Numbers

3DES (Data Encryption Standard), 152, 338

3G/4G/5G, 302, 307, 314

800 series routers, 492

802.11 (Wi-Fi), QoS traffic marking, 373

900 series routers, 490

5500 series routers, 491

A

abstraction layers, virtualization, 589–590

access

access attacks, 110–113

remote access Trojan horses, 107

access control

data loss, 98

troubleshooting, 541

access layer

hierarchical network design, 462

scalable networks, 475

access points. See AP

accumulating costs, single-area OSPF, 66–67

ACI (Application Centric Infrastructure), 598, 602

ANP, 602

APIC, 602–603

APIC-EM, 606–608

Nexus 9000 series switches, 602

spine-leaf topologies, 603

ACL (Access Control Lists), 164, 175, 188

ACE, 164–165

best practices, 174–175

creating, 173–175, 183, 188

defined, 164

extended ACL, 166, 175–176, 180–181, 203–204, 220

editing, 213–214

named extended IPv4 ACL, 212–216

numbered extended IPv4 ACL, 204–206, 209–210

ports, 207–209

protocols, 206–209

TCP-established extended ACL, 210–211

verifying, 216–218

implicit denies, 167, 182

inbound ACL filters, 166–167

limits per interface, 173–174

log keyword, 542

modifying, 195–196, 219

sequence numbers method, 197–198

text method, 196–197

named ACL, 177

modifying, 198–199

named extended IPv4 ACL, 212–216

named standard IPv4 ACL, 189–190, 193–195

NAT pools, 246

network traffic, 165

numbered ACL, 176

numbered extended IPv4 ACL, 204–206, 209–210

numbered standard IPv4 ACL, 188–189, 191–193, 195

outbound ACL filters, 167

packet filtering, 164–166

placement of, 177–181

purpose of, 164–168, 182

standard ACL, 166, 175–176, 179, 190, 200–203, 219–220

stateful firewall services, 210, 220

statistics, 199

tasks using ACL, 165

traffic flows, 165

transport layer, troubleshooting, 539–542

types of, 175–181, 183–184

verifying, 568–570

wildcard masks, 168, 182–183

calculating, 170–172

examples of, 168–169

IPv4 address ranges, 170

IPv4 subnets, 169–170

keywords, 172–173

matching hosts, 169–170

addresses

mapping errors, troubleshooting, 536

spoofing attacks, 118, 120–121

adjacencies

BDR, 51, 54–56

DR, 51, 54–56

routers, 23–24

troubleshooting, 539

adjacency databases, OSPF, 5

adware, 108

AES (Advanced Encryption Standard), 152, 338

AF (Assured Forwarding) values, DSCP, 376–377

AH (Authentication Headers), 336

algorithms

OSPF, 5

QoS queueing algorithms, 361, 383

CBWFQ, 364

FIFO, 362

LLQ, 365

WFQ, 362–364

SHA, 146–147, 339

SPF, 5, 8–9

amplification attacks, 118–120

analyzing

cable analyzers, 527

dynamic NAT, 247–249

information (troubleshooting process), 514

PAT, 254–255

static NAT, 241–242

ANP (Application Network Profiles), 602

Ansible, 643

AnyConnect Secure Mobility Client, 321

AP (Access Points), 288, 485

API (Application Programming Interface), 628–629, 631, 633, 651

calls, 630

example of, 629–630

internal (private) API, 632

JSON-RPC, 632–633

open (public) API, 631–632

partner API, 632

REST, 632–639, 651–652

SOAP, 632

web service API, 632–633

XML-RPC, 632–633

APIC (Application Policy Infrastructure Controller), 602–603

APIC-EM (Application Policy Infrastructure Controller-Enterprise Module), 606–608

application layer

DNS, 544

FTP, 544

HTTP, 544

NFS, 544

POP, 544

SMTP, 544

SNMP, 544

SSH, 544

telnet command, 544

TFTP, 544

troubleshooting, 543–545

area ID

hello packets, 16

point-to-point OSPF networks, 40

ARP (Address Resolution Protocol)

cache poisoning, 128–130

commands, 553–554

process of, 128

spoofing attacks, 130

tables, 553–554, 557

vulnerabilities, 127–130

arrays, 625

ASA (Adaptive Security Appliances), 140, 321

ASBR (Autonomous System Boundary Routers), 74

ASIC (Application-Specific Integrated Circuits), 485–486

ASR 1000 series routers, 490–491

ASR 9000 series routers, 488–491

assets (security), defined, 96

assigning

router ID, 40

VLAN, troubleshooting, 556–558

asymmetric encryption, 152–156

ATM (Asynchronous Transfer Mode), 296, 324

attacks (security), 109, 158

access attacks, 110–113

address spoofing attacks, 118, 120–121

amplification attacks, 118–120

baiting attacks, 114

buffer overflow attacks, 112–113

DDoS attacks, 116–117

DoS attacks, 115–116

dumpster diving attacks, 114

ICMP attacks, 117–119

impersonation attacks, 114

IP attacks, 117–122

MITM attacks, 112–113, 118

password attacks, 111

phishing attacks, 114. See also spear phishing attacks

port redirection attacks, 112

pretexting attacks, 114

reconnaissance attacks, 109–110

reflection attacks, 118–120

session hijacking attacks, 118

shoulder surfing attacks, 114

social engineering attacks, 114–115

something for something (quid pro quo) attacks, 114

spam attacks, 114

spear phishing attacks, 114. See also phishing attacks

spoofing attacks, 111

tailgaiting attacks, 114

tools, 101–102

trust exploitation attacks, 111

types of attacks, 104–105

attenuation, troubleshooting, 533

authentication, 339–340

AH, 336

HMAC, 147–149, 338–339

MD5, 339

origin authentication, 144

HMAC, 147–149

IPsec, 333, 335

PSK, 339–340

RSA, 340–342

SHA, 339

authoritative time sources, 401–402, 443–444

automation, 619, 641, 651

API, 628–629, 631, 633, 651

calls, 630

example of, 629–630

internal (private) API, 632

JSON-RPC, 632–633

open (public) API, 631–632

partner API, 632

REST, 632–639, 651–652

SOAP, 632

web service API, 632–633

XML-RPC, 632–633

benefits of, 619–620

Cisco DNA, 647–648

Cisco DNA Center, 648–650, 652

concept of, 620–621

configuration management tools, 639, 642–643, 652

Ansible, 643

Chef, 643

CLI, 639

network automation, 641

Puppet, 643

SaltStack, 643

SNMP, 640–641

data formats, 620, 628

JSON, 622–626

key/value pairs, 622–628

rules of, 622

syntax, 622

XML, 623, 627–628

YAML, 623, 626–627

IBN, 644–646, 652

JSON, 622–627

arrays, 625

format of, 623

IPv4 addresses, 625–626

JSON-RPC, 632–633

syntax, 624–626

smart devices, 620

XML, 623, 627–628

YAML, 623, 626–627

availability, network security, 138

AWA Management Console, 586

B

backbone networks, 287

backhaul networks, 287

backups

configurations from TFTP servers, 428–430, 436

IOS images, 437–442

baiting attacks, 114

bandwidth, 354

DSL Internet connectivity, 302

reference bandwidth, single-area OSPF, 64–66

scalable networks, 474–475

baselines, 507–509

baselining tools, 524

performance, troubleshooting, 532, 535

BDR (Backup Designated Routers), 17

adjacencies, 51, 54–56

election

in OSPF, 20, 23–24

process of, 56–59

LSA, 24–26

multiaccess OSPF networks, 49–51, 53, 56–59

router priorities, 61–63

BE (Best Effort) values, DSCP, 376

best practices

ACL, 174–175

network security, 137, 159

availability, 138

confidentiality, 138

defense-in-depth approach, 138–139

firewalls, 139–140

IDS, 140–141

integrity, 138

IPS, 140–141

layered approach, 138–139

best-effort QoS policy model, 366–367

black hat hackers, 99

blacklisting URL (Uniform Resource Locators), 142

boot sector viruses, 107

boot system, configuring IOS images, 441–442

BOOTP, troubleshooting, 543

borderless switched networks, 458–461

bottlenecks/congestion (networks), troubleshooting, 532

bottom-up troubleshooting method, 518–519

branch networks, 281

branch routers, 488

breaches (security), 95

broadband connectivity

dedicated broadband WAN connectivity, 297–298

Internet-based broadband WAN connectivity, 298, 314–315

3G/4G/5G, 302, 307, 314

cable Internet connectivity, 305–306

DSL Internet connectivity, 302–304

ISP Internet connectivity, 309–310

LTE, 307

solution comparisons, 311

teleworking, 283, 302, 308, 312, 314

wired Internet connectivity, 301–302

wireless Internet connectivity, 302

wireless Internet-based broadband connectivity, 306–307

broadcast multiaccess networks, 49, 84

broadcasts, troubleshooting, 536

buffer overflow attacks, 112–113

buffered logging, 529

building switch blocks, 474

business considerations for switch selection, 486–487

C

cable analyzers, 527

cable modems, 288

cable testers, 526–527

cabling

DOCSIS, 305

faults, troubleshooting, 533

fiber optic Internet connectivity, 305–306

HFC networks, cable modems, 305

Internet connectivity, 305

optical nodes, 305

SDH cabling standard, 291–292

SONET cabling standard, 291–292

calendar services, network management, 400

CAM tables, spoofing attacks, 121

campus LAN switches, 477–478

campus networks, 280

carrier protocols, 329

carrier WAN connections, 278

dual-carrier WAN connections, 278–279

single-carrier WAN connections, 278

Catalyst 2960-C series switches, 485–486

Catalyst 3560-C series switches, 485

causes of network problems, troubleshooting, 573–574

data link layer, 534–537

physical layer, 531–534

CBWFQ (Class-Based Weight Fair Queuing), 364

CDP (Cisco Discovery Protocol), 390–396, 441–442

CEF (Cisco Express Forwarding), Layer 3 switches, 596

cellular Internet connectivity, 306–307

central controller and SDN, 597

changing passwords, 435

Chef, 643

circuit-switched network communications, 290

circuit-switched WAN connectivity, 295

Cisco DNA Assurance, 648

Cisco DNA Center, 648–650, 652

Cisco DNA (Digital Network Architecture), 647–648

Cisco DNA Security, 648

classification/marking tools (QoS), 371–372

classifying traffic, 362–363, 368

CLI (Command Line Interface), 639

client-based VPN, 321, 326

clientless VPN, 326

clock (software)

setting manually, 400

source, displaying, 403

cloud computing, 583, 585–586, 609

cloud services, 584

cloud-managed switches, 478

community clouds, 585

data centers versus, 585

hybrid clouds, 584–585

IaaS, 584

PaaS, 584

private clouds, 584

public clouds, 584

SaaS, 584

storage devices, data loss, 98

CnC (Command and Control), 116–117, 132–133

CO (Central Office), WAN, 286

code delays, 355

collapsed core network design, 464

collecting data, IOS commands, 511–512

communications (network)

circuit-switched network communications, 290

demodulation, 288, 295

DWDM multiplexing, 292

jitter, 291, 294, 355

latency, 291, 294, 302, 314

modulation, 288, 295

packet-switched network communications, 290–291

ATM, 296, 324

Frame Relay networks, 295–296

parallel network communications, 289

SDH cabling standard, 291–292

serial network communications, 289

SONET cabling standard, 291–292

community clouds, 585

community strings (SNMP), 412–415

comparison troubleshooting method, 522

compromised-key attacks, 105

confidentiality

data confidentiality, 144, 150

IPsec, 333–334, 336–338

network security, 138

configuration register, password recovery, 433–435, 437

configuring

CDP, 391–393

configuration management tools, 639, 642–643, 652

Ansible, 643

Chef, 643

CLI, 639

network automation, 641

Puppet, 643

SaltStack, 643

SNMP, 640–641

dynamic NAT, 245–247, 251

LLDP, 397

NAT, 260

networks

CLI, 639

SNMP, 640–641

NTP, 402–405

OSPF

ipospf command, 43–44

network command, 41–43

router priorities, 61–63

PAT

address pools, 253

single IP addresses, 252

point-to-point OSPF networks, 49

restoring configurations from, text files, 428–430

routers

copying configurations, 431

ID, 38–39

restoring configurations, 432

saving configurations, 435

verifying configurations, 432

static NAT, 240–241

switches

fixed configuration switches, 480

modular configuration switches, 480

stackable configuration switches, 481

Syslog, 422–423

Syslog traps, 530–531

congestion, 353–354

avoidance tools, 371, 379–380

management tools, 371, 379–380

troublehooting, 532

connectivity

IP connectivity, troubleshooting, end-to-end connectivity, 545–549

loss of, 532

troubleshooting, 535, 539

WAN connectivity

3G/4G/5G, 302, 307, 314

cable Internet connectivity, 305–306

circuit-switched WAN connectivity, 295

dedicated broadband WAN connectivity, 297–298

DSL Internet connectivity, 302–304

Internet-based broadband WAN connectivity, 298, 301–311, 314–315

ISDN, 295

ISP Internet connectivity, 309–310

leased-line WAN connectivity, 293–294

LTE, 307

Metro Ethernet WAN connectivity, 298–300, 332

modern WAN connectivity, 296–301, 314

MPLS, 298, 300–301, 324, 332

packet-switched WAN connectivity, 298

PSTN, 295

solution comparisons, 311

teleworking, 283, 302, 308, 312, 314

traditional WAN connectivity, 292–296, 312–313

wired Internet connectivity, 301–302

wireless Internet connectivity, 302

wireless Internet-based broadband connectivity, 306–307

wireless connectivity, scalable networks, 466–467

console error messages, troubleshooting, 533

console logging, 529

console messages, troubleshooting, 536

content security appliances

ESA, 142

WSA, 142–143

control plane, SDN, 595

controller-based SDN, 605, 611–612

converged networks, 458, 493

convergence

link-state operation, 6

OSPF routers, 17–26

converters (optical), 288

copying

IOS images to TFTP servers, 439–440

router configurations to USB drives, 431–432

core devices (WAN), 288

core layer (hierarchical network design), 462

CoS traffic marking, 373–374, 377–378

cost metrics

single-area OSPF, 63–64

accumulating costs, 66–67

manually setting cost value, 66–67

reference bandwidths, 65

switches, 486

VPN, 322

CPE (Customer Premises Equipment), 286

CPU (Central Processing Units)

high utilization rates, troubleshooting, 533

overloads, troubleshooting, 534

cryptography, 143, 156, 159

data confidentiality, 144, 150

data integrity, 144–145

data nonrepudiation, 144

encryption

3DES, 152

AES, 152

asymmetric encryption, 152–156

DES, 152

DH, 154–156

DSA, 154

DSS, 154

ElGamal, 154

elliptic curve cryptography, 154

public key algorithms, 152–156

RC series algorithms, 152

RSA, 154

SEAL, 152

symmetric encryption, 151–152

hash functions, 144

MD5, 145

SHA, 146–147

origin authentication, 144, 147–149

CS (Class Selector) bits, DSCP, 377–378

CSU (Channel Service Units), 288

cybercriminals, 100

cybersecurity (current state of), 95, 157. See also security

assets, 96

breaches, 95

current state of affairs, 95–96

cybercriminals, 95

exploits, 96

mitigation, 96

risk, 96

threats, 96

vectors of

data loss, 97–98

network attacks, 96–97

vulnerabilities, 96

D

dark fiber, 297–298

data centers

cloud computing versus, 585

switches, 478

data collection, IOS commands, 511–512

data confidentiality, 144, 150

data delays, 360–361

data exfiltration, 97–98

data formats, 620, 628

concept of, 620–621

JSON, 622–624, 626–627

arrays, 625

IPv4 addresses, 625–626

JSON-RPC, 632–633

syntax, 624–626

key/value pairs, 622–628

rules of, 622

syntax, 622, 624–626

XML, 623, 627–628

YAML, 623

data integrity, 144–145, 333, 335, 338–339

data link layer (networks), troubleshooting, 534–537

data loss vectors (security), 97–98

data measurement, network documentation, 510–512

data modification attacks, 105

data nonrepudiation, 144

data plane, SDN, 596

data sending Trojan horses, 107

data structures, OSPF, 4–5

data traffic, 357, 360–361

databases

adjacency databases, 5

forwarding databases, 5

LSDB 5, 7

OSPF, 5, 20–22

topology databases, troubleshooting, 539

DBD (Database Description) packets, 13–14, 21–22

DCE (Data Communications Equipment), 286–288

DDoS (Distributed Denial of Service) attacks, 116–117

dead intervals, 16, 70–73

debug command, 517

debuggers, 104

dedicated broadband WAN connectivity, 297–298

dedicated servers, virtualization, 586–587

default gateways, verifying, 558–560

IPv4, 559

IPv6, 560–562

defense-in-depth approach (network security), 138–139

defining problems (troubleshooting process), 514

de-jitter delays, 355

delays, 353

code delays, 355

data delays, 360–361

de-jitter delays, 355

fixed delays, 355

jitter, 291, 294, 355

packetization delays, 355

playout delay buffers, 355–356

propagation delays, 355

queuing delays, 355

serialization delays, 355

variable delays, 355

demarcation points, 286

demodulation, 288, 295

Denial of Service. See DoS attacks

density (port), switches, 482, 486

departmental switch blocks, 474

DES (Data Encryption Standard), 152, 338

design limits, troubleshooting, 534

designing networks, 455

borderless switched networks, 458–461

collapsed core network design, 464

hierarchical networks, 493

access layer, 462, 475

borderless switched networks, 458–461

core layer, 462

distribution layer, 462

OSPF, 476–477

scalability, 455–458

switched networks, 464–465

three-tier network design, 455, 460, 463

two-tier network design, 461, 464

line cards, 480, 482

routers, 494–495

800 series routers, 492

900 series routers, 490

5500 series routers, 491

ASR 1000 series routers, 490–491

ASR 9000 series routers, 490–491

branch routers, 488

fixed configuration routers, 492

form factors, 490–492

industrial routers, 490, 492

modular routers, 492

network edge routers, 488–489

requirements, 487–488

service provider routers, 489

scalable networks, 465–466, 477, 493–494

access layer, 475

bandwidth, 474–475

failure domains, 469–474

hierarchical networks, 455–458

multiple links, 466–467

redundancy plans, 469

redundant links, 466–467

scalable routing protocol, 467–468

tuning routing protocols, 476–477

wireless connectivity, 465–466

SFP devices, 482

switches, 477, 487, 494–495

ASIC, 485–486

business considerations for switch selection, 486–487

campus LAN switches, 477–478

Catalyst 2960-C series switches, 485–486

Catalyst 3560-C series switches, 485

cloud-managed switches, 478

data center switches, 478

fixed configuration switches, 480

form factors, 479–481

forwarding rates, 483

modular configuration switches, 480

multilayer switching, 485–486

platforms, 477–479

PoE, 484–486

port density, 482

RU, 481, 494

service provider switches, 479

stackable configuration switches, 481

thickness of switches, 481

virtual networks, 479

wire speeds, 483

three-tier network design, 455, 460, 463

two-tier network design, 461, 464

virtual networks, switches, 479

destination ports, troubleshooting, 541

destructive Trojan horses, 107

device discovery

CDP, 390–396, 443

LLDP, 396–400, 443

device documentation (networks), 505, 512

end-system documentation files, 506–507

routers, 505–506

switches, 506

device-based SDN, 604–605

DH (Diffie-Hellman), 154–156

DHCP (Dynamic Host Configuration Protocol), 133

rogue DHCP servers, 121, 134–136

spoofing attacks, 134–136

troubleshooting, 543

dialup modems. See voiceband modems

Diffie-Hellman key exchanges, 333, 335, 342–343

DiffServ (Differentiated Services), 366, 369–370

digital certificates, 327, 333, 335, 339, 341–342, 344–345

digital multimeters (DMM), 525–526

Dijkstra’s algorithm, 5

disaster recovery, virtualization, 589

discovering devices

CDP, 390–396, 443

LLDP, 396–400, 443

distributed networks, 282

distribution layer (hierarchical network design), 461–462, 493

divide-and-conquer troubleshooting method, 520–521

DLCI (Data-Link Connection Identifiers), 296

DMM (Digital Multimeters), 525–526

DMVPN (Dynamic Multipoint VPN), 330–331

DNS (Domain Name System), 131, 544

domain shadowing attacks, 132

open resolver attacks, 131

stealth attacks, 132

traffic analysis, 136

troubleshooting, 543

tunneling, 132–133

verifying, 570–571

DOCSIS (Data Over Cable Service Interface Specification), 305

documentation, networks, 502, 572

baselines, 507–509

device documentation, 505, 512

data measurement, 510–512

end-system documentation files, 506–507

routers, 505–506

switches, 506

logical network topologies, 504–505

overview of, 502

physical network topologies, 503

domain shadowing attacks, 132

DoS (Denial of Service) attacks, 105, 107, 115–116

Down state, 17–19

DR (Designated Routers), 16

adjacencies, 51, 54–56

election

in OSPF, 20, 23–24

process of, 56–59

failures/recovery, 58–59

LSA, 24–26

multiaccess OSPF networks, 49–51, 53–54, 56–59

router priorities, 61–63

single-area OSPF, router ID, 36

drives (USB)

copying router configurations to, 431–432

displaying contents of, 430

verifying connections, 430–431

DROTHER, 25, 50–51, 52–53

DSA (Digital Signature Algorithm), 154

DSCP (Differentiated Services Code Points), 375–378

DSL (Digital Subscriber Line) Internet connectivity, 302–303

bandwidth space allocation, 302

DSLAM, 303

example of, 303

modems, 288

PPP, 303–304

DSP (Digital Signal Processors), 357

DSS (Digital Signature Standard), 154

DSU (Data Service Units), 288

DTE (Data Terminal Equipment), 286–288

dual stacks, 259, 263

dual-carrier WAN connections, 278–279

dual-homed ISP connectivity, 309

dual-homed WAN topology, 276

dual-multihomed ISP connectivity, 310

dumpster diving attacks, 114

duplex mismatches, troubleshooting, 551–553

DWDM multiplexing, 292

dynamic NAT (Network Address Translation), 232–233, 244–245, 260–261

analyzing, 247–249

configuring, 245–247, 251

topologies, 244–245

verifying, 249–251

E

eavesdropping attacks, 105

E-carriers, 294

edge routers, 74

failure domains, 470–471

network edge routers, 488–489

educated guess troubleshooting method, 522

EF (Expedited Forwarding) values, DSCP, 376

egress packets, 372

ElGamal, 154

eliminating probable cause (troubleshooting process), 514

elliptic curve cryptography, 154

email

data loss, 98

POP, 544

SMTP, 544

EMI (Electromagnetic Interference), troubleshooting, 534

encapsulating

errors, troubleshooting, 536

protocols (IPsec), 336

encryption

3DES, 338

AES, 152, 338

asymmetric encryption, 152–156

DES, 152, 338

DH, 154–156

DSA, 154

DSS, 154

ElGamal, 154

elliptic curve cryptography, 154

encryption protocols, troubleshooting, 542

protocols, troubleshooting, 543

public key algorithms, 152–156

RC series algorithms, 152

RSA, 154

SEAL, 152, 338

symmetric encryption, 151–152

tools, 104

end users (troubleshooting process), questioning, 515–516

endpoint groups (EPG), 602

end-system documentation files, 506–507

end-to-end IP connectivity, troubleshooting

components of, 545–547

IPv4

pinging, 547–548

traceroute command, 548

IPv6

pinging, 548–549

traceroute command, 548–549

reference topologies, 545–547

enterprise networks, 458, 477, 487, 491, 493–494

enterprise VPN (Virtual-Private Networks), 324–325

EoMPLS. See Metro Ethernet WAN connectivity

EPG (Endpoint Groups), 602

error messages (console), troubleshooting, 533

ESA (Email Security Appliance), 142

ESP (Encapsulation Security Protocol), 336

established keyword, troubleshooting, 542

Ethernet

CoS traffic marking, 373–374, 377–378

Metro Ethernet WAN connectivity, 298–300, 332

network adjacencies, 23–24

PoE, switches, 484–486

PPPoE, DSL Internet connectivity, 303–304

QoS traffic marking, 373

WAN, 297–298

ethical hacking, 95

excessive broadcasts, troubleshooting, 536

Exchange state, 18

exfiltration of data, 97–98

exploits (security), defined, 96

ExStart state, 18

extended ACL (Access Control Lists), 166, 175–176, 180–181, 203–204, 220

editing, 213–214

named extended IPv4 ACL, 212–216

numbered extended IPv4 ACL, 204–206, 209–210

ports, 207–209

protocols, 206–209

TCP-established extended ACL, 210–211

verifying, 216–218

F

failover tests to backup routes, single-area OSPF, 69

failure domains

edge routers, 470–471

scalable networks, 469–474

failures/recovery

routers, multiaccess OSPF networks, 58–59

single point of failure, 275, 278

FIB (Forwarding Information Base), 596

fiber optic Internet connectivity, 305–306

FIFO (First-In, First-Out), 362

file systems

Flash file systems, 425

IOS File System, 424, 437–442

NVRAM file systems, 425–426

restoring configurations from, text files, 428–430

router file systems, 423–425, 445–446

switch file systems, 426–427, 445–446

filtering

network traffic with ACL

inbound ACL filters, 166–167

outbound ACL filters, 167

URL, 142

firewalls, 139–140, 210, 220

firmware viruses, 107

fixed configuration routers, 492

fixed configuration switches, 480

fixed delays, 355

Flash

backing up configurations from, 436

file systems, 425

IOS images, verifying size of, 439–441

flexibility, borderless switched networks, 459

flood attacks

TCP SYN flood attacks, 124

UDP flood attacks, 127

flooding LSA, 23–24

flow control, TCP, 123

flow tables (switches), 601

flowcharts (troubleshooting), 512–513

follow-the-path troubleshooting method, 521–522

forensic tools, 103

form factors

routers, 490–492

SFP devices, 482

switches, 479–481

forwarding databases, OSPF, 5

Forwarding Information Base (FIB), 596

forwarding rates (switches), 483

frame buffers, switches, 487

Frame Relay networks, 295–296

framing errors, troubleshooting, 537

FTP (File Transfer Protocol), 107, 544

FTTB (Fiber-to-the-Building) Internet connectivity, 306

FTTH (Fiber-to-the-Home) Internet connectivity, 306

FTTN (Fiber-to-the-Node/Neighborhood) Internet connectivity, 306

FTTx Internet connectivity, 305–306

Full state, 18

full-duplex, 551–553

fully meshed WAN topology, 276

functionality, troubleshooting, 535

fuzzers, 103

G

gateways (default), verifying, 558–560

IPv4, 559

IPv6, 560–562

gathering information (troubleshooting process), 514, 516–517

general network issues, troubleshooting, 539

general troubleshooting procedures, 512–513

get operations (SNMP), 406–407

global NAT addresses, 229–231

gray hat hackers, 99

GRE (Generic Routing Encapsulation)

GRE over IPsec, 328–329

mGRE, 330–331

group tables (switches), 602

H

hackers, 98–100

hacking

OS, 104

tools, 103

hacktivists, 100

half-duplex, 551–553, 575

hard copies, data loss, 98

hardware, troubleshooting

faults, 533

tools

cable analyzers, 527

cable testers, 526–527

DMM, 525–526

portable network analyzers, 528

Prime NAM, 528

Syslog server, 529–531

hash functions

MD5, 145

SHA, 146–147

headend, 305

headers

TCP headers, 122

UDP headers, 126

hello intervals, 16

hello packets, 13–17

intervals, single-area OSPF, 69–73

neighbor adjacencies, OSPF link-state operation, 6

HFC networks, cable modems, 305

hierarchical networks, 493

access layer, 462, 475

borderless switched networks, 458–461

core layer, 462

designing, OSPF, 476–477

distribution layer, 461–462, 493

OSPF, 476–477

scalability, 455–458

switched networks, 464–465

three-tier network design, 455, 460, 463

two-tier network design, 461, 464

hierarchical topologies, multi-area OSPF, 11

high CPU utilization rates, troubleshooting, 533

HMAC (Hash Message Authentication Code), 147–149, 338–339

HTTP (Hypertext Transfer Protocol), 544, 634–639

hub routers, 275–276

hub-and-spoke WAN topology, 275, 330–331

hybrid clouds, 584–585

hypervisors, 588, 591–593

hypotheses (troubleshooting process)

proposals, 514

testing, 515

I

IaaS (Infrastructure as a Service), 584

IBN (Intent-Based Networking), 644–646, 652

ICMP attacks, 117–119

ID

area ID, point-to-point OSPF networks, 40

router ID, 16, 40, 83

assigning, 40

choosing, 36–37

configuration mode, 35

configuring, 38–39

DR election, 36

loopback interfaces, 37–38

modifying, 39–40

order of precedence, 36–37

reference topologies, 34–35, 38

rid values, 37

synchronization of OSPF databases, 36

verifying, 38–39

IDS (Intrusion Detection Systems), network security, 140–141

IEEE 802.1p. See CoS traffic marking

IFS (IOS File System), 424, 437–442

IKE (Internet Key Exchange), 335

images (IOS), managing, 446

backups, 438–441

boot system configurations, 441–442

TFTP backups, 437–442

impersonation attacks, 114

implicit denies, 167, 182, 541

inbound ACL filters, 166–167

industrial routers, 490, 492

information (troubleshooting process)

analyzing, 514

gathering, 514, 516–517

ingress packets, 372

Init state, 17–19

input errors, troubleshooting, 551

input queue drops, 550

inside NAT addresses, 229–231

integrity

of data, 144–145, 333, 335, 338–339

network security, 138

interfaces, show interfaces command, 549–550

interference, troubleshooting, 534

internal (private) API, 632

Internet-based broadband WAN connectivity, 298, 314–315

3G/4G/5G, 302, 307, 314

cable Internet connectivity, 305–306

DSL Internet connectivity, 302, 303

bandwidth space allocation, 302

DSLAM, 303

example of, 303

PPP, 303–304

ISP Internet connectivity

dual-homed ISP connectivity, 309

dual-multihomed ISP connectivity, 310

multihomed ISP connectivity, 309–310

single-homed ISP connectivity, 309

LTE, 307

microwave Internet connectivity. See WiMAX

solution comparisons, 311

teleworking, 283, 302, 308, 312, 314

wired Internet connectivity, 301–302

wireless Internet connectivity, 302

wireless Internet-based broadband connectivity, 306, 308

cellular Internet connectivity, 306–307

municipal Wi-Fi Internet connectivity, 306

satellite Internet connectivity, 307

WiMAX, 307

interoperability areas (transport layer), troubleshooting, 542–543

IntServ (Integrated Services), 366–368

IOS commands

data collection, 511–512

gathering information (troubleshooting process), 516–517

IOS File System, 424, 437–442, 446

IOS log messages, severity levels (Syslog), 530

IP (Internet Protocol)

show ip interface brief command, 517

show ip route command, 517

IP addresses, attacks, 105, 117–122, 158. See also security

IP connectivity, troubleshooting, 574–576

ACL, verifying, 568–570

DNS, verifying, 570–571

end-to-end connectivity

components of, 545–547

duplex mismatches, 551–553

IPv4 pinging, 547–548

IPv4 traceroute command, 548

IPv6 pinging, 548–549

IPv6 traceroute command, 548–549

reference topologies, 545–547

verifying physical layer, 549–551

local network addressing, end-to-end connectivity, 553–556

network paths, verifying, 562–566

transport layer, verifying, 566–567

verifying physical layer, 549–551

VLAN assignments, 556–562

IP phone, PoE, 484

IP services, 127–130, 158

ipospf command, point-to-point OSPF networks, configuring OSPF, 43–44

ipospf priority command, 61

IPP (IP Precedence), 373, 375, 377–378

IPS (Intrusion Prevention Systems), 140–141

IPsec (IP Security), 332–345. See also VPN

AH, 336

authentication, 339–340

PSK, 339, 340

RSA, 340–342

confidentiality, 333–334, 336–338

data integrity, 333, 335, 338–339

Diffie-Hellman key exchanges, 333, 335, 342–343

ESP, 336

framework of, 334–335

GRE over IPsec, 328–329

origin authentication, 333, 335

protocol encapsulation, 336

SA, 334–335

SSL comparisons, 326–327

transport and tunnel mode, 343

VTI, 331–332

IPv4 (Internet Protocol version 4)

ACL, 175, 188. See also extended ACL; named ACL; numbered ACL; standard ACL

creating, 188

modifying, 195–198, 219

placement of, 177–181

stateful firewall services, 210, 220

statistics, 199

wildcard masks, 168–173

addressing

ranges, wildcard masks, 170

troubleshooting, 541

ARP tables, 553–554

attacks, 117–118

default gateways, 559

extended ACL, 175–176, 180–181, 203–204, 220

editing, 213–214

named extended IPv4 ACL, 212–216

numbered extended IPv4 ACL, 204–206, 209–210

ports, 207–209

protocols, 206–209

TCP-established extended ACL, 210–211

verifying, 216–218

JSON, 625–626

logical network topologies, 504

named ACL, 177

modifying, 198–199

named extended IPv4 ACL, 212–216

named standard IPv4 ACL, 189–190, 193–195

NAT, 226, 237

advantages of, 238, 261

configuring, 260

defined, 227–228

disadvantages of, 238–239, 261

dynamic NAT, 232–233, 244–251, 260–261

global NAT addresses, 229–231

inside global NAT addresses, 230

inside local NAT addresses, 230–231

inside NAT addresses, 227–231

local NAT addresses, 229–231

NAT overload. See PAT

NAT64, 258–259

NAT-PT, 259

operation of, 228–229

outside global NAT addresses, 231

outside local NAT addresses, 231

outside NAT addresses, 229, 231

PAT, 233–234, 237, 251–257, 260–261

pools, 245–247

private IPv4 addresses, 226–227

static NAT, 231–232, 239–244, 260–261

stub networks, 228

terminology, 229–231

troubleshooting, 542–543

numbered ACL, 176

numbered extended IPv4 ACL, 204–206, 209–210

numbered standard IPv4 ACL, 188–189, 191–193, 195

packet headers, 374–375

pinging, 547–548

private addresses, 226–227

QoS traffic marking, 373

standard ACL, 175–176, 179, 190, 200–203, 219–220

subnets, wildcard masks, 169–170

traceroute command, 548

Type of Service field, 375

wildcard masks

address ranges, 170

subnets, 169–170

troubleshooting, 541

IPv6 (Internet Protocol version 6)

attacks, 117–118

default gateways, 560–562

logical network topologies, 505

NAT64, 258–259

neighbor tables, 554–555

packet headers, 374–375

pinging, 548–549

QoS traffic marking, 373

show ipv6 interface brief command, 517

show ipv6 route command, 517

traceroute command, 548–549

Traffic Class field, 375

ISDN (Integrated Services Digital Networks), 295

ISP (Internet Service Providers)

Internet connectivity

dual-homed ISP connectivity, 309

dual-multihomed ISP connectivity, 310

MPLS VPN, 332

multihomed ISP connectivity, 309–310

single-homed ISP connectivity, 309

VPN, 324–325

routers, 489

switches, 479

VPN, 324–325

ISR 4000 series routers, 488

J

jabber, 533

jitter, 291, 294, 355

JSON (JavaScript Object Notation), 622–624, 626–627

arrays, 625

format of, 623

IPv4 addresses, 625–626

JSON-RPC, 632–633

syntax, 624–626

JSON-RPC (JavaScript Object Notation-Remote Procedure Call), 632–633

K

keylogger attacks, 107

keys (security), compromised-key attacks, 105

key/value pairs, 622–628

knowledge bases, 524

L

LAN (Local-Area Networks)

campus LAN switches, 477–478

switches, device documentation, 506

WAN comparisons, 272–273

last mile (local loops), 286

latency, 291, 294, 302, 314

Layer 2 MPLS VPN, 324, 332, 344

Layer 2 QoS traffic marking, 373–374

Layer 2 traffic marking, 373–374

Layer 3 MPLS VPN, 324, 332, 334, 344

Layer 3 switches, SDN, 596

Layer 3 traffic marking, 374–375

layered approach (network security), 138–139

layered models, troubleshooting with, 517–518

leased-line WAN connectivity, 293–294

legacy support, virtualization, 589

line cards, 480, 482

links, scalable networks

multiple links, 466–467

redundant links, 466–467

link-state operation

convergence, 6

OSPF, 6

establishing neighbor adjacencies, 6

LSA, 6–7

LSDB, 7

SPF algorithms, 8–9

SPF trees, 8–9

route selection, 8–9

link-state routing protocols. See OSPF

list of neighbors, 17

LLDP (Link Layer Discovery Protocol), 396–400, 443

LLQ (Low Latency Queuing), 365

Loading state, 18

local loops (last mile), 286

local NAT addresses, 229–231

local network addressing, verifying, 553–556

log keyword, ACL, 542

logging

buffered logging, 529

console logging, 529

logging trap command, 530

logical network topologies, 504–505

loopback interfaces

point-to-point OSPF networks, 48

router ID, 37–38

loops

local loops (last mile), 286

STP loops, troubleshooting, 537

LSA (Link-State Advertisements)

BDR, 24–26

DR, 24–26

exchanging, OSPF, 6–7

flooding, 23–24

LSU packets, 14

LSAck (Link-State Acknowledgement) packets, 13–14

LSDB (Link-State Databases)

OSPF, 5, 7

topology tables, 7

LSR (Label-Switched Routers), 300–301

LSR (Link-State Request) packets, 13–14, 22

LSU (Link-State Update) packets, 13–14

LTE (Long-Term Evolution), 307

M

MAC addresses

spoofing attacks, 120–121

switch MAC address tables, 555–557

macros, viruses, 107

malware, 106, 108–109, 157

adware, 108

overview of, 106

ransomware, 108

rootkits, 108

spyware, 108

Trojan horses, 106–107

viruses, 106–107

worms, 106, 108

management plane, SDN, 598

managing networks, 390

calendar services, 400

CDP, 390–396, 443

configurations

backups, 428–430, 436

restoring from text files, 428–430

IOS images, 424, 437–442

LLDP, 396–400, 443

NTP, 400–405, 443–444

passwords

changing, 435

recovery, 433–437

routers

copying configurations, 431

file systems, 423–424, 445–446

restoring configurations, 432

saving configurations, 435

USB ports, 430

verifying configurations, 432

SNMP, 405–418, 444

switch file systems, 426–427, 445–446

Syslog, 418–423, 444–445

time services, 400

USB drives

copying router configurations to, 431–432

displaying contents of, 430

verifying connections, 430–431

man-in-the-middle attacks. See MITM

marking/classification tools (QoS), 371–372

MD5 (Message-Digest 5), 339

MD5 hash function, 145

measuring data, network documentation, 510–512

meter tables (switches), 602

Metro Ethernet WAN connectivity, 298–300, 332

mGRE (Multipoint GRE), 330–331

MIB (Management Information Base)

OID, 415

variables, SNMP agents, 407

microwave Internet connectivity. See WiMAX

mission-critical services, 455–456, 490

mitigation (security), defined, 96

MITM (Man-in-the-Middle) attacks, 105, 112–113, 118

modems

cable Internet connectivity, 305

cable modems, 288

CSU, 288

dialup modems. See voiceband modems

DSL modems, 288

DSU, 288

voiceband modems, 288

modern WAN connectivity, 296–301, 314

modifying

ACL, 195–196, 219

named ACL, 198–199

sequence numbers method, 197–198

text method, 196–197

router ID, 39–40

single-area OSPF, 85–86

modular configuration switches, 480

modular routers, 492

modularity, borderless switched networks, 459

modulation, 288, 295

MPLS (Multi-Protocol Label Switching), 298, 300–301, 324

Layer 2 MPLS VPN, 324, 332, 344

Layer 3 MPLS VPN, 324, 332, 334, 344

QoS traffic marking, 373

VPN, 332

multiaccess OSPF networks, 49

adjacencies, 54–56

designated routers, 49–51

election process, 56–59

reference topologies, 51–52, 57

router election process, 56–59

router failures/recovery, 58–59

router priorities, 61–63

verifying router roles, 52–54

multi-area OSPF, 9–11

multihomed ISP connectivity, 309–310

multilayer switching, 485–486

multimeters (digital), 525–526

multiple adjacencies, routers, 23–24

multiple links, scalable networks, 466–467

municipal Wi-Fi Internet connectivity, 306

N

NAM (Network Analysis Module), 528

named ACL (Access Control Lists), 177

modifying, 198–199

named extended IPv4 ACL, 212–216

named standard IPv4 ACL, 189–190, 193–195

NAT (Network Address Translation), 226, 237

advantages of, 238, 261

characteristics of, 227–231

configuring, 260

defined, 227–228

disadvantages of, 238–239, 261

dynamic NAT, 232–233, 244, 245–247, 249–251, 260–261

analyzing, 247–249

configuring, 251

topologies, 244–245

global NAT addresses, 229–231

inside global NAT addresses, 230

inside local NAT addresses, 230–231

inside NAT addresses, 229–231

local NAT addresses, 229–231

NAT overload. See PAT

NAT64, 258–259

NAT-PT, 259

operation of, 228–229

outside global NAT addresses, 231

outside local NAT addresses, 231

outside NAT addresses, 229, 231

PAT, 233–234, 251, 260–261

analyzing, 254–255

configuring, 252–253

NAT comparisons, 236–237

next available port, 233–234

source port assignments, 235

verifying, 256–257

pools, 245–247

private IPv4 addresses, 226–227

routers, private/public IPv4 address translations, 227

static NAT, 231–232, 239–240, 242–244, 260–261

analyzing, 241–242

configuring, 240–241

topology, 240

stub networks, 228

terminology, 229–231

troubleshooting, 542–543

NBAR (Network Based Application Recognition), 372

NBMA (Non-Broadcast Multiaccess) networks, 70

NCS 6000 series routers, 489

neighbor adjacencies

establishing, 18–20

OSPF link-state operation, 6

troubleshooting, 539

neighbor tables (IPv6), 554–555

neighbors, list of, 17

NETCONF, 638–639

network addresses, prefixes, 12

Network Analysis Module (NAM), 528

network analyzers (portable), 528

network command, point-to-point OSPF networks

command syntax, 40

configuring OSPF, 41–43

network edge routers, 488–489

network layer, troubleshooting, 537–539

network masks, hello packets, 16

networks

ACL, 164, 165, 175, 188

ACE, 164–165

best practices, 174–175

creating, 173–175, 183, 188

defined, 164

extended ACL, 175–176, 180–181, 203–206, 207–218, 220

implicit denies, 167, 182

limits per interface, 173–174

modifying, 195–196, 219

modifying, sequence numbers method, 197–198

modifying with text method, 196–197

named ACL, 177, 189–190, 193–195, 198–199, 212–216

numbered ACL, 176, 188–189, 191–193, 195, 204–206, 209–210

packet filtering, 164–168

placement of, 177–181

purpose of, 164–168, 182

standard ACL, 175–176, 179, 190, 200–203, 219–220

stateful firewall services, 210, 220

statistics, 199

types of, 175–181, 183–184

wildcard masks, 168–173, 182–183

ATM, 296, 324

attacks, 109, 117, 158. See also security

access attacks, 110–113

address spoofing attacks, 118, 120–121

amplification attacks, 118–120

ARP vulnerabilities/attacks, 127–130

baiting attacks, 114

best practices, 137–143, 159

buffer overflow attacks, 112–113

DDoS attacks, 116–117

DHCP attacks, 134–136

DNS attacks, 131–133

DoS attacks, 115–116

dumpster diving attacks, 114

ICMP attacks, 117–119

impersonation attacks, 114

IP attacks, 117–122

IP service attacks, 127–136

MITM attacks, 112–113, 118

password attacks, 111

phishing attacks 114. See also spear phishing attacks

port redirection attacks, 112

pretexting attacks, 114

reconnaissance attacks, 109–110

reflection attacks, 118–120

session hijacking attacks, 118

shoulder surfing attacks, 114

social engineering attacks, 114–115

something for something (quid pro quo) attacks, 114

spam attacks, 114

spear phishing attacks, 114. See also phishing attacks

spoofing attacks, 111

tailgaiting attacks, 114

TCP vulnerabilities/attacks, 122–126, 158

trust exploitation attacks, 111

UDP vulnerabilities/attacks, 122, 126–127, 158

vectors of, 96–97

zombies, 116

automation, 619, 641, 651

API, 628–639, 651–652

benefits of, 619, 620

Cisco DNA, 647–648

Cisco DNA Center, 648–650, 652

concept of, 620–621

configuration management tools, 639–643, 652

data formats, 620–628

IBN, 644–646, 652

JSON, 622–626, 632–633

smart devices, 620

XML, 623, 627–628

YAML, 623, 626–627

backbone networks, 287

backhaul networks, 287

bandwidth, 354

baselines, 408, 507–509, 524

borderless switched networks, 458–461

bottlenecks/congestion, troubleshooting, 532

branch networks, 281

broadcast multiaccess networks, 49, 84

campus networks, 280

Cisco DNA, 647–648

Cisco DNA Assurance, 648

Cisco DNA Center, 648–650, 652

Cisco DNA Security, 648

CLI, 639

communications

ATM, 296, 324

circuit-switched network communications, 290

demodulation, 288, 295

DWDM multiplexing, 292

Frame Relay networks, 295–296

jitter, 291, 294, 355

latency, 291, 294, 302, 314

modulation, 288, 295

packet-switched network communications, 290–291, 295–296

parallel network communications, 289

SDH cabling standard, 291–292

serial network communications, 289

SONET cabling standard, 291–292

configuring

CLI, 639

SNMP, 640–641

congestion, 353–354

converged networks, 458, 493

data link layer, troubleshooting, 534–537

delays, 353

code delays, 355

data delays, 360–361

de-jitter delays, 355

fixed delays, 355

jitter, 291, 294, 355

packetization delays, 355

propagation delays, 355

queuing delays, 355

serialization delays, 355

variable delays, 355

designing, 455

borderless switched networks, 458–461

collapsed core network design, 464

hierarchical networks, 455–465, 475

line cards, 480, 482

routers, 487–492

scalable networks, 455–458, 465–477

SFP devices, 482

switch hardware, 477–487

three-tier network design, 455, 460, 463

two-tier network design, 461, 464

distributed networks, 282

documentation, 502, 572

baselines, 507–509

data measurement, 510–512

device documentation, 505–507, 512

logical network topologies, 504–505

overview of, 502

physical network topologies, 503

enterprise networks, 458, 477, 487, 491, 493, 494

Ethernet networks, adjacencies, 23–24

evolution of, 279–282

firewalls, 139–140

Frame Relay networks, 295–296

hacking tools, 103

HFC networks, cable modems, 305

hierarchical networks, 493

access layer, 462, 475

borderless switched networks, 458–461

core layer, 462

distribution layer, 462

distribution layer switches, 461, 462, 493

OSPF, 476–477

scalability, 455–458

switched networks, 464–465

three-tier network design, 455, 460, 463

two-tier network design, 461, 464

IBN, 644–646, 652

ISDN, 295

knowledge bases, 524

LAN

campus LAN switches, 477–478

WAN comparisons, 272–273

line cards, 480, 482

local network addressing, verifying, 553–556

managing, 390

backing up configurations, 428–430, 436

calendar services, 400

CDP, 390–396, 443

changing passwords, 435

IOS images, 424, 437–442

LLDP, 396–400, 443

NTP, 400–405, 443–444

password recovery, 433–436, 437

restoring configurations from text files, 428–430

router configurations, 431–432

router file systems, 423–424, 445–446

routers, USB ports, 430–432

SNMP, 405–418, 444

switch file systems, 426–427, 445–446

Syslog, 418–423, 444–445

time services, 400

USB drives, 430–432

multiaccess OSPF networks, 49–51

NBMA, 70

network layer, troubleshooting, 537–539

NMS

SNMP, 405, 444

tools, 524

NOC, 457

OSPF, network types, 84–85

paths, verifying, 562–566

physical layer

troubleshooting, 531–534

verifying, 549–551

point-to-point OSPF networks, 40, 83–84

area ID, 40

configuring, 49

configuring with ipospf command, 43–44

configuring with network command, 41–43

ipospf command, 43–44

loopback interfaces, 48

network command, 40, 41–43

passive interfaces, 44–46

verifying network type, 46–48

wildcard masks, 40, 41, 42–43

prioritizing traffic, 353–354

PSTN, 295

router hardware, 487–492

routers, 494–495

scalable networks, 493–494

designing, 465–477

hierarchical networks, 455–458

scanning tools, 103

SD-Access, 647

SDN, 595, 598, 600, 610–611

ACI, 598, 602–603

CEF, 596

central controller, 597

control plane, 595

controller-based SDN, 605, 611–612

controllers, 600–602

data plane, 596

device-based SDN, 604–605

framework, 599

Layer 3 switches, 596

management plane, 598

OpenFlow, 598

OpenStack, 598

policy-based SDN, 605

traditional architectures and, 599

SD-WAN, 648

security, 95, 157. See also attacks; VPN

adware, 108

ASA, 140

assets, 96

attack tools, 101–102

attack types, 104–105

availability, 138

best practices, 137–143

blacklisting URL, 142

breaches, 95

confidentiality, 138

content security appliances, 141–143

cryptography, 143–146, 159

cybercriminals, 95, 100

cybersecurity, current state of, 95–98

data confidentiality, 144, 150

data integrity, 144, 145

data nonrepudiation, 144

debuggers, 104

defense-in-depth approach, 138–139

encryption, 104, 151–156

ESA, 142

ethical hacking, 95

evolution of tools, 102–104

exploits, 96

firewalls, 139–140

forensic tools, 103

fuzzers, 103

hackers, 98–100

hacking OS, 104

hacking tools, 103

hacktivists, 100

hash functions, 144–147

IDS, 140–141

integrity, 138

IPS, 140–141

layered approach, 138–139

malware, 106–109

mitigation, 96

origin authentication, 144, 147–149

packet crafting tools, 103

packet sniffers, 103

password crackers, 103

penetration testing tools, 102–104

ransomware, 108

risk, 96

rootkit detectors, 103

rootkits, 108

scanning tools, 103

script kiddies, 100

spyware, 108

threat actors, 98–101, 157

threats, 96

Trojan horses, 106, 107

URL filtering, 142

vectors of data loss, 97–98

vectors of network attacks, 96–97

viruses, 106–107

vulnerabilities, 96

vulnerability brokers, 100

vulnerability exploitation tools, 104

vulnerability scanners, 104

wireless hacking tools, 103

worms, 106, 108

WSA, 142–143

SFP devices, 482

small networks, 279–280

SNMP, 640–641

stub networks, NAT and, 228

switch hardware, 477–487

switched networks, borderless switched networks, 458–461, 464–465

switches, 481, 494–495

toll networks, 286

topologies

logical network topologies, 504–505

physical network topologies, 503

traffic

data traffic, 357, 360–361

video traffic, 357–360

voice traffic, 357–358

transmission quality, 353, 382

congestion, 353–354

delays, 353, 355

packet loss, 355–357

prioritizing traffic, 353–354

troubleshooting

analyzing information, 514

application layer, 543–545

bottom-up troubleshooting method, 518–519

buffered logging, 529

comparison troubleshooting method, 522

console logging, 529

data link layer, 534–537

defining problems, 514

divide-and-conquer troubleshooting method, 520–521

documentation, 502–512, 572

educated guess troubleshooting method, 522

eliminating probable cause, 514

flowcharts, 512–513

follow-the-path troubleshooting method, 521–522

gathering information, 514, 516–517

general troubleshooting procedures, 512–513

hardware troubleshooting tools, 525–528

IP connectivity, 574–576

layered models, 517–518

network layer, 537–539

physical layer, 531–534

process of, 512–523

proposing hypotheses, 514

protocol analyzers, 525

questioning end users, 515–516

selecting troubleshooting method, 523

seven-step troubleshooting process, 513–515

SNMP traps, 530

software troubleshooting tools, 524

solving problems, 515

structured troubleshooting methods, 518–522

substitution troubleshooting method, 522

symptoms/causes of network problems, 531–545, 573–574

terminal lines, 529

testing hypotheses, 515

top-down troubleshooting method, 519–520

virtual networks, 592–593

complexity of, 594–595, 610

switches, 479

UCS Manager, 593–594

virtualization, 583, 609

abstraction layers, 589–590

advantages of, 589

AWA Management Console, 586

cloud computing, 583–586

dedicated servers, 586–587

disaster recovery, 589

hypervisors, 588, 591–593

legacy support, 589

prototyping, 589

SDN, 595–598, 610–611

servers, 587–589

virtual network infrastructure, 592–595, 610

VLAN, 556–558, 594

VNI, 357

VPN, 283, 308, 321, 344. See also IPsec

AnyConnect Secure Mobility Client, 321

ASA, 321

authentication, 339–342

benefits of, 322–323

client-based VPN, 321, 326

clientless VPN, 326

cost metrics, 322

data integrity, 338–339

digital certificates, 327, 333, 335, 339, 341–342, 344–345

DMVPN, 330–331

enterprise VPN, 324–325

GRE over IPsec, 328–329

MPLS VPN, 332

PKI, 327, 344

remote access VPN, 283, 308, 312, 314–315, 324, 325–326

scalability, 323

service provider VPN, 324–325

site-to-site VPN, 283, 308, 312, 314–315, 323, 327–328

SOHO, 321

SSL VPN, 326–327

VTI, 331–332

VRF, 595

WAN

3G/4G/5G, 302, 307, 314

AP, 288

ATM, 296, 324

backbone networks, 287

backhaul networks, 287

branch networks, 281

cable Internet connectivity, 305–306

cable modems, 288

campus networks, 280

circuit-switched network communications, 290

circuit-switched WAN connectivity, 295

CO, 286

connectivity, 292–301

core devices, 288

CPE, 286

CSU, 288

DCE, 286–288

dedicated broadband WAN connectivity, 297–298

demarcation points, 286

devices, 287–289

distributed networks, 282

DSL Internet connectivity, 302–304

DSL modems, 288

DSU, 288

DTE, 286–288

DWDM multiplexing, 292

E-carriers, 294

Frame Relay networks, 295–296

Internet-based broadband WAN connectivity, 298, 301–311, 314–315

ISDN, 295

ISP Internet connectivity, 309–310

LAN comparisons, 272–273

leased-line WAN connectivity, 293–294

local loops (last mile), 286

LTE, 307

Metro Ethernet WAN connectivity, 298–300, 332

modern WAN connectivity, 296–301, 314

MPLS, 298, 300–301, 324, 332

operation of, 283–292, 312–313

optical converters, 288

OSI model, 284–285

packet-switched network communications, 290–291, 295–296

packet-switched WAN connectivity, 298

parallel network communications, 289

POP, 286

private WAN, 273

PSTN, 295

public WAN, 273

purpose of, 272–282, 312

SDH cabling standard, 291–292

serial network communications, 289

small networks, 279–280

SONET cabling standard, 291–292

standards, 283

T-carriers, 294

teleworking, 283, 302, 308, 312, 314

terminology, 285–287

toll networks, 286

topologies, 274–277

traditional WAN connectivity, 292–296, 312–313

voiceband modems, 288

wired Internet connectivity, 301–302

wireless Internet connectivity, 302

wireless Internet-based broadband connectivity, 306–307

wireless routers, 288

next available port (PAT), 235–236

Nexus 9000 series switches, 602

NFS (Network File System), 544

NMS (Network Management System)

SNMP, 405, 444

agent traps, 408–409

community strings, 412–415

MIB OID, 415

Object Navigator, 417–418

operation of, 406–407

snmpget utility, 417

tools, 524

NOC (Network Operations Center), 457

noise, troubleshooting, 534

nonrepudiation of data, 144

NTP (Network Time Protocol), 400, 443–444

authoritative time sources, 401–402, 443–444

calendar services, 400

client topologies, 402–403

configuring, 402–405

operation of, 401–402

server topologies, 402–403

strata, 401–402

stratum, 401–405, 443–444

time services, 400

verifying, 403–405

numbered ACL (Access Control Lists), 176

numbered extended IPv4 ACL, 204–206, 209–210

numbered standard IPv4 ACL, 188–189, 191–193, 195

NVRAM, file systems, 425–426

O

Object Navigator (SNMP), 417–418

OC (Optical Carriers), 294

OID (Object ID), MIB OID, 415

open (public) API, 631–632

open resolver attacks (DNS), 131

OpenFlow, 598

OpenStack, 598

optical converters, 288

optical fiber Internet connectivity, 305–306

optical nodes, 305

Optical Time-Domain Reflectometers (OTDR), 527

order of precedence, router ID, 36–37

origin authentication, 144

HMAC, 147–149

IPsec, 333, 335

OS (Operating Systems), hacking, 104

OSI model

common devices, 517–518

WAN, 284–285

OSPF (Open Shortest Path First), 17

adjacencies, 23–24

algorithms, 5

BDR

adjacencies, 51, 54–56

election process, 20, 23–24, 56–59

multiaccess OSPF networks, 49–51, 53, 56–59

router priorities, 61–63

components of, 4–5

data structures, 4–5

databases, 5, 20–22

Down state, 17, 18–19

DR

adjacencies, 51, 54–56

election process, 56–59

failures/recovery, 58–59

multiaccess OSPF networks, 49–51, 53–54, 56–59

router priorities, 61–63

DR election, 20, 23–24

Exchange state, 18

ExStart state, 18

Full state, 18

hierarchical networks, 476–477

Init state, 17–19

introduction to, 3

link-state operation, 6

establishing neighbor adjacencies, 6

LSA, 6–7

LSDB, 7

route selection, 8–9

SPF algorithms, 8–9

SPF trees, 8–9

Loading state, 18

LSA

BDR, 24–26

DR, 24–26

flooding, 23–24

multiaccess OSPF networks, 49

adjacencies, 54–56

designated routers, 49–51

reference topologies, 51–52, 57

router election process, 56–59

router priorities, 61–63

verifying router roles, 52–54

multi-area OSPF, 9–11

neighbor adjacencies, 6, 18–20

network types, 84–85

operational states, 17–18

OSPFv2, 12

OSPFv3, 12–13

OSPFv4, 12

overview of, 3

packets, 4, 13–14, 17

hello packets, 15–17

LSU packets, 14

point-to-point OSPF networks, 40, 83–84

area ID, 40

configuring, 49

configuring with ipospf command, 43–44

configuring with network command, 41–43

ipospf command, 43–44

loopback interfaces, 48

network command, 40, 41–43

passive interfaces, 44–46

verifying network type, 46–48

wildcard masks, 40–43

routers

configuration mode, 35

convergence, 6, 17–26

designated routers, 49–51

ID, 34–40, 83

routing protocol messages, 4

single-area OSPF, 9, 10, 34, 38

cost metrics, 63–67

dead intervals, 70–73

default route propagation, 73–77, 86

hello packet intervals, 69–73

modifying, 85–86

point-to-point OSPF networks, 40–49

reference bandwidth adjustments, 64–66

reference topologies, 34–35

router ID, 34–40

static routes, 73–77

test failover to backup routes, 69

verifying, 77–82, 86–87

Two-Way state, 18, 19–20

OTDR (Optical Time-Domain Reflectometers), 527

outbound ACL filters, 167

output errors, troubleshooting, 551

output queue drops, 550

outside global NAT addresses, 231

outside local NAT addresses, 231

outside NAT addresses, 229, 231

P

packetization delays, 355

packets

crafting tools, 103

DBD packets, 13–14, 21–22

filtering, 164–166

hello packets, 13–14, 15–17

ingress packets, 372

IPv4 packet headers, 374–375

IPv6 packet headers, 374–375

loss, 355–357, 371

LSAck packets, 13–14

LSR packets, 13–14, 22

LSU packets, 13–14

OSPF packets, 4, 13–17

queuing. See delay

sniffers, 103

packet-switched network communications, 290–291

ATM, 296, 324

Frame Relay networks, 295–296

packet-switched WAN connectivity, 298

parallel network communications, 289

partially meshed WAN topology, 277

partner API, 632

passive interfaces, point-to-point OSPF networks, 44–46

passwords

attacks, 105, 111

changing, 435

configuration register, 433–435, 437

password crackers, 103

plaintext passwords, 415

recovery, 433–436, 437

ROMMON mode, 433–434

PAT (Port Address Translation), 233–234, 251, 260–261

analyzing, 254–255

configuring

address pools, 253

single IP addresses, 252

NAT comparisons, 236–237

next available port, 233–234

source port assignments, 235

verifying, 256–257

paths (network), verifying, 562–566

penetration testing tools, 102–104

performance, troubleshooting, 532, 535

phishing attacks, 114. See also spear phishing attacks

physical layer (networks)

troubleshooting, 531–534

verifying, 549–551

physical network topologies, 503

pinging, 532, 534

gathering information (troubleshooting process), 517

IPv4, 547–548

IPv6, 548–549

TFTP servers, 438, 440

PKI (Public Key Infrastructure), 327, 344

plaintext passwords, 415

playout delay buffers, 355–356

PoE (Power over Ethernet), switches, 484–486

point-to-point OSPF networks, 40, 83–84

area ID, 40

configuring, 49

ipospf command, 43–44

network command, 41–43

ipospf command, configuring OSPF, 43–44

loopback interfaces, 48

network command

configuring OSPF, 41–43

syntax, 40

passive interfaces, 44–46

verifying network type, 46–48

wildcard masks, 40–43

point-to-point WAN topology, 274–275

policing traffic, QoS, 380–381

policy-based SDN, 605

polling scenarios, SNMP, 415–417

POP (Point of Presence), 286, 312, 544

portable network analyzers, 528

ports

density, switches, 482, 486

destination ports, troubleshooting, 541

next available port (PAT), 235–236

redirection attacks, 112

source ports

assigning, 235

troubleshooting, 541

speeds, switches, 487

USB ports on routers, 430

VTY port security, standard IPv4 ACL, 200–203, 220

wire speeds, 483

Postman, 638

power supplies, troubleshooting, 533

PPP (Point-to-Point Protocol), DSL Internet connectivity, 303–304

precedence (router ID), order of, 36–37

prefixes, 12

pretexting attacks, 114

PRI (Priority) fields, 373

Prime NAM (Network Analysis Module), 528

prioritizing network traffic, 353–354

private (internal) API, 632

private clouds, 584

private IPv4 addresses, 226–227

private WAN (Wide-Area Networks), 273

probable cause (troubleshooting process), eliminating, 514

problems (troubleshooting process)

defining, 514

solving, 515

program viruses, 107

propagating

delays, 355

static routes

default route propagation, 73–77, 86

single-area OSPF, 73–77

proposing hypotheses (troubleshooting process), 514

protocols

analyzers, 525

encapsulation (IPsec), 336

prototyping, virtualization, 589

proxy Trojan horses, 107

PSK (Pre-Shared Keys), 339–340

PSTN (Public Service Telephone Networks), 295

public clouds, 584

public key algorithms, 152–156

public (open) API, 631–632

public WAN (Wide-Area Networks), 273

Puppet, 643

PVC (Permanent Virtual Circuits), 295–296

Python, 638

Q

QoS (Quality of Service)

classification/marking tools, 371–372

congestion

avoidance tools, 371, 379–380

management tools, 371, 379–380

DSP, 357

egress packets, 372

implementation techniques, 384–385

ingress packets, 372

IPP, 373, 375, 377–378

models, 383–384

network traffic

data traffic, 357, 360–361

video traffic, 357–360

voice traffic, 357, 358

network transmissions, 353, 382

congestion, 353–354

delays, 353, 355

packet loss, 355–357

prioritizing traffic, 353–354

packet loss, avoiding, 371

playout delay buffers, 355–356

policy guidelines, 381

policy models

best-effort QoS policy model, 366–367

DiffServ, 366, 369–370

IntServ, 366–368

selecting, 366

queueing algorithms, 361, 383

CBWFQ, 364

FIFO, 362

LLQ, 365

WFQ, 362–364

RSVP, 368, 370

tool usage, sequence of, 372

ToS values, 363, 374–375, 377, 383

traffic

characteristics, 382–383

classification, 362–363, 368

marking, 372–379, 382–383

policing, 380–381

shaping, 380–381

WRED, 371

questioning end users (troubleshooting process), 515–516

queue drops

input queue drops, 550

output queue drops, 550

queueing algorithms (QoS), 383

CBWFQ, 364

FIFO, 362

LLQ, 365

overview of, 361

WFQ, 362–364

queuing delays, 355

queuing packets. See delay

quid pro quo (something for something) attacks, 114

R

rack units (RU), 481, 494

ransomware, 108

RC (Rivest Cipher) series algorithms, 152

reconnaissance attacks, 109–110

recovery, passwords, 433–437

redundancy

network design, 469

scalable networks, 469

redundant links, scalable networks, 466–467

reference bandwidths, single-area OSPF, 64–66

reference topologies

end-to-end IP connectivity, troubleshooting, 545–547

multiaccess OSPF networks, 51–52, 57

single-area OSPF, 34–35, 38, 74

reflection attacks, 118–120

rejoins, routers, multiaccess OSPF networks, 58–59

reliability, switches, 486

remote access Trojan horses, 107

remote access VPN (Virtual Private Networks), 283, 308, 312, 314–315, 324–326

removable media, data loss, 98

reset attacks (TCP), 125–126

resiliency, borderless switched networks, 459

REST (Representational State Transfer), 632–639, 651–652

RESTful API, 633–639

restoring configurations

router configurations, 432

from text files, 428–430

rid values, 37

risk (security), defined, 96

rogue DHCP servers, 121, 134–136

ROMMON mode, 433–434

rootkit detectors, 103

rootkits, 108

routers, 494–495

800 series routers, 492

900 series routers, 490

5500 series routers, 491

ASBR, 74

ASR 1000 series routers, 490–491

ASR 9000 series routers, 488–491

BDR, 17

election in OSPF, 20, 23–24

LSA, 24–26

multiaccess OSPF networks, 49–51, 53, 56–59

branch routers, 488

configurations

copying, 431

restoring, 432

saving, 435

verifying, 432

convergence, 6, 17–26

DBD packets, 21–22

device documentation, 505–506

Dijkstra’s algorithm, 5

DR, 16

election in OSPF, 20, 23–24

failures/recovery, 58–59

LSA, 24–26

multiaccess OSPF networks, 49–51, 53–54, 56–59

router ID, 36

DROTHER, 50–53

edge routers, 74, 470–471, 488–489

failover tests to backup routes, single-area OSPF, 69

file systems, 423–424, 445–446

Flash file systems, 425

NVRAM file systems, 425–426

fixed configuration routers, 492

form factors, 490–492

hub routers, 275–276

ID, 16, 34, 40, 83

assigning, 40

choosing, 36–37

configuration mode, 35

configuring, 38–39

DR election, 36

loopback interfaces, 37–38

modifying, 39–40

order of precedence, 36–37

reference topologies, 34–35

rid values, 37

synchronization of OSPF databases, 36

verifying, 38–39

industrial routers, 490, 492

ISR 4000 series routers, 488

list of neighbors, 17

LSR, 300–301

LSR packets, 22

modular routers, 492

MPLS routers, 300–301

NAT routers, private/public IPv4 address translations, 227

NCS 6000 series routers, 489

network edge routers, 488–489

OSPF

database synchronization, 20–21

designated routers, 49–51

priorities, 16, 61–63

requirements, 487–488

service provider routers, 489

software clock, setting manually, 400

SPF algorithms, 10–11

spoke routers, 275–276

USB ports, 430

wireless routers, 288

routing

GRE

GRE over IPsec, 328–329

mGRE, 330–331

OSPF

default route propagation, 73–77, 86

link-state operation, route selection, 8–9

protocols

failover tests to backup routes, single-area OSPF, 69

link-state routing protocols. See OSPF

messages, 4

scalable routing protocol, 467–468

show ip route command, 517

show ipv6 route command, 517

tables, troubleshooting, 539

tuning protocols, scalable networks, 476–477

VRF, 595

RPC (Remote Procedure Calls)

JSON-RPC, 632

XML-RPC, 632

RSA (Rivest, Shamir, Adleman)

authentication, 340–342

encryption algorithms, 154

RSVP (Resource Reservation Protocol), 368, 370

RU (Rack Units), 481, 494

Ruby, 643

S

SA (Security Associations), 334–335

SaaS (Software as a Service), 584

SaltStack, 643

satellite Internet connectivity, 307

saving router configurations, 435

scalability

switches, 487

VPN, 323

scalable networks, 493–494

designing, 465–466, 477

access layer, 475

bandwidth, 474–475

failure domains, 469–474

multiple links, 466–467

redundancy plans, 469

redundant links, 466–467

scalable routing protocol, 467–468

tuning routing protocols, 476–477

wireless connectivity, 468

hierarchical networks, 455–458

scalable routing protocol, 467–468

scanning tools, 103–104

script kiddies, 100

script viruses, 107

SD-Access, 647

SDH cabling standard, 291–292

SDN (Software-Defined Networking), 595, 598, 600, 610–611

ACI, 598, 602

ANP, 602

APIC, 602–603

APIC-EM, 606–608

Nexus 9000 series switches, 602

spine-leaf topologies, 603

CEF, 596

central controller, 597

control plane, 595

controller-based SDN, 605, 611–612

controllers, 600–602

data plane, 596

device-based SDN, 604–605

framework, 599

Layer 3 switches, 596

management plane, 598

OpenFlow, 598

OpenStack, 598

policy-based SDN, 605

traditional architectures and, 599

SD-WAN, 648

SEAL (Software-Optimized Encryption Algorithm), 152, 338

security. See also VPN

AnyConnect Secure Mobility Client, 321

ASA, 140, 321

attack tools, 101–102

attack types, 104–105

authentication, 339–340

HMAC, 338–339

MD5, 339

PSK, 339, 340

RSA, 340–342

SHA, 339

cryptography, 143, 156, 159

data confidentiality, 144, 150

data integrity, 144–145

data nonrepudiation, 144

encryption, 151–156

hash functions, 144–147

origin authentication, 144, 147–149

data confidentiality, 144, 150

data integrity, 144–145

data nonrepudiation, 144

encryption

3DES, 152, 338

AES, 152, 338

asymmetric encryption, 152–156

DES, 152, 338

DH, 154–156

DSA, 154

DSS, 154

ElGamal, 154

elliptic curve cryptography, 154

public key algorithms, 152–156

RC series algorithms, 152

RSA, 154

SEAL, 152, 338

symmetric encryption, 151–152

ESA, 142

firewalls, 139–140, 210, 220

GRE over IPsec, 328–329

hash functions, 144

MD5, 145

SHA, 146–147

HMAC, 338–339

IDS, 140–141

IKE, 335

IPS, 140–141

IPsec, 333, 344–345. See also VPN

AH, 336

authentication, 339–342

confidentiality, 333–334, 336–338

data integrity, 333–335, 338–339

Diffie-Hellman key exchanges, 333–335, 342–343

ESP, 336

framework of, 334–335

GRE over IPsec, 328–329

protocol encapsulation, 336

SA, 334–335

SSL comparisons, 326–327

transport and tunnel mode, 343

VTI, 331–332

keys, compromised-key attacks, 105

malware, 106, 108–109, 157

adware, 108

overview of, 106

ransomware, 108

rootkits, 108

spyware, 108

Trojan horses, 106–107

viruses, 106–107

worms, 106, 108

MD5, 339

networks, 95, 109, 117, 158

access attacks, 110–113

address spoofing attacks, 118, 120–121

amplification attacks, 118–120

ARP vulnerabilities/attacks, 127–130

ASA, 140

assets, 96

availability, 138

baiting attacks, 114

best practices, 137–143, 159

blacklisting URL, 142

breaches, 95

buffer overflow attacks, 112–113

confidentiality, 138

content security appliances, 141–143

cybercriminals, 95

cybersecurity, current state of, 95–98

DDoS attacks, 116–117

defense-in-depth approach, 138–139

DHCP attacks, 134–136

DNS attacks, 131–133

DoS attacks, 115–116

dumpster diving attacks, 114

ethical hacking, 95

exploits, 96

firewalls, 139–140

ICMP attacks, 117–119

IDS, 140–141

impersonation attacks, 114

integrity, 138

IP attacks, 117–122

IP service attacks, 127–136

IPS, 140–141

layered approach, 138–139

mitigation, 96

MITM attacks, 112–113, 118

password attacks, 111

phishing attacks, 114. See also spear phishing attacks

port redirection attacks, 112

pretexting attacks, 114

reconnaissance attacks, 109–110

reflection attacks, 118–120

risk, 96

session hijacking attacks, 118

shoulder surfing attacks, 114

social engineering attacks, 114–115

something for something (quid pro quo) attacks, 114

spam attacks, 114

spear phishing attacks, 114. See also phishing attacks

spoofing attacks, 111

tailgaiting attacks, 114

TCP vulnerabilities/attacks, 122–126, 158

threats, 96

trust exploitation attacks, 111

UDP vulnerabilities/attacks, 122, 126–127, 158

URL filtering, 142

vectors of data loss, 97–98

vectors of network attacks, 96–97

vulnerabilities, 96

zombies, 116

origin authentication, 144, 147–149

passwords

changing, 435

configuration register, 433–437

recovery, 433–437

ROMMON mode, 433–434

SA, 334–335

SHA, 339

software disablers, 107

SSL

IPsec comparisons, 326–327

SSL VPN, 326

stateful firewall services, 210, 220

Syslog security levels, 421

threat actors, 98, 157

attack tools, 102–104

cybercriminals, 100

hackers, 98, 100

hacktivists, 100

script kiddies, 100

vulnerability brokers, 100

TLS, VPN, 326

tools

debuggers, 104

encryption tools, 104

evolution of, 102–104

forensic tools, 103

fuzzers, 103

hacking OS, 104

hacking tools, 103

packet crafting tools, 103

packet sniffers, 103

password crackers, 103

penetration testing tools, 102–104

rootkit detectors, 103

scanning tools, 103

SET, 115

vulnerability exploitation tools, 104

vulnerability scanners, 104

wireless hacking tools, 103

VTY ports, standard IPv4 ACL, 200–203, 220

vulnerabilities

defined, 96

exploitation tools, 104

fuzzers, 103

scanners, 104

vulnerability brokers, 100

WSA, 142–143

sequence numbers method, modifying ACL, 197–198

serial network communications, 289

serialization delays, 355

servers

DHCP servers, rogue DHCP servers, 121, 134–136, 158

sprawl, 587, 609

Syslog server

messages, 419

as troubleshooting tool, 529–531

TFTP servers

backing up configurations from, 428–430, 436

IOS image backups, 437–442

pinging, 438, 440

virtualization, 589

dedicated servers, 586–587

examples of, 587–588

service providers. See ISP

services

cloud services, 584

IaaS, 584

PaaS, 584

SaaS, 584

stateful firewall services, 210, 220

session hijacking attacks, 118, 126

SET (Social Engineering Toolkits), 115

set operations (SNMP), 406–407

seven-step troubleshooting process, 513–515

severity levels (Syslog), 444–445, 530

SFP (Small Form-Factor Pluggable) devices, 482

SHA (Secure Hash Algorithm), 146–147, 339

shaping traffic, QoS, 380–381

shoulder surfing attacks, 114

show interfaces command, 549–550

show ip interface brief command, 517

show ip route command, 517

show ipv6 interface brief command, 517

show ipv6 route command, 517

single point of failure, 275, 278

single-area OSPF, 9, 10, 34

cost metrics, 63–64

accumulating costs, 66–67

manually setting cost value, 67–69

reference bandwidths, 65

dead intervals, 70–73

default route propagation, 73–77, 86

hello packet intervals, 69–73

modifying, 85–86

point-to-point OSPF networks, 40

area ID, 40

configuring, 49

configuring with ipospf command, 43–44

configuring with network command, 41–43

ipospf command, 43–44

loopback interfaces, 48

network command, 40–43

passive interfaces, 44–46

verifying network type, 46–48

wildcard masks, 40–43

reference bandwidth adjustments, 64–66

reference topologies, 34–35, 38

router ID, 34, 40

assigning, 40

choosing, 36–37

configuration mode, 35

configuring, 38–39

DR election, 36

loopback interfaces, 37–38

modifying, 39–40

order of precedence, 36–37

reference topologies, 34–35, 38

synchronization of OSPF databases, 36

verifying, 38–39

routers, test failover to backup routes, 69

verifying, 86–87

interface settings, 81–82

neighbors, 77–79

process information, 80–81

protocol settings, 79–80

single-carrier WAN connections, 278

single-homed ISP connectivity, 309

site-to-site VPN (Virtual-Private Networks), 283, 308, 312, 314–315, 323–324, 327–328

SLA (Service Level Agreements), 278

small networks, 279–280

smart devices, 620

SMTP (Simple Mail Transfer Protocol), 544

sniffer attacks, 105

SNMP (Simple Network Management Protocol), 405, 444, 544, 640–641

agent traps, 408–409

agents, 406–409

community strings, 412–415

get operations, 406–407

messages, exchanging, 409

MIB OID, 415

NMS, 405

nodes, 405–406

Object Navigator, 417–418

operation of, 406–407

polling scenario, 415–417

set operations, 406–407

SNMP manager, 405–406, 407

snmpget utility, 417

traps, 530

troubleshooting, 543

versions of, 409–412

SOAP (Simple Object Access Protocol), 632

social engineering attacks, 114–115

social networking, data loss, 98

software

clock

displaying clock source, 403

setting manually, 400

security software disablers, 107

troubleshooting tools, 524

baselining tools, 524

knowledge bases, 524

NMS tools, 524

protocol analyzers, 525

SOHO (Small Office, Home Office), VPN, 321

solving problems (troubleshooting process), 515

something for something (quid pro quo) attacks, 114

SONET cabling standard, 291–292

source ports

assigning, 235

troubleshooting, 541

spam attacks, 114

spear phishing attacks, 114. See also phishing attacks

SPF (Shortest-Path First) algorithm, 5, 8–9, 10–11

spine-leaf topologies, 603

spoke routers, 275–276

spoke-to-spoke tunnels, 331

spoofing attacks, 105, 111

address spoofing attacks, 118, 120–121

ARP, 130

CAM tables, 121

DHCP, 134–136

MAC addresses, 120–121

sprawl (servers), 587, 609

spyware, 108

SSH (Secure Shell), 544

ssh -1 command, 517

SSL (Secure Socket Layer)

IPsec comparisons, 326–327

VPN, 326–327

stackable configuration switches, 481

standard ACL (Access Control Lists), 166, 175, 175–176, 179, 190, 200–203, 219–220

stateful firewall services, 210, 220

state-sponsored hackers, 100

static NAT (Network Address Translation), 231–232, 239–240, 260–261

analyzing, 241–242

configuring, 240–241

topology, 240

verifying, 242–244

stealth attacks (DNS), 132

storage devices (cloud), data loss, 98

STP failures/loops, troubleshooting, 537

stratum (NTP), 401–405, 443–444

structured troubleshooting methods, 518

bottom-up troubleshooting method, 518–519

comparison troubleshooting method, 522

divide-and-conquer troubleshooting method, 520–521

educated guess troubleshooting method, 522

follow-the-path troubleshooting method, 521–522

selecting, 523

substitution troubleshooting method, 522

top-down troubleshooting method, 519–520