- •Warning and Disclaimer
- •Feedback Information
- •Trademark Acknowledgments
- •About the Author
- •About the Technical Reviewers
- •Dedication
- •Acknowledgments
- •Contents at a Glance
- •Contents
- •Icons Used in This Book
- •Command Syntax Conventions
- •Cisco’s Motivation: Certifying Partners
- •Format of the CCNA Exams
- •What’s on the CCNA Exams
- •ICND Exam Topics
- •Cross-Reference Between Exam Topics and Book Parts
- •CCNA Exam Topics
- •INTRO and ICND Course Outlines
- •Objectives and Methods
- •Book Features
- •How This Book Is Organized
- •Part I: LAN Switching
- •Part II: TCP/IP
- •Part III: Wide-Area Networks
- •Part IV: Network Security
- •Part V: Final Preparation
- •Part VI: Appendixes
- •How to Use These Books to Prepare for the CCNA Exam
- •For More Information
- •Part I: LAN Switching
- •“Do I Know This Already?” Quiz
- •Foundation Topics
- •Brief Review of LAN Switching
- •The Forward-Versus-Filter Decision
- •How Switches Learn MAC Addresses
- •Forwarding Unknown Unicasts and Broadcasts
- •LAN Switch Logic Summary
- •Basic Switch Operation
- •Foundation Summary
- •Spanning Tree Protocol
- •“Do I Know This Already?” Quiz
- •Foundation Topics
- •Spanning Tree Protocol
- •What IEEE 802.1d Spanning Tree Does
- •How Spanning Tree Works
- •Electing the Root and Discovering Root Ports and Designated Ports
- •Reacting to Changes in the Network
- •Spanning Tree Protocol Summary
- •Optional STP Features
- •EtherChannel
- •PortFast
- •Rapid Spanning Tree (IEEE 802.1w)
- •RSTP Link and Edge Types
- •RSTP Port States
- •RSTP Port Roles
- •RSTP Convergence
- •Edge-Type Behavior and PortFast
- •Link-Type Shared
- •Link-Type Point-to-Point
- •An Example of Speedy RSTP Convergence
- •Basic STP show Commands
- •Changing STP Port Costs and Bridge Priority
- •Foundation Summary
- •Foundation Summary
- •Virtual LANs and Trunking
- •“Do I Know This Already?” Quiz
- •Foundation Topics
- •Review of Virtual LAN Concepts
- •Trunking with ISL and 802.1Q
- •ISL and 802.1Q Compared
- •VLAN Trunking Protocol (VTP)
- •How VTP Works
- •VTP Pruning
- •Foundation Summary
- •Part II: TCP/IP
- •IP Addressing and Subnetting
- •“Do I Know This Already?” Quiz
- •Foundation Topics
- •IP Addressing Review
- •IP Subnetting
- •Analyzing and Interpreting IP Addresses and Subnets
- •Math Operations Used to Answer Subnetting Questions
- •Converting IP Addresses from Decimal to Binary and Back Again
- •The Boolean AND Operation
- •How Many Hosts and How Many Subnets?
- •What Is the Subnet Number, and What Are the IP Addresses in the Subnet?
- •Finding the Subnet Number
- •Finding the Subnet Broadcast Address
- •Finding the Range of Valid IP Addresses in a Subnet
- •Finding the Answers Without Using Binary
- •Easier Math with Easy Masks
- •Which Subnet Masks Meet the Stated Design Requirements?
- •What Are the Other Subnet Numbers?
- •Foundation Summary
- •“Do I Know This Already?” Quiz
- •Foundation Topics
- •Extended ping Command
- •Distance Vector Concepts
- •Distance Vector Loop-Avoidance Features
- •Route Poisoning
- •Split Horizon
- •Split Horizon with Poison Reverse
- •Hold-Down Timer
- •Triggered (Flash) Updates
- •RIP and IGRP
- •IGRP Metrics
- •Examination of RIP and IGRP debug and show Commands
- •Issues When Multiple Routes to the Same Subnet Exist
- •Administrative Distance
- •Foundation Summary
- •“Do I Know This Already?” Quiz
- •Foundation Topics
- •Link-State Routing Protocol and OSPF Concepts
- •Steady-State Operation
- •Loop Avoidance
- •Scaling OSPF Through Hierarchical Design
- •OSPF Areas
- •Stub Areas
- •Summary: Comparing Link-State and OSPF to Distance Vector Protocols
- •Balanced Hybrid Routing Protocol and EIGRP Concepts
- •EIGRP Loop Avoidance
- •EIGRP Summary
- •Foundation Summary
- •“Do I Know This Already?” Quiz
- •Foundation Topics
- •Route Summarization and Variable-Length Subnet Masks
- •Route Summarization Concepts
- •VLSM
- •Route Summarization Strategies
- •Sample “Best” Summary on Seville
- •Sample “Best” Summary on Yosemite
- •Classless Routing Protocols and Classless Routing
- •Classless and Classful Routing Protocols
- •Autosummarization
- •Classful and Classless Routing
- •Default Routes
- •Classless Routing
- •Foundation Summary
- •Advanced TCP/IP Topics
- •“Do I Know This Already?” Quiz
- •Foundation Topics
- •Scaling the IP Address Space for the Internet
- •CIDR
- •Private Addressing
- •Network Address Translation
- •Static NAT
- •Dynamic NAT
- •Overloading NAT with Port Address Translation (PAT)
- •Translating Overlapping Addresses
- •Miscellaneous TCP/IP Topics
- •Internet Control Message Protocol (ICMP)
- •ICMP Echo Request and Echo Reply
- •Destination Unreachable ICMP Message
- •Time Exceeded ICMP Message
- •Redirect ICMP Message
- •Secondary IP Addressing
- •FTP and TFTP
- •TFTP
- •MTU and Fragmentation
- •Foundation Summary
- •Part III: Wide-Area Networks
- •“Do I Know This Already?” Quiz
- •Foundation Topics
- •Review of WAN Basics
- •Physical Components of Point-to-Point Leased Lines
- •Data-Link Protocols for Point-to-Point Leased Lines
- •HDLC and PPP Compared
- •Looped Link Detection
- •Enhanced Error Detection
- •Authentication Over WAN Links
- •PAP and CHAP Authentication
- •Foundation Summary
- •“Do I Know This Already?” Quiz
- •Foundation Topics
- •ISDN Protocols and Design
- •Typical Uses of ISDN
- •ISDN Channels
- •ISDN Protocols
- •ISDN BRI Function Groups and Reference Points
- •ISDN PRI Function Groups and Reference Points
- •BRI and PRI Encoding and Framing
- •PRI Encoding
- •PRI Framing
- •BRI Framing and Encoding
- •DDR Step 1: Routing Packets Out the Interface to Be Dialed
- •DDR Step 2: Determining the Subset of the Packets That Trigger the Dialing Process
- •DDR Step 3: Dialing (Signaling)
- •DDR Step 4: Determining When the Connection Is Terminated
- •ISDN and DDR show and debug Commands
- •Multilink PPP
- •Foundation Summary
- •Frame Relay
- •“Do I Know This Already?” Quiz
- •Foundation Topics
- •Frame Relay Protocols
- •Frame Relay Standards
- •Virtual Circuits
- •LMI and Encapsulation Types
- •DLCI Addressing Details
- •Network Layer Concerns with Frame Relay
- •Layer 3 Addressing with Frame Relay
- •Frame Relay Layer 3 Addressing: One Subnet Containing All Frame Relay DTEs
- •Frame Relay Layer 3 Addressing: One Subnet Per VC
- •Frame Relay Layer 3 Addressing: Hybrid Approach
- •Broadcast Handling
- •Frame Relay Service Interworking
- •A Fully-Meshed Network with One IP Subnet
- •Frame Relay Address Mapping
- •A Partially-Meshed Network with One IP Subnet Per VC
- •A Partially-Meshed Network with Some Fully-Meshed Parts
- •Foundation Summary
- •Part IV: Network Security
- •IP Access Control List Security
- •“Do I Know This Already?” Quiz
- •Foundation Topics
- •Standard IP Access Control Lists
- •IP Standard ACL Concepts
- •Wildcard Masks
- •Standard IP ACL: Example 2
- •Extended IP Access Control Lists
- •Extended IP ACL Concepts
- •Extended IP Access Lists: Example 1
- •Extended IP Access Lists: Example 2
- •Miscellaneous ACL Topics
- •Named IP Access Lists
- •Controlling Telnet Access with ACLs
- •ACL Implementation Considerations
- •Foundation Summary
- •Part V: Final Preparation
- •Final Preparation
- •Suggestions for Final Preparation
- •Preparing for the Exam Experience
- •Final Lab Scenarios
- •Scenario 1
- •Scenario 1, Part A: Planning
- •Solutions to Scenario 1, Part A: Planning
- •Scenario 2
- •Scenario 2, Part A: Planning
- •Solutions to Scenario 2, Part A: Planning
- •Part VI: Appendixes
- •Glossary
- •Answers to the “Do I Know This Already?” Quizzes and Q&A Questions
- •Chapter 1
- •“Do I Know This Already?” Quiz
- •Chapter 2
- •“Do I Know This Already?” Quiz
- •Chapter 3
- •“Do I Know This Already?” Quiz
- •Chapter 4
- •“Do I Know This Already?” Quiz
- •Chapter 5
- •“Do I Know This Already?” Quiz
- •Chapter 6
- •“Do I Know This Already?” Quiz
- •Chapter 7
- •“Do I Know This Already?” Quiz
- •Chapter 8
- •“Do I Know This Already?” Quiz
- •Chapter 9
- •“Do I Know This Already?” Quiz
- •Chapter 10
- •“Do I Know This Already?” Quiz
- •Chapter 11
- •“Do I Know This Already?” Quiz
- •Chapter 12
- •“Do I Know This Already?” Quiz
- •Using the Simulation Software for the Hands-on Exercises
- •Accessing NetSim from the CD
- •Hands-on Exercises Available with NetSim
- •Scenarios
- •Labs
- •Listing of the Hands-on Exercises
- •How You Should Proceed with NetSim
- •Considerations When Using NetSim
- •Routing Protocol Overview
- •Comparing and Contrasting IP Routing Protocols
- •Routing Through the Internet with the Border Gateway Protocol
- •RIP Version 2
- •The Integrated IS-IS Link State Routing Protocol
- •Summary of Interior Routing Protocols
- •Numbering Ports (Interfaces)
10 Chapter 1: LAN Switching Review and Configuring Cisco 2950 LAN Switches
Foundation Topics
Cisco’s LAN switch revenues surpassed router revenues about the time the CCNA exam was first announced, in 1998, so there is little doubt about the importance of LAN switches to Cisco. Not surprisingly, both CCNA exams cover LAN switching concepts extensively.
This chapter starts with a brief review of LAN switching topics. The majority of this chapter is devoted to basic switch configuration for a Cisco 2950 switch.
Brief Review of LAN Switching
LAN switches forward Ethernet frames—they just have to decide when to forward them and when not to. Most switch logic relates somehow to the source and destination MAC addresses inside the Ethernet frame headers of the frames sent through the LAN. Switch logic is also dependent on the type of MAC addresses used. So, a brief review of Ethernet addresses can help shed some light on how LAN switches work.
The IEEE defines three general categories of MAC addresses on Ethernet:
■Unicast addresses—A MAC address that identifies a single LAN interface card. Today, most cards use the MAC address that is burned into the card.
■Broadcast addresses—The most often used IEEE group MAC address, the broadcast address, has a value of FFFF.FFFF.FFFF (in hexadecimal notation). The broadcast address implies that all devices on the LAN should receive and process a frame sent to the broadcast address.
■Multicast addresses—Frames sent to unicast addresses are destined for a single device; frames sent to a broadcast address are sent to all devices on the LAN. Frames sent to multicast addresses are meant for all devices that care to receive the frame, meaning that all devices might receive the frame, none, or some number in between. Some applications need to communicate with multiple other devices. By sending one frame, all the devices that care about receiving the data sent by that application can process the data, and the rest can ignore it.
With these reminders of the three types of Ethernet MAC addresses, you can appreciate the logic used by a LAN switch. A switch listens for frames that enter all its interfaces. After receiving a frame, about a switch decides whether to forward a frame and, if so, out which port(s). Switches basically perform three tasks:
■Learning—The switch learns MAC addresses by examining the source MAC address of each frame the bridge receives. By learning, the switch can make good forwarding choices in the future.
Brief Review of LAN Switching 11
■Forwarding or filtering—The switch decides when to forward a frame or when to filter (not forward) it based on the destination MAC address. The switch looks at the previously learned MAC addresses in an address table to decide where to forward the frames.
■Loop prevention—The switch creates a loop-free environment with other bridges by using Spanning Tree Protocol (STP). Having physically redundant links helps LAN availability, and STP prevents the switch logic from letting frames loop around the network indefinitely, congesting the LAN.
The next few sections take you through the first two tasks a switch performs. The third task, loop prevention, is performed using STP, which is covered in depth in Chapter 2, “Spanning Tree Protocol.”
The Forward-Versus-Filter Decision
Switches reduce network overhead by forwarding traffic from one segment to another only when necessary. To decide whether to forward a frame, the switch uses a dynamically built table called a bridge table or MAC address table. The switch examines the address table to decide whether it should forward a frame.
For example, consider the simple network shown in Figure 1-1. Fred first sends a frame to Barney and then one to Wilma.
The switch decides to filter (in other words, to not forward) the frame that Fred sends to Barney. Fred sends a frame with a destination MAC address of 0200.2222.2222, which is Barney’s MAC address. The switch overhears the frame, because it is attached to Hub1. The switch then decides what common sense tells you from looking at the figure—it should not forward the frame, because Barney, attached to Hub1 as well, already has received the frame. (Hubs simply repeat the signal out all ports, for all frames, so the switch receives everything sent by either Barney or Fred.) But how does the switch know to not forward the frame? The switch decides to filter the frame because it received the frame on port E0, and it knows that Barney’s MAC is also located out E0.
Conversely, the switch decides to forward the frame that Fred sends to Wilma in the bottom part of the figure. The frame enters the switch’s E0 interface, and the switch knows that the destination address, 0200.3333.3333, is located somewhere out its E1 interface. So the switch forwards the frame.
12 Chapter 1: LAN Switching Review and Configuring Cisco 2950 LAN Switches
Figure 1-1 Switch Forwarding and Filtering Decision
Frame Sent to 0200.2222.2222… Came in E0.
I Should FILTER it, Because
Fred Destination Is on Port E0. 0200.1111.1111
Wilma 0200.3333.3333
E0 |
E1 |
Hub1 |
Hub2 |
Barney 0200.2222.2222
Frame sent to 0200.3333.3333… Came in E0.
I should FORWARD it, because
Fred destination is off port E1. 0200.1111.1111
E0 |
E1 |
Hub1 |
Hub2 |
Betty 0200.4444.4444
MAC Address Table
0200.1111.1111 E0
0200.2222.2222 E0
0200.3333.3333 E1
0200.4444.4444 E1
Wilma 0200.3333.3333
Barney |
Betty |
0200.2222.2222 |
0200.4444.4444 |
How Switches Learn MAC Addresses
The filter-versus-forward decision works best when the switch knows where all the MAC addresses are in the network. Switches dynamically learn the MAC addresses in the network to build its MAC address table. With a full, accurate MAC address table, the switch can make accurate forwarding and filtering decisions.
Switches build the MAC address table by listening to incoming frames and examining the frame’s source MAC address. If a frame enters the switch, and the source MAC address is not in the address table, the switch creates an entry in the table. The MAC address is placed in the table, along with the interface in which the frame arrived. Switch learning logic is that simple!
Figure 1-2 shows the same network as Figure 1-1, but before the switch has built any bridge table entries. This figure shows the first two frames sent in this network—a frame from Fred, addressed to Barney, and then Barney’s response, addressed to Fred.
Brief Review of LAN Switching 13
Figure 1-2 Switch Learning: Adding Two Entries to an Empty Table
|
|
|
|
|
|
|
|
|
|
I Learned Fred’s MAC When He Sent |
|
|
|
|
|
|
|
|
|||||||||
|
|
|
Fred |
|
Frame 1. |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|||||
|
|
|
|
I Learned Barney’s MAC When He |
|
Address Table: Before Either Frame Is Sent |
|||||||||||||||||||||
0200.1111.1111 |
|
Sent Frame 2! |
|
||||||||||||||||||||||||
|
|
|
|
|
|
|
|
|
|||||||||||||||||||
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Wilma |
|
|
|
|
|
|
|
|
|||||
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|||||||
|
|
|
|
|
|
|
|
|
|
|
0200.3333.3333 |
|
|
|
|
|
|
|
|
||||||||
|
|
|
|
|
1 |
|
|
Address Table: After Frame 1 (Fred to Barney) |
|||||||||||||||||||
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
||||||||||||
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
||||||||
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Address: |
|
|
Interface |
|
||
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
||||||||
|
|
|
|
|
|
|
|
|
E0 |
E1 |
|
|
|
|
|
|
|
|
0200.1111.1111 |
E0 |
|||||||
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|||||||||||
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|||
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|||
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Address Table: After Frame 2 (Barney to Fred) |
|||||||
2 |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Address: |
|
Interface |
|
||||||
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|||||||
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
0200.1111.1111 |
E0 |
|||||||||
|
|
|
|
|
|
|
|
|
|
|
Betty |
||||||||||||||||
|
|
|
|
|
|
|
|
|
|
|
|
|
|
0200.2222.2222 |
E0 |
||||||||||||
|
|
|
|
|
|
|
|
|
|
|
0200.4444.4444 |
||||||||||||||||
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|||||||||
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Barney 0200.2222.2222
As shown in the figure, after Fred sends his first frame to Barney, the switch adds an entry for 0200.1111.1111, Fred’s MAC address, associated with interface E0. When Barney replies in Step 2, the switch adds a second entry, this one for 0200.2222.2222, Barney’s MAC address. Learning always occurs by looking at the source MAC address in the frame.
Forwarding Unknown Unicasts and Broadcasts
Bridges forward LAN broadcast frames, and unknown unicast frames, out all ports. LAN broadcasts, by definition, are received by all devices on the same LAN. So the switch simply forwards broadcasts out all ports, except the one on which the broadcast was received. Switches forward unknown unicast frames, which are frames whose destination MAC addresses are not yet in the bridging table, out all ports as well. The switch floods the frame with the hope that the unknown device will be on some other Ethernet segment, it will reply, and the switch will build a correct entry in the address table.
Generally speaking, switches also forward LAN multicast frames out all ports, just like they do for broadcasts. However, a few multicast features in switches limit the flooding of multicasts, such as Internet Group Management Protocol (IGMP) snooping.