1. Mike Meyers’ CompTIA Network+ ® Guide to Managing and Troubleshooting Networks, Third Edition (Exam N10-005 ) © 2012 The McGraw-Hill Companies, Inc. All rights reserved. Advanced Networking Devices Chapter 12

2. Mike Meyers’ CompTIA Network+ ® Guide to Managing and Troubleshooting Networks, Third Edition (Exam N10-005 ) © 2012 The McGraw-Hill Companies, Inc. All rights reserved. Objectives Discuss client/server and peer-to-peer topologies Describe the features and functions of VPNs Configure and deploy VLANs Implement advanced switch features

3. Mike Meyers’ CompTIA Network+ ® Guide to Managing and Troubleshooting Networks, Third Edition (Exam N10-005 ) © 2012 The McGraw-Hill Companies, Inc. All rights reserved. Overview

4. Mike Meyers’ CompTIA Network+ ® Guide to Managing and Troubleshooting Networks, Third Edition (Exam N10-005 ) © 2012 The McGraw-Hill Companies, Inc. All rights reserved. Introduction to advanced network devices Simple devices each work at one OSI layer Advanced devices work at multiple layers Home router really a multilayer switch CompTIA’s logical network topologies –The way network systems are organized –Client/server, peer-to-peer, VPN, and VLAN

5. Mike Meyers’ CompTIA Network+ ® Guide to Managing and Troubleshooting Networks, Third Edition (Exam N10-005 ) © 2012 The McGraw-Hill Companies, Inc. All rights reserved. Three parts to Chapter 12 Logical network topologies VLAN in depth Multilayer switches

6. Mike Meyers’ CompTIA Network+ ® Guide to Managing and Troubleshooting Networks, Third Edition (Exam N10-005 ) © 2012 The McGraw-Hill Companies, Inc. All rights reserved. Logical network topologies

7. Mike Meyers’ CompTIA Network+ ® Guide to Managing and Troubleshooting Networks, Third Edition (Exam N10-005 ) © 2012 The McGraw-Hill Companies, Inc. All rights reserved. Logical network topologies –Beyond physical or signaling topologies –Software architecture model –Roles computers play in network Servers Clients

8. Mike Meyers’ CompTIA Network+ ® Guide to Managing and Troubleshooting Networks, Third Edition (Exam N10-005 ) © 2012 The McGraw-Hill Companies, Inc. All rights reserved. Client/server topologies –Dedicated servers –Dedicated clients Servers Clients –Earliest networks used this model –Novell NetWare servers

9. Mike Meyers’ CompTIA Network+ ® Guide to Managing and Troubleshooting Networks, Third Edition (Exam N10-005 ) © 2012 The McGraw-Hill Companies, Inc. All rights reserved. Figure 12.1 A simple client/server network

10. Mike Meyers’ CompTIA Network+ ® Guide to Managing and Troubleshooting Networks, Third Edition (Exam N10-005 ) © 2012 The McGraw-Hill Companies, Inc. All rights reserved. Figure 12.2 Novell NetWare in action

11. Mike Meyers’ CompTIA Network+ ® Guide to Managing and Troubleshooting Networks, Third Edition (Exam N10-005 ) © 2012 The McGraw-Hill Companies, Inc. All rights reserved. Peer-to-peer topologies –Microsoft’s early Windows versions –Any system server, client, or both –Depends on configuration –Windows 9x common example –Lack of security a problem – no user accounts Permissions Read Only or Full Control Available to anyone connected over network

12. Mike Meyers’ CompTIA Network+ ® Guide to Managing and Troubleshooting Networks, Third Edition (Exam N10-005 ) © 2012 The McGraw-Hill Companies, Inc. All rights reserved. Figure 12.3 Sharing options in Windows 98

13. Mike Meyers’ CompTIA Network+ ® Guide to Managing and Troubleshooting Networks, Third Edition (Exam N10-005 ) © 2012 The McGraw-Hill Companies, Inc. All rights reserved. Peer-to-peer today –Adopted by every modern operating system –Now offers more robust security User accounts More advanced permissions

14. Mike Meyers’ CompTIA Network+ ® Guide to Managing and Troubleshooting Networks, Third Edition (Exam N10-005 ) © 2012 The McGraw-Hill Companies, Inc. All rights reserved. Figure 12.4 µTorrent downloading

15. Mike Meyers’ CompTIA Network+ ® Guide to Managing and Troubleshooting Networks, Third Edition (Exam N10-005 ) © 2012 The McGraw-Hill Companies, Inc. All rights reserved. Peer-to-peer and client/server today –Updated – linked to individual applications –E-mail client and e-mail server Outlook a dedicated client MS Exchange Server a dedicated server –Peer-to-peer (P2P) applications Act as both client and server File-sharing applications –Bit Torrent, LimeWire, DC++

16. Mike Meyers’ CompTIA Network+ ® Guide to Managing and Troubleshooting Networks, Third Edition (Exam N10-005 ) © 2012 The McGraw-Hill Companies, Inc. All rights reserved. Virtual private network (VPN) –VPN over Internet Alternative to expensive remote connections Connection using an encrypted tunnel –Data encrypted and decrypted at endpoints –Connecting computers must have same network ID as network –Tunneling protocols: PPTP and L2TP

17. Mike Meyers’ CompTIA Network+ ® Guide to Managing and Troubleshooting Networks, Third Edition (Exam N10-005 ) © 2012 The McGraw-Hill Companies, Inc. All rights reserved. Figure 12.5 VPN connecting computers across the United States

18. Mike Meyers’ CompTIA Network+ ® Guide to Managing and Troubleshooting Networks, Third Edition (Exam N10-005 ) © 2012 The McGraw-Hill Companies, Inc. All rights reserved. Figure 12.6 Typical tunnel

19. Mike Meyers’ CompTIA Network+ ® Guide to Managing and Troubleshooting Networks, Third Edition (Exam N10-005 ) © 2012 The McGraw-Hill Companies, Inc. All rights reserved. Figure 12.7 Endpoints must have their own IP addresses.

20. Mike Meyers’ CompTIA Network+ ® Guide to Managing and Troubleshooting Networks, Third Edition (Exam N10-005 ) © 2012 The McGraw-Hill Companies, Inc. All rights reserved. PPTP VPNs –Point-to-Point Tunneling Protocol (PPTP) –Advanced version of PPP –One endpoint on client—other on Routing and Remote Access Service (RRAS) –Clients use a virtual NIC that acquires a DHCP address –Client connects to RRAS, PPTP creates tunnel over Internet

21. Mike Meyers’ CompTIA Network+ ® Guide to Managing and Troubleshooting Networks, Third Edition (Exam N10-005 ) © 2012 The McGraw-Hill Companies, Inc. All rights reserved. Figure 12.8 RRAS in action

22. Mike Meyers’ CompTIA Network+ ® Guide to Managing and Troubleshooting Networks, Third Edition (Exam N10-005 ) © 2012 The McGraw-Hill Companies, Inc. All rights reserved. Figure 12.9 VPN connection in Windows

23. Mike Meyers’ CompTIA Network+ ® Guide to Managing and Troubleshooting Networks, Third Edition (Exam N10-005 ) © 2012 The McGraw-Hill Companies, Inc. All rights reserved. Figure 12.10 VPN on a Macintosh OS X system

24. Mike Meyers’ CompTIA Network+ ® Guide to Managing and Troubleshooting Networks, Third Edition (Exam N10-005 ) © 2012 The McGraw-Hill Companies, Inc. All rights reserved. L2TP VPNs –Layer2 Tunneling Protocol (L2TP) –Cisco developed –Good features of PPTP plus… –Added support to run on most connections –Moved the endpoint on the local LAN VPN concentrator can be endpoint Can connect two remote LANs using two VPN concentrators

25. Mike Meyers’ CompTIA Network+ ® Guide to Managing and Troubleshooting Networks, Third Edition (Exam N10-005 ) © 2012 The McGraw-Hill Companies, Inc. All rights reserved. L2TP has no authentication or encryption –Usually uses IPSec for security –Technically should be “L2TP/IPSec” VPN –Connects client to LAN or LAN to LAN –VPN clients in all OSs support L2TP/IP Sec

26. Mike Meyers’ CompTIA Network+ ® Guide to Managing and Troubleshooting Networks, Third Edition (Exam N10-005 ) © 2012 The McGraw-Hill Companies, Inc. All rights reserved. Site-to-site VPNs –Used to connect two LANs separated by a WAN or the cloud –Uses a VPN concentrator –Slower, but cheaper, than dedicated leased line between LANS

27. Mike Meyers’ CompTIA Network+ ® Guide to Managing and Troubleshooting Networks, Third Edition (Exam N10-005 ) © 2012 The McGraw-Hill Companies, Inc. All rights reserved. Figure 12.11 Cisco 2811 Integrated Services Router

28. Mike Meyers’ CompTIA Network+ ® Guide to Managing and Troubleshooting Networks, Third Edition (Exam N10-005 ) © 2012 The McGraw-Hill Companies, Inc. All rights reserved. SSL VPNs –VPNs using Secure Sockets Layer –Work at the Transport layer –Don’t require any special client software –Clients connect using Web browser –Traffic secured using SSL –Two most common types are SSL Portal and SSL Tunnel VPNs

29. Mike Meyers’ CompTIA Network+ ® Guide to Managing and Troubleshooting Networks, Third Edition (Exam N10-005 ) © 2012 The McGraw-Hill Companies, Inc. All rights reserved. SSL VPNs (cont.) –SSL portal VPNs Client accesses VPN and is presented with a secure Web page Able to access anything on that page, such as email, data, links, etc.

30. Mike Meyers’ CompTIA Network+ ® Guide to Managing and Troubleshooting Networks, Third Edition (Exam N10-005 ) © 2012 The McGraw-Hill Companies, Inc. All rights reserved. SSL VPNs (cont.) –SSL tunnel VPNs Client browser runs an active control, such as Java or Flash Enables much greater access to VPN-connected network Creates a more typical client-to-site connection than SSL portal VPNs User must have sufficient permissions to run active browser controls

31. Mike Meyers’ CompTIA Network+ ® Guide to Managing and Troubleshooting Networks, Third Edition (Exam N10-005 ) © 2012 The McGraw-Hill Companies, Inc. All rights reserved. Alternatives to PPTP, L2TP, and SSL –Majority of VPNs use PPTP or L2TP –Open VPN using Secure Shell (SSH) –Pure IPSec using IPSec tunneling

32. Mike Meyers’ CompTIA Network+ ® Guide to Managing and Troubleshooting Networks, Third Edition (Exam N10-005 ) © 2012 The McGraw-Hill Companies, Inc. All rights reserved. VLANs in depth

33. Mike Meyers’ CompTIA Network+ ® Guide to Managing and Troubleshooting Networks, Third Edition (Exam N10-005 ) © 2012 The McGraw-Hill Companies, Inc. All rights reserved. VLAN –Virtual Local Area Network (VLAN) –Used by all but smallest LANs

34. Mike Meyers’ CompTIA Network+ ® Guide to Managing and Troubleshooting Networks, Third Edition (Exam N10-005 ) © 2012 The McGraw-Hill Companies, Inc. All rights reserved. Serious networks are complex –Remote incoming connections –Public Web or e-mail servers –Wireless networks –String of connected switches –Tremendous amount of traffic –Security Issues

35. Mike Meyers’ CompTIA Network+ ® Guide to Managing and Troubleshooting Networks, Third Edition (Exam N10-005 ) © 2012 The McGraw-Hill Companies, Inc. All rights reserved. VLANs as solution –Separate networks with multiple switches –Segment networks using switches Break up broadcast domains Serious networks have more than one switch Trunking connects VLANs on separate switches One port on each switch is trunk port Inter-Switch Link (ISL) Cisco form of trunking

36. Mike Meyers’ CompTIA Network+ ® Guide to Managing and Troubleshooting Networks, Third Edition (Exam N10-005 ) © 2012 The McGraw-Hill Companies, Inc. All rights reserved. Figure 12.12 Switch with two VLANs

37. Mike Meyers’ CompTIA Network+ ® Guide to Managing and Troubleshooting Networks, Third Edition (Exam N10-005 ) © 2012 The McGraw-Hill Companies, Inc. All rights reserved. Figure 12.13 Two switches, each with a VLAN 2 and a VLAN 1

38. Mike Meyers’ CompTIA Network+ ® Guide to Managing and Troubleshooting Networks, Third Edition (Exam N10-005 ) © 2012 The McGraw-Hill Companies, Inc. All rights reserved. Figure 12.14 Trunk ports

39. Mike Meyers’ CompTIA Network+ ® Guide to Managing and Troubleshooting Networks, Third Edition (Exam N10-005 ) © 2012 The McGraw-Hill Companies, Inc. All rights reserved. VLANs today –Every Ethernet switch uses IEEE 802.1Q –Connect switches from different sources

40. Mike Meyers’ CompTIA Network+ ® Guide to Managing and Troubleshooting Networks, Third Edition (Exam N10-005 ) © 2012 The McGraw-Hill Companies, Inc. All rights reserved. Configuring a VLAN-capable switch –Connect to Web server on switch –Cisco Catalyst models –Simple switches at Layer 2 (use MAC addresses) –Managed switches use Layer 3 (IP addresses) –Define the VLANs –Assign MAC addresses or ports to VLANs

41. Mike Meyers’ CompTIA Network+ ® Guide to Managing and Troubleshooting Networks, Third Edition (Exam N10-005 ) © 2012 The McGraw-Hill Companies, Inc. All rights reserved. Figure 12.15 Catalyst 2950 Series Device Manager

42. Mike Meyers’ CompTIA Network+ ® Guide to Managing and Troubleshooting Networks, Third Edition (Exam N10-005 ) © 2012 The McGraw-Hill Companies, Inc. All rights reserved. Figure 12.16 Defining VLANs in Cisco Network Assistant

43. Mike Meyers’ CompTIA Network+ ® Guide to Managing and Troubleshooting Networks, Third Edition (Exam N10-005 ) © 2012 The McGraw-Hill Companies, Inc. All rights reserved. Figure 12.17 Assigning a port to a VLAN

44. Mike Meyers’ CompTIA Network+ ® Guide to Managing and Troubleshooting Networks, Third Edition (Exam N10-005 ) © 2012 The McGraw-Hill Companies, Inc. All rights reserved. Virtual Trunk Protocol (VTP) –Large networks with many VLANS would require a LOT of manual updates –VTP is a proprietary Cisco protocol that automates updating multiple VLAN switches –Three states: Server, Client, or Transparent –Updating configuration of the Server switch updates all other switches in the Client state in minutes – Transparent doesn’t update

45. Mike Meyers’ CompTIA Network+ ® Guide to Managing and Troubleshooting Networks, Third Edition (Exam N10-005 ) © 2012 The McGraw-Hill Companies, Inc. All rights reserved. InterVLAN routing –Each VLAN a separate broadcast domain –Need router to communicate between –Problems with physical routers –Some switches can do InterVLAN routing –Cisco 3550 Supports VLANs and virtual routers Works at Layers 2 and 3

46. Mike Meyers’ CompTIA Network+ ® Guide to Managing and Troubleshooting Networks, Third Edition (Exam N10-005 ) © 2012 The McGraw-Hill Companies, Inc. All rights reserved. Figure 12.18 One router connecting multiple VLANs

47. Mike Meyers’ CompTIA Network+ ® Guide to Managing and Troubleshooting Networks, Third Edition (Exam N10-005 ) © 2012 The McGraw-Hill Companies, Inc. All rights reserved. Figure 12.19 Cisco 3550

48. Mike Meyers’ CompTIA Network+ ® Guide to Managing and Troubleshooting Networks, Third Edition (Exam N10-005 ) © 2012 The McGraw-Hill Companies, Inc. All rights reserved. Figure 12.20 Setting up interVLAN routing

49. Mike Meyers’ CompTIA Network+ ® Guide to Managing and Troubleshooting Networks, Third Edition (Exam N10-005 ) © 2012 The McGraw-Hill Companies, Inc. All rights reserved. Multilayer switches

50. Mike Meyers’ CompTIA Network+ ® Guide to Managing and Troubleshooting Networks, Third Edition (Exam N10-005 ) © 2012 The McGraw-Hill Companies, Inc. All rights reserved. Multilayer switches & InterVLAN routing –Example: Cisco 3550 Supports VLANs and virtual routers Works at Layers 2 and 3 –On Layer 2 switches, ports do not have IP addresses –On a router, every port MUST have an IP address (due to routing table) –Multilayer ports can be configured either way

51. Mike Meyers’ CompTIA Network+ ® Guide to Managing and Troubleshooting Networks, Third Edition (Exam N10-005 ) © 2012 The McGraw-Hill Companies, Inc. All rights reserved. Load balancing –Load balancing: many servers look like one –Creates a server cluster –Requests are distributed evenly –Many load balancing methods –Common to use advanced network devices

52. Mike Meyers’ CompTIA Network+ ® Guide to Managing and Troubleshooting Networks, Third Edition (Exam N10-005 ) © 2012 The McGraw-Hill Companies, Inc. All rights reserved. DNS load balancing –Oldest and most common method –Each server has its own IP address –Multiple A records for one FQDN –DNS server cycles through A records –Windows DNS “Enable round robin” –BIND DNS server has more features –Requires multiple DNS servers

53. Mike Meyers’ CompTIA Network+ ® Guide to Managing and Troubleshooting Networks, Third Edition (Exam N10-005 ) © 2012 The McGraw-Hill Companies, Inc. All rights reserved. Figure 12.21 Multiple IP addresses, same name

54. Mike Meyers’ CompTIA Network+ ® Guide to Managing and Troubleshooting Networks, Third Edition (Exam N10-005 ) © 2012 The McGraw-Hill Companies, Inc. All rights reserved. Figure 12.22 Enabling round robin

55. Mike Meyers’ CompTIA Network+ ® Guide to Managing and Troubleshooting Networks, Third Edition (Exam N10-005 ) © 2012 The McGraw-Hill Companies, Inc. All rights reserved. Using a multilayer or content switch –Client cache problem with DNS load balancing –Hide all Web servers behind one IP address –Special multilayer switch (Layers 3 and 4) Is a router performing NAT and port forwarding Queries hidden Web server

56. Mike Meyers’ CompTIA Network+ ® Guide to Managing and Troubleshooting Networks, Third Edition (Exam N10-005 ) © 2012 The McGraw-Hill Companies, Inc. All rights reserved. Using a content switch for load balancing –Works at Layer 7 (Application) –Works with Web servers –Reads incoming HTTP and HTTPS requests –Handles SSL certificates and cookies –Takes workload off Web servers –Passes cookies to Web browsers

57. Mike Meyers’ CompTIA Network+ ® Guide to Managing and Troubleshooting Networks, Third Edition (Exam N10-005 ) © 2012 The McGraw-Hill Companies, Inc. All rights reserved. Figure 12.23 Layer 7 content switch

58. Mike Meyers’ CompTIA Network+ ® Guide to Managing and Troubleshooting Networks, Third Edition (Exam N10-005 ) © 2012 The McGraw-Hill Companies, Inc. All rights reserved. QoS and traffic shaping –Quality of Service (QoS) Controls bandwidth use Rules-based policies prioritize traffic –Traffic shaping Bandwidth management Controls flow of packets in or out Guarantees a certain amount of bandwidth and/or latency Popular where IT must control user activities

59. Mike Meyers’ CompTIA Network+ ® Guide to Managing and Troubleshooting Networks, Third Edition (Exam N10-005 ) © 2012 The McGraw-Hill Companies, Inc. All rights reserved. Figure 12.24 QOS configuration on a router

60. Mike Meyers’ CompTIA Network+ ® Guide to Managing and Troubleshooting Networks, Third Edition (Exam N10-005 ) © 2012 The McGraw-Hill Companies, Inc. All rights reserved. Network protection –Intrusion protection/intrusion detection –Port mirroring –Proxy serving –Port authentication

61. Mike Meyers’ CompTIA Network+ ® Guide to Managing and Troubleshooting Networks, Third Edition (Exam N10-005 ) © 2012 The McGraw-Hill Companies, Inc. All rights reserved. Intrusion detection/intrusion prevention –Intrusion detection system (IDS) Inspects incoming packets Network based IDS (NIDS) Host-based IDS (HIDS) Reporting –Intrusion protection system (IPS) Adds capability to react to attacks Can block incoming packets on-the-fly

62. Mike Meyers’ CompTIA Network+ ® Guide to Managing and Troubleshooting Networks, Third Edition (Exam N10-005 ) © 2012 The McGraw-Hill Companies, Inc. All rights reserved. Figure 12.25 Diagram of network-based IDS

63. Mike Meyers’ CompTIA Network+ ® Guide to Managing and Troubleshooting Networks, Third Edition (Exam N10-005 ) © 2012 The McGraw-Hill Companies, Inc. All rights reserved. Figure 12.26 OSSEC HIDS

64. Mike Meyers’ CompTIA Network+ ® Guide to Managing and Troubleshooting Networks, Third Edition (Exam N10-005 ) © 2012 The McGraw-Hill Companies, Inc. All rights reserved. Port mirroring –Mirrors data from ports to a single port –Works like a configurable promiscuous port –Allows inspection of traffic to or from certain computers

65. Mike Meyers’ CompTIA Network+ ® Guide to Managing and Troubleshooting Networks, Third Edition (Exam N10-005 ) © 2012 The McGraw-Hill Companies, Inc. All rights reserved. Proxy serving –Proxy server between clients and external servers –Intercepts requests from clients –Makes requests itself on behalf of clients –Client must not use DNS to access the type of server that is proxied HTTP, SSL, FTP, Gopher, SOCKS

66. Mike Meyers’ CompTIA Network+ ® Guide to Managing and Troubleshooting Networks, Third Edition (Exam N10-005 ) © 2012 The McGraw-Hill Companies, Inc. All rights reserved. Figure 12.27 Setting a proxy server in Mozilla Firefox

67. Mike Meyers’ CompTIA Network+ ® Guide to Managing and Troubleshooting Networks, Third Edition (Exam N10-005 ) © 2012 The McGraw-Hill Companies, Inc. All rights reserved. Figure 12.28 Web proxy at work

68. Mike Meyers’ CompTIA Network+ ® Guide to Managing and Troubleshooting Networks, Third Edition (Exam N10-005 ) © 2012 The McGraw-Hill Companies, Inc. All rights reserved. Figure 12.29 Squid proxy software

69. Mike Meyers’ CompTIA Network+ ® Guide to Managing and Troubleshooting Networks, Third Edition (Exam N10-005 ) © 2012 The McGraw-Hill Companies, Inc. All rights reserved. Port authentication –Authentication at point of connection –Critical for AAA authentication RADIUS, TACACS+, 802.1X –Many switches and WAPs support it

70. Mike Meyers’ CompTIA Network+ ® Guide to Managing and Troubleshooting Networks, Third Edition (Exam N10-005 ) © 2012 The McGraw-Hill Companies, Inc. All rights reserved. Figure 12.30 802.1X configuration on a Cisco 2811