Exam Topics Ccna 200 301

802.15 WPAN

-Worldwide Interoperability for Microwave Access -IEEE 802.16 WWAN

Global System for Mobile (GSM) and Code Division Multiple Access (CDMA). GSM is internationally recognized, while CDMA is primarily used in the US.

Satellite Broadband

WiFi/wireless devices are based on IEEE 802.11 set of protocols and wireless local area network (WLAN) Wi-Fi computer communication in various frequencies -Radio frequency is 2.4 GHz

5 Ghz frequency band IEEE standard for transmitting data over a wireless network.

2.4GHz and 5GHz

802.11a 802.11ac

WPAN

Access Point

shared service set identifier (SSID)

Beacons

Quality of Service is a feature of routers and switches which prioritizes traffic so that more important traffic can pass first.

Wireless Access Point more generally just an access point, is a networking hardware devices that allows other Wi-Fi devices to connect to a wired network.

Wireless Fidelity technically, this is not the case. Wi-Fi is simply a trademarked term meaning IEEE 802.11x.

-Standalone devices like a home router. Where the entire WLAN configuration resides on the device. -Sometimes called thick APs -do not require a controller to control the AP and it use WLSE for management software -use for a network that requires only a couple of access points.

Wireless LAN Controller

Autonomous System

-These devices require no initial configuration and are often called lightweight APs (LAPs). -Also called thin APs -Centralized management, configuration, encryption, updates and policy settings through a centralized controller

Lightweight Access Points

Light Weight Access Point Protocol

Controller-based APs

Link Aggregation Group

Multiple Input Multiple Output. Uses multiple antennas to increase available bandwidth for IEEE 802.11n/ac/ax wireless networks. Up to eight transmit and receive antennas can be used to increase throughput.

Access Point, Switch, Router

A wireless router or AP connects wireless clients to a wired distribution system.

Application Programming Interface (API) An API is software that allows other applications to access its data or services. It is a set of rules describing how one application can interact with another, and the instructions to allow the interaction to occur. Data formats shared between smart devices often use an Application Programming Interface (API

Simple Object Access Protocol (SOAP) Representational State Transfer (REST) eXtensible Markup Language-Remote Procedure Call (XML-RPC) JavaScript Object Notation-Remote Procedure Call (JSON-RPC)

The physical separation of the network control plane from the forwarding plane, and where a control plane controls several devices. dynamic, manageable, cost-effective, and adaptable

File Transfer Protocol Port 20, 21 Provides reliability when loading an IOS image upon boot up

Secure Shell Protocol port 22

23

port 25

53

80

161

FTP, SSH, Telnet, SMTP, DNS, HTTP, POP3, NTP, IMAP4, HTTPS

DNS, DHCP, TFTP, SNMP

A protocol used to automate the assignment of IP Address. It stands for Dynamic Host Control Protocol and is the successor to BOOTP.

67

HSRP stands for Hot Standby Router Protocol, it was designed for gateway redundancy without addition config on end devices. Routers configured with HSRP present themselves as a single virtual default gateway. -It is Cisco Proprietary -has one active router and one standby router

Virtual Router Redundancy Protocol Has one master router and multiple backup routers

0000.5E00.01xx 0000.5E00.01xx, where xx is the value ID for the VRRP group number

First-Hop Redundancy Protocol

D

O

C

S

* on a route such as S * 0.0.0.0/0 [1/0] via Fastethernet 0/1

L

Port Aggregation Protocol is a Cisco proprietary link aggregator protocol that can bundle up to 8 active ports. -Only uses DESIRABLE and AUTO modes

120 seconds

30

Link Layer Discovery Protocol. OSI layer 2 open standard discovery protocol that is used to facilitate interoperability between Cisco devices and non-Cisco devices. Attributes that can be learned from neighboring devices contain Type, Length, Value (TLV) info including port description, system description and management address.

VLAN Trunking Protocol (VTP) is a Layer 2 messaging protocol that maintains VLAN configuration consistency throughout a common administrative domain by managing VLAN additions, deletions, and name changes across multiple switches. Without VTP, you would have to manually add VLAN information to each switch in the network.

Cisco Discovery Protocol (CDP) is a Cisco Proprietary feature that allows you to see directly connected Cisco devices. CDP can provide VLAN Trunking Protocol (VTP) information whereas LLDP does not.

Software basically. (previously known as Hybrid Remote Edge Access Point or H-REAP) is a wireless solution for branch office and remote office deployments. It enables customers to configure and control access points (AP) in a branch or remote office from the corporate office through a wide area network (WAN) link without deploying a controller in each office. The FlexConnect access points can switch client data traffic locally and perform client authentication locally when their connection to the controller is lost. When they are connected to the controller, they can also send traffic back to the controller. In the connected mode, the FlexConnect access point can also perform local authentication.

256; 255.255.255.0

512; 255.255.254.0

1024; 255.255.252.0

2048; 255.255.248.0

8192; 255.255.224.0

16384; 255.255.192.0

128; 255.255.255.128

64; 255.255.255.192

32; 255.255.255.224

16; 255.255.255.240

8; 255.255.255.248

4; 255.255.255.252

2; 255.255.255.254

1; 255.255.255.255

32768; 255.255.128.0

65536; 255.255.0.0

10.0.0.0-10.255.255.255 172.16.0.0-172.31.255.255 192.168.0.0-192.168.255.255

127.0.0.0-127.255.255.255

10.0.0.0 - 10.255.255.255

172.16.0.0 - 172.31.255.255

192.168.0.0 - 192.168.255.255

FD or FC Because the first 7 bits of a unique local unicast address are always 1111110 They can not be aggregatable nor summarized.

169.254.1.0 to 169.254.254.255

DNS (Domain Name System)

FF00::/8

FF80::/10

single

Neighbor adjacencies

NO. They do NOT form neighbor adjacency.

FF02::/16

FF05::/16

FC00::/7

FF0E::/16

NO. Used for neighbor discovery

The High-Level Data-Link Control (HDLC) protocol is a populare ISO-standard, bit-oriented, Data Link layer protocol. It specifies an encapsulation method for data on synchronous serial data links using frame characters and checksums. HDLC is a point-to-point protocol used on leased lines. No authentication can be used with HDLC.

The major difference between HDLC and PPP , the PPP protocol performs better than HDLC because there is no compulsion of using the Cisco devices in both the ends, which means these are interoperable. PPP also supports multiple protocols and support authentication.

Point-to-Point Protocol (PPP) is a Data Link layer protocol that can be used over either asynchronous serial (dial-up) or synchronous serial (ISDN) media. It uses Link Control Protocol (LCP) to build and maintain data-link connections. Network Control Protocol (NCP) is used to allow multiple Network layer protocols (routed protocols) to be used on a point-to-point connection. The basic purpose of PPP is to transport layer 3 packets across a Data Link layer point-to-point link, and it's nonproprietary. The PPP protocol stack is specified at the Physical and Data Link layers only.

Basic Service Set; Consist of a single AP interconnecting all associated wireless clients. The radius of which it covers in it wireless range is called a Basic Service Area (BSA). Layer 2 MAC address of the AP is used to uniquely ID each BSS which is called a Basic Service Set Identifier (BSSID).

Extended Service Set ESS is ID by a SSID and each BSS is ID by its BSSID. When you need more coverage, two or more BSS can join through a common distribution system (DS) into an ESS. The whole covered area is called an Extended Service Area (ESA). A client in one BSA can now communicate with other clients in another BSA within the same ESS. Like a roaming cell phone user may move from one BSA to another and it would be seamless

(CSMA/CA) carrier sense multiple access with collision avoidance.

1812 for authentication 1813 for accouting 1645/1646 for UDP ports

0

1

90

110

120

170

Hop count

bandwidth, delay

cost

-sends entire routing table -slow convergence -doesn't know network topology -simpler to configure -examples: RIP, IGRP

-sends only link state information -fast convergence -less susceptible to routing loops -always uses multicast for the routing updates -knows the entire network topology -can be harder to configure -examples: OSPF, IS-IS

-60 second update frequency -180 second hold timer (the top end timer is 255) -enabled by default -L2 protocol -Cisco proprietary -Can convey VTP information

-30 second update frequency -120 second hold timer -disabled by default -L2 protocol -Open standard protocol

Server mode

Enhanced Interior Gateway Routing Protocol. Is an advanced distance vector routing protocol. EIGRP supports classless routing and VLSM, route summarization, incremental updates, load balancing and many other useful features. It is a Cisco proprietary protocol, so all routers in a network that is running EIGRP must be Cisco routers.

bandwidth and delay

Cost

Hop count

You set it as a native VLAN

RFC 1918 is Address Allocation for Private Internets The Internet Assigned Numbers Authority (IANA) has reserved the following three blocks of the IP address space for private Internets: 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16

Application Centric Infrastructure

Layer 2.5; Multiprotocol Label Switching

VMM (Virtual Machine Monitor)

Cyclic Redundancy Check

A single pane of glass

OSGi REST

NETCONF OnePK OpenFlow OpFlex

The source MAC address

Destination MAC Address

Software as services enables it consumer to access applications running in the cloud infrastructure but does not enable the consumer to manage the cloud infrastructure or the configs of the provided applications. A good example is a company license an office suite, including email service, that is delivered to the end user through a web browser.

Infrastructure as a Service the greatest degree of freedom by enabling its consumer to provision processing, memory, storage and network resources within the cloud infrastructure. Customer does NOT have control over the physical infrastructure in the cloud.

Platform as a Service provides it consumer with slightly more freedom than the SaaS model by enabling the consumer to install and possibly config provider supported applications in the cloud infrastructure. An example would be a company obtains a subscription to use a service provider's infrastructure, programming tools, and programming languages to develop and serve cloud based applications.

Gateway Load Balancing Protocol Has one active virtual gateway and multiple active virtual forwarders Cisco proprietary similar to HSRP. Allows load-balancing.

Network Address Translation (NAT) is a protocol that translates public IP addresses to private IP addresses and vice-versa. NAT is often enabled on the Internet-facing firewall, and in home networks is usually running on the router.

display an IP address that an inside host as seen by host on the outside network A valid public address that the inside host is given when it exits the NAT router.

display the IP address config on a host on the local network

display the IP address of a host on the outside network as seen from a host on the inside network

display the IP address config on a host on the outside network

Etherchannel is a Cisco feature that allows you to combine several physical links (up to eight) into one logical connection for increased bandwidth. Data between the links is load-balanced, and Spanning Tree sees the logical link as one link; thus all physical ports are forwarding. Different interface types can't be bundled together such as gigabit can't be bundle with fast Ethernet

Link Aggregation Control Protocol bundle two or more identical, physical interfaces into a single logical link between switches -Open Standard -Only uses ACTIVE and PASSIVE mode

Spanning Tree Protocol. Allows for multiple redundant paths while breaking loops. Operates at Data Link

the switch with the lowest BID Since by default all switches have the BID priority of 32768, the second comparison has to be made - the lowest MAC address.

-Elect the root bridge, with the switch with the lowest BID -Elect a root port for each nonroot switch, based on the lowet root path cost -Elect a designated port for each segment, based on the lowest root path cost -Root ports and designated ports transition to the forwarding state

Per-VLAN Spanning Tree Plus cisco enhancement of STP that provides a separate spanning tree instance for each VLAN configured on the network -slow convergence -default setting on all cisco catalyst switches -uses a lot of CPU

Uses PVST+ and provides config PER VLAN -cisco proprietary -fast convergence -need very high resources to use

the lowest neighbor bridge ID the lowest neighbor port priority the lowest neighbor internal port number

he designated switch and its port is known as the designated port. In order to avoid loops, the non-designated port on the other end of the link is placed in blocking state.

-Discover OSPF neighbors and establish neighbor adjacencies -Advertise parameters on which two routers must agree to become neighbors -Elect the DR and BDR on multiaccess networks such as Ethernet and Frame Relay

-Classless routing protocol -only supports equal cost load balancing -Uses COST as it metric -Fast convergence -Uses Dijksta's Algorithm -Open Standard -AD is 110 -multicast address is 224.0.0.5 or 224.0.0.6 -destination MAC address is also a multicast address of 01-00-5E-00-00-05 or 01-00-5E-00-00-06. -Supports MD5 Authentication

Highest priority, then highest router ID (highest physical interface by default). The router with the second highest OSPF priority or router ID will become a BDR.

· Highest IP address among loopback interface · Then by highest IP address among physical interfaces

FULL/DROTHER Basically, DRother is a router that's neither a DR nor a BDR.

-Timers/hello and dead timers -Network Type/Netmask -Area ID *PROCESS ID DO NOT HAVE TO MATCH

-IP Address -Router ID *PROCESS ID DO NOT HAVE TO MATCH

The default gateway of last resort for the whole network if the routers don't know where to send the information. If it is configured on a router: OSPF will advertise that router's gateway of last resort to use. It will also make that router become the OSPF ASBR

autonomous system boundary router (ASBR)

OSPF areas must match Although you can config for a multiarea OSPF topology, OSPF areas on neighboring interfaces must match in order for two OSPF routers to form an adjacency.

PREAMBLE-SOF-DESTINATION ADDRESS-SOURCE ADDRESS-TYPE-PAYLOAD-FCS

Backup Designated Router The BDR monitors the DR and takes over as DR if the current DR fails.

Designated Router The DR is responsible for updating all other OSPF routers when a change occurs in the multiaccess network.

The backbone area

Area Border Router ABRs send interarea routes between areas.

locally

area ID

-Manually configured if not: -highest IP address among loopback interfaces -Then by highest IP address among physical interfaces

Platinum

Gold

Silver

Bronze

0

1

2

3

4

5

6

7

-creates/modifies/deletes VLANS -synchronizes VTP information -originates VTP adverts -forwards VTP adverts -stores VLAN info in NVRAM

-synchronizes VTP info -originates VTP adverts -forwards VTP adverts

-creates/modifies/deletes VLANs -forwards VTP adverts -stores VLAN info in NVRAM -does not advertise -does not synchronize it configs

prevents introduced switches from being elected the new root

This is used in conjunction with Portfast to prevent the Portfast enabled switchport from responding to STP updates that could destroy the current network STP configuration. When the STP update is received, this puts the switchport into error disabled mode until the administrator manually brings the switchport back up.

reduces convergence time by placing edge ports into a forwarding state

prevents a switch port from transitioning to the forwarding state when it stops receiving BPDUs

The best metric along a path

A successor is the route with the best metric to reach a destination. That route is stored in the routing table

A feasible successor is a backup path to reach that same destination that can be used immediately if the successor route fails. These backup routes are stored in the topology table. Loop-free

the neighbor's advertised distance (AD) for the route must be less than the successor's feasible distance (FD).

The metric that the next-hop router has calculated

DUAL (Diffusing Update Algorithm) selects the best path and the second best path to the destination

5 seconds

60 seconds

enables a DHCP relay agent on a router.

Presentation Layer

used to create, manage, and terminate sessions between communicating nodes. It handles the service request and service responses that take place between different applications.

responsible for error-free and sequential delivery of data and flow control.

defines a logical address that helps select the route to the destination

Data link layer issue but the physical layer of the interface is operational

0000.0C07.ACxx . 0000.0C07.ACxx where xx is the group number

0007.B400.xxyy 0007.B400.xxyy where xx is the GLBP group number and yy is the AVF number

Software Defined Access uses a controller and application programming interfaces (APIs) to communicate via southbound interfaces (SBIs) with the network infrastructure,

-Agentless -Uses YAML -Uses SSH/NETCONF for remote device communication -Uses a push model -Has a 'playbook' -Written in PYTHON

-Agent based -Written in RUBY -Uses a pull model -Has a 'manifest'-where config elements are stored -Uses HTTP (REST) to communicate -uses TCP 8140

-Agent based -Written in RUBY -Uses a Pull model -Has a 'recipe' and 'Cookbook' -Use HTTP (REST) -Not supported by a lot of Cisco devices -uses TCP 10002 config for push jobs

PYTHON

KEY:VALUE Uses { } and [ ] Array is in [ ] Object is in { } Value are after the colon Value text is listed in double quotes Value numeric is listed without quotes

A REST API is an API that works on top of the HTTP protocol. It defines a set of functions developers can use to perform requests and receive responses through HTTP, such as GET and POST.

-Client/server: The client handles the front end, and the server handles the back end. Either can be replaced independently of the other. -Stateless: No client data is stored on the server between requests. The session state is stored on the client. -Cacheable: Clients can cache responses to improve performance.

APIs exist to allow two programs to exchange data. Some APIs are for interprogram communications within a single operating system (OS). Other APIs are available to programs that run on other computers. These APIs must define the networking protocol. Many are based on REST.

Extensible Markup Language

YAML Ain't Markup Language

Fabric

Underlay: This is most closely associated with the physical network. The underlay reveals additional devices and specifies how these devices are connected. Endpoints access the network through the Layer 2 devices. Switches, routers, cables Overlay: This is where tunneling protocols like Virtual Extensible LAN (VXLAN) are implemented to transport Layer 3 protocols such as IP Security (IPsec) and Control and Provisioning of Wireless Access Points (CAPWAP). The overlay is where policies are specified. The overlay is not concerned with how the devices are physically or logically connected.

-A controller in a network that uses Cisco SDA - A network management platform for traditional (non-SDA) network devices

Per AP and per VLAN Also supported on the NATIVE VLAN THEY ARE NOT PER PORT/INTERFACE

We like DHCP SNOOPING-uses the concept of trusted and untrusted ports. We do NOT LIKE DHCP SPOOFING-spoofing attack occurs when a rogue DHCP server is connected to the network and provides false IP configuration parameters to legitimate clients.

10-15%

Config each AP with the same SSID and a unique, non overlapping channel

Control and Provisioning of Wireless Access Points - a way for control data to be tunneled between Lightweight AP and Centralized controller

ICMP Unreachable Message

Ethernet

PPP

-A Router on a stick is where you have a router hanging off a switch on a trunk link and have subinterfaces. Use for routing between VLANS. Has to be directly connected to the router for interVLAN routing and router on a stick to work.

TRUE

Switch virtual interface (SVI): Virtual VLAN interface used for inter-VLAN routing

In a small network that requires only simple routing In a hub-and-spoke network topology When you want to create a quick ad hoc route As a backup when the primary route fails Static routes are commonly used when you are routing from a larger network to a stub network (a network that is accessed by a single link). Static routes can also be useful for specifying a default route or gateway of last resort.

In a large network When the network is expected to scale

ip route {network-address subnet mask}

The router has to check through the routing table more than once in order to find a route to a destination. It is important to put the exit interface on an ip route command for this reason

router and switch

default

Just as with the quad-zero in IPv4, the double colon (::) means all 0s or any address, and the /0 means any prefix length.

10 seconds

40 seconds/ always 4 x the hello timer

LInk-state Update. LSUs are the packets used for OSPF routing updates. An LSU packet can contain 11 types of LSAs

Link-state request

1

10

100

1000

NO

Neighbor ID PRI=Priority of the interface State Dead Time Address Interface

broadcast multicast nonbroadcast point to point point to multipoint broadcast point to multipoint nonbroadcast

HDCL and PPP

FALSE Because it has some proprietary characteristics that won't allow it to work on non-cisco devices

30 second hello 120 second dead interval

IPSec

GRE (Generic Routing Encapsulation) is a protocol designed to tunnel any L3 protocol through an IP transport network. Because the focus of GRE is to transport many different protocols, it has very limited security features

It is an untrusted port. DAI (Dynamic ARP Inspection) has been configured.

first state to last statement.

Source address only

access-list; in global config mode to create an entry in standard IPv4 ACL. We always put the subnet mask in wildcar mask form example: access-list 1 permit 172.16.0.0 0.0.255.255

ip nat inside source static {ip address} overload

Smooth Benign Drop sensitive Delay sensitive UDP priority

Bursty Greedy Drop Sensitive Delay Sensitive UDP priority

Smooth/bursty Benign/greedy drop insensitive delay insensitive TCP retrasmists

WRED

TRAP

NTP server {ip address of the NTP server}

Auto

If a router has a static route and an OSPF route to the same destination network, the static route will be preferred over the dynamic route because static routes have a lower AD than routing protocols.

ip route {prefix mask [ip-address | interface}

Control Frame

Ready to send Clear to send

AES

CCMP (Cipher Block Chaining Message Authentication Code Protocol)

GCMP (Galois/Counter Mode Protocol)

Dynamic ARP Inspection and it helps mitigate ARP poisoning attacks or ARP spoofing attakcs.

ip arp inspection vlan in global config mode

one

service-port interface

static client mode

-First 7 bits of the prefix are always 1111110 -Unique only within an organization

Access ports

show interfaces trunk

DTP (Dynamic Trunking Protocol)

-Longest prefix match: Routers select routes with the longest match to the destination address in the forwarded packet. -Administrative distance: If a router is receiving the same route from multiple routing protocols it will install the route with the lowest Administrative distance in the routing table -Metric: If the router is receiving the same route many times from the same routing protocol it will consult the metric value for its selection; the lowest the best. If routes has the same metric both will be installed in the routing table and the router will load balance packets over them

Network interfaces for both wireless and wired networks

FC-DUR-ADD1-ADD2-ADD3-SEQ-ADD4-DATA-FCS

point-to-multipoint point-to-point

cisco proprietary API

uses an imperative SDN model detailed instructions are sent to the SDN controller when a new policy is to be configured.

uses a declarative SDN model instructions that are sent to the controller are not so detailed.

uses XML and RPCs to config the network devices

WLSE (Wireless LAN Solution Engine)

RouterA (dhcp-config)#domain-name exmaple.com

Random Early Detection randomly drops packets based on a mark probability denominator when congestion is detected

First in First out queuing congestion method; packets are processed in the order they are received without any regard to the IP. All packets destined for a full FIFO queue are dropped until the existing packets make free space

Weighted Fair Queing congestion management method not a congestion avoidance method. traffic is ID by WFQ based on source and destination IP address, port number and protocol number.

TRUE

passwords config by any means along with any passwords configured in the future

2-way

DOWN

AP-manager interface

ACTIVE/PASSIVE

They can not be configured with a per-rule direction

-Dynamic interfaces are typically used for client data -Dynamic interfaces are user-defined

Enables network access in minutes for any user or device to any application without compromising security

-Delivers better user experiences for applications residing on premise or in the cloud -Achieve greater agility and cost savings through easier deployments and transport independence

-Allows to ID root causes and provide suggestings for faster troubleshooting -provides easy to use SINGLE dashboard -Has machine learning continually improves network intelligence to predict problems before they occur

-360 degree visibility through real-time analytics for deep intelligence -lower complexity with end to end security -encrypts traffic, reduce risk and protect your organization against threats

Top Of Rack

-Resource Reservation -Authentication

A key component of CAPWAP is the concept of a split MAC, where part of the 802.11 protocol operation is managed by the CAPWAP AP, while the remaining parts are managed by the WLC.

autonomous AP deployment

Beacons

0

-Device ID or hostname, of the neighboring device -IP address of the neighboring device -platform, or product number, of the neighboring device -capabilities of the neighboring device -local interface -remote interface -holdtime -software version -native VLAN -VTP domain

-device ID of the neighboring device -capabilities of the neighboring device -product number of the neighboring device -holdtime -local interface -remote interface

Local

Enables a failsafe for the lightweight AP if its connection to the WLC by way of CAPWAP tunnels goes down. Enables a lightweight AP to switch traffic between a given SSID and a VLAN.

embedded AP deployment

no lldp run

AP's Syslog server settings

TRUE

lightweight AP

no lldp holdtime

-Beacons -Probe request -Probe responses - Association Request -Association responses -Authentication request -Authentication Reponses -Deauthentication -Reassociation Request -Reassoction reponses -announcement traffic indication message

802.1w (Rapid Spanning Tree Protocol RSTP)

(T)FTP is a file transfer protocol. -Port 69 -uses UDP -does not require user authentication

Input erros CRC

Management

A leaf switch can be added with connections to every spine switch

FF02::1 FF02::2

The L2 switch floods packets to all ports except the receiving port in the given VLAN

Unique Local

FF00::/8

It eliminates the need to configure each access point individually

TRUE

-switch must be running k9 (crypto) IOS image -ip domain-name command must be configured

-host name -domain name

Spanning tree may fail to detect a switching loop in the network that causes broadcast storms.

wireless LAN controller

access point

service port

virtual interface

dynamic interface

FlexConnect

ON

lightweight

SSID profile name

lldp reinit

The link becomes a trunk port.

It divides a reference bandwidth of 100 Mbps by the actual bandwidth of the exiting interface to calculate the route with the lowest cost.

broadcast

Metric

-It can mitigate congestion by preventing the queue from filling up. - It drops lower-priority packets before it drops higher-priority packets.

-assigns a default gateway to a client -holds the TCP/IP settings to be distributed to the clients -assigns IP addresses to enabled clients

-resolves web URLs to IP addresses -stores a list of IP addresses mapped to names

The switch discards all ingress ARP traffic with invalid MAC-to-IP address bindings

AES-256

-ASCII -hexadecimal

-WPA+WPA2 -802.1X

-web policy -passthrough -VPN Pass-Through

TACACS+ is a Cisco Proprietary protocol that enables AAA. Most commonly used for administrator access to network devices like routers and switches. -All three AAA can be used independently -TCP used on port 49 -Supports multiprotocol for Appletalk, NetBIOS, X.25 and NASI -encryption applied to username and password -Does NOT support 802.1x -use in trusted environment

Designed to authenticate and log remote network users, uses AAA. The advantage to using RADIUS or TACACS+ on this central server is that you don't configure changes on each separate network device when a user is added or deleted, or when a user changes a password. You only make one change to the configuration on the server and then devices continue to access the server for authentication. -Authentication and Authorization are bundled together. When client request authentication from server it comes with both. Can not be seperated -Accounting can be used independently -Uses UDP on port 1645/1646, 1812/1813 -Encryption applied to password -Supports 802.1x -client/server model -use in semi trusted environment

Only controller-based networks decouple the control plane and the data plane.

-Reduced operation costs -Faster changes with more reliable results

-It uses northbound and southbound APIs to communicate between architectural layers. -It moves the control plane to a central point.

-REST APIs that allow for external applications to interact natively with Cisco DNA Center -SDKs that support interaction with third-party network equipment

It abstracts policy from the actual device configuration.

southbound

getNext get

tail drop it does NOT address strict-priority queuing

-TCP packets that are dropped must be re-transmitted -TCP sources reduce traffic flow when congestion occurs

01-00-5E-0F-0F-0F

-Each spine node must connect to every leaf node -Each leaf node must connect to every spine mode

Data center technology that uses switches, categorized as spine and leaf nodes, to dynamically implement network application policies in response to application-level needs. Network policies are defined on a APIC (Application Policy Infrastructure Controller) and then implemented by the spine and leaf nodes.

Giant *Remember the default MTU size for Ethernet frames is 1,500 bytes.

CAM table *The switch makes forwarding decisions based on destination MAC address, it searches the CAM table for and entry that matches. If not found, it then forwards the frame to all its ports except the one it was received from.

Contains L2 and L3 addresses. the method for finding a host's Link Layer (MAC) address when only its IP address is known. The ARP table is used to maintain a correlation between each MAC address and its corresponding IP address. The ARP table can be manually entered by the user. User entries are not aged out.

By issuing ip arp inspection trust command in interface config mode.

-FF02::/16 -FF80::/10

An Ethernet frame that is up to 1600 bytes in length.

Ethernet collision that occurs after 512 bits of frame have already been transmitted. An Ethernet cable that is too long, half-duplex port that is connected to a full-duplex port can create this as well

duplex mismatch

FC (Frame Control)

Link-local address

to send packets to the closest device that is configured with an anycast address. Ideal for load balancing.

AKA aggregatable global address, deisgned to minimize the size of internet routing tables.

A collision occurs

2000::/3

FE80::/10

TRUE

TRUE

TRUE

-Ethernet -FDDI

-Frame Relay -X.25

-HDLC -PPP

Point-to-Point Broadcast

-Nonbroadcast -point-to-multipoint -point-to-multipoint nonbroadcast

A floating static route is used to provide link redundancy

2-Way Sate

FULL

GLBP

Baby Giants

FF02::2

RC4 *Less secure than AES and uses a stream cipher

TKIP (Temporal Key Integrity Protocol)

Enable secret *Enable secret will override enable password command

device that provides Wi-Fi devices with a connection to a wired network

Used to support mobility management

Applied to the WLAN for wireless client communication

Used for out of band management of WLC

Devices that manages access points

SSID Profile Name

Administrative Distance

-The router calculates the feasible distance of all paths to the destination route. -The router calculates the best backup path to the destination route and assigns it as the feasible successor.

-The two routers negotiate one router as the active router and the other as the standby router. -The two routers share a virtual IP address that is used as the default gateway for devices on the LAN.

It uses a shared virtual MAC and a virtual IP address to a group of routers that serve as the default gateway for hosts on a LAN.

Broadcast

Point-to-Point

ip address dhcp

Authentication identifies and verifies a user who is attempting to access a system, and authorization controls that tasks the user can perform.

XML JSON

SAP MKA

MACsec provides Layer 2 encryption on the LAN. It also encapsulates and protects the metadata field that carries the Security Group TAG (SGT). Currently, two keying mechanisms are available: Security Association Protocol (SAP) and MAC Security Key Agreement (MKA).

High Availability Site-to-site VPN

MD5 or SHA authentication with DES encryption

TACACS+

REST

Route with lowest AD

TRUE

The data plane

RIP and OSPF

EIGRP

VPN Pass-Through There are two types of WLANs you can configure by using the WLC GUI: WLAN and Guest LAN. VPN Pass-Through is ONLY available to WLAN.

Web Authentication Web Passthrough

NATIVE VLAN

0000.0C9F.F00A

Network Automation

crypto key generate rsa

local * Default lightweight AP mode

AES CCMP

115

XML

communication system is a point-to-point system of two devices that can communicate with each other in both direction

it cannot send and receive data at the same time. Network hubs run in half-duplex mode in order to prevent collisions. Since hubs are rare in modern LANs, the half-duplex system is not widely used in Ethernet networks anymore.

all nodes can send and receive on their port at the same time. There are no collisions in full-duplex mode, but the host NIC and the switch port must support the full-duplex mode