Wide area networks Chapter 11

objectives Upon completion of this chapter, you should be able to: Understand how to connect to a WAN Identify how data moves in the WAN Identify common WAN services Configure a PPP WAN link Connect to a DSL network Create and configure a remote access connection Configure a server for remote access connections Configure a RADIUS solution to provide AAA for remote access

Network+ Objectives 1.3 Explain the concepts and characteristics of routing and switching Distributed switching Packet-switched vs. circuit-switched network 2.5 Compare and Contrast WAN technologies Service type ISDN, T1/T3, E1/E3, OC-3 - OC-192, Metropolitan Ethernet, PRI Transmission mediums Copper, Fiber Characteristics of service MPLS, ATM, Frame relay, SIP trunk Termination Demarcation point, CSU/DSU

11.1 Wan structure

wan 2 or more LANs that connect together Usually the ISP provides the WAN devices Cloud is represented as another network that you don’t manage. In this scenario, your network leads to the service provider (sometimes called the Central Office) which connects to the Internet or the Public Switched Telephone Network. The service provider is responsible for everything between the demarcs. The local loop is the connection from your demarc to the ISP Demarc is the end of your network and beginning of the service provider network. You are responsible for everything within your network, AKA CPE (customer premise equipment).

Csu/dsu Device that connects your line to the WAN or service provider line Acts like a modem A cable modem & DSL modem are CSU/DSUs. Channel Service Unit/ Data Service Unit CSU terminates the signal coming from the Internet and the DSU converts the signal into a format to be read by your router.

Moving through cloud Circuit switching Packet switching Dedicated path from one end to other May be permanent or established for each transmission (like a phone call) NOT COMMON Packet switching Data broken into packets Takes different paths Service provider makes sure all packets arrive & are reassembled MOST COMMON Packet switching: each packet is routed through the WAN

Establishing a wan connection- t & e T1 LINE 24 channels on 2 pairs of wire 1.544Mbps (64k each) T3 LINE 672 channels 44.7Mbps (64k each) E1 32 channels (64k each) 2.047Mbps E3 16 channels (2.048Mbps each) 34.368Mbps T-Carrier: Digital using copper cable; Voice & data US EUROPE

Establishing a wan connection- optical OC specs for speed over SONET OC-1 Base Rate: 51.84Mbps Signals use DWDM Multiplexes multiple optical signals on one cable OC- Optical Carrier SONET- Synchronous Optical Network OC-1 is the base rate. After that, multiply the base rate times the OC number to figure out the speed. DWDM: Dense Wavelength Division Multiplexing (uses different colors of light) A multiplexer (joins signals) & demultiplexer (splits signals back out)

Wan services- PSTn & isdn POTS/PSTN 56k analog dial-up ISDN (not common in US) Connection to the WAN service provider BRI Analog over telephone line with J45 2 B data channels at 64k 1 D signaling channel at 16k 128kbps for data (144kbps total) PRI Uses digital T1 line at 1.544Mbps 23 B data channels, 1 D signaling channel at 64k each Public Switched Telephone Network Plain Old Telephone Service ISDN still used in Europe. T1 line=1.544Mbps T3 line= 44.7Mbps

Wan services- frame relay (OLD) Packet switching Uses T1 lines Permanent virtual circuit through the WAN Point-to-point or multipoint connection It’s like you have a dedicated connection to the other end. Multipoint is a single virtual circuit that can go to three separate locations. When using Frame Relay, you get a CIR (Committed Information Rate) which is how much guaranteed bandwidth/data you can send through the network. Frame Relay drops packets when it is congested.

Wan services- atm Packet switching Divides packets into cells at a fixed size You get a constant rate Used for time-sensitive transmissions such as audio or video Constant rate happens because the WAN does not need to figure out how long the data should be. It will always be 53 bytes. Switches in the ATM WAN read the cells. Does not drop packets when congested. It ensures delivery.

Wan services- metro ethernet Routers & switches using fiber in a MAN Tends to be faster than other WAN services because it stays within the ISP WAN Sets up a point to point (or even multipoint) within a MAN.

activity TestOut 11.1.7 Practice Questions (15)

11.2 Wan connections Process of securing devices

Ppp connection Used to encapsulate and transport data from LAN to ISP over dedicated leased lines Layer 2 PPP is universal* Authentication with PAP or CHAP Cisco routers use HDLC by default; if you are NOT connecting from Cisco to Cisco router, use PPP PPP uses 2 protocols to establish & maintain the link; LCP (establishes, maintains and ends the connection) & detects errors at LAYER 2 and provides authentication (PAP/CHAP) NCP is control protocols for the LAYER 3 protocol (IPCP for IPv4 & IPv6CP for IPv6) PAP- Password Authentication Protocol (2-way); clear text; username/password sent & acknowledged if correct CHAP- Challenge Handshake Authentication Protocol (3-way); hash is sent (this is not encrypted but a random number); authentication request, challenge, hashed password, authentication acknowledgement

acivity TestOut Lab 11.2.4- Configure a PPP WAN Link TestOut 11.2.5- Practice Questions (8Q)

Internet service facts Info Dial-up 56k; phone line/number to dial in; can’t use voice & data at same time DSL Digital over POTS line; Distance limits; ADSL most common (voice & data) Cable Data over cable service (DOCSIS); cable modems; high speed; bandwidth shared with neighbors Satellite Available anywhere using dish & clear view of sky; weather can disrupt service; high latency Cellular Uses GSM or CDMA networks; coverage may be weak depending on provider coverage; 3G, 4G LTE Complete TestOut 11.3.4- LAB Connect to a DSL Network TestOut 11.3.5 Practice Questions (15)

11.4 Remote access Process of securing devices

Remote access Ways to connect to remote sites or main office while traveling PSTN- slow & rarely used anymore Internet After you connect, negotiate the connection PPP (Point-to-Point Protocol)/PPPoE Used to establish the physical remote connection They decide which protocols they’ll use You get an IP address from the remote network Can use authentication (CHAP, MS-CHAP, EAP) Authorization (what client has access to) PPPoE is what would be used to connect to a DSL ISP Broadband provider. Imagine old dial-up connections like a conversation over the telephone between you and your boss. It's just the two of you who can participate in the conversation. But what if your boss wanted to speak to all your team? If your conversation would be a dial-up connection, all your team would have to gather around the same phone earpiece. It would make for a funny and ineffective conversation, wouldn't it? PPP is just like that: only one to one connections are possible. PPPoE changed that and it allowed more client devices to use the same network in order to connect to one single server. It's like your boss speaking with all your team, but you would have a loudspeaker so that you don't have to crowd around one small earpiece. PPPoE is one of the most preferred means of delivering DSL Internet access. Your ISP will rent or sell you a modem-router. Comcast modems connect to their hub and gets encapsulated as IP packets.

More remote access More and more clients use remote access Need more servers to handle connections Use an AAA server One server with all of the policies instead of copying policies to many servers When you connect remotely, authorization requests forwarded to AAA server for approval AAA- Authentication, Authorization, Accounting (keeps logs of access) The AAA server can be a RADIUS server which handles the authentication & authorization. It uses UDP. When you dial in to the ISP you must enter your username and password. This information is passed to a RADIUS server, which checks that the information is correct, and then authorizes access to the ISP system. A TACACS+ server (up to date version) can put all three into one server or separate servers. It uses TCP and encryption.

Aaa Authentication is the process of proving identity After devices agree on the authentication protocol to use, the logon credentials are exchanged & logon is allowed or denied EAP allows authentication using a variety of methods, including passwords, certificates, and smart cards Authorization identifies the resources that a user can access Authorization can restrict access based on the following parameters: Time of day Type of connection Restrict access to specific servers Accounting tracks or logs the use of the remote access connection Often used by ISPs to bill for services based on time spent or the amount of data downloaded Two common AAA Server Solutions: RADIUS Used by Microsoft servers for centralized remote access administration. Combines authentication and authorization using policies to grant access. Uses UDP. Encrypts only the password. Often uses vendor-specific extensions. RADIUS solutions from different vendors might not be compatible. When implementing a RADIUS solution, configure a single server as a RADIUS server and configure all remote access servers as RADIUS clients. TACACS+: Provides three protocols, one for authentication, one for authorization, and one for accounting. This allows each service to be provided by a different server. Uses TCP port 49. Encrypts the entire packet contents. Supports more protocol suites than RADIUS.

activity TestOut 11.4.5- Practice Questions (14Q)

11.5 Wan troubleshooting Process of securing devices

troubleshoot Ping test On Cisco router, check line status Interface status up or down (Layer 1) Protocol status up or down (Layer 2) SHOW IP INT BRIEF command Down, Down- bad cable, no cable, powered off device Up, Down- make sure you’re using the same encapsulation on both sides (HDLC to HDLC, PPP to PPP), DCE side needs clock rate set, incorrect PAP/CHAP authentication Up, Up working properly A failed PING or TRACEROUTE means layer 1, 2 or 3 problem.

activity TestOut 11.5.4- Practice Questions (9Q)

Review & study Complete the study guide handout Complete TestOut Practice in Packet Tracer Jeopardy review

Wide area networks Chapter 11