Table FF.1 lists the seven layers of the OSI model and significant aspects of each layer.

Two domains determine data transport reliability:

Unshielded twisted-pair (UTP) cables are vulnerable to Electromagnetic Interference (EMI) and use an RJ-45 connector. Fiber-optic cables are not susceptible to EMI.

Use a straight-through cable to connect the following devices:

Use a cross-over cable to connect the following devices:

Spread Spectrum Wireless LANs allow for high-speed transmissions over short distances.

Wireless Fidelity (Wi-Fi) is defined by IEEE 802.11.

A MAC address is hard-coded (burnt-in) on the network interface controller (NIC) of the Physical layer device attached to the network. Each MAC address must be unique and use the following format:

Example of a MAC address: 00:00:07:A9:B2:EB

The OUI in this example is 00:00:07.

The broadcast address value is FFFF.FFFF.FFFF.

802.3 frame information and parameters are as follows:

Bridges and switches examine the source MAC address of each inbound frame to learn MAC addresses.

Switches are multiport bridges that use ASIC hardware chips for frame forwarding. Dedicated bandwidth enables the switch port to guarantee the speed assigned to that port. For example, 100Mbps port connections get 100Mbps transmission rates.

Hubs use half-duplex technology. Switches can be set up for full-duplex.

WAN interfaces are used to provide a point of interconnection between Cisco routers and other network devices. Types of WAN interfaces include the following:

BRI is an Integrated Services Digital Network (ISDN) line that consists of two 64Kbps bearer (B) channels and one 16Kbps data (D) channel.

DCE equipment might consist of a:

DTE equipment might consist of a:

Four memory components are used by Cisco devices. Those components include ROM, Flash, RAM, and NVRAM.

RAM contains the running IOS, with the exception of Run-From-Flash (RFF) routers. RAM also contains the running configuration or the active configuration that is used after a machine is booted.

Given the example filename c2600-ipbase-1.122-1.T.bin, from left to right, each portion of the filename represents the following:

Internet Control Messaging Protocol (ICMP) is used by ping and traceroute utilities. Packet Internet Groper (ping) allows you to validate that an IP address exists and can accept requests.

A traceroute traces the route or path taken from a client to a remote host. Traceroute also reports the IP addresses of the routers at each next hop on the way to the destination. This is especially useful when you suspect that a router on the route to an unreachable network is responsible for dropping the packet.

Three classes of attack are commonly found in today’s network environment:

The following actions can be taken to lessen the impact of an attack on a network:

IPv4 addresses

TCP/IP defines two additional address classes:

The 127.x.x.x address range is reserved for loopback addresses.

Default subnet masks:

IPv6 is a workable IP version that was created in the event that the IP space from IPv4 is exhausted.

IPv6 address format summary:

The same IPv6 IP address can be written in all of the following ways:

2001:0BD2:0200:08F1:0000:0000:0000:16AB

2001:BD2:200:8F1:0:0:0:16AB

2001:BD2:200:8F1::16AB

Routers and Layer 3 switches perform the following functions:

Routers decide which interface to forward a packet through by examining the network portion of each IP address.

To gain access to an EXEC session to an IOS for configuration and administration, you can use the following methods:

To solidify the startup process, the following is a recap of the stages of the bootup, any fallback procedures, and the memory locations involved:

First and foremost, ensure that you physically secure access to your Cisco devices to ensure that there are no intentional or unintentional disruptions or access to the device itself.

To secure User EXEC to your console port:

Router(config)#line console 0
Router(config-line)#login
Router(config-line)#password password

To secure User EXEC to your aux port:

Router(config)#line aux 0
Router(config-line)#login
Router(config-line)#password password

To secure User EXEC to all five Telnet lines:

Router(config)#line vty 0 4
Router(config-line)#login
Router(config-line)#password password

To secure access to Privileged EXEC mode:

Router(config)#enable secret password
Router(config)#enable password password

The enable secret global configuration command encrypts the password using a MD5 hash. If the enable secret and the enable password commands are used at the same time, the enable secret password is used.

To encrypt the enable password and the line passwords, use the service password-encryption command.

The copy command is used to copy files from one location to another. For example, to save the current configuration, we copy the running-config in RAM to the startup-config in NVRAM using the copy running-config startup-config command.

The copy command is used to copy files between our device and a TFTP server. For instance, copy flash tftp backs up the IOS in flash to a TFTP server. copy flash tftp can be used to upgrade, downgrade, or restore an IOS back onto our device. Before copying to a TFTP server, the following preparation steps are in order:

Proprietary Cisco Layer 2 protocol that uses multicast to gather hardware and protocol information about directly connected devices.

Network layer protocol- and media-independent.

Enabled by default on all Cisco devices, but can be disabled globally:

Router(config)#no cdp run

or can be disabled on interface-by-interface basis:

Router(config-if)#no cdp enable

To learn the remote device’s Layer 3 address and IOS version:

Router>show cdp neighbor detail

or

Router>show cdp entry *

Telnet enables a virtual terminal connection to a remote device’s IP address using the Application layer protocol, Telnet (TCP port 23 at Transport layer).

To Telnet from IOS, enter the keyword telnet followed by the IP address or hostname. If you only type an IP address or hostname in User EXEC or Privileged EXEC mode, IOS automatically assumes that you are Telnetting. To Telnet to a Cisco device, the vty passwords must be set, or you receive the “Password required, but none set” error. To access Privileged EXEC mode in a Telnet session, you must have enable password set, or you receive the “% No password set” error.

Your Cisco device can act as a DHCP server and respond to DHCP requests on a segment. To configure the Cisco device as a DHCP server, you must first enable the interface that will receive the DHCP requests and assign an IP address to it. After the interface is enabled, you define the DHCP address pool with the ip dhcp pool poolname global configuration command. After you are in dhcp-config mode, you can define the DHCP address scope with network command followed by the IP subnet to be assigned. You can also define additional parameters such as the default gateway, DNS server, domain name, and length of the IP lease. To exclude IP addresses from being assigned (such as if you have statically assigned them to specific devices), use the ip dhcp excluded-address ip-address command to remove the IP(s) from the scope.

To verify the devices that have been assigned IP addresses from the DHCP address scope, use the show dhcp bindings command.

Switches have the following functions:

A switch has three methods of forwarding frames:

Switch(config-if)#switchport mode access
Switch(config-if)#switchport port-security
Switch(config-if)#switchport port-security maximum 1
Switch(config-if)#switchport port-security violation {protect | restrict | shutdown}

Packets originating from a nonrouting device destined for another network are sent to their default gateway (Layer 3 device on segment). The router consults its routing table to determine if the destination network can be reached. If not, the ICMP Destination Unreachable message is sent to the source. If so, packet is forwarded out interface associated with the destination network in routing table.

Router(config)#ip route 10.0.0.0 255.0.0.0 192.168.2.5

Router(config)#ip route 10.0.0.0 255.0.0.0 192.168.2.9 2

Router(config)#ip route 0.0.0.0 0.0.0.0 serial 0/0

Router(config)#ip default-network 192.168.1.0

In complex networks with multiple pathways to destinations, dynamic routing protocols enable routers to advertise their networks to each other and dynamically react to topology changes.

Routing protocols determine the best path based on the lowest metric.

Distance vector routing protocols contain several measures to prevent routing loops:

Wireless networks have impacted our existing network environments profoundly over the last few years. Because this is the newest topic on the CCENT and CCNA exams, much of what you need to know is the foundations of wireless:

Because wireless networking has become so prevalent in businesses, it is imperative that every network technician knows the foundations of wireless security. Table FF.28 describes the wireless encryption standards currently available.

Wireless authentication adds an entirely new layer of security to your wireless network. Rather than simply requiring a preshared key (PSK) to gain access to the WLAN, users must authenticate using one of many EAP methods. Encryption keys are dynamically generated after a successful authentication.

Network authentication for LAN environments is called 802.1x (also known as EAP over LAN [EAPOL]).

When implementing wireless access points, you can use a Basic Service Set (BSS), which is a single access point. Or you can use an Extended Service Set (ESS), which is two or more BSSs that tie users to the same LAN. These typically have overlapping coverage areas.

The farther you move from a wireless access point, the more your speed decreases. 802.11a/b/g have the following steps:

802.11a and 802.11g:

802.11b:

Implementing a wireless network should typically be done in four steps:

NAT is in use on virtually every Internet-connected router in the world today. This technology acts as a security boundary and Internet address sharing system. The following facts are relevant to NAT.

NAT operates by typically translating private IP addresses to public Internet addresses. The following are the private address ranges as defined by RFC 1918:

The three primary forms of NAT are as follows:

The standards bodies have developed many terms to describe the location of an IP address in the world of NAT:

Wide-area network (WAN) connections tie together geographically distant locations, enabling them to communicate as if directly connected. The following facts are relevant to WANs.

WAN technologies only encompass the Physical and Data Link layers of the OSI model. The three major categories of WAN technology used to connect networks today are as follows:

Cisco routers connect to most WAN connections through their serial ports. The Cisco side of the connection uses either a DB-60 or Smart Serial port. The CSU/DSU that the Cisco router connects to will have one of five standard connectors: V.35, X.21, EIA/TIA-232, EIA/TIA-449, or EIA/TIA-530.

At the Data Link layer, Cisco routers primarily use one of two WAN encapsulations for leased line and circuit switched networks:

HDLC is the default encapsulation on all Cisco serial interfaces. However, PPP is used to gain more features and industry standard capabilities when connecting over the WAN. It is made up of three sublayers:

When configuring PPP authentication, you can choose between two authentication protocols:

When configuring PPP compression, you can choose between three compression types:

To activate PPP encapsulation on an interface, use the following syntax:

Router(config)#interface serial 0
Router(config-if)#encapsulation ppp

When adding CHAP authentication to your configuration, you need to ensure that you create a user account that matches the hostname of the other side of the connection. In addition, the passwords must be the same on both sides. Here is a PPP CHAP authentication configuration between the Kirk and Spock routers:

Kirk(config)#username Spock password cisco
Kirk(config)#interface serial 0
Kirk(config-if)#encapsulation ppp
Kirk(config-if)#ppp authentication chap

Spock(config)#username Kirk password cisco
Spock(config)#interface serial 0
Spock(config-if)#encapsulation ppp
Spock(config-if)#ppp authentication chap

The show interface command is one of the most useful when verifying the PPP configuration. The connection is active when the LCP Open tag is seen, as shown here:

Router#show interface serial 0
Serial0 is up, line protocol is up
  Hardware is PowerQUICC Serial
  Internet address is 10.2.2.2/24
  MTU 1500 bytes, BW 1544 Kbit, DLY 20000 usec,
     reliability 255/255, txload 1/255, rxload 1/255
  Encapsulation PPP, loopback not set
  Keepalive set (10 sec)
  LCP Open
  Open: IPCP, CCP, CDPCP

When troubleshooting PPP authentication issues, use the debug ppp authentication command to observe the authentication process as it occurs.