This site is about layered tcp ip networks. You will not only learn tcp utp protocol, LAN WAN architects, as well as ssh, ssl, ipsec, vlan, vpn, ip routing etc, you will also expect to hands on hub, switch, router, ethernet cable and serial WAN cable.
Fiber optics allows the ethernet cable to connect nodes tens of miles apart. It is long enough to cover the distance from the customer premise equipment (CPE) to service provider's point of presence (POP), it is even long enough to cover the distance from one city to another.
Internet service providers (ISPs) quickly turn this new technology into profit by offering ethernet based WAN services.
Your little-rock-city SOHO LAN is connect to the CPE router in the little-rock-city commercial center building with an ethernet cable. The CPE router then connects to a special ethernetswitch located in the local ISP central office (CO) with an ethernet cable (fiber optics). This central office provides a point of presence (POP). Behind the ethernet switch, ISP can uses any WAN technology to connect their devices internally. In another city, say big-river-city, the ISP's central office provides another POP, where another special ethernet switch connects to your CPE router located in -- well -- big-river-city commercial center building with a fiber optic ethernet cable, this CPE router then connects to you big-river-city SOHO LAN with an ethernet cable.
The internal WAN connection can vary from ISP to ISP. However, from customer's perspective: a point-to-point connection is established between two remote CPEs connected with a (long, virtual) ethernet link.
Ethernet over Multiprotocol Label Switching (EoMPLS) is one of those WAN technologies that can provide that "long, virtual ethernet link".
Recall the routing process in HDLC WAN.When an IP packet from source PC needs to travel across WAN to reach destination PC, the IP packet has to be de-encapsulated and re-encapsulated between Ethernet frame and HDLC frame.
EoMPLS uses ethernet for both layer 1 and layer 2 functions, routing over an EoMPLS WAN uses the same Ethernet protocols as LAN. Instead of switching between Ethernet and HDLC, EoMPLs use the Ethernet protocol all the time.
IP packet travel LAN and EoMPLS
At the beginning, the sending node encapsulates the IP packet in an Ethernet frame with the destination MAC address of the gateway router. This Ethernet frame travels across the LAN and reaches the gateway router. At the gateway router, the Ethernet frame is de-encapsulated to extract the IP packet. This IP packet is then encapsulated in another ethernet frame, this time, the destination MAC address is the MAC address of the receiving gateway router. The ethernet frame is then forwarded to the EoMPLS WAN network. The Ethernet frame travels across EoMPLS WAN and reaches other side of the point to point link, which is the receiving LAN's gateway router. The Ethernet frame is de-encapsulated to extract the IP packet. This IP packet is then encapsulated in an Ethernet frame with the destination MAC address as the receiving node. Finally the Ethernet frame travels across the LAN and reaches the receiving node. The return journey follow the same ethernet frame header/trailer changing process.
The following diagram is an overall architecture of internet.
You home PC connects to a home LAN, your home LAN then connects to a tier 3 ISP, the tier 3 ISP have access to a NSP's network infrastructure (fibers, routers etc.) via a POP. These NSPs have peer to peer connections via NAP or IXP, so that the internet made of inter-connected NSPs span the whole globe.
ISP and NAP
Local Loop also called "last mile", is a copper or fiber cable that connects the demarc to the closest switching office, called a central office. In the diagram, the local loop is a T1 line.
Internet Service Provider (ISP), An Internet Service Provider (ISP) is a company that provides Internet access. The most common ISP is the provider who delivers Internet to your home or business for a fee.
Central office (CO) also called point of presence (POP), connects the customers to the provider's switching network. It is the entry point to the WAN cloud and the exit point from the WAN for called devices. The tier 3 Internet service provider (ISP) often has multiple point-of-presence in major cities, which are connected together by the leased lines from NSP.
Network Service Providers (NSP) A network service provider (NSP) is a company that owns, operates and sells access to internet backbone infrastructure and services. They often sell network to tier 3 ISPs, or act as ISP by themselves. NSPs build and maintain the fiber optic cable and core routers. Some of the large NSPs are UUNet, CerfNet, IBM, BBN Planet, SprintNet, PSINet, as well as others. These networks peer with each other to exchange packet traffic via NAP.
Network Access Points (NAP) is a public network exchange facility where Internet Service Providers (ISPs) can connect with one another in peering arrangements. The NAPs are a key component of the Internet backbone because the connections within them determine how traffic is routed. They are also the points of most Internet congestion.
Metropolitan Area Exchanges (MAEs). MAEs serve the same purpose as the NAPs but are privately owned. NAPs were the original Internet interconnect points. Both NAPs and MAEs are referred to as Internet Exchange Points (IXs).
Tier 1 ISP, Tier 2 ISP and Tier 3 ISP, ISPs are categorized by their size. Tier 3 are generally small ISPs who only purchase their connection to the Internet from NSP. Tier 1 are generally internet giant NSP who owns so much network infrastructure that they don’t need to purchase any connection from other ISPs. These major players “peer” with other to allow the traffic between their networks to flow back and forth. Tier 2 are providers who have some interconnection agreements, but who also purchase some connections. Largest Tier 1 Internet providers are the networks that provide the backbone of the Internet. These providers build infrastructure such as the Atlantic Internet sea cables. These infrastructures allow the data exchange between continent and countries. Examples are Hibernia Networks, Cogent Communications.
LAN and WAN are similar layer 1 and layer 2 technology. Small company usually use a leased line to connect the LANs in their branch offices cross a WAN.
Knowing the following 3 factors, you should be able to setup a WAN lab at home.
The leased line service conceptually acts as a full-duplex crossover Ethernet link between two routers.
Another factor about WAN is you need a CSU/DSU device. A CSU/DSU is a digital signal processing device. The DSU portion is responsible for timing, and actually connects to the DTE router via its serial port. The CSU portion is responsible for terminating the service provider’s link, and handles transmitting and receiving data from the DCE switch over the WAN link.
The DCE cable has a female connector, while the DTE cable has a male connector. You can plug the DTE cable directly into the DCE cable, skipping the CSU/DSU device. As a result, the WAN link is conceptually two routers linked by a cross over cable.
Follow the following guidelines, you should be able to figure out how to setup the network:
Now you can plug one side of the crossover cable into one cisco router's DB-60 port. This router will acts as the service provider's DCE switch; you then plug the other end of the crossover cable into another cisco router's DB-60 port. This router will act as the organization's DTE router.
The only problem at this point is, you don't have DSU to provide timing. Don't worry, you can configure serial clocking using the "clock rate 128000" command on the router that act as the DCE switch. The rest of the configuration is the same as connecting two routers with serial connection.
R1(config-if) # interface S0/0/1
R1(config-if) # ip address 172.16.3.1 255.255.255.0
Back>
Let's talk a little bit about IOS commands for WAN trouble-shooting.
To verify the physcial cable connection on the routers, "show controller serial 1", where serial 1 is the serial port the cable attached to.
R1#show controller serial1
For the sake of trouble-shooting, we may want to use command "show interfaceserial1" to gain more information about the interfaces. Sometimes we find that the physical interface is up and the line procol down, generally there could be two reasons
We forget to set the clock rate on DCE. The line protocal will be down after 30 seconds, because the DTE need to receive the clock rate to work correctly. To set the clock rate on the DCE, use command "clock rate56000" to set the clock rate to, for instance, 56 kbps.
The encapsulation type mismatch on both ends of the connection.
For example, if we physically connected router R1 and R2, but set different encapsulation type on them.
R1#encapsulation ppp
R2#encapsulation hdlc
Then, we will see physical interface up and line prococal down by running command "show interface serial1" on both router R1 and R2. To resolve the problem, we issue command "encapsulation hdlc" on R1 or issue command "encapsulation ppp" on R2, so that the encapsulation type matches on both ends of the serial link.
The public switched telephone network (PSTN) is the network of the world's public circuit-switched telephone networks, in much the same way that the Internet is the network of the world's public IP-based packet-switched networks. Originally a network of fixed-line analog telephone systems, the PSTN is now almost entirely digital, and now includes mobile as well as fixed telephones. There are many advantages for PSTN as a communications link:
Other than a modem, no additional equipment is required.
The cost associated with the implementation of a PSTN connection link for a WAN is relatively low.
The maintenance of a public telephone network is very high quality with few instances in which lines are not available.
Wide Area Network (WAN) is a computer network that covers a broad geographical area. On the contrary, Local Area Networks (LAN) are usually limited to a small physical area, like a home, office, building or campus. The largest and most well-known example of a WAN is the Internet. WAN is needed because people or business in remote sites need to be able to communicate and share data. For example, branch offices of an organization want to share the database and company intranet, remote employees or traveling employees want to access information that resides in the corporation network, such as database, confluence, wageworks, etc.
Wide area network
WANs are used to connect LANs and other types of networks together. Many WANs are built for one particular organization and are private. Others, built by Internet Service Providers (ISP), provide connections from an organizations’s LAN to the internet. In order to provide connections over large geographical arears, WANs often use public networks, such as the telephone system, leased lines (ISDN), satellite, microwave, or other connection method.
Typical WANs use serial connections of various types to access bandwidth over large geographic areas.
So, who is managing the WANs today? The following organizations defined and managed the WAN access standards:
International Organization for Standardization (ISO)
Telecommunications Industry Association (TIA)
Electronics Industry Alliance (EIA)
WAN access standards are primarily resides in TCP/IP model Link layer or OSI model data link layer and physical layer. WAN access standards describe physical layer and data link layer requirements such as physical addressing, flow control, and encapsulation. The following picture shows the popular WAN solutions today.
WAN access standards
As shown above, at OSI model layer 1, WAN protocols describe how to provide electrical, mechanical, operational, and functional connections to the services of a communications service provider.
At OSI model layer 2,WAN protocols define encapsulation of data for transmission toward a remote location and the mechanisms for transferring the resulting frames. The WAN data link layer protocols include:
HDLC
PPP
Frame Relay (Link Access Procedure for Frame Relay [LAPF])
ATM
Ethernet WAN, Leased Line, Cable Internet and DSL
Serial connections support WAN services such as dedicated leased line, above which the PPP or Frame Relay runs.
With fiber optics technology, Ethernet became a reasonable WAN technology. Ethernet cable nowadays can also support long distance communication. 1000BASE-ZX standard, for example, can support 70km cable length, above which Ethernet emulation and Ethernet over MPLS (EoMPLS) protocol runs.
Other WAN services, such as ISDN or dial-up modem, offer low cost dial-on-demand connection. An ISDN BRI is composed of two 64-kbps bearer channels (B channels) for data, and one 16-kbps data channel(D channel) for link-management purposes.
DSL and cable modem connections dominates today’s residential broadband service market. A typical residential DSL service can offer up to 1.5 Mbps connection speed over the existing telephone line. Cable services can offer higher speed connection over the existing coaxial cable TV line.
Switch#show running-config
Building configuration...
Current configuration : 984 bytes
!
version 12.2
no service password-encryption
!
hostname Switch
!
!
!
!
!
ip ssh version 1
!
port-channel load-balance src-mac
!
interface FastEthernet0/1!
interface FastEthernet0/2...omitted for clarity...!
interface FastEthernet0/23!
interface FastEthernet0/24
!
interface GigabitEthernet0/1!
interface GigabitEthernet0/2
!
interface Vlan1
no ip address
shutdown
!
ip classless
!
!
!
!
!
line con 0
line vty 0 4
login
!
!
end
-----------------
As shown above, the cisco switch have 24 FastEthernet interfaces, 2 GigabitEthernet interfaces, 1 VLAN interface, 1 console line and 5 vty lines.
For some types of interfaces, including FastEthernet interface, GigabitEthernet interface, Serial interface, and console line there is an one-to-one mapping between a specific interface and its corresponding physical port on the cisco device. The naming rule is typeslot/port. For example, FastEthernet 0/1 interface can be mapped to the FastEthernet port (type) located in slot number 0 and port number 1, as circled in the following picture.
switch port 1
Other types of interfaces, however, are virtue, which means a interface don't always have a single port as its physical conterpart. For example, vlan 1 on a switch includes all the switch ports. For another example, vty lines from number 0 through number 4 might all be assigned to one single FastEthernet port on a cisco device.
Let's run command "show running-config" on a 2621XM router.
Router#show running-config
Building configuration...
Current configuration : 502 bytes
!
version 12.2
no service password-encryption
!
hostname Router
!
!
!
!
!
ip ssh version 1
!
!
interface FastEthernet0/0
no ip address
duplex auto
speed auto
shutdown
!
interface FastEthernet0/1
no ip address
duplex auto
speed auto
shutdown
!
interface Serial0/0
no ip address
shutdown
!
interface Serial0/1
no ip address
shutdown
!
interface Serial0/2
no ip address
shutdown
!
interface Serial0/3
no ip address
shutdown
!
ip classless
!
!
!
!
!
line con 0
line vty 0 4
login
!
!
end
---------------
Note that the router's interfaces are very similar to the switch's. We can map the FasterEthernet interfaces, Serial interfaces to the router's physical ports. As the following pictures show, this router have 2 slots. The left-side slot, slot number 1 is empty. The right-side slot, slot number 0 have two WIC-2T modules installed. These modules are changeable, that is, they can be replaced by other modules such as module WIC-1T.
router1 ports
The following picure is the detail view of slot 0. Don't forget the interface naming rule: "type slot/port".
router1 ports detail
The output of command "show running-config" looks slightly different on the cisco 2811 router:
Router#show running-config
Building configuration...
Current configuration : 455 bytes
!
version 12.4
no service password-encryption
!
hostname Router
!
!
!
!
!
ip ssh version 1
!
!
interface FastEthernet0/0
no ip address
duplex auto
speed auto
shutdown
!
interface FastEthernet0/1
no ip address
duplex auto
speed auto
shutdown
!
interface Serial0/0/0 no ip address
shutdown
!
interface Serial0/0/1 no ip address
shutdown
!
interface Vlan1
no ip address
shutdown
!
ip classless
!
!
!
!
!
line con 0
line vty 0 4
login
!
!
end
-----------------------------------------
As the following pictures show, the 2811 router have 2 slots. The slot number 1 is empty. In slot number 2, we add one WIC-2T module.
router2 ports
Note that the naming rule for Serial port is "type router/slot/port", which explained what the extra 0/ mean.
router2 ports details
Understanding the naming rule for ports on cisco devices is important, because this rule is also used in other commands such as "interfaceFastEthernet 0/1".
In this section, we will talk about the basic management commands for the router. Most commands we learned in switch are still applied to router. These commands are so basic that we repeated them again and again during the course.
Now we have watched the demo long enough, it is the time to practice with packets tracer.
In the following exercise, our goals are:
Connect to a router through console port.
configure the console settings with commands "exec-timeout20 10" and "loggingsynchronous"
Set various passwords on the Router.
Change the router’s name with command "hostnameroutername".
Set banner with command "banner motd # message #".
Manage terminal history with commands "show history", "terminal history", and "terminal history size5".
Configure router's IP address and subnet mask with command "interface FastEthernet 0/1" and its subcommands "ip address192.168.1.100 255.255.255.0".
Configure a description for a specific router interface with command "descriptionblablabla".
Configure Telnet and SSH connection on the router.
Verify the router's status with various "show" commands.
Save configuration file with command "copy running-config startup-config".
The router used in the exercise is a cisco 2811 router.
In step one, we physically connect the router's console port to the Pc0's RS232 port with a console cable.
console connect
Then, we configure the hyper terminal program on the PC with the following configurations.
terminal
If the hyper terminal program successfully logged into the router via console line, the following CLI will show up.
System Bootstrap, Version 12.1(3r)T2, RELEASE SOFTWARE (fc1)
Copyright (c) 2000 by cisco Systems, Inc.
cisco 2811 (MPC860) processor (revision 0x200) with 60416K/5120K bytes of memory
Self decompressing the image :
########################################################################## [OK]
Restricted Rights Legend
Use, duplication, or disclosure by the Government is
subject to restrictions as set forth in subparagraph
(c) of the Commercial Computer Software - Restricted
Rights clause at FAR sec. 52.227-19 and subparagraph
(c) (1) (ii) of the Rights in Technical Data and Computer
Software clause at DFARS sec. 252.227-7013.
cisco Systems, Inc.
170 West Tasman Drive
San Jose, California 95134-1706
Cisco IOS Software, 2800 Software (C2800NM-ADVIPSERVICESK9-M), Version 12.4(15)T1, RELEASE SOFTWARE (fc2)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2007 by Cisco Systems, Inc.
Compiled Wed 18-Jul-07 06:21 by pt_rel_team
Image text-base: 0x400A925C, data-base: 0x4372CE20
This product contains cryptographic features and is subject to United
States and local country laws governing import, export, transfer and
use. Delivery of Cisco cryptographic products does not imply
third-party authority to import, export, distribute or use encryption.
Importers, exporters, distributors and users are responsible for
compliance with U.S. and local country laws. By using this product you
agree to comply with applicable laws and regulations. If you are unable
to comply with U.S. and local laws, return this product immediately.
If you require further assistance please contact us by sending email to export@cisco.com.
cisco 2811 (MPC860) processor (revision 0x200) with 60416K/5120K bytes of memory
Processor board ID JAD05190MTZ (4292891495)
M860 processor: part number 0, mask 49
2 FastEthernet/IEEE 802.3 interface(s)
239K bytes of non-volatile configuration memory.
62720K bytes of ATA CompactFlash (Read/Write)
Cisco IOS Software, 2800 Software (C2800NM-ADVIPSERVICESK9-M), Version 12.4(15)T1, RELEASE SOFTWARE (fc2)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2007 by Cisco Systems, Inc.
Compiled Wed 18-Jul-07 06:21 by pt_rel_team
--- System Configuration Dialog ---
Continue with configuration dialog? [yes/no]: n
Press RETURN to get started!
So we press RETURN to get started. Our next step is to configure password, exec-timeout, and logging synchronous on the console port.
Router>enable
Router#config terminal
Enter configuration commands, one per line. End with CNTL/Z.
Router(config)#line console 0
Router(config-line)#password console
Router(config-line)#login
Router(config-line)#exec-timeout 20 10
Router(config-line)#logging synchronous
Router(config-line)#^Z
%SYS-5-CONFIG_I: Configured from console by console
Router#write memory
Building configuration...
[OK]
Router#logout
Next, we logout of the router then login the router in order to make sure the password works. As you have already guessed, it works. The password is "console" as we configured on line console 0.
Router con0 is now available
Press RETURN to get started.
User Access Verification
Password:
Our next goal is to configure passwords for privileged mode and vty lines. We also encryt our passwords with command "service password-encrytion"
Router>enable
Router#config t
Enter configuration commands, one per line. End with CNTL/Z.
Now, it's time to configure the message of tody (motd).
Router#config t
Enter configuration commands, one per line. End with CNTL/Z.
Router(config)#banner motd # authorized user only! #
In the next step, we configured the FasterEthernet 0/0 interface. We add a brief descrition for the interface, then configured the ip address and network mask, finally we bring the interface up with command "no shutdown".
Router(config)#interface FastEthernet 0/0
Router(config-if)#description this port is configured for telnet and ssh connection.
%LINK-5-CHANGED: Interface FastEthernet0/0, changed state to up
Router(config-if)#
Router(config-if)#exit
Router(config)#exit
%SYS-5-CONFIG_I: Configured from console by console
We have entered many commands, let's see what they are.
Router#show history
enable
config t
banner motd # authorized user only! #
wr
config t
show history
Router#terminal history size 50
Router#wr
Building configuration...
[OK]
Router#
Next step is to configure telnet and ssh on the router. Note that we have already configured the Ethernet 0/0 interface and vty line 0 4 for telnet connection, so the work left is to configure the remote PC correctly.
The router's FastEthernet0/0 port is connected to the PC1's FastEthernet port via a cross-over cable. Note that for switch, straight-through cable should be used instead.
telnet
Since Telnet need Layer 3 address, the Pc1's FasterEthernet port must be configured with IP address, in our case, it is 192.168.1.100.
Now we bring up a microsoft command promt window, type in "telnet 192.168.1.1". The telnet program is executed, and started a telnet session on the router for us. Of couse a password is needed, we know the password is "vty", because we set it previously when configuring vty line 0 4. Note that the message of today is shown up before login.
During this telnet session, our task is to configure ssh on the router. Note that the password to enter the privileged mode is "cisco" instead of "ccent", because command "enable secrete cisco" takes priority over command "enable password ccent".
PC>ipconfig /all
IP Address......................: 192.168.1.100
Subnet Mask.....................: 255.255.255.0
Default Gateway.................: 0.0.0.0
DNS Servers.....................: 0.0.0.0
PC>telnet 192.168.1.1
Trying 192.168.1.1 ...
authorized user only!
Router#config t
Enter configuration commands, one per line. End with CNTL/Z.
Router(config)#hostname RouterA
RouterA(config)#ip domain-name domain.net
RouterA(config)#crypto key generate rsa
The name for the keys will be: RouterA.domain.net
Choose the size of the key modulus in the range of 360 to 2048 for your
General Purpose Keys. Choosing a key modulus greater than 512 may take
a few minutes.
How many bits in the modulus [512]: 1024
% Generating 1024 bit RSA keys, keys will be non-exportable...[OK]
RouterA(config)#line vty 0 4
RouterA(config-line)#transport input ssh
RouterA(config-line)#login local
RouterA(config-line)#exit
RouterA(config)#username ccent password ccent
RouterA(config)#^Z
%SYS-5-CONFIG_I: Configured from console by console
RouterA#write memory
Building configuration...
[OK]
RouterA#logout
[Connection to 192.168.1.1 closed by foreign host]
Now, it's time to login with ssh program. Before we do that, we should verify that the telnet login is really disabled on the FastEthernet port by the command "transport input ssh". The password for ssh login is "ccent" as we configured in command "username ccent password ccent".
PC>ipconfig /all
Physical Address................: 0010.1194.8786
IP Address......................: 192.168.1.100
Subnet Mask.....................: 255.255.255.0
Default Gateway.................: 0.0.0.0
DNS Servers.....................: 0.0.0.0
PC>telnet 192.168.1.1
Trying 192.168.1.1 ...
[Connection to 192.168.1.1 closed by foreign host]
PC>ssh -l ccent 192.168.1.1
Password:
authorized user only!
RouterA>enable
Password:
After successfully log in with ssh, we issued many "show" commands to check the router's current status.
RouterA#show version
Cisco IOS Software, 2800 Software (C2800NM-ADVIPSERVICESK9-M), Version 12.4(15)T1, RELEASE SOFTWARE (fc2)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2007 by Cisco Systems, Inc.
Compiled Wed 18-Jul-07 06:21 by pt_rel_team
ROM: System Bootstrap, Version 12.1(3r)T2, RELEASE SOFTWARE (fc1)
Copyright (c) 2000 by cisco Systems, Inc.
System returned to ROM by power-on
System image file is "c2800nm-advipservicesk9-mz.124-15.T1.bin"
This product contains cryptographic features and is subject to United
States and local country laws governing import, export, transfer and
use. Delivery of Cisco cryptographic products does not imply
third-party authority to import, export, distribute or use encryption.
Importers, exporters, distributors and users are responsible for
compliance with U.S. and local country laws. By using this product you
agree to comply with applicable laws and regulations. If you are unable
to comply with U.S. and local laws, return this product immediately.
If you require further assistance please contact us by sending email to export@cisco.com.
cisco 2811 (MPC860) processor (revision 0x200) with 60416K/5120K bytes of memory
Processor board ID JAD05190MTZ (4292891495)
M860 processor: part number 0, mask 49
2 FastEthernet/IEEE 802.3 interface(s)
239K bytes of NVRAM.
62720K bytes of processor board System flash (Read/Write)
Configuration register is 0x2102
RouterA#show interface FastEthernet0/0
FastEthernet0/0 is up, line protocol is up (connected)
Hardware is Lance, address is 0060.2f94.a501 (bia 0060.2f94.a501)
Description: this port is configured for telnet and ssh connection.
Internet address is 192.168.1.1/24
MTU 1500 bytes, BW 100000 Kbit, DLY 100 usec, rely 255/255, load 1/255
Encapsulation ARPA, loopback not set
ARP type: ARPA, ARP Timeout 04:00:00,
Last input 00:00:08, output 00:00:05, output hang never
Last clearing of "show interface" counters never
Queueing strategy: fifo
Output queue :0/40 (size/max)
5 minute input rate 207 bits/sec, 0 packets/sec
5 minute output rate 203 bits/sec, 0 packets/sec
409 packets input, 26440 bytes, 0 no buffer
Received 0 broadcasts, 0 runts, 0 giants, 0 throttles
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
0 input packets with dribble condition detected
374 packets output, 25037 bytes, 0 underruns
0 output errors, 0 collisions, 1 interface resets
0 babbles, 0 late collision, 0 deferred
0 lost carrier, 0 no carrier
0 output buffer failures, 0 output buffers swapped out
RouterA#show ssh
Connection Version Encryption State Username
67 1.99 3DES Session Started ccent
%No SSHv1 server connections running.
%No SSHv2 server connections running.
RouterA#show running-config
Building configuration...
Current configuration : 763 bytes
!
version 12.4
service password-encryption
!
hostname RouterA
!
!
enable secret 5 $1$mERr$hx5rVt7rPNoS4wqbXKX7m0
enable password 7 08224F4B070D
!
!
!
!
username ccent password 7 08224F4B070D
!
ip ssh version 1
ip domain-name domain.net
!
!
interface FastEthernet0/0
description this port is configured for telnet and ssh connection.
ip address 192.168.1.1 255.255.255.0
duplex auto
speed auto
!
interface FastEthernet0/1
no ip address
duplex auto
speed auto
shutdown
!
interface Vlan1
no ip address
shutdown
!
ip classless
!
!
!
!
!
banner motd ^C authorized user only! ^C
line con 0
history size 50
exec-timeout 20 10
password 7 082243401A160912
logging synchronous
login
line vty 0 4
password 7 08375857
login local
transport input ssh
!
!
end
Finally, we save all the above configuration in the startup-config file, so that they will not lost after the router is powered off.
RouterA#copy running-config startup-config
Destination filename [startup-config]?
Building configuration...
[OK]
RouterA#
Back>
The following is a citation from a cisco document. Conclusion: don't use enable password, use enable secret instead.
Password Management Passwords control access to resources or devices. This is accomplished through the definition a password or secret that is used in order to authenticate requests. When a request is received for access to a resource or device, the request is challenged for verification of the password and identity, and access can be granted, denied, or limited based on the result. As a security best practice, passwords must be managed with a TACACS+ or RADIUS authentication server. However, note that a locally configured password for privileged access is still be needed in the event of failure of the TACACS+ or RADIUS services. A device can also have other password information present within its configuration, such as an NTP key, SNMP community string, or Routing Protocol key.
The enable secret command is used in order to set the password that grants privileged administrative access to the Cisco IOS system. The enable secret command must be used, rather than the older enable password command. The enable password command uses a weak encryption algorithm.
If no enable secret is set and a password is configured for the console tty line, the console password can be used in order to receive privileged access, even from a remote virtual tty (vty) session. This action is almost certainly unwanted and is another reason to ensure configuration of an enable secret.
The service password-encryption global configuration command directs the Cisco IOS software to encrypt the passwords, Challenge Handshake Authentication Protocol (CHAP) secrets, and similar data that are saved in its configuration file. Such encryption is useful in order to prevent casual observers from reading passwords, such as when they look at the screen over the muster of an administrator. However, the algorithm used by the service password-encryption command is a simple Vigenère cipher. The algorithm is not designed to protect configuration files against serious analysis by even slightly sophisticated attackers and must not be used for this purpose. Any Cisco IOS configuration file that contains encrypted passwords must be treated with the same care that is used for a cleartext list of those same passwords.
While this weak encryption algorithm is not used by the enable secret command, it is used by the enable password global configuration command, as well as the password line configuration command. Passwords of this type must be eliminated and the enable secret command or the Enhanced Password Security feature needs to be used.
The enable secret command and the Enhanced Password Security feature use Message Digest 5 (MD5) for password hashing. This algorithm has had considerable public review and is not known to be reversible. However, the algorithm is subject to dictionary attacks. In a dictionary attack, an attacker tries every word in a dictionary or other list of candidate passwords in order to find a match. Therefore, configuration files must be securely stored and only shared with trusted individuals.
Cisco IOS software is the embedded software architecture in all Cisco devices and is also the operating system of Cisco Catalyst switches.
The Cisco IOS Software command-line interface (CLI) is used by network administrators to monitor and configure Cisco devices. You access the CLI by establishing a console connection or a Telnet connect connection to the Cisco devices. Log in to the Cisco device brings up a CLI window, where you are put into user EXEC mode by default and the prompt sign is ">". The command exit close the session from the user EXEC mode.
The Cisco IOS software CLI have very handy help features.
command avialability help: enter the ? (question mark) command at the user EXEC mode or privileged EXEC mode will reveal commands that available at that EXEC level.
word help: Enter an incomplete command followed by a ? (without any space between) will display a list of available commands that start with the characters that you entered.
word auto-complete: Enter an incomplete command, then press TAB key will automatically complete the command for you, provide that only one command exists which start with the characters that you entered.
command syntax help: Enter a command followed by a space then ? will display a list of the available command options supported by the command that you entered.
The following is the CLI help features demonstration on a Cisco 2960-24TT switch:
Switch>?
Exec commands:
<1-99> Session number to resume
connect Open a terminal connection
disconnect Disconnect an existing network connection
enable Turn on privileged commands
exit Exit from the EXEC
logout Exit from the EXEC
ping Send echo messages
resume Resume an active network connection
show Show running system information
telnet Open a telnet connection
terminal Set terminal line parameters
traceroute Trace route to destination
Switch>sh?
show
Switch>show ?
cdp CDP information
clock Display the system clock
dtp DTP information
etherchannel EtherChannel information
flash: display information about flash: file system
history Display the session command history
interfaces Interface status and configuration
ip IP information
mac-address-table MAC forwarding table
sessions Information about Telnet connections
tcp Status of TCP connections
terminal Display terminal configuration parameters
users Display information about terminal lines
version System hardware and software status
vlan VTP VLAN status
vtp VTP information
Switch>show ip ?
arp IP ARP table
interface IP interface status and configuration
Switch>show ip interface ? Vlan Catalyst Vlans
brief Brief summary of IP status and configuration
<cr>
Switch>show ip interface
Vlan1 is administratively down, line protocol is down
Internet protocol processing disabled
Switch>enable
Switch#?
Exec commands:
<1-99> Session number to resume
clear Reset functions
clock Manage the system clock
configure Enter configuration mode
connect Open a terminal connection
copy Copy from one file to another
debug Debugging functions (see also 'undebug')
delete Delete a file
dir List files on a filesystem
disable Turn off privileged commands
disconnect Disconnect an existing network connection
enable Turn on privileged commands
erase Erase a filesystem
exit Exit from the EXEC
logout Exit from the EXEC
more Display the contents of a file
no Disable debugging informations
ping Send echo messages
reload Halt and perform a cold restart
resume Resume an active network connection
setup Run the SETUP command facility
--More--
So far, we have learned how the Transport layer protocols UDP and TCP work, we also learned that both Network Layer addresses (the IP address) and data link layer addresses (MAC address) are needed for two hosts to communicate. In this section, we will put these knowledge into use by examing a Host-to-Host communication example.
In the example setup, Host A has Layer 3 address of 192.168.1.100 and Layer 2 address of 0000:0000:AAAA; Host B has Layer 3 address of 192.168.1.200 and Layer 2 address of 0000:0000:BBBB.
host-to-host
Let's assume that Host B have a web server running on it, and its port 80 is ready to accept http connections. A HTML file named test.htm is located in Host A's internet folder.
Now, we open a web brower in Host A and type the URL http://192.168.1.200/test.htm in the address bar, then press the ENTER key. This is what happened afterwards.
Note that I will not emphasis events happened on the three upper layers of the OSI model. Simply put, browser issued an application layer http GET request to web server, where presentation layer format are specified for browser to render test.htm. http protocol is based on session layer socket communication between browser process (192.168.1.100, TCP, random port) and listening web server process (192.168.1.200, TCP, 80). socket communication is based on transport layer TCP/UDP protocols. If you really want a complete picture, please install a firebug on the firefox browser and exam the upper layer protocols by yourself. (ref)
Step 1, The web brower program reads your input from the address bar.
Step 2, The browser broke the URL into three parts: the protocol (http), the server address (192.168.1.200), and the file name (test.htm).
Step 3, From the protocol part "http", the browser knows two things: a reliable connection is needed, and the port number 80 should be used. Therefore the browser requests the reliable connection service from the transport layer, it also tells the transport layer that the IP address is 192.168.1.200 and port number is 80. The browser then try to create a session layer socket, thus passes the request down to transport layer.
Step 4, Upon receiving the request from the browser program, the work flow is now passed from application programmer's realm to operating system's TCP/IP stack (software, firmware and hardware). The transport layer selects TCP to set up the session. TCP initiates the session by creating a TCP segment with SYN bit set. The source port is a randomly assigned dynamic port number and the destination port is 80. The TCP segment was passed down to the Network layer, with the destination IP address 192.168.1.200.
Step 5, IP then creates a packet with IP source address 192.168.1.100 and destination address 192.168.1.200 received from TCP. The Protocol field of the packet has value 0×06, which means TCP. After the packet creation, IP then passes the packet to Layer 2.
Step 6, Because hosts only communicate via hardware addresses on the local LAN, for this packet to be sent to the destination Host B, Layer 2 needs to map the destination IP addrss 192.168.1.200 to its MAC address. Layer 2 does this by requesting a mapping from the ARP program.
Step 7, ARP checks its ARP table to see if the IP address of the destination IP has already been resolved to hardware address. If it is, the frame is then created with the hardware destinatio address. Otherwise, Layer 2 holds the packet until ARP can provide a mapping. Since this is the first time we connect to the web server, the ARP table is empty.
Step 8, The ARP program builds an ARP request and passes it to Layer 2, telling Layer 2 to send the request t a broadcast address.
Step 9, Layer 2 encapsulates the ARP requestin a Layer 2 frame using the broadcast address (FFFF:FFFF:FFFF) provided by ARP as the destination MAC address and the local MAC address (0000:0000:AAAA) as the source MAC address.
Step 10, Layer 2 at Host B receives the frame, it notes the broadcast address and strips the Layer 2 header and send it to ARP program.
Step 11, ARP sees the ARP request is from a host with IP address 192.168.1.100 and MAC address 0000:0000:AAAA, so it adds this IP and MAC pair to its ARP table.
Step 12, ARP builds a ARP response with its own IP address 192.168.1.200, then passes it to Layer 2, telling Layer 2 to send the response to MAC address 0000:0000:AAAA.
Step 13, Layer 2 encapsulates the ARP in a Layer 2 frame using the destination MAC address 0000:0000:AAAA provided by ARP and the local source MAC address 0000:0000:BBBB.
Step 14, When Host A receives the frame, it notes that the destination MAC address is the same as its own. It strips the Layer 2 encapsulation and passes the remaining ARP reply to the ARP program.
Step 15, ARP notice the ARP reply is from a host with IP 192.168.1.200 and MAC 0000:0000:BBBB, so it adds this IP and MAC pair to its ARP table.
Step 16, Layer 2 now mapped the destination IP addrss 192.168.1.200 to the corresponding MAC address 0000:0000:BBBB with the help of ARP program. Therefore, it can encapsulats the pending packet into a frame with Source MAC 0000:0000:AAAA and destination Address 0000:0000:BBBB, then the frame out.
Step 17, At Host B, the frame is passed up the stack where encapsulation is removed. The remaining protocol data unit (PDU) is passed to TCP.
Step 18, In response to the SYN, TCP at Host B passes a SYN ACK down the stack to be encapsulated.
Step 19, Upon receives the SYN ACK from Host B, Host A sends back the ACK to complete the Three-Way Handshake.
Step 20, With the three-way handshake completed, TCP can inform the web browser that a connection to the server at IP address 192.168.1.200 have been formed on port 80.
Step 21, Following the application layer HTTP protocol, the browser sent a GET request to the server, asking for the file test.htm.
Step 22, The server running on Host B then sent the HTML format text for the Web page to the browser running on Host A..
Step 23, The browser read the HTML tags and the presentation layer present the page onto your screen.
The Host to Host communication didn't involves routing process, which will be covered later.
A Ethernet LAN segment is a network connection made by a single unbroken network cable. The network cable have a length limit, because the signal will tenuate as they travel down the cable and finally be corrupted by the line noise.
The following table compares many Ethernet cable specifications for the speed and the maximum segment length.
Ethernet specification
speed
cable
Maximum length
10BASE-T
10 Mbps
Twisted-pair
100m
10BASE-FL
10 Mbps
Fiber-optic
2000m
100BASE-TX
100 Mbps
Twisted-pair
100m
100BASE-FX
100 Mbps
Fiber-optic
400m
1000BASE-T
1000 Mbps
Twisted-pair
100m
1000BASE-LX
1000 Mbps
Fiber-optic
550m for multimode fiber or 10km for single-mode fiber
1000BASE-CX
1000 Mbps
copper
25m
When we need an Ethernet LAN longer than a single cable's maximum length, devices such as repeater, hub, switch and routers are needed to extend LAN segments. Notice that all computers attached to a given Ethernet segment compete for the same amout of bandwidth provided by the network media.
The data link layer Protocal Data units (PDU) is frame. A frame contains the bits that are transmitted over an Ethernet LAN. The frame have three parts, frame header, frame trailer and the actual data that is being transmitted. As showed the picture below, the frame structure defined in Ethernet II and 802.3 have some slight differences: In Ethernet II frame, the 2-byte field Type represnets the Type of data to immediately follow in the Data field. In 802.3 frame, the 2 byte Legnth field specifies the length of the 802.2 Header and Data field. The protocol information is contained in 802.2 Header and Data field, which are at the LLC layer.
Ethernet II Frame
7 bytes
1 byte
6 bytes
6 bytes
2 bytes
46-1500 bytes
4 bytes
Preamble
SOF
Dest. Address
Source Address
Type
Data
FCS
802.3 Frame
7 bytes
1 byte
6 bytes
6 bytes
2 bytes
46-1500 bytes
4 bytes
Preamble
SOF
Dest. Address
Source Address
Length
LLC header and Data (802.2 Header and Data)
FCS
Preamble— synchronize the signals of the communicating computer, but really not counted as part of the 14-byte frame header.
Start-of-frame (SOF) delimiter: This field contains bits that signal the receiving computer that the transmission of the actual frame is about to start and that any data following is part of the actual frame.
Destination address— the address of the NIC to which the frame is being sent. Can be Unicast, multicast, or broadcast.
Source address— the address of the NIC of the sending computer. Always unicast.
Length— In 802.3, this field specifies the length of the data field. Valid length field (<= 1500 bytes or 0x05dc).
Type — In Ethernet II, this field identifies the network layer protocol.
Data— IEEE 802.3 specification includes requirement to pad the data to the 46-byte requirement, but the Ethernet II specification really doesn't. 802.3 frame data field actually contains a 802.2 Header and Data, which is at the LLC sublayer.
Frame check sequence— A 4-byte error detection CRC created by the sender and recalculated by the receiver to check for transit damage.
The Destination Address, Source Address and Type/Length fields are collectively called MAC Header, in contract with the LLC header and data field in the 802.3 frame.
LAN stands for Local Area Network, it is a network of computers and other components located relatively close together in a limited area. A SOHO LAN might consist of two computers connected with a hub, while the LAN in a large corporate might include hundreds of computers located in many buildings.
LAN
It is interesting to notice that how similar the LAN and our public transportaion system are. As a car driver, our journey starts at the parking lot, we drive on the road, obey the traffic regulations and always watch for the traffic lights. Finally, our car is parked into a parking lot. The LAN works in the same way.
There are four common components for all the LANs:
Computers: Computers are the endpoints in the network, sending and receiving data. They are the parking lot in our metaphor.
Interconnections: Interconnections enable data to travel from one point to another in the network. There are two types of interconnections: Network Interface Cards (NICs) translate the data produced by the computer into a format that can be transmitted over the LAN. Network media, such as cables or wireless media, is the "roads", that transmit signals from one device on the LAN to another.
Network deives: including hubs, ehternet switches and routers. They are the "traffic lights", controling how data is transmitted in the network.
Protocols: Protocols is the "traffic regulations", indicating the way the data is transmitted over a LAN and include Ehernet protocols, IP, ARP and RARP, and DHCP.
The LAN allows users to communicate and share resources such as printers, files, softwares locally. In case a resource is not available locally, the LAN can provide connectivity to remote resources via a gateway.
We have walked through the OSI model and TCP/IP model in the previous sections. We studied TCP, UDP in detail. We have understood how port works. Now, we are capable of understanding what's exactly going on behind the common network applications such as FTP, Telnet and web browser. Cisco only test the definition of common application layer protocols, you can skip the labs in the videos.
The following tutorial videos use wireshark to capture network traffic. Please install wireshark and play on it. Doing them by yourself, everything will be simple and clear.
E-mail (SMTP): Simple Mail Transfer Protocol allows users to send and receive messages to e-mail applications throughout the internetwork.
Trivial File Transfer Protocol (TFTP): TFTP is an application that uses UDP. Routers use TFTP to transfer configuration files and Cisco IOS images and to transfer files between systems that support TFTP.
File Transfer Protocol (FTP): FTP is a reliable, connection-oriented service that uses TCP to transfer files between systems that support FTP. FTP supports bidirectional binary and ASCII file transfers.
Terminal Emulation (Telnet): Telnet provides the capability to remotely access another computer. Telnet enables a user to log on to a remote host and execute commands.
HTTP: HTTP is a protocol (utilizing TCP) to transfer hypertext requests and information between servers and browsers.
Source port -- This field identifies the sending port when meaningful and should be assumed to be the port to reply to if needed. If not used, then it should be zero.
Destination port -- This field identifies the destination port and is required.
Length -- A 16-bit field that specifies the length in bytes of the entire datagram: header and data. The minimum length is 8 bytes since that's the length of the header. The field size sets a theoretical limit of 65,535 bytes (8 byte header + 65527 bytes of data) for a UDP datagram. The practical limit for the data length which is imposed by the underlying IPv4 protocol is 65,507 bytes.
Checksum -- The 16-bit checksum field is used for error-checking of the header and data. The algorithm for computing the checksum is different for transport over IPv4 and IPv6.
The TCP header consists of 11 fields, of which only 10 are required. The eleventh field is optional (pink background in table) and is aptly named "options".
Source port (16 bits) – identifies the sending port
Destination port (16 bits) – identifies the receiving port
Sequence number (32 bits) – has a dual role
If the SYN flag is set, then this is the initial sequence number. The sequence number of the actual first data byte will then be this sequence number plus 1.
If the SYN flag is clear, then this is the sequence number of the first data byte
Acknowledgment number (32 bits) – if the ACK flag is set then the value of this field is the next sequence number that the receiver is expecting. This acknowledges receipt of all prior bytes (if any). The first ACK sent by each end acknowledges the other end's initial sequence number itself, but no data.
Data offset (4 bits) – specifies the size of the TCP header in 32-bit words. The minimum size header is 5 words and the maximum is 15 words thus giving the minimum size of 20 bytes and maximum of 60 bytes, allowing for up to 40 bytes of options in the header. This field gets its name from the fact that it is also the offset from the start of the TCP segment to the actual data.
Reserved (4 bits) – for future use and should be set to zero
CWR (1 bit) – Congestion Window Reduced (CWR) flag is set by the sending host to indicate that it received a TCP segment with the ECE flag set and had responded in congestion control mechanism (added to header by RFC 3168).
ECE (1 bit) – ECN-Echo indicates
If the SYN flag is set, that the TCP peer is ECN capable.
If the SYN flag is clear, that a packet with Congestion Experienced flag in IP header set is received during normal transmission(added to header by RFC 3168).
URG (1 bit) – indicates that the Urgent pointer field is significant
ACK (1 bit) – indicates that the Acknowledgment field is significant. All packets after the initial SYN packet sent by the client should have this flag set.
PSH (1 bit) – Push function
RST (1 bit) – Reset the connection
SYN (1 bit) – Synchronize sequence numbers. Only the first packet sent from each end should have this flag set. Some other flags change meaning based on this flag, and some are only valid for when it is set, and others when it is clear.
FIN (1 bit) – No more data from sender
Window (16 bits) – the size of the receive window, which specifies the number of bytes (beyond the sequence number in the acknowledgment field) that the receiver is currently willing to receive (see Flow control)
Checksum (16 bits) – The 16-bit checksum field is used for error-checking of the header and data
Urgent pointer (16 bits) – if the URG flag is set, then this 16-bit field is an offset from the sequence number indicating the last urgent data byte
Options (Variable 0-320 bits, divisible by 32) – The length of this field is determined by the data offset field. Options 0 and 1 are a single byte (8 bits) in length. The remaining options indicate the total length of the option (expressed in bytes) in the second byte.
Back> IP protocal resides in Network Layer, which provide service to the Transport Layer protocals TCP and UDP.
IP packet structure
bit offset
0–3
4–7
8–15
16–18
19–31
0
Version
Header length
Differentiated Services
Total Length
32
Identification
Flags
Fragment Offset
64
Time to Live
Protocol
Header Checksum
96
Source Address
128
Destination Address
160
Options
160
or
192+
Data
The header consists of 13 fields, of which 12 are required. The 13th field is optional (red background in table) and aptly named: options.
IP is the primary protocol in the Network Layer (Layer 3) of the OSI Model and has the task of delivering packets from the source host to the destination host solely based on their addresses. IP is considered a best-effort protocol because IP does not provide acknowledgement of the data delivery. Its service can also be characterized as unreliable. In network architectural language it is a connection-less protocol, in contrast to so-called connection-oriented protocols such as TCP and Frame Relay.
ICMP packet structure
The ICMP header starts after bit 160 of the IP header (unless IP options are used). Although ICMP messages are contained within standard IP datagrams, ICMP messages are usually processed as a special case.
ICMP messages are constructed from a normal IP datagram that has generated an ICMP response. IP encapsulates the appropriate ICMP message with a new IP header to get the ICMP message back to the original sending host and transmits the resulting datagram in the usual manner.
As the growth of public networks, we are facing shortage of the 32-bit IPv4 addresses. The Class A and Class B address category were nearly depleted at the time. Although there are still numerous Class C network addresses, Class C addresses are limited to 254 hosts, which is too few for large organizations.
To address the IP address shortage issue, solutions have been developed in the past 20 years. One of them is IPv6, which is a 128-bit binary number and provides far more addresses than IPv4. Another solution is CIDR, which is a classless address scheme and allows for more efficient allocation of IP addresses.
The advantage of CIDR allows route aggregation, also known as supernetting. That is, CIDR can aggregate multiple smaller classful networks into a single larger network. In the above example, suppose we need to assign IP address to a network which have 700 hosts. A Class C address can only provide 254 hosts, not meet our requirement. On the other hand, if we assign a Class B address to the network, it is too wasteful. A Class B address can support 65,534 hosts, but we only use 700 hosts. In stead of using classful address scheme, we use CIDR address 192.168.16.0/22 instead. By doing so, we aggregated 4 class C networks into a single /22 address (the fourth one is 192.168.19.0/24), which can have 1022 hosts in it. Our requirement is met without using a Class B address.
As the above picture shows, the router can aggregates networks 192.168.16.0/24, 192.168.17.0/24, 192.168.18.0/24 into one larger network 192.168.16.0/22. Where /22 means the first 22 bits are the network part of the address, and the remaining 10 bits are the host part of the address.
The new network diagram looks like:
In suppernetting, CIDR borrow bits from network side, so that we aggregate smaller network blocks; on the other hand, sometimes we want to divide a large network into smaller sub network blocks. In later case, we use CIDR to borrow bits from host side, the process is called subnetting.
Maybe, your ISP is using CIDR right now. Your ISP might own a large address block such as 200.100.0.0/16, which consists of many Class C networks. The ISP assigns a small chunck of 200.100.0.0/16 network to you, say 200.100.100.0/23 network. The 200.100.100.0/23 network allows you to have 510 hosts. (You can subdivide your 200.100.100.0/23 network into even smaller chuncks such as 200.100.100.200/24, 200.100.100.201/25, and assign them to your own subnetworks.) In this example, your ISP takes the responsibility of managing the IP addresses within network 200.100.0.0/16, so that internet routers only need to keep this single summary route (200.100.0.0/16 ), or supernet route, in order to route packets to your ISP's network. After packets get into your ISP's intranet 200.100.0.0/16, it is your ISP's intranet routers, that then keep the routes that are more specific to its customers' networks.
