Dynamic Host Configuration Protocol (DHCP) gives a host an IP address and the settings it needs to use the network. A relay lets clients reach a server in another subnet.

What the client receives

A lease is permission to use an address for a limited time. Along with that address, a DHCP server can supply the subnet mask, default gateway, and Domain Name System (DNS) servers. The gateway reaches other networks; DNS resolves names. They solve different problems.

DORA: follow one new lease

Choose a message to see who sends it and why. DORA means Discover → Offer → Request → Acknowledge. User Datagram Protocol (UDP) port 67 belongs to the server; port 68 belongs to the client.

The slides draw all four messages as broadcasts. In real networks the server may send the Offer and ACK straight to the client (unicast) instead, and lease renewals are normally unicast. See RFC 2131, message delivery.

Configure a local DHCP server

1. Check the gateway first. The VLAN needs a working gateway interface: an SVI such as interface vlan 10 on a multilayer switch, or a router subinterface.
2. Exclude fixed addresses. Addresses already used by the gateway, servers or printers must be excluded so DHCP never hands them to a client.
3. Create a named pool. Enter the subnet, then the gateway, DNS server and lease time that clients should receive.
4. One pool per VLAN. Each VLAN subnet needs its own pool. The server chooses the pool whose subnet matches the interface the request arrived on; for a relayed request, it uses the relay interface address (for example 10.1.10.1).

ip dhcp excluded-address 10.1.10.1 10.1.10.20   ! range: .1 through .20
ip dhcp excluded-address 10.1.10.254             ! a single address
ip dhcp pool VLAN10
 network 10.1.10.0 255.255.255.0
 default-router 10.1.10.1
 dns-server 8.8.8.8 8.8.4.4                      ! one or two servers
 lease 7                                         ! 7 days; lease 0 12 = 12 hours; lease infinite
 exit

Use ip dhcp excluded-address, including the final d. This corrects the command typo in the slides; the syntax is confirmed in Cisco's DHCP server guide.

DHCP relay: keep the server central

In the slide example, clients are in VLAN 10 with gateway 10.1.10.1/24, and the DHCP server is 20.5.5.5 in another network. Put ip helper-address on the VLAN 10 gateway interface, because that is where the client broadcast arrives.

interface vlan 10
 ip address 10.1.10.1 255.255.255.0
 ip helper-address 20.5.5.5

The relay turns the broadcast into a normal (unicast) packet to 20.5.5.5 and adds its own address, 10.1.10.1, so the server knows which pool to use. The server still needs a pool for 10.1.10.0/24 with 10.1.10.1 as the default router, and the two networks must be able to route to each other in both directions. The helper command does not create a pool or a route.

Verify the result, then isolate the failure

IPv6 SLAAC alongside IPv4 DHCP

Stateless Address Autoconfiguration (SLAAC) lets a host form an IPv6 address using a prefix in a Router Advertisement (RA). It does not need a DHCPv6 address lease. LAB 13 deliberately uses IPv4 DHCP and IPv6 Automatic together.

ipv6 unicast-routing
interface vlan 10
 ipv6 address 2001:DB8:10::1/64
 ipv6 enable
 no ipv6 nd managed-config-flag
 no ipv6 nd other-config-flag

A campus network should grow and recover in predictable ways. Give each layer a clear job, group access and distribution switches into blocks, and provide deliberate redundant paths.

From one shared segment to a hierarchy

The first slide shows an old shared Ethernet segment (a hub): all hosts share the same bandwidth and are in one collision domain and one broadcast domain. A switch gives every port its own collision domain; a router or Layer 3 switch splits broadcast domains. So the collision problem on that slide does not apply to modern switched networks.

When a network grows without a plan, nobody can tell which path traffic takes. A good design knows where traffic flows, has enough capacity, has room to grow, and has a known plan for failures.

Three layers, three responsibilities

Classify the service before tracing the path

In an exam scenario, trace the real path: a server in another switch block is always reached through the core.

A switch block limits the failure domain

A switch block is a group of access switches plus the distribution switches they connect to. The core connects the switch blocks together. Usually routing starts at the distribution switches: VLANs and broadcasts stop there, so Spanning Tree Protocol (STP) runs only inside each block.

A second cable does not protect against failure of the only upstream switch. Use a pair of distribution switches, with each access switch connected to both. A separate core also needs redundancy; one core switch would remain a single point of failure.

Compare three switch-block designs

Pick a design and see where routing (Layer 3) begins. All three use the slides' layout: two distribution switches above two access switches.

Size the block by traffic, not just headcount

• Access capacity: enough ports for users and devices, plus uplink capacity for their traffic.
• Distribution capacity: all traffic from the access switches, plus routing between VLANs, plus ACL and QoS processing.
• VLAN size: how far each VLAN stretches, how much broadcast and multicast traffic it carries, and how large the STP domain becomes.
• Growth: which user groups and applications will be added, and where their servers are.

The slides give about 2,000 users per block as a historical sizing guideline. It is not a protocol limit. Traffic behavior and device capacity decide when to split a block.

Core, dual core, and collapsed core

A collapsed core merges two layers; it does not remove redundancy. The two devices must be powerful enough for both jobs.

Design review: explain every link

1. Mark the access, distribution, and core roles.
2. Draw the VLAN and Layer 3 boundaries. Identify which links are trunks and which are routed.
3. Give each access switch two upstream paths to distinct distribution switches.
4. Link the two distribution switches together. Do not link access switches to each other, unless they are stacked into one logical switch.
5. Test both a link failure and a switch failure, and know which protocol recovers (STP, HSRP or the routing protocol).
6. After a failure, the remaining link carries all the traffic. Make sure it is big enough.

In a wireless LAN, all devices on a channel share the same radio time. The access point (AP) links wireless clients to the wired network. The design you choose (autonomous or controller-based) decides where traffic goes, where settings are managed, and how a moving client stays connected.

Shared airtime: CSMA/CA and backoff

Wi-Fi is half-duplex: on one channel, only one device can transmit at a time. Devices use Carrier Sense Multiple Access with Collision Avoidance (CSMA/CA): listen first, then wait a random time before sending, so two devices are less likely to transmit together.

1. Wait for the channel to become idle, then wait the Distributed Coordination Function Interframe Space (DIFS).
2. Count down a random backoff while the channel stays idle.
3. If another device starts transmitting, pause the countdown. Continue counting when the channel is free again.
4. Transmit when the counter reaches zero. Collisions can still occur, for example when two counters expire together.

In the slide's A/B/C example, A transmits first; B and C defer. C's shorter backoff wins the next turn, so B waits again. Collision avoidance reduces the risk; it does not promise that collisions never happen.

Wi-Fi standards: compare the slide values

The rates below are theoretical maximums. Real speed is much lower, because it depends on channel width, the number of antennas (spatial streams), the number of clients, signal quality and shared airtime. MIMO means Multiple Input, Multiple Output; SU and MU mean single-user and multi-user.

Building blocks: IBSS, BSS, ESS, and SSID

An Access Point (AP) connects wireless and wired traffic. In normal (infrastructure) mode, clients never talk directly: even two clients on the same AP send their traffic through the AP. Direct Link Setup is a special exception.

Cells, channel reuse, and BSS coloring

A cell is one AP's coverage area. Neighboring cells should overlap a little so clients can roam, with no gaps (coverage holes). The slides compare a grid layout with a honeycomb layout, and also plan channels between floors, because APs on the floor above and below interfere too.

• Coverage is not the same as capacity. Full power covers a bigger area, but then more clients share one AP's airtime, so each client gets less.
• Smaller cells can support a denser deployment. The slides call reduced-power cells microcells and very small cells picocells.
• Plan channels. Two nearby APs on the same channel share airtime and slow each other down, so neighbors should use different non-overlapping channels (1, 6 and 11 on 2.4 GHz).
• BSS coloring (Wi-Fi 6) puts a 6-bit "color" number in the frame's first part (the PHY header). A device can then tell quickly whether a frame comes from its own AP or a neighbor's, without reading the full 48-bit BSSID.

Autonomous AP or controller-based WLAN?

With autonomous APs, roaming inside one SSID needs the same VLAN on every AP's switch port across the area, like an end-to-end VLAN. With a WLC, client traffic travels inside tunnels, so the client VLAN only needs to exist at the WLC.

Split-MAC: divide the work

Split-MAC (Cisco Unified Wireless Network, CUWN) divides the work that one autonomous AP does alone between two separate devices. A lightweight AP (LAP) is an AP that cannot work alone; it needs a wireless LAN controller (WLC), a separate device that manages many LAPs. The LAP keeps the real-time radio work: sending and receiving frames, beacons and probe replies, and Wi-Fi encryption. The WLC does everything else: authentication, security policy, association and roaming, RF channel and power, and QoS.

Control and Provisioning of Wireless Access Points (CAPWAP) is the protocol between the LAP and the WLC. It runs over IP, so the LAP and WLC can be in different subnets. It replaced the older Lightweight Access Point Protocol (LWAPP). CAPWAP uses two tunnels:

The LAP and WLC prove who they are to each other with X.509 certificates. Note the difference: Wi-Fi encryption (WPA2/WPA3) protects client ↔ AP, while CAPWAP DTLS protects AP ↔ WLC. They are separate.

The WLC can also choose channels and power automatically, raise power to cover a failed AP's area, spread clients across APs, monitor the radio environment, and detect wireless attacks.

How a lightweight AP becomes ready

1. Get an IP address from DHCP.
2. Discover available controllers and learn their addresses.
3. Join a controller. If it cannot join the first one, it tries the next.
4. Match the software image. If needed, download the controller-provided image and reboot.
5. Build the secure CAPWAP tunnel and download its settings (SSIDs, VLANs, channels).

In the slides' model, if a LAP loses its WLC, its clients are disconnected and the LAP looks for another WLC. Some AP modes (such as FlexConnect) and backup controllers can keep clients working.

Trace client traffic before troubleshooting

If a client is connected to Wi-Fi but cannot reach anything, follow its path: check the client's VLAN and IP address, then the CAPWAP tunnel and WLC (if used), then routing beyond the WLC.

Roaming: what changes and what stays?

Roaming means the client moves from one AP to another. With autonomous APs, each AP keeps its own client list, and the old AP forwards leftover frames to the new AP. With a WLC, the controller keeps the client list and moves the client for it.

The slides quote under 10 ms for an intracontroller roam and under 20 ms for a Layer 2 intercontroller roam. These are Cisco's figures, not guarantees; authentication and the client device also affect the delay.

Layer 3 roam: follow the same client IP

In the slide example, Client-1 starts with 192.168.100.199/24. AP-1 serves the staff WLAN in 192.168.100.0/24; AP-2's local subnet is 192.168.200.0/24. Switch between before and after.

The tunnel between the two WLCs is Ethernet over IP (EoIP). If the client roams again to a third WLC, the first WLC stays the anchor. A guest anchor uses the same idea on purpose: all guest traffic is tunneled to one chosen WLC (often in the DMZ).

Fast authentication and mobility groups

Joining a new AP is quick, but logging in again (802.1X with a RADIUS server, then new encryption keys) is slow. These methods let a roaming client skip the full login, if both the client and the network support them:

Correction: the slide's "remembers previous APs, up to eight" describes Sticky Key Caching (SKC), not PKC. Cisco explains the difference in its fast-secure roaming note.

A mobility group is a set of WLCs that share client information so clients can roam between them. Each WLC has a mobility list of the other WLCs (MAC address, IP address and group name), configured by hand; WLCs do not trust each other automatically. Roaming works best between WLCs in the same group.

A host sends every off-subnet packet to one default gateway. A First Hop Redundancy Protocol (FHRP) lets two or more routers share a virtual gateway address, so one router can fail without reconfiguring any host.

The gateway is a single point of failure

In the supplied example, hosts in VLAN 10 (10.1.1.0/24) use R1 at 10.1.1.9 as their default gateway. Redundant switch links do not help when R1, or its LAN interface, fails: nothing can leave the subnet.

Adding R2 at 10.1.1.129 creates a second exit, but a host still has only one configured gateway. Hosts pointing at .9 keep sending to a dead router. Changing every host, or waiting for new DHCP leases, is not a failover plan.

Three FHRPs

The deck compares all three and configures HSRP. HSRP is the protocol to configure and analyze for this topic.

Follow one HSRP failover

Choose a stage. The hosts' configuration never changes: every host keeps gateway 10.1.1.1 and the same ARP entry for it.

Which router becomes active?

1. No other HSRP router on the subnet: the local router becomes active.
2. No active router yet, several candidates: the highest priority wins. Default priority is 100.
3. Priorities tie: the highest IP address on the HSRP interface wins.
4. An active router already exists: it keeps the role unless a higher-priority router is configured with preempt.

HSRP version 1 and version 2

Work out a virtual MAC from the group number in hex: version 1 group 10 → 0000.0C07.AC0A; version 2 group 1 → 0000.0C9F.F001. Both routers in a group must run the same version.

Configure HSRP

interface GigabitEthernet0/0
 standby version 2                  ! both routers must match; default is version 1
 standby 1 ip 10.1.1.1              ! group 1, virtual IP — the only required line
 standby 1 priority 110             ! default 100; highest wins
 standby 1 preempt                  ! reclaim active after recovery
 standby 1 name GATEWAY-VLAN10      ! optional label

! R1
interface GigabitEthernet0/0
 ip address 10.1.1.9 255.255.255.0
 standby version 2
 standby 1 ip 10.1.1.1
 standby 1 priority 110
 standby 1 name HSRP-group-for-book

! R2 — same group and virtual IP, own interface address, default priority
interface GigabitEthernet0/0
 ip address 10.1.1.129 255.255.255.0
 standby version 2
 standby 1 ip 10.1.1.1
 standby 1 name HSRP-group-for-book

Read the verification output

R1# show standby brief
                     P indicates configured to preempt.
                     |
Interface   Grp  Pri P State   Active          Standby         Virtual IP
Gi0/0       1    110   Active  local           10.1.1.129      10.1.1.1

R2# show standby brief
Interface   Grp  Pri P State   Active          Standby         Virtual IP
Gi0/0       1    100   Standby 10.1.1.9        local           10.1.1.1

The longer show standby adds the virtual MAC, hello and hold timers, preemption, state-change history, and the active router's priority. Both routers should agree on who is active, who is standby, and the virtual IP.

High availability (HA) means the network keeps working almost all the time, even when a part fails. In a campus you get it from: two of every device, two of every link, joining switch pairs into one logical switch (so STP blocks nothing), and a backup supervisor that takes over quickly.

Pairs at every layer — and what they still waste

The campus design rule is to build each layer in pairs and connect each lower switch to the next layer with two links. In the supplied figure, every access switch has an uplink to each distribution switch. That survives a link or distribution-switch failure, but two problems remain:

• The two access switches do not back each other up; a host plugged into one depends on that one switch.
• The redundant uplinks form loops, so STP blocks some of the bandwidth you paid for.

The improvement is to make two physical switches behave as one logical switch. Links to a logical switch can be bundled into one EtherChannel, and STP sees one link rather than a loop.

Three stages of the same switch block

StackWise: many access switches, one logical switch

• Cisco StackWise / StackWise Plus joins separate physical switches with special stacking cables, daisy-chained back to the first switch to close a ring.
• Up to nine physical switches can form one stack in the deck's model.
• One member is the stack master: it performs management for the whole stack, which is managed through one IP address.
• The deck's examples are fixed-configuration access switches such as the Catalyst 3750-E, 3750-X, and 3850.

Virtual Switching System: two chassis, one logical switch

• A chassis switch has slots for line cards plus a supervisor card: the "brain" that runs management, routing protocols and the forwarding tables.
• Virtual Switching System (VSS) configures two identical chassis as one logical switch, a VSS pair, joined by a virtual switch link (VSL).
• One supervisor, in one chassis, controls the logical switch; the other chassis' supervisor is the redundant standby.
• VSS is usually used at distribution or core. It is how you build the "logical distribution" switch in the third diagram above.

Supervisor redundancy modes

A chassis can hold two supervisors. The first one to boot becomes active; the other waits as standby. Redundant power supplies work the same way. The redundancy mode decides how ready the standby is: the more it prepares in advance, the faster it takes over.

The slides write RPR and RPR+ as "PRP" on one page; the correct names are Route Processor Redundancy and RPR Plus. The times are the slides' rough figures for comparison.

Nonstop Forwarding and the RIB vs FIB question

Nonstop Forwarding (NSF) works together with SSO. The standby already has a copy of the FIB, so packets keep being forwarded during the switchover. The new active supervisor then rebuilds its routing table (RIB). Neighbors that support NSF ("NSF-aware") do not drop the neighbor relationship; they simply send their routes again. Supported routing protocols: BGP, EIGRP, OSPF and IS-IS.

The slide spells these “NFS” and “EIRP”; the correct names are NSF and EIGRP.

Quality of Service (QoS) is the set of methods a network uses to protect and prioritize time-critical or important traffic. It classifies traffic, marks it, limits its rate, and decides what to queue, send first, or drop when a link is congested.

Different traffic, different requirements

Jitter is variation in delay: packets sent at even intervals arrive unevenly. Typical acceptable jitter in the deck: VoIP < 30 ms, video conferencing 30–50 ms, online gaming < 30 ms, streaming media < 100 ms, general data around 100 ms or higher.

What QoS is for

• Control over resources — for example, stop low-priority traffic from monopolizing a link.
• More efficient use of resources — measure traffic, then decide how each class is handled.
• Tailored services — offer different service grades to different customers or applications.
• Coexistence of mission-critical applications — critical applications get the most efficient use of the network.

QoS deals with congestion. It fights three problems: delay (latency), jitter (changing delay), and packet loss. QoS cannot add bandwidth; it decides which traffic waits or is dropped when the link is full.

Three service models

Campus switches use DiffServ because it scales: each switch only reads the packet's marking and does not need to keep a reservation for every conversation.

The Cisco switch QoS pipeline

1. Classify each incoming packet: decide what kind of traffic it is and give it an internal DSCP value.
2. Police: compare the traffic with its allowed rate; traffic above the rate is dropped or given a lower marking.
3. Mark (or re-mark) the packet's QoS field.
4. Choose a transmit queue for the egress interface.
5. Congestion management decides which queue sends next; congestion avoidance (WRED) drops some packets early, before a queue is full.

Without a congestion-avoidance mechanism, a queue simply drops new packets when it is full.

Where the markings live: CoS, IP Precedence, DSCP

The last 2 bits of that byte are Explicit Congestion Notification (ECN). (The slide says "the last 2 bits of DSCP"; they actually come after the 6 DSCP bits.) IP Precedence is just the first 3 bits of DSCP, so IPP 5 = 101 becomes DSCP 101000 = 40. In short: DSCP = IPP × 8. DSCP is the main marking used in enterprise networks.

Worked example: a Cisco IP phone marks voice DSCP 46 = 101110. Its top three bits 101 are IP Precedence 5, and the phone also uses CoS 5.

Per-hop behaviors (the homework)

Decode AF from binary b5 b4 b3 b2 b1 b0: b5b4b3 is the class, b2b1 is the drop priority, b0 is always 0. Example: 011100 → class 011 = 3, drop 10 = 2 → AF32; all six bits as decimal → DSCP 28.

Trust boundaries and default maps

Inside the switch, every packet gets an internal DSCP. By default, ports are untrusted: the switch ignores the packet's marking and uses DSCP 0. A port set to trust DSCP keeps the packet's own DSCP. A port that trusts CoS or IP Precedence converts that value to DSCP using this table:

Example from the slides: a host sends CoS 5. On a port that trusts CoS, the internal DSCP becomes 40; on an untrusted port it becomes 0. Note that CoS 5 becomes 40, not 46 (EF), so for voice you trust DSCP instead or change the map.

• Ways to classify: trust the marking arriving on a port; set one fixed value for everything on a port; match packets with an ACL; or recognize applications with Network-Based Application Recognition (NBAR).
• Classify as close to the user as possible — normally at the access switch — so every switch after it can simply trust the marking.
• Marking means writing a new DSCP, CoS or IPP value into incoming packets, for a whole port or with a policy map. Example: mark everything from a video server as DSCP 40.

Shaping vs policing

The slides' "leaky token bucket": each arriving packet pours tokens (equal to its size) into a bucket. The bucket drains at the configured rate, and its size is the burst allowed. If a packet would make the bucket overflow, traffic is arriving too fast: that packet is out of profile and is dropped or re-marked. A policer can act as a dropper (traffic within the CIR is sent, the rest dropped) or as a marker (within CIR = AF11, between CIR and PIR = AF12, above PIR = AF13).

Congestion management: queuing and scheduling

WRR example: four queues with weights 50, 10, 25, 15 (total 100) get 50%, 10%, 25% and 15% of the bandwidth. If the weights do not add up to 100, a queue's share is its weight ÷ the total. Buffer memory is split too: priority queues get little (voice packets are small and leave immediately), while low-priority queues get more because their traffic waits longer.

LLQ (Low-Latency Queuing) is Cisco's name for adding one strict-priority queue to class-based queuing (CBWFQ): voice is always sent before packets in the other queues.

Congestion avoidance: tail drop, RED, WRED

Tail drop, the default, drops every arriving packet once the queue is full. That hurts TCP: many sessions lose packets together and enter slow start together (TCP synchronization), aggressive flows can monopolize the queue, deep queues add delay and jitter, and premium traffic is dropped just like best effort.

RED (Random Early Detection) drops a few packets at random before the queue is full; the fuller the queue, the more it drops. Only some TCP senders slow down each time, at different moments, so the link stays busy instead of every flow slowing down together. Once the queue is completely full, tail drop happens anyway. RED only helps TCP, because TCP slows down after a loss; UDP does not.

WRED (Weighted RED) adds classification: each IP Precedence or DSCP value can have its own minimum threshold, maximum threshold, and drop probability. Deck example for one queue: at 50% full, randomly drop DSCP 0–20 (best effort); at 80%, also drop DSCP above 20 (up to 31); when full, tail drop.

AutoQoS: one command makes the switch create standard QoS classes and policies (for example for voice) automatically.

Monitoring answers “what happened, when, and what is flowing now.” Switches log events with syslog, keep the timestamps correct with NTP, report counters and alerts through SNMP, and mirror traffic to an analyzer with SPAN or RSPAN.

Syslog message format

00:30:39: %SYS-5-CONFIG_I: Configured from console by console
! timestamp  facility-severity-mnemonic  message text

Memory hook for 0–7: Every Awesome Cisco Engineer Will Need Ice-cream Daily.

Where messages go

! Console: on by default at debugging (7); seen only when connected to the console port
logging console warnings         ! same as: logging console 4 — shows 0–4

! Internal buffer: off by default; keeps messages to review later
logging buffered informational   ! level 6 and more severe
logging buffered 16384           ! size in bytes, 4096–2147483647
show logging

! Clock-time stamps with every option
service timestamps log datetime localtime show-timezone msec year
! …or time since boot, e.g. 2w5d
service timestamps log uptime

! datetime timestamps
Nov 10 13:55:24: %LINEPROTO-5-UPDOWN: Line protocol on Interface Ethernet1/1, changed state to down
! uptime timestamps
00:17:58: %AMDP2_FE-6-EXCESSCOLL: Ethernet3/3 TDR=0, TRC=0

Correct time: the clock and NTP

A datetime stamp is only useful if the switch clock is right. After boot the clock starts at March 1, 1993.

show clock
Switch# clock set 15:30:00 20 October 2026      ! privileged EXEC, not config mode
Switch(config)# clock timezone ICT 7             ! Thailand, UTC+7
Switch(config)# clock timezone IST 5 30          ! India, UTC+5:30 — minutes are optional

Network Time Protocol (NTP) synchronizes many devices to common time servers:

ntp server 200.1.1.10 prefer      ! preferred source
ntp server 200.1.1.240 version 4  ! version 3 is the default; 4 adds IPv6
show ntp status
show ntp associations

IOU3# show ntp status
Clock is synchronized, stratum 4, reference is 200.1.1.10

IOU3# show ntp associations
  address         ref clock       st   when   poll reach  delay  offset   disp
+~200.1.1.240     127.127.1.1      5     90    128   377  0.000   0.000  2.850
*~200.1.1.10      127.127.1.1      3     25    128   377  1.000   0.500  2.537
 * sys.peer, # selected, + candidate, - outlyer, x falseticker, ~ configured

In the running configuration, 200.1.1.10 is also marked prefer. Because it is preferred and has the lower stratum, the switch synchronizes to it. reach 377 means the last eight polls all succeeded.

SNMP: manager, agent, MIB

• SNMP manager — a network management system, usually a central application, that polls devices and receives alerts. Examples: Cacti, Munin.
• SNMP agent — a process on the monitored device.
• MIB (Management Information Base) — the device's database of variables, kept in memory and updated in real time, organized as a tree. Each variable has an OID (object identifier), defined with ASN.1.

Example OID: 1.3.6.1.2.1.2.2.1.10 = iso(1).org(3).dod(6).internet(1).mgmt(2).mib-2(1).interfaces(2)… — the inbound-byte counter of an interface in the IF-MIB. Vendor MIBs live under private(4).enterprise(1): Cisco is .9, Microsoft .311, Juniper .2636.

access-list 10 permit 192.168.3.99                 ! optional ACL, numbered 1–99
snmp-server community NETRO ro 10                  ! read-only, limited by ACL 10
snmp-server community NETRW rw 10                  ! read-write (avoid with v1)

snmp-server host 192.168.3.99 NETRO                ! v1 traps
snmp-server host 192.168.3.99 NETRO snmp           ! v1 traps, only the snmp trap type
snmp-server host 192.168.3.99 version 2c NETRO     ! v2c traps
snmp-server host 192.168.3.99 informs version 2c NETRO   ! v2c informs

! Optional view: let the group read only the interfaces subtree
snmp-server view IFONLY 1.3.6.1.2.1.2 included
snmp-server group READERS v3 auth read IFONLY     ! authNoPriv, restricted view

! Supplied example: only 192.168.3.99 and 192.168.100.4 may poll
access-list 10 permit 192.168.3.99
access-list 10 permit 192.168.100.4
snmp-server group NetOps v3 priv
snmp-server user mymonitor NetOps v3 auth sha s3cr3tauth priv aes 128 s3cr3tpr1v 10
snmp-server host 192.168.3.99 informs version 3 priv mymonitor

Port mirroring: SPAN and RSPAN

Switched Port Analyzer (SPAN) copies traffic from source ports or VLANs to a destination port where a network analyzer (sniffer) captures it. Normal forwarding is unchanged.

! Supplied example: mirror Gi1/0/1 to the analyzer on Gi1/0/48
monitor session 1 source interface gigabitethernet1/0/1 both
monitor session 1 destination interface gigabitethernet1/0/48

! A VLAN as the source, received traffic only, keeping tags
monitor session 2 source vlan 10 rx
monitor session 2 destination interface gigabitethernet1/0/47 encapsulation replicate

! Every switch, including intermediate Switch-B
vlan 99
 remote-span
 exit

! Switch-A: source
monitor session 1 source interface gigabitethernet 1/0/1 both
monitor session 1 destination remote vlan 99

! Switch-C: destination
monitor session 1 source remote vlan 99
monitor session 1 destination interface gigabitethernet 1/0/48

show running-config | include monitor
show monitor                         ! every session
show monitor session 1 detail
show monitor session remote          ! RSPAN sessions only
no monitor session 1                 ! remove one session
no monitor session all               ! or: no monitor session local

Security protects three properties of data: availability, integrity, and confidentiality. At the network edge, a firewall enforces which connections may cross between zones, a DMZ holds public servers, and an IPS looks inside traffic for known attacks.

The CIA (AIC) triad

Connect it to earlier topics: HA and HSRP serve availability; SNMPv3 authentication serves integrity; SNMPv3 encryption and SSH serve confidentiality.

Firewall

A firewall sits inline in the forwarding path between the internal network and the external network, so every packet crossing the edge passes through it. It chooses which packets to allow and which to discard, using rules that can match:

• source and destination addresses;
• transport-layer port numbers;
• text in an HTTP request's URI;
• TCP connection state — a stateful firewall remembers connections and allows the return traffic of sessions started from inside.

Security zones and the DMZ

A demilitarized zone (DMZ) is a less-secured zone for servers that outside users are allowed to reach, such as the public web servers for www.example.com. If a DMZ server is compromised, the attacker still has to pass the firewall to reach the inside zone.

IPS: matching attack signatures

A firewall filters by rules the administrator writes. An Intrusion Prevention System (IPS) uses different logic: it compares traffic with attack signatures — patterns of known attacks such as DoS, DDoS, viruses, and worms — and can drop matching packets or redirect them to another security application. An IPS is also placed inline between the external and internal networks. Its signature database must be kept updated.

One figure caption in the deck says “IDS.” An IDS (intrusion detection system) usually monitors a copy of traffic — for example from a SPAN port — and alerts, while an IPS sits inline and can block. The figure shows the inline IPS.

Next-generation firewall and IPS

The deck's product examples are Cisco ASA 5500-X with FirePOWER Services and Firepower 1000/2100/4100/9000 appliances, NGIPSv for VMware, and Firepower Threat Defense for ISR routers. Know the functions; product names are context.