This connection category is what most people are familiar with when they hear the term, “WAN connection.” A leased line connection provides a dedicated, point-to-point link between two locations. The beauty of this connection type is that you have a virtual private road between your sites. You have complete control over the traffic on that road; nobody else can share the road with you. If you have a T1-speed connection (1.544Mbps) between your locations, that bandwidth is always dedicated to you, regardless of whether you use it or not. Therefore, leased lines are typically the most expensive connection types.

Anytime you hear the hum of a dial tone followed by the rhythmic beeping of digits, you are more than likely connected to a circuit-switched network. This type of connection establishes a dedicated channel (or circuit) for the duration of the transmission, and then tears down the channel when the transmission is complete. This is known as a dial-on-demand connection. The largest circuit-switched network in the world is the telephone system, which links together many different network segments to create an end-to-end circuit for each telephone call.

Circuit-switched networks can be called a “connection-oriented” network type. They are most useful when you have small amounts of data to reliably send at a time. Some circuit-switched networks charge on a per-use or per-minute basis (primarily ISDN), so the amount you pay for the connection is directly related to how much you use it. This type of connection would be ideal for a small office that uses local area network (LAN) connectivity during the day and then replicates all the updated data back to the main site in the evening. For example, you might have a sales office that creates a log of transactions that it sends back to the corporate headquarters at night.

Packet-switched networks enable the service provider to create a large pool of bandwidth for their clients, rather than dedicate specific amounts of bandwidth to each client (as in leased lines). The client can then dictate what circuits they would like established through the service provider network between their sites (these are called permanent virtual circuits), providing an end-to-end connection. By using packet-switched networks to provide WAN connectivity, you can gain lower-cost WAN connections that can potentially provide more bandwidth to your locations.

When you sign up for a packet-switched network, the service provider gives you a guaranteed level of bandwidth. The higher your service guarantee, the more you pay for the connection on a monthly basis. The great aspect of a packet switched network is that you usually get more than you are guaranteed; depending on the type of contract you negotiate with the service provider, you could get much more bandwidth than you are guaranteed. However, you must realize that this bandwidth is just that: non-guaranteed. If you send extra traffic during a busy time of day, the service provider can drop the traffic and be well within the service contract. This also applies for delay guarantees. Because traffic sent through a packet-switched network may take different paths (depending on the service provider’s infrastructure) to reach the destination, most service providers offer a very loose delay guarantee (if they decide to offer one at all).

Broadband technology, in its base definition, is a system that enables you to send multiple signals over a wire at one time. The alternative technology, baseband, enables you to send only a single signal over the wire at a time. Broadband connections primarily encompass small office/home office (SOHO) WAN links that use cable modem or DSL technology to connect to the Internet. A cable service provider sends multiple signals over a cable coaxial line, enabling a home user to run many services, such as cable television, high-speed Internet, and telephone service, over a single line. Telephone providers are offering the same services through the copper phone line connections.

Medium and large businesses are just now beginning to consider cable and DSL connections as backup Internet connections for their main offices. Broadband technology is one of the newest WAN connection offerings to market, and has yet to prove its reliability on a long-term basis.

VPNs are not a specific type of WAN connection, but are often used to accomplish the same purpose as a WAN connection. Connections to the Internet have become widely available at an extremely low cost (when compared against the other types of WAN connectivity). Rather than purchasing dedicated circuits between locations, you can just purchase a standard Internet connection at each site. The quality of your Internet connection determines the quality of your WAN connectivity. After all sites have a connection to the Internet, you can then create tunnels through the Internet to each location, enabling the sites to connect through a full-mesh relationship (every site is directly connected, through the Internet, to every other site). These tunnels isolate the interoffice connectivity from the rest of the Internet traffic and secure the traffic through heavy encryption algorithms.

The VPN tunnels are created with the application of a heavy amount of encryption to the traffic sent between the locations. Because sending your company’s private data across a public network, such as the Internet, could be perilous, you should scramble (encrypt) your data before sending it. Because the process of encrypting and de-encrypting data is extremely hard on a router processor, you may choose to offload this work to a router VPN card (a hardware add-on), a PIX firewall (Cisco’s firewall platform), or a VPN concentrator (a specific device manages and maintains many VPN connections). Within this concept lie the advantages and disadvantages of using VPNs for your WAN connections. The major advantage is the cost: You can establish full connectivity between all your locations for a small fraction of what it would cost to purchase dedicated WAN links. You can also allow home users to connect into the office through a VPN connection to allow for telecommuting employees. The disadvantage is the delay incurred in applying the VPN encryption algorithms and the unreliable nature of the Internet. Although the Internet is the most redundant network in the world, because of the massive amount of traffic that crosses the Internet daily, the delay can be inconsistent.

Metro ethernet technology began to emerge early in the new millennium as a viable alternative to traditional WAN connections when connecting offices within a metropolitan area (primarily major cities). At the end of the century, .com-based businesses were booming. Many of these companies began laying complex fiber optic–based networks throughout many of the major metropolitan areas of the nation. When the world economy plummeted at the turn of the century, many of these .com companies went out of business, leaving huge amounts of unmanaged fiber cable under the city streets. This fiber was quickly acquired by local service providers and is slowly being leased to their customers.

Using this fiber to connect offices in the same general region allows for WAN links at speeds of 1000Mbps or greater, at a fraction of the cost of a standard T1 line. The WAN link can even terminate onto a standard Category 5E/6 UTP copper cable and plug directly into a switch using a fiber to copper converter at the customer premise. This enables the WAN connections to be managed completely through VLANs with no dedicated router hardware in place. The connections, which are already fast enough, become even faster.

Metro ethernet is beginning to stretch even between cities, as service providers are planting fiber-optic cable runs between major metropolitan areas. It shouldn’t be too long before intranation WAN links are rated in terms of Gbps as a standard. Metro ethernet is becoming quite popular in government organizations that have many locations in the same general geographic region.

SLIP is a standards-based protocol for point-to-point serial connections that use only TCP/IP. This was primarily used for dial-up connections to the Internet back in the earlier days of the Internet. It has been widely replaced by PPP.

This protocol has largely replaced SLIP connections for point-to-point WAN connections and dial-up networking. PPP was released as an improvement to SLIP and added support for non-TCP/IP protocols and encrypted authentication (among many other features). PPP is the most popular protocol for connecting point-to-point WAN connections.

HDLC was originally designed as an open standard protocol, meaning all routers could support it. However, the open standard version of HDLC was pretty horrible. It did not support multiple network-layer protocols, which meant that you could support only one protocol (such as TCP/IP, IPX/SPX, or AppleTalk) over your WAN connection. In view of this shortcoming, Cisco modified the standard HDLC to support this missing feature. However, anytime a standard is modified, the protocol becomes proprietary. In this case, you can use HDLC only on Cisco routers to connect to other Cisco routers. HDLC is the default encapsulation on all serial interfaces on Cisco routers. Although HDLC does not have as many features as PPP, it does offer very low overhead, which makes your WAN connections very efficient.

This encapsulation is used on X.25-based networks, which is the predecessor to Frame Relay. Although X.25 is used rarely in well-developed countries, it has widespread use in countries not as technologically advanced.

This encapsulation relates directly to the Frame Relay WAN connection, which is the faster successor to X.25. Frame Relay increased its speed capabilities by removing much of the error correction that is no longer needed on the more reliable circuits of today. Frame Relay has widespread use in nearly all well-developed areas.

This technology is very similar to frame relay, but chops packets into very small pieces (53 bytes each) called cells. Because all the frames are exactly the same size, routers are able to process them much quicker. ATM also has the capability to run at very fast speeds because it adapts to run over fiber optic cabling.

These technologies have been implemented to allow service providers to harness the features of PPP on an ethernet or ATM connection. This technology is primarily used in DSL high-speed Internet deployments.

Initially, seeing this layer in PPP seems quite odd. Wasn’t HDLC a competing protocol to PPP? This sub-layer of PPP comprises the industry standard ISO HDLC. This sub-layer is responsible for allowing PPP to be supported by multiple devices. It gives the devices that run PPP common ground to stand on when they communicate with each other. As you will see in just a moment, the LCP layer above is responsible for negotiating all the features of HDLC. Because all devices that run HDLC may not support every single feature, the HDLC sub-layer enables the base PPP communication to continue, even if the platforms support different features.

You can think of the LCP sub-layer as the feature negotiation layer. All the features that PPP supports are negotiated by LCP. These features are:

The final sub-layer of PPP is what gives it the functionality to allow multiple Network layer protocols to run across a single WAN link at any given time. I think of this layer as the PPP DUPLO^® LEGO^® block connector. Have you ever seen the DUPLO^® blocks for small children? They all have that standard connector with which any other DUPLO^® can connect so the child can put any two pieces together (which provides positive affirmation, I’m sure). In that same sense, the Network Control Protocol (NCP) sub-layer of PPP has open-source, network-layer connectors that anyone can plug into. For example, the TCP/IP protocol has a connector called IPCP (the CP stands for “control protocol”) that enables TCP/IP to run across a PPP WAN link. IPX/SPX has a connector called IPXCP. With the open-source nature of this protocol, I could create a “Jeremy protocol” and then write a JeremyCP to allow it to run across a PPP WAN link. Cisco has written its own extension called CDPCP that enables the Cisco Discovery Protocol to run across a PPP WAN link, which enables the routers on each end of the connection to use CDP to see each other.

The CCNA exam focuses on configuring PPP authentication between two Cisco routers rather than using authentication for dial-up users (this is covered in the Building Cisco Remote Access Networks CCNP course). Typically, when Cisco routers are performing authentication on a WAN link, the routers will be configured as two-way authentication. Two-way authentication means that both routers authenticate each other. Typically, when a dial-up user connects to a router, one-way authentication is performed (the user must authenticate to the Cisco router, not vice-versa).

To set up CHAP PPP authentication, you must do the following:

At first, these steps may seem somewhat cryptic, but let me walk you through a configuration example and explain how all these pieces fit together. Refer to Figure 17.3 for a visual of this example configuration.

Figure 17.3. PPP authentication example.

This sample configuration enables two-way, CHAP PPP authentication between the Robin and Pigeon routers. For the sake of brevity, assume the router hostnames are already configured and PPP encapsulation has been enabled under the serial interfaces.

Before you begin, you need to understand the significance of the router hostname. By default, when a Cisco router attempts to authenticate with another router, it uses the router hostname as its PPP username to authenticate with the other side. In this example, the router with the hostname “Robin” crosses the PPP link and attempts to authenticate with the Pigeon router, using the username “Robin.” The Pigeon router attempts to authenticate with the Robin router, using the username “Pigeon.” You therefore need to create user accounts on each router that match the usernames the routers will use when authenticating. The following syntax accomplishes this:

Pigeon#configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Pigeon(config)#username Robin password cisco

Robin#configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Robin(config)#username Pigeon password cisco

Now, when the Robin router comes over to the Pigeon router and says “My username is Robin,” the Pigeon router has a user database that identifies that username. Likewise, the Pigeon router can now authenticate the Robin router. If you have any experience with Windows administration, this is an identical concept to creating user accounts for people to log on to their PCs.

When using CHAP authentication, you must use the same password for both user accounts. In this case, both the Pigeon and Robin router share the password “cisco.” It must remain the same on both sides because CHAP never actually sends the password across the wire; it sends only the MD5 hash version of it. When the receiving side gets the hash, it runs the MD5 algorithm on its own password and compares the two hashes. If they match, authentication succeeds. The following is the complete configuration of both the Pigeon and Robin routers to enable CHAP PPP authentication:

Pigeon#configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Pigeon(config)#username Robin password cisco
Pigeon(config)#interface serial 0
Pigeon(config-if)#encapsulation ppp
Pigeon(config-if)#ppp authentication chap

Robin#configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Robin(config)#username Pigeon password cisco
Robin(config)#interface serial 0
Robin(config-if)#encapsulation ppp
Robin(config-if)#ppp authentication chap

Enabling PPP compression is a piece of cake. You just have to make sure that both sides of the connection enable it; if only one side of the connection enables it, the link fails. Using the Pigeon and Robin scenario again, the following shows the steps you can take to enable compression:

Pigeon#configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Pigeon(config)#interface serial 0
Pigeon(config-if)#compress  ?
  mppc       MPPC compression type
  predictor  predictor compression type
  stac       stac compression algorithm
  <cr>

That’s it! Just use the compress command and type the mode of compression you would like to use, and let the bandwidth savings begin.