 What is the default administrative distance for IGRP? A 90 B 100 C 120 D 22 0 55 56 6 Chapter 1 Planning & Designing What does split horizon do? A Ensures that information about a route will not be sent back in the direction from which the original update came B It splits... logical interfaces: R The R reference point defines the point between non-ISDN equipment (TE2) and a TA S The S reference point defines the point between the customer router and an NT2 This reference point enables calls between the different customer equipment T The T reference point defines the point between NT1 and NT2 devices S and T reference points are electrically the same and can perform the same . 1 72. 16 .20 .1 /24 E0 Host_B 1 72. 16 .20 .2/ 24 Lab_A 1 72. 16.10.1 /24 E0 S0 S0 Lab_B Host_A 1 72. 16.10 .2/ 24 1 72. 16.10.0 /24 1 72. 16 .20 .0 /24 10.3.1 .2/ 2410.3.1.1 /24 10.3.1.0 /24 1 72. 16 .20 .1 /24 E0 Host_B 1 72. 16 .20 .2/ 24 Lab_A 1 72. 16.10.1 /24 . E0 Host_B 1 72. 16 .20 .2/ 24 Lab_A 1 72. 16.10.1 /24 E0 S0 S0 Lab_B Host_A 1 72. 16.10 .2/ 24 1 72. 16.10.0 /24 1 72. 16 .20 .0 /24 10.3.1 .2/ 24 Network 1 72. 16.0.0 is over here! 10.3.1.1 /24 Network 1 72. 16.0.0 is over. (continued) Characteristic OSPF RIPv1 1 72. 16.10.0 1 72. 16 .20 .0 1 72. 16.30.0 1 72. 16.40.0 1 72. 16.50.0 S0E0 25 01A F0/0 26 21A S1S0 E0 25 01B E0S0 25 01C 4309c01.fm Page 26 Thursday, October 23 , 20 03 4:37 PM 1.4 Designing