How does Virtual Private Network service work in banking?
Whenever you use the internet through an Internet Service Provider (ISP) or at another site, your computer is given an address on that provider's network. While you can reach your bank from the Internet, you will normally be denied access to services that are restricted to bank network addresses because your computer is using an address from an external network.
But, if you are on the internet, you can still connect to the Bank’s VPN service, in two ways. From a web browser or with a software VPN client. A VPN need not have explicit security features, such as authentication or content encryption. Virtual Private Network setup, can be used to separate traffic of different user communities over an underlying network with strong security features.
Seek secured private connectivity across public IP networks!
Extends geographical connectivity
Improves productivity
Improves security
Reduce transit time and transportation costs for remote users
Reduce operational costs versus traditional WAN
Simplify network topology
Provides global networking opportunities
Provides broadband networking compatibility
Provides faster ROI than traditional WAN
Provides telecommuter support
VPN are categorised into two types:
• Remote access VPN
• Site to site VPN
What is site to site Virtual Private Network in banking?
Such Site to site VPN allows you to have a secured connection between locations across the open internet. With the help if site to site VPN your bank can save a great deal of money, as you can use cheaper means always – on connections such as domestic broadband rather than expensive leased lines between sites.
What about Remote access VPN?
Remote access VPN also known as Virtual Private Dial up(VPDN) is used by banks who have staff regularly working in locations outside the office. You can connect into the office network over dial up phone/isdn lines or over broadband from anywhere.
Virtual Private Network banking uses advanced encryption and tunneling to permit computers to establish secure, end-to-end, private network connections over insecure networks, such as the Internet or wireless networks. VPN services can impact your overall computing and network performance. VPNs exist to protect traffic on public data networks like the Internet. VPN Services will work with other ISP dialup services too. Try your online route for your VPN.
Showing posts with label network. Show all posts
Showing posts with label network. Show all posts
Saturday, January 3, 2009
Tuesday, December 30, 2008
A Comparison Of Dish Network And Cable Television
It's a very competitive business world out there, and the situation is not different in the home entertainment sector.
At the moment cable television operators are fighting the battle of their lives with their satellite counterparts. What is at stake is a big crown and whoever comes out on top will go home with the hearts and wallets of millions of subscribers.
But midway into this war of attrition, all discerning observers knew where the pendulum will swing in the end. And you the reader will also realize this because by the time you are through with this you will be wondering why anyone still maintains subscription with a cable television company.
Dish Network is unarguably the biggest satellite TV operator in the U.S, and with its quality service and cutting edge technology, there is no way any cable television firm can compete with it for business, and that is a fact.
In terms of value, Dish Network offers far more programming channels and with a low entry price of $20, compared to the $70 charged by cable companies and with far fewer channels to boot. Are you getting the drift now?
In reality Dish Network offers hundreds of channels, but the best cable companies can muster is just about a hundred, and for a fact can never provide more than 150. Want to know the implication of this? When you are provided with fewer program channels then your options will be very limited.
With Dish Network you can get additional channels like ESPN Gameday, NHL on the Ice, and NBA League Pass. These are packages no cable operator can provide.
But what really nailed the coffin of cable satellite television is its limited availability. Anyone that desires cable TV service must be resident in or near a mid sized town. On the contrary Dish Network signals can be received anywhere as long as the satellite dish is aimed at the southern sky.
The rather high cost of cable television subscription can be traced to the amount of data that can be sent over a medium, which is technically known as the bandwidth.
By nature, the amount of data cables can carry is very limited, but the companies are trying to get over this problem by resorting to the use of higher capacity cables, which unfortunately still fall short of the requirements.
Dish Network however transmits its signals using electromagnetic waves which are not constrained by bandwidth problems. This is the reason why operator keeps up with subscribers demand and provides better service than their cable rivals.
At the moment cable television operators are fighting the battle of their lives with their satellite counterparts. What is at stake is a big crown and whoever comes out on top will go home with the hearts and wallets of millions of subscribers.
But midway into this war of attrition, all discerning observers knew where the pendulum will swing in the end. And you the reader will also realize this because by the time you are through with this you will be wondering why anyone still maintains subscription with a cable television company.
Dish Network is unarguably the biggest satellite TV operator in the U.S, and with its quality service and cutting edge technology, there is no way any cable television firm can compete with it for business, and that is a fact.
In terms of value, Dish Network offers far more programming channels and with a low entry price of $20, compared to the $70 charged by cable companies and with far fewer channels to boot. Are you getting the drift now?
In reality Dish Network offers hundreds of channels, but the best cable companies can muster is just about a hundred, and for a fact can never provide more than 150. Want to know the implication of this? When you are provided with fewer program channels then your options will be very limited.
With Dish Network you can get additional channels like ESPN Gameday, NHL on the Ice, and NBA League Pass. These are packages no cable operator can provide.
But what really nailed the coffin of cable satellite television is its limited availability. Anyone that desires cable TV service must be resident in or near a mid sized town. On the contrary Dish Network signals can be received anywhere as long as the satellite dish is aimed at the southern sky.
The rather high cost of cable television subscription can be traced to the amount of data that can be sent over a medium, which is technically known as the bandwidth.
By nature, the amount of data cables can carry is very limited, but the companies are trying to get over this problem by resorting to the use of higher capacity cables, which unfortunately still fall short of the requirements.
Dish Network however transmits its signals using electromagnetic waves which are not constrained by bandwidth problems. This is the reason why operator keeps up with subscribers demand and provides better service than their cable rivals.
Sunday, December 28, 2008
Router - Transmitting Packets
In a previous article we discussed the basics of what a router did. We're now going to get into a more detailed, and yes technical, explanation of how packets are transmitted as well as a few other tech specs of how routers work. So put on your learning caps because you're in for a real mind bender.
Internet data, whether it be in the form of a web page, a downloaded file or an email message, travels over what is called a packet switching network. Basically what happens is that the data is broken up into individual packets because there is only so much data that can be transmitted at one time. Each packet is about 1500 bytes long. Each packet contains quite a bit of information including the sender's address, the receiver's address and of course the information being sent which includes the order of each packet how it should be put back together so that the end user can make sense of the data. The packet is sent off to its destination based on what the router believes to be the best route to follow, which is usually the route with the least amount of traffic and if possible, the shortest route. Each packet may actually given a different route depending on conditions at the time, which in a high traffic network can change every second. By doing this, the router can balance the load across the network so that no one segment gets overloaded. Also, if there is a problem with one piece of equipment in the network, the router can bypass this piece of equipment and send the packet along another route. This way if there is a problem, the entire message will still arrive intact.
In conducting this process, routers have to speak to each other. They tell each other about any problems on the network and make recommendations on routes to take. This way, paths can be reconfigured if they have to be. However, not all routers do all jobs as routers come in different sizes and have different functions.
There are what we call simple routers. A simple router is usually used in a simple small network. Simple routers simply look to see where the data packet needs to go and sends it there. It doesn't do much else.
Slightly larger routers, which are used for slightly larger networks, do a little bit more. These routers will also enforce security for the network, protecting the network from outside attacks. They are able to do a good enough job of this that additional security software is not needed.
The largest routers are used to handle data at major points on the Internet. These routers handle millions of packets of information per second. They work very hard to configure the network as efficiently as possible. These are stand alone systems and actually have more in common with supercomputers than with a simple server one might have in a small office.
In our next instalment we'll look at how to actually trace the path that a message has taken and some examples of transmitting packets.
Internet data, whether it be in the form of a web page, a downloaded file or an email message, travels over what is called a packet switching network. Basically what happens is that the data is broken up into individual packets because there is only so much data that can be transmitted at one time. Each packet is about 1500 bytes long. Each packet contains quite a bit of information including the sender's address, the receiver's address and of course the information being sent which includes the order of each packet how it should be put back together so that the end user can make sense of the data. The packet is sent off to its destination based on what the router believes to be the best route to follow, which is usually the route with the least amount of traffic and if possible, the shortest route. Each packet may actually given a different route depending on conditions at the time, which in a high traffic network can change every second. By doing this, the router can balance the load across the network so that no one segment gets overloaded. Also, if there is a problem with one piece of equipment in the network, the router can bypass this piece of equipment and send the packet along another route. This way if there is a problem, the entire message will still arrive intact.
In conducting this process, routers have to speak to each other. They tell each other about any problems on the network and make recommendations on routes to take. This way, paths can be reconfigured if they have to be. However, not all routers do all jobs as routers come in different sizes and have different functions.
There are what we call simple routers. A simple router is usually used in a simple small network. Simple routers simply look to see where the data packet needs to go and sends it there. It doesn't do much else.
Slightly larger routers, which are used for slightly larger networks, do a little bit more. These routers will also enforce security for the network, protecting the network from outside attacks. They are able to do a good enough job of this that additional security software is not needed.
The largest routers are used to handle data at major points on the Internet. These routers handle millions of packets of information per second. They work very hard to configure the network as efficiently as possible. These are stand alone systems and actually have more in common with supercomputers than with a simple server one might have in a small office.
In our next instalment we'll look at how to actually trace the path that a message has taken and some examples of transmitting packets.
Router - Tracing Your Packets
Few people will really care about the path that your packet takes when sending a message, but if you're one of those high tech egg heads then this article may be of great interest to you. It can become very addictive so proceed with caution.
If you're using a Microsoft Windows based operation system, then it's very easy to trace the route that your message has taken. Not only that, you can see exactly how many routers it took to get your message from point A to point B. You can do this by using a program that is on your computer called Traceroute. That is exactly what the program does. It traces the route a message takes to get to its final destination.
To run the program you have to go to a DOS prompt. After doing this, go to the C:\windows directory and type tracert followed by the URL of the Internet site you're connected to at the time. It will give you a rather technical spec sheet of every IP address it stopped at along the way until it got to its final destination.
The first number on the spec sheet tells you how many routers it went through to get to its final destination. Then each individual router listed on the page is numbered from 1 down to the last one which is actually the final destination. The next 3 numbers on each line for each router shows how long the packet took to get to that router. The next piece of information on each line is the actual name of the router the information went through. Yes, routers have names. This may be important to the users but is totally irrelevant to the router itself. Finally, the last piece of info on each line is the actual IP address of the router itself.
The amount of time it takes information to get from one router to another varies depending on how much traffic there is on that route at the time. Normally, it is no more than a couple of seconds. But occasionally, it can be longer. That is why sometimes you will be trying to access a web site and it seems to take forever. This can be for a number of reasons, but usually it is because along the way one of the routers is not working correctly and has to be bypassed. Sometimes the actual final location itself is down or having problems and the delay is the last router in the chain trying to connect to the network.
Traceroute is not limited to just checking the number of routers between you and an Internet site. You can use it to check the number of routers between you and any other computer on a network. As long as you know the IP address of the other computer you can trace the route of the packets between you and the other computer.
In our next instalment we're going to look at how routers handle denial of service attacks and other problems.
If you're using a Microsoft Windows based operation system, then it's very easy to trace the route that your message has taken. Not only that, you can see exactly how many routers it took to get your message from point A to point B. You can do this by using a program that is on your computer called Traceroute. That is exactly what the program does. It traces the route a message takes to get to its final destination.
To run the program you have to go to a DOS prompt. After doing this, go to the C:\windows directory and type tracert followed by the URL of the Internet site you're connected to at the time. It will give you a rather technical spec sheet of every IP address it stopped at along the way until it got to its final destination.
The first number on the spec sheet tells you how many routers it went through to get to its final destination. Then each individual router listed on the page is numbered from 1 down to the last one which is actually the final destination. The next 3 numbers on each line for each router shows how long the packet took to get to that router. The next piece of information on each line is the actual name of the router the information went through. Yes, routers have names. This may be important to the users but is totally irrelevant to the router itself. Finally, the last piece of info on each line is the actual IP address of the router itself.
The amount of time it takes information to get from one router to another varies depending on how much traffic there is on that route at the time. Normally, it is no more than a couple of seconds. But occasionally, it can be longer. That is why sometimes you will be trying to access a web site and it seems to take forever. This can be for a number of reasons, but usually it is because along the way one of the routers is not working correctly and has to be bypassed. Sometimes the actual final location itself is down or having problems and the delay is the last router in the chain trying to connect to the network.
Traceroute is not limited to just checking the number of routers between you and an Internet site. You can use it to check the number of routers between you and any other computer on a network. As long as you know the IP address of the other computer you can trace the route of the packets between you and the other computer.
In our next instalment we're going to look at how routers handle denial of service attacks and other problems.
Protect Your Network From Identity Theft Now!
It is deniable that our works and lives are more convenient and easier when using wireless. We can work anywhere and that is why wireless networks are becoming so popular. Especially if you have broadband Internet access, a wireless router can give you instant communication with the world.
Imagine you are sitting by the pool and enjoying chatting through the Internet. Or lounging in the Jacuzzi listening to your MP3 collection is appealing to us all. Unfortunately, many, or even most, wireless units don't come with security features already functioning. This may not seem like a big issue to someone who is simply setting up a home network, but there are a number of potential problems you should consider.
Identity theft seems to be the most serious problem. If your network is unsecured, the personal data on your wireless electronic equipment is also unsecured. The order you just placed for a book at Amazon may have given your contact and payment information to an unscrupulous hacker! Nearly every town in which "WiFi" is common will have "War Drivers" and "War Chalkers" at work. These are people who walk or drive around town with wireless equipment, searching for unsecured networks. The "Chalkers" then live up their name, marking curbs and other public items with chalk so that others can more easily find and exploit your network.
In fact, not all "War Drivers" are hackers, of course. Many just want to use your network for free, but the risk is high if you don't learn how to protect yourself. You can usually find quite a bit of free information as to how to secure your network at the website of your router's manufacturer, or by doing a search in a search engine for a phrase like "secure home wireless."
In addition, there are also your neighbors who may find your network by accident and enjoy nosing into your activities and using your Internet access at will, slowing down your network speed in the process.
Even many businesses use cheap, home-use quality equipment for their company networks. With the poor security often found on small business networks, anyone with a basic knowledge of wireless can access sensitive company and customer data.
It is highly recommended that you hire service companies to secure your network for you, or else you will have to bear with a risk of being exploited. A search of your local yellow pages or an inquiry at your neighborhood computer store should yield professional help and get your private data private again.
Imagine you are sitting by the pool and enjoying chatting through the Internet. Or lounging in the Jacuzzi listening to your MP3 collection is appealing to us all. Unfortunately, many, or even most, wireless units don't come with security features already functioning. This may not seem like a big issue to someone who is simply setting up a home network, but there are a number of potential problems you should consider.
Identity theft seems to be the most serious problem. If your network is unsecured, the personal data on your wireless electronic equipment is also unsecured. The order you just placed for a book at Amazon may have given your contact and payment information to an unscrupulous hacker! Nearly every town in which "WiFi" is common will have "War Drivers" and "War Chalkers" at work. These are people who walk or drive around town with wireless equipment, searching for unsecured networks. The "Chalkers" then live up their name, marking curbs and other public items with chalk so that others can more easily find and exploit your network.
In fact, not all "War Drivers" are hackers, of course. Many just want to use your network for free, but the risk is high if you don't learn how to protect yourself. You can usually find quite a bit of free information as to how to secure your network at the website of your router's manufacturer, or by doing a search in a search engine for a phrase like "secure home wireless."
In addition, there are also your neighbors who may find your network by accident and enjoy nosing into your activities and using your Internet access at will, slowing down your network speed in the process.
Even many businesses use cheap, home-use quality equipment for their company networks. With the poor security often found on small business networks, anyone with a basic knowledge of wireless can access sensitive company and customer data.
It is highly recommended that you hire service companies to secure your network for you, or else you will have to bear with a risk of being exploited. A search of your local yellow pages or an inquiry at your neighborhood computer store should yield professional help and get your private data private again.
Network Monitoring for Serious eCommerce
In the real world, businesses come in every size, from self-employed entrepreneurs like me to mega malls like Wal-Mart.
What Network Monitoring Monitors
On the Internet, companies come in every size, too, from a stand-alone ebook sales page with webmaster and owner all in one, to 300 pound gorilla like Amazon, with over a million pages, who requires the entire population of a small country to serve as webmaster.
If your site is a single page, it is its own network. But if your site is any bigger, and you have plans to grow, it is a network or is fast becoming one. You need network monitoring.
Most ecommerce webmasters are at least somewhat familiar with website monitoring. Many use a website monitoring service or software to keep track of "uptime" and "downtime".
At your local shopping mall, serious business requires more than just knowing when the front doors are open and when they are closed. Serious ecommerce needs to know more than just when the site is accessible. That is what network monitoring is all about.
Chances are, your e-business owns one of the following, or uses one of the following remotely:
DNS servers: These are used to translate your site name, like www.URL.com, to the numbers called "IP addresses" that computers understand. If DNS servers are not working properly, end-users will not be able to find your site and will get an error. Usually only an external or remote monitoring service will detect such a problem.
An FTP server: File Transfer Protocol servers are used to help you
exchange files with remote users. If you use FTP, a monitoring
service can make sure it is always up and running.
POP3 and SMTP servers: These are used for exchanging emails. If you are using email, chances are you are using SMTP and POP3. If your SMTP server is down, everyone who sends you email will receive an error, stating that your mail server is down and cannot accept incoming email. To say that the impression this leaves your customers is bad would be an understatement. If your POP3 server is down, you will be unable to retrieve email from your mailbox. Once again, only external monitoring will prevent such a problem.
Firewalls: Many businesses use firewalls to protect their internal network from un-authorized traffic, such as spyware, viruses and sabotage by competitors. Furthermore, a firewall is your first line of defense. If your firewall goes down, your whole network may actually become inaccessible from outside. In other words, if you host your own web site and mail servers, those will become
inaccessible to the outside world if your firewall goes down. Once again, remote network monitoring is required to detect that a problem exists and quickly get it repaired.
Internet connections: Users come to your network from multiple backbones, depending on the company they use to connect to the Internet and their location. It is important to insure that your connection performs well for each user. A remote monitoring service can ping your networks from multiple locations around the world, thus testing most major routes to your web server or network. Before hiring a network monitoring service, check to see that they have both your customer geography and the Internet backbone layout covered.
Very few websites of any size and functionality are anything less than a complete network, and many networks rely on servers in different parts of the world.
A good network monitoring service can ensure, as a base, that all servers are properly functioning, that data can be sent to and received from each server, and that each function sharing the server responds as required. An advanced network monitoring service can even remotely monitor the temperature of your servers.
What you need to monitor depends on how extensive your network is. A network monitoring expert can help you determine what needs monitoring. If you own the servers, or are remotely hosted on dedicated servers, you most likely need everything monitored. If your site is hosted on shared servers, you might need fewer functions monitored.
IT Consulting: Networking Steps
Starting an IT consulting business requires patience and dedication. The hardest part is often getting new clients. In this article, learn some more of the steps you should take before beginning your IT consulting practice.
Step Sixteen: Get Your Networking Contacts into a Follow Up Plan
With every business card you collect, jot down the date that you met them and any relevant notes about them. If you have a follow up request like they said "hey give me a call about that," or "hey call me on Tuesday about setting that up", immediately jump on those.
Follow up on the request tomorrow if not sooner. If you can’t follow up with a personal call, send a handwritten note that says you look forward to seeing them again and if you need any help between now and when we meet again, give me a call. Include your card in the note, and put your contact's card on a rolodex and put him on a 30, 60-day call back schedule.
Step Seventeen: Re-Evaluate Your Networking Organization Options
Take another look at the different networking groups you attended as a guest. Which ones did you like? Which ones have the most potential for the most business opportunities? Start joining and participating. The purpose is to get known and to raise your profile in the community.
Pick out at least 4 groups and join them. Drop off your check personally to the director or office manager. Be direct and tell him or her that you have this new IT consulting business and that you are looking for small business that you can help out with LANs, etc. Ask them what is the best way to get to know these small business owners that are most likely to need your IT consulting services.
At every 60-90 minute event, you should be talking to eight or ten people. Half of them may be a waste of time, half of them could be potential clients, half could be potential referrals. It’s a matter of staying organized and keeping your name in front of them.
After you go through the first ninety days and you’ve gone to one of these every week, move on to more sustainable networking.
Step Eighteen: Do Your First Direct Mail Campaign
Have your testimonials in place from your earlier clients, and get your networking organizations’ directory on disc. Send out a personal letter and your business card to every member who may fit into the IT consulting sweet spot. Offer them a free 30-minute needs assessment coupon with an expiration date. Tell them you look forward to seeing them at upcoming event and then you can always follow up with a phone call.
Copyright MMI-MMVI, Computer Consulting 101 Blog. All Worldwide Rights Reserved. {Attention Publishers: Live hyperlink in author resource box required for copyright compliance}
Step Sixteen: Get Your Networking Contacts into a Follow Up Plan
With every business card you collect, jot down the date that you met them and any relevant notes about them. If you have a follow up request like they said "hey give me a call about that," or "hey call me on Tuesday about setting that up", immediately jump on those.
Follow up on the request tomorrow if not sooner. If you can’t follow up with a personal call, send a handwritten note that says you look forward to seeing them again and if you need any help between now and when we meet again, give me a call. Include your card in the note, and put your contact's card on a rolodex and put him on a 30, 60-day call back schedule.
Step Seventeen: Re-Evaluate Your Networking Organization Options
Take another look at the different networking groups you attended as a guest. Which ones did you like? Which ones have the most potential for the most business opportunities? Start joining and participating. The purpose is to get known and to raise your profile in the community.
Pick out at least 4 groups and join them. Drop off your check personally to the director or office manager. Be direct and tell him or her that you have this new IT consulting business and that you are looking for small business that you can help out with LANs, etc. Ask them what is the best way to get to know these small business owners that are most likely to need your IT consulting services.
At every 60-90 minute event, you should be talking to eight or ten people. Half of them may be a waste of time, half of them could be potential clients, half could be potential referrals. It’s a matter of staying organized and keeping your name in front of them.
After you go through the first ninety days and you’ve gone to one of these every week, move on to more sustainable networking.
Step Eighteen: Do Your First Direct Mail Campaign
Have your testimonials in place from your earlier clients, and get your networking organizations’ directory on disc. Send out a personal letter and your business card to every member who may fit into the IT consulting sweet spot. Offer them a free 30-minute needs assessment coupon with an expiration date. Tell them you look forward to seeing them at upcoming event and then you can always follow up with a phone call.
Copyright MMI-MMVI, Computer Consulting 101 Blog. All Worldwide Rights Reserved. {Attention Publishers: Live hyperlink in author resource box required for copyright compliance}
Saturday, December 27, 2008
How To Secure Your Wireless Network
People have more flexible time due to wireless network. Thanks to the invention of wireless. People can now work from home while taking care of their kids or doing house works. No more stress from traffic jam anymore. Is this great?
Well, there is something you should realize. Working from home while using a wireless local area network (WLAN) may lead to theft of sensitive information and hacker or virus infiltration unless proper measures are taken. As WLANs send information over radio waves, someone with a receiver in your area could be picking up the transmission, thus gaining access to your computer. They could load viruses on to your laptop which could be transferred to the company's network when you go back to work.
Believe it or not! Up to 75 per cent of WLAN users do not have standard security features installed, while 20 per cent are left completely open as default configurations are not secured, but made for the users to have their network up and running ASAP. It is recommended that wireless router/access point setup be always done though a wired client.
You can setup your security by follow these steps:
1. Change default administrative password on wireless router/access point to a secured password.
2. Enable at least 128-bit WEP encryption on both card and access point. Change your WEP keys periodically. If equipment does not support at least 128-bit WEP encryption, consider replacing it. Although there are security issues with WEP, it represents minimum level of security, and it should be enabled.
3. Change the default SSID on your router/access point to a hard to guess name. Setup your computer device to connect to this SSID by default.
4. Setup router/access point not to broadcast the SSID. The same SSID needs to be setup on the client side manually. This feature may not be available on all equipment.
5. Block anonymous Internet requests or pings. On each computer having wireless network card, network connection properties should be configured to allow connection to Access Point Networks Only. Computer to Computer (peer to peer) Connection should not be allowed.
Enable MAC filtering. Deny association to wireless network for unspecified MAC addresses. Mac or Physical addresses are available through your computer device network connection setup and they are physically written on network cards. When adding new wireless cards / computer to the network, their MAC addresses should be registered with the router /access point. Network router should have firewall features enabled and demilitarized zone (DMZ) feature disabled.
All computers should have a properly configured personal firewall in addition to a hardware firewall. You should also update router/access point firmware when new versions become available. Locating router/access point away from strangers is also helpful so they cannot reset the router/access point to default settings. You can even try to locate router/access point in the middle of the building rather than near windows to limit signal coverage outside the building.
There is no guarantee of a full protection of your wireless network, but following these suggested tips can definitely lessen your risk of exposing to attackers aiming at insecure networks.
Well, there is something you should realize. Working from home while using a wireless local area network (WLAN) may lead to theft of sensitive information and hacker or virus infiltration unless proper measures are taken. As WLANs send information over radio waves, someone with a receiver in your area could be picking up the transmission, thus gaining access to your computer. They could load viruses on to your laptop which could be transferred to the company's network when you go back to work.
Believe it or not! Up to 75 per cent of WLAN users do not have standard security features installed, while 20 per cent are left completely open as default configurations are not secured, but made for the users to have their network up and running ASAP. It is recommended that wireless router/access point setup be always done though a wired client.
You can setup your security by follow these steps:
1. Change default administrative password on wireless router/access point to a secured password.
2. Enable at least 128-bit WEP encryption on both card and access point. Change your WEP keys periodically. If equipment does not support at least 128-bit WEP encryption, consider replacing it. Although there are security issues with WEP, it represents minimum level of security, and it should be enabled.
3. Change the default SSID on your router/access point to a hard to guess name. Setup your computer device to connect to this SSID by default.
4. Setup router/access point not to broadcast the SSID. The same SSID needs to be setup on the client side manually. This feature may not be available on all equipment.
5. Block anonymous Internet requests or pings. On each computer having wireless network card, network connection properties should be configured to allow connection to Access Point Networks Only. Computer to Computer (peer to peer) Connection should not be allowed.
Enable MAC filtering. Deny association to wireless network for unspecified MAC addresses. Mac or Physical addresses are available through your computer device network connection setup and they are physically written on network cards. When adding new wireless cards / computer to the network, their MAC addresses should be registered with the router /access point. Network router should have firewall features enabled and demilitarized zone (DMZ) feature disabled.
All computers should have a properly configured personal firewall in addition to a hardware firewall. You should also update router/access point firmware when new versions become available. Locating router/access point away from strangers is also helpful so they cannot reset the router/access point to default settings. You can even try to locate router/access point in the middle of the building rather than near windows to limit signal coverage outside the building.
There is no guarantee of a full protection of your wireless network, but following these suggested tips can definitely lessen your risk of exposing to attackers aiming at insecure networks.
Friday, December 26, 2008
It’s 2008. Do You Know Where Your IT Career Is?
Whether you're thinking of starting a career with computers and information technology, or thinking about earning a professional certification such as the CCNA or MCSE to accelerate your career, there is no better time to start than today. Silicon Valley is hiring again, and while we all can't work for Google, IT hiring is at its highest level in years and the opportunities for driven, motivated individuals are unlimited.
I also know that for many of us, the holiday season is a good excuse to put off those studies! "I'll study for the CCNA after Thanksgiving..." "I'll start working on my CCNP after the New Year..." Well, guess what - the new year is here.
It's 2008. Where is your IT career? Are you actively studying to earn a certification, or are you still thinking about it? Are you attending a school to break into the IT field, or are you still thinking about it?
Newton's First Law Of Motion states that an object at rest tends to stay at rest, and an object at motion tends to stay in motion. This is true of careers as well, including yours. Where do you want your career to be in one year? Do you want to have earned several certifications in that time, therefore advancing your career, or do you want to be in the exact same place you are today?
The only person who can make this decision is you. And I can speak from experience that when you begin putting your career into motion - the possibilities are unlimited. But you have to get started - today!
I also know that for many of us, the holiday season is a good excuse to put off those studies! "I'll study for the CCNA after Thanksgiving..." "I'll start working on my CCNP after the New Year..." Well, guess what - the new year is here.
It's 2008. Where is your IT career? Are you actively studying to earn a certification, or are you still thinking about it? Are you attending a school to break into the IT field, or are you still thinking about it?
Newton's First Law Of Motion states that an object at rest tends to stay at rest, and an object at motion tends to stay in motion. This is true of careers as well, including yours. Where do you want your career to be in one year? Do you want to have earned several certifications in that time, therefore advancing your career, or do you want to be in the exact same place you are today?
The only person who can make this decision is you. And I can speak from experience that when you begin putting your career into motion - the possibilities are unlimited. But you have to get started - today!
How To Become a Cisco CCNP
Congratulations on your decision to earn your CCNP certification! As a CCIE, I can tell you that Cisco certifications are both financially and personally rewarding.
To earn your CCNP, you first have to earn your CCNA certification. Then you're faced with a decision - take the three-exam CCNP path, or the four-exam path? They're both quite demanding, so let's take a look at each path.
The four-exam CCNP path includes the Building Scalable Cisco Internetworks exam (BSCI), Building Cisco Multilayer Switched Networks exam (BCMSN), Building Cisco Remote Access Networks (BCRAN), and Cisco Internetwork Troubleshooting (CIT) exam.
The three-exam path combines the BSCI and BCMSN exams into a single exam, called the Composite exam.
I'm often asked what order I recommend taking the exams in. After earning your CCNA, I recommend you begin studying for the BSCI exam immediately. You will find the fundamentals you learned in your CCNA studies will help you a great deal with this exam. You're going to add to your CCNA knowledgebase quite a bit when it comes to OSPF and EIGRP, as well as being introduced to BGP.
I don't have a preference between the BCMSN and BCRAN exams, but I do recommend you take the CIT exam last. You'll be using all the skills you learned in the first three exams to pass the CIT. It's a very demanding exam, and it's a little hard to troubleshoot technologies that you haven't learned yet!
The CCNP is both financially and personally fulfilling. Once you complete your CCNA studies, take a little breather and then get started on your CCNP studies. The more you know, the more valuable you are in today's ever-changing IT job market.
To earn your CCNP, you first have to earn your CCNA certification. Then you're faced with a decision - take the three-exam CCNP path, or the four-exam path? They're both quite demanding, so let's take a look at each path.
The four-exam CCNP path includes the Building Scalable Cisco Internetworks exam (BSCI), Building Cisco Multilayer Switched Networks exam (BCMSN), Building Cisco Remote Access Networks (BCRAN), and Cisco Internetwork Troubleshooting (CIT) exam.
The three-exam path combines the BSCI and BCMSN exams into a single exam, called the Composite exam.
I'm often asked what order I recommend taking the exams in. After earning your CCNA, I recommend you begin studying for the BSCI exam immediately. You will find the fundamentals you learned in your CCNA studies will help you a great deal with this exam. You're going to add to your CCNA knowledgebase quite a bit when it comes to OSPF and EIGRP, as well as being introduced to BGP.
I don't have a preference between the BCMSN and BCRAN exams, but I do recommend you take the CIT exam last. You'll be using all the skills you learned in the first three exams to pass the CIT. It's a very demanding exam, and it's a little hard to troubleshoot technologies that you haven't learned yet!
The CCNP is both financially and personally fulfilling. Once you complete your CCNA studies, take a little breather and then get started on your CCNP studies. The more you know, the more valuable you are in today's ever-changing IT job market.
Thursday, December 25, 2008
Cisco CCNP / BCMSN Exam Tutorial: Dynamic VLANs and VMPS
Knowledge of Dynamic VLANs and VMPS is important in your efforts to pass the BCMSN exam and earn your CCNP, and it's also a great skill to have for your networking career.
As a CCNA and CCNP candidate, you know how and why to configure static VLANs. Static VLANs can be a powerful tool for reducing unnecessary broadcast and multicast traffic, but if hosts are moved from one switch port to another, you've got to make those changes manually on the switch. With Dynamic VLANs, the changes are made - how else? - dynamically.
The actual configuration of dynamic VLANs is out of the scope of the BCMSN exam, but as a CCNP candidate you need to know the basics of VMPS - a VLAN Membership Policy Server.
Using VMPS results in port VLAN membership changes being performed dynamically, because the port's VLAN membership is decided by the source MAC address of the device connected to that port. (Yet another reason that the first value a switch looks at on an incoming frame is the source MAC address.)
In my home lab network, I've got a host connected to switch port fast0/1 that resides in VLAN 12. What if we had to move Host 1's connection to the switch to port 0/6? With static VLANs, we'd have to connect to the switch, configure the port as an access port, and then place the port into VLAN 12. With VMPS, the only thing we'd have to do is reconnect the cable to port 0/6, and the VMPS would dynamically place that port into VLAN 12.
I urge you to do additional reading regarding VMPS. Use your favorite search engine for the term configuring vmps and you'll quickly find some great official Cisco documentation on this topic.
To review, the VLAN membership of a host is decided by one of two factors. With static VLANs, the host's VLAN membership is the VLAN to which its switch port has been assigned. With dynamic VLANs, it is dependent upon the host's MAC address.
As a CCNA and CCNP candidate, you know how and why to configure static VLANs. Static VLANs can be a powerful tool for reducing unnecessary broadcast and multicast traffic, but if hosts are moved from one switch port to another, you've got to make those changes manually on the switch. With Dynamic VLANs, the changes are made - how else? - dynamically.
The actual configuration of dynamic VLANs is out of the scope of the BCMSN exam, but as a CCNP candidate you need to know the basics of VMPS - a VLAN Membership Policy Server.
Using VMPS results in port VLAN membership changes being performed dynamically, because the port's VLAN membership is decided by the source MAC address of the device connected to that port. (Yet another reason that the first value a switch looks at on an incoming frame is the source MAC address.)
In my home lab network, I've got a host connected to switch port fast0/1 that resides in VLAN 12. What if we had to move Host 1's connection to the switch to port 0/6? With static VLANs, we'd have to connect to the switch, configure the port as an access port, and then place the port into VLAN 12. With VMPS, the only thing we'd have to do is reconnect the cable to port 0/6, and the VMPS would dynamically place that port into VLAN 12.
I urge you to do additional reading regarding VMPS. Use your favorite search engine for the term configuring vmps and you'll quickly find some great official Cisco documentation on this topic.
To review, the VLAN membership of a host is decided by one of two factors. With static VLANs, the host's VLAN membership is the VLAN to which its switch port has been assigned. With dynamic VLANs, it is dependent upon the host's MAC address.
Cisco CCNA Exam Tutorial: Mapping The OSI Model To The TCPIP Model
The OSI model is the model that most networking personnel are familiar with, but to earn your CCNA, you need to know the OSI model, the TCP/IP model, and how the two map to each other.
The four layers of the TCP/IP architecture can be compared to certain levels of the OSI model. It’s important to know what each level of the TCP/IP protocol architecture does, and how these layers map to the OSI model.
The Application Layer of the TCP/IP model performs much the same tasks as the Application, Presentation, and Session layers of the OSI model.
The Transport layer in the TCP/IP architecture is similar to the Transport layer in the OSI model. This layer can use TCP or UDP as well.
The Internetwork layer in the TCP/IP architecture uses IP addresses to determine how packets should be routed. Remember that the OSI model uses IP addresses, or “Layer 3 Addresses”, at the Network layer. The two layers do much the same thing. This layer is also referred to in the TCP/IP model as the Internet layer.
The Network Interface layer in the TCP/IP architecture serves to define the protocols and the hardware needed to actually deliver the data across the network. The Network Interface model does the work of both the Data Link and Physical Layers in the OSI model.
Keeping all this straight can be very confusing when you first start your CCNA studies. Concentrate on the OSI model in your studies, but make sure you know how the TCP/IP model maps to that model and you'll be ready for CCNA exam success!
The four layers of the TCP/IP architecture can be compared to certain levels of the OSI model. It’s important to know what each level of the TCP/IP protocol architecture does, and how these layers map to the OSI model.
The Application Layer of the TCP/IP model performs much the same tasks as the Application, Presentation, and Session layers of the OSI model.
The Transport layer in the TCP/IP architecture is similar to the Transport layer in the OSI model. This layer can use TCP or UDP as well.
The Internetwork layer in the TCP/IP architecture uses IP addresses to determine how packets should be routed. Remember that the OSI model uses IP addresses, or “Layer 3 Addresses”, at the Network layer. The two layers do much the same thing. This layer is also referred to in the TCP/IP model as the Internet layer.
The Network Interface layer in the TCP/IP architecture serves to define the protocols and the hardware needed to actually deliver the data across the network. The Network Interface model does the work of both the Data Link and Physical Layers in the OSI model.
Keeping all this straight can be very confusing when you first start your CCNA studies. Concentrate on the OSI model in your studies, but make sure you know how the TCP/IP model maps to that model and you'll be ready for CCNA exam success!
Wednesday, December 24, 2008
Cisco CCNA Exam Tutorial: Cisco Discovery Protocol (CDP)
The Cisco Discovery Protocol (CDP) sure looks simple enough, but there are quite a few details to know for success on the CCNA exam. In your CCNP studies, you'll be introduced to additional uses for CDP, but for now it's enough to know that CDP is designed to give you information regarding directly connected Cisco routers and switches.
CDP runs by default between all directly connected Cisco devices. CDP is also a Cisco-proprietary protocol - if the directly connected device is not a Cisco device, you won't see the information you wanted.
The basic CDP command to display information about the directly connected neighbor is "show cdp neighbor".
R2#show cdp neighbor
Capability Codes: R - Router, T - Trans Bridge, B - Source Route Bridge
S - Switch, H - Host, I - IGMP, r – Repeater
Device ID Local Intrfce Holdtme Capability Platform Port ID
R1 BRI0 167 R 2521 Dialer1
This command is particularly helpful when troubleshooting Cisco switches. There’s no need to trace wiring in a rack of Cisco devices to see what routers are connected to a Cisco switch when show cdp neighbor can be used. In the above output, you can see the remote device's hostname, what interface on the remote device is connected to the local device, the capability of the remote device, the remote device’s hardware platform, and the local interface that is connected to the remote device.
CDP can be disabled at both the global and interface level. To disable CDP at the interface level, run no cdp enable on the interface, and cdp enable to turn it back on.
cdp timer defines how often CDP packets are transmitted, and cdp holdtime defines how long a device will hold a received packet.
To turn CDP off for the entire router, run no cdp run. To view the current global status of CDP, run show cdp.
R2#show cdp
Global CDP information:
Sending CDP packets every 60 seconds
Sending a holdtime value of 180 seconds
CDP is running by default.
R2#conf t
R2(config)#cdp timer 45
R2(config)#cdp holdtime 100
The CDP timers are changed.
R2#show cdp
Global CDP information:
Sending CDP packets every 45 seconds
Sending a holdtime value of 100 seconds
The CDP values have been successfully changed. “show cdp interface” will give the timer information for each interface on the router.
R2#conf t
R2(config)#interface bri0
R2(config-if)#no cdp enable
CDP is disabled on the BRI interface. This does NOT have to be done to keep the line from dialing.
R2#conf t
R2(config)#no cdp run
CDP is disabled globally.
R2#show cdp
% CDP is not enabled
CDP has been successfully disabled.
Show cdp neighbor gives you a great deal of information, but what if you need the neighbor’s IP address? Just run show cdp neighbor detail. You will get even more information about that directly connected neighbor, including its IP address.
SW2#show cdp neighbor detail
-------------------------
Device ID: R4
Entry address(es):
IP address: 172.12.23.4
Platform: cisco 2520, Capabilities: Router
Interface: FastEthernet0/4, Port ID (outgoing port): Ethernet0
Holdtime : 158 sec
The details of CDP are important to you on the job and in the CCNA exam room. When you find yourself negotiating a badly documented network, you can use CDP to "walk" through the network and create a network map for your client as well. Sometimes the simplest protocols are the most helpful!
CDP runs by default between all directly connected Cisco devices. CDP is also a Cisco-proprietary protocol - if the directly connected device is not a Cisco device, you won't see the information you wanted.
The basic CDP command to display information about the directly connected neighbor is "show cdp neighbor".
R2#show cdp neighbor
Capability Codes: R - Router, T - Trans Bridge, B - Source Route Bridge
S - Switch, H - Host, I - IGMP, r – Repeater
Device ID Local Intrfce Holdtme Capability Platform Port ID
R1 BRI0 167 R 2521 Dialer1
This command is particularly helpful when troubleshooting Cisco switches. There’s no need to trace wiring in a rack of Cisco devices to see what routers are connected to a Cisco switch when show cdp neighbor can be used. In the above output, you can see the remote device's hostname, what interface on the remote device is connected to the local device, the capability of the remote device, the remote device’s hardware platform, and the local interface that is connected to the remote device.
CDP can be disabled at both the global and interface level. To disable CDP at the interface level, run no cdp enable on the interface, and cdp enable to turn it back on.
cdp timer defines how often CDP packets are transmitted, and cdp holdtime defines how long a device will hold a received packet.
To turn CDP off for the entire router, run no cdp run. To view the current global status of CDP, run show cdp.
R2#show cdp
Global CDP information:
Sending CDP packets every 60 seconds
Sending a holdtime value of 180 seconds
CDP is running by default.
R2#conf t
R2(config)#cdp timer 45
R2(config)#cdp holdtime 100
The CDP timers are changed.
R2#show cdp
Global CDP information:
Sending CDP packets every 45 seconds
Sending a holdtime value of 100 seconds
The CDP values have been successfully changed. “show cdp interface” will give the timer information for each interface on the router.
R2#conf t
R2(config)#interface bri0
R2(config-if)#no cdp enable
CDP is disabled on the BRI interface. This does NOT have to be done to keep the line from dialing.
R2#conf t
R2(config)#no cdp run
CDP is disabled globally.
R2#show cdp
% CDP is not enabled
CDP has been successfully disabled.
Show cdp neighbor gives you a great deal of information, but what if you need the neighbor’s IP address? Just run show cdp neighbor detail. You will get even more information about that directly connected neighbor, including its IP address.
SW2#show cdp neighbor detail
-------------------------
Device ID: R4
Entry address(es):
IP address: 172.12.23.4
Platform: cisco 2520, Capabilities: Router
Interface: FastEthernet0/4, Port ID (outgoing port): Ethernet0
Holdtime : 158 sec
The details of CDP are important to you on the job and in the CCNA exam room. When you find yourself negotiating a badly documented network, you can use CDP to "walk" through the network and create a network map for your client as well. Sometimes the simplest protocols are the most helpful!
Cisco CCNA Certification: Cisco Switching Modes Tutorial
To pass the CCNA exam and earn that coveted certification, you've got to know Cisco switches inside and out. Among the many important details you've got to know are the three methods that Cisco switches use to forward frames, and the differences between the three.
The first switching method is Store-and-Forward. The name is the recipe, because that's just what the switch does - it stores the entire frame before beginning to forward it. This method allows for the greatest amount of error checking, since the Frame Check Sequence (FCS) can be run before the frame is forwarded. As always, there is a tradeoff, since this error checking process makes this the slowest of the three frame forwarding methods.
The quickest method is Cut-Through, where only the destination MAC address of the frame is examined before the forwarding process begins. This means that the part of the frame is actually being forwarded as it is still being received! The tradeoff here is that the FCS does not run, so there is absolutely no error checking with Cut-Through switching.
The middle ground between these two extremes is Fragment-Free, so named since fragmented frames will not be forwarded. The switch examines only the first 64 bytes of the frame for errors, since that is the part of the frame that will be damaged in case of a collision. There is error checking, but it is not as thorough as Store-and-Forward.
Keeping these three switching schemes straight is vital to your CCNA exam efforts, and it will help you in working with Cisco switches in the real world as well. Keep studying!
The first switching method is Store-and-Forward. The name is the recipe, because that's just what the switch does - it stores the entire frame before beginning to forward it. This method allows for the greatest amount of error checking, since the Frame Check Sequence (FCS) can be run before the frame is forwarded. As always, there is a tradeoff, since this error checking process makes this the slowest of the three frame forwarding methods.
The quickest method is Cut-Through, where only the destination MAC address of the frame is examined before the forwarding process begins. This means that the part of the frame is actually being forwarded as it is still being received! The tradeoff here is that the FCS does not run, so there is absolutely no error checking with Cut-Through switching.
The middle ground between these two extremes is Fragment-Free, so named since fragmented frames will not be forwarded. The switch examines only the first 64 bytes of the frame for errors, since that is the part of the frame that will be damaged in case of a collision. There is error checking, but it is not as thorough as Store-and-Forward.
Keeping these three switching schemes straight is vital to your CCNA exam efforts, and it will help you in working with Cisco switches in the real world as well. Keep studying!
Cisco CCNA / CCNP Tutorial: Home Lab Assembly Case Study
Part of your CCNA / CCNP education is deciding what network topology to use when you're putting together your home lab. Some of you are starting with one or two routers or switches, while others are starting with more. A customer recently sent me a list of his Cisco routers and switches that he has available for a home lab and asked for my help in coming up with the best way to use them.
There is no "right" or "wrong" answer to this question; again, part of the learning process is configuring and reconfiguring the physical topology of your lab. Let's look at the routers and switches he has available, including the interfaces on each, and come up with one possible CCNA / CCNP home lab setup.
The equipment list:
Two 3620 routers. Each has 1 serial port and 2 ethernet ports.
One 3640 router. This has two ethernet cards, each with two ports, and two AUI ports.
Three 2503s, my personal favorite for home labs! These have 1 AUI port, 2 serial interfaces, and one BRI interface apiece.
One 2524 router. This has one serial port, 1 ethernet port, and one BRI interface.
One 4500 router. This has eight BRI ports, 2 ethernet ports, and more importantly, four serial ports.
He also has a 5200 access server, an ISDN simulator, one 2924 switch, and one 1924 switch.
Now, if you don't have this much equipment to work with, don't panic! Most CCNA / CCNP candidates don't; this is more of an exercise in looking at what you do have and using it to the utmost.
As I've mentioned in many of my CCNA / CCNP home lab articles, an access server is a great thing to have. All he needs is an octal cable to connect his AS to the other devices we choose to use, and he's all set. (If you need an access server sample configuration, there is one on my website in the Home Lab section.)
A frame relay switch is also great to have, and the 4500 will make a great FR switch. Having a frame relay cloud in your CCNA / CCNP home lab is a great way to get experience configuring and troubleshooting frame relay, an essential skill for CCNA success.
I would put both of the 3620s on the frame relay cloud via the Serial interface, as well as two of the 2503s. That gives you four routers that will be using frame relay to communicate, and that's the most we can have since the 4500 has four serial ports. The 4500 will need to be configured as a frame relay switch and connected to the other routers via a DTE/DCE cable. (Again, if you need a frame relay switch configuration, the one I use in my pods is on the website in the same place as the access server configuration.)
The two 2503s that are on the frame relay cloud should also be connected via their BRI interfaces. The home lab also includes an ISDN simulator, which is necessary to allow routers to communicate via their BRI interfaces. Just get a couple of straight-through cables to connect those two routers to the ISDN simulator and that segment is ready to go. (Remember that you can't connect Cisco routers directly via their BRI interfaces.)
All of the routers in this lab have at least one ethernet or AUI port, so we can connect them all to either one of the switches. The switches should be connected via at least two crossover cables to allow practice with trunking, root bridge election, and VLANs. Having two switches really does add quite a bit to a CCNA / CCNP home lab's capabilities. You can experiment with different subnets and vlans with as well. Don't be afraid to dive in - that's what a home lab is all about!
So now we've got four routers connected via frame relay, two via ISDN, and the others via ethernet segments. Two of the routers that are not using their serial interfaces should be connected directly via their serial ports. For this, you'll just need another DTE/DCE cable. Knowing how to bring up the line between two directly connected serial ports is an important CCNA skill, and so is troubleshooting it. You should be able to bring such a connection up with your eyes closed, and once you work with your own CCNA / CCNP home lab, you'll be able to!
Also, don't forget to add a loopback interface to each one of your routers. I like to use 1.1.1.1 for R1, 2.2.2.2 for R2, and so on. Advertising loopbacks is another great way to get practice with RIP, OSPF, EIGRP, IGRP, and static routing.
We've taken a pile of routers and switches and turned them into a fantastic CCNA / CCNP home lab. Whether you're working with two Cisco devices or ten, coming up with your own home lab topology is a great learning experience and the beginning of developing your analytical and troubleshooting skills.
There is no "right" or "wrong" answer to this question; again, part of the learning process is configuring and reconfiguring the physical topology of your lab. Let's look at the routers and switches he has available, including the interfaces on each, and come up with one possible CCNA / CCNP home lab setup.
The equipment list:
Two 3620 routers. Each has 1 serial port and 2 ethernet ports.
One 3640 router. This has two ethernet cards, each with two ports, and two AUI ports.
Three 2503s, my personal favorite for home labs! These have 1 AUI port, 2 serial interfaces, and one BRI interface apiece.
One 2524 router. This has one serial port, 1 ethernet port, and one BRI interface.
One 4500 router. This has eight BRI ports, 2 ethernet ports, and more importantly, four serial ports.
He also has a 5200 access server, an ISDN simulator, one 2924 switch, and one 1924 switch.
Now, if you don't have this much equipment to work with, don't panic! Most CCNA / CCNP candidates don't; this is more of an exercise in looking at what you do have and using it to the utmost.
As I've mentioned in many of my CCNA / CCNP home lab articles, an access server is a great thing to have. All he needs is an octal cable to connect his AS to the other devices we choose to use, and he's all set. (If you need an access server sample configuration, there is one on my website in the Home Lab section.)
A frame relay switch is also great to have, and the 4500 will make a great FR switch. Having a frame relay cloud in your CCNA / CCNP home lab is a great way to get experience configuring and troubleshooting frame relay, an essential skill for CCNA success.
I would put both of the 3620s on the frame relay cloud via the Serial interface, as well as two of the 2503s. That gives you four routers that will be using frame relay to communicate, and that's the most we can have since the 4500 has four serial ports. The 4500 will need to be configured as a frame relay switch and connected to the other routers via a DTE/DCE cable. (Again, if you need a frame relay switch configuration, the one I use in my pods is on the website in the same place as the access server configuration.)
The two 2503s that are on the frame relay cloud should also be connected via their BRI interfaces. The home lab also includes an ISDN simulator, which is necessary to allow routers to communicate via their BRI interfaces. Just get a couple of straight-through cables to connect those two routers to the ISDN simulator and that segment is ready to go. (Remember that you can't connect Cisco routers directly via their BRI interfaces.)
All of the routers in this lab have at least one ethernet or AUI port, so we can connect them all to either one of the switches. The switches should be connected via at least two crossover cables to allow practice with trunking, root bridge election, and VLANs. Having two switches really does add quite a bit to a CCNA / CCNP home lab's capabilities. You can experiment with different subnets and vlans with as well. Don't be afraid to dive in - that's what a home lab is all about!
So now we've got four routers connected via frame relay, two via ISDN, and the others via ethernet segments. Two of the routers that are not using their serial interfaces should be connected directly via their serial ports. For this, you'll just need another DTE/DCE cable. Knowing how to bring up the line between two directly connected serial ports is an important CCNA skill, and so is troubleshooting it. You should be able to bring such a connection up with your eyes closed, and once you work with your own CCNA / CCNP home lab, you'll be able to!
Also, don't forget to add a loopback interface to each one of your routers. I like to use 1.1.1.1 for R1, 2.2.2.2 for R2, and so on. Advertising loopbacks is another great way to get practice with RIP, OSPF, EIGRP, IGRP, and static routing.
We've taken a pile of routers and switches and turned them into a fantastic CCNA / CCNP home lab. Whether you're working with two Cisco devices or ten, coming up with your own home lab topology is a great learning experience and the beginning of developing your analytical and troubleshooting skills.
Tuesday, December 23, 2008
Cisco CCNA / CCNP Certification Exam Lab: Frame Relay Subinterfaces And Split Horizon
Earning your Cisco CCNA and CCNP is a tough proposition, and part of that is the fact that you quickly learn that there’s usually more than one way to do things with Cisco routers – and while that’s generally a good thing, you better know the ins and outs of all options when it comes to test day and working on production networks. Working with Frame Relay subinterfaces and split horizon is just one such situation.
One reason for the use of subinterfaces is to circumvent the rule of split horizon. You recall from your CCNA studies that split horizon dictates that a route cannot be advertised out the same interface upon which it was learned in the first place. In the following example, R1 is the hub and R2 and R3 are the spokes. All three routers are using their physical interfaces for frame relay connectivity, and they are also running RIPv2 172.12.123.0 /24. Each router is also advertising a loopback interface, using the router number for each octet.
R1(config)#int s0
R1(config-if)#ip address 172.12.123.1 255.255.255.0
R1(config-if)#no frame inverse
R1(config-if)#frame map ip 172.12.123.2 122 broadcast
R1(config-if)#frame map ip 172.12.123.3 123 broadcast
R1(config-if)#no shut
R2(config)#int s0
R2(config-if)#encap frame
R2(config-if)#no frame inver
R2(config-if)#frame map ip 172.12.123.1 221 broadcast
R2(config-if)#frame map ip 172.12.123.3 221 broadcast
R2(config-if)#ip address 172.12.123.2 255.255.255.0
R3(config)#int s0
R3(config-if)#encap frame
R3(config-if)#no frame inver
R3(config-if)#frame map ip 172.12.123.1 321 broadcast
R3(config-if)#frame map ip 172.12.123.2 321 broadcast
R3(config-if)#ip address 172.12.123.3 255.255.255.0
R1#show ip route rip
2.0.0.0/32 is subnetted, 1 subnets
R 2.2.2.2 [120/1] via 172.12.123.2, 00:00:20, Serial0
3.0.0.0/32 is subnetted, 1 subnets
R 3.3.3.3 [120/1] via 172.12.123.3, 00:00:22, Serial0
R2#show ip route rip
1.0.0.0/32 is subnetted, 1 subnets
R 1.1.1.1 [120/1] via 172.12.123.1, 00:00:06, Serial0
R3#show ip route rip
1.0.0.0/32 is subnetted, 1 subnets
R 1.1.1.1 [120/1] via 172.12.123.1, 00:00:04, Serial0
The hub router R1 has a route to both loopbacks, but neither spoke has a route to the other spoke's loopback. That's because split horizon prevents R1 from advertising a network via Serial0 if the route was learned on Serial0 to begin with.
We've got two options here, one of which is to disable spilt horizon on the interface. While doing so will have the desired effect in our little network, disabling split horizon is not a good idea and should be avoided whenever possible. We’re not going to do it in this lab, but here is the syntax to do so:
R1(config)#interface serial0
R1(config-if)#no ip split-horizon
A better solution is to configure subinterfaces on R1. The IP addressing will have to be revisited, but that's no problem here. R1 and R2 will use 172.12.123.0 /24 to communicate, while R1 and R3 will use 172.12.13.0 /24. R3's serial0 interface will need to be renumbered, so let's look at all three router configurations:
R1(config)#interface serial0
R1(config-if)#encap frame
R1(config-if)#no frame inverse-arp
R1(config-if)#no ip address
R1(config-if)#interface serial0.12 multipoint
R1(config-subif)#ip address 172.12.123.1 255.255.255.0
R1(config-subif)#frame map ip 172.12.123.2 122 broadcast
R1(config-subif)#interface serial0.31 point-to-point
R1(config-subif)#ip address 172.12.13.1 255.255.255.0
R1(config-subif)#frame interface-dlci 123
R2(config)#int s0
R2(config-if)#ip address 172.12.123.2 255.255.255.0
R2(config-if)#encap frame
R2(config-if)#frame map ip 172.12.13.3 221 broadcast
R2(config-if)#frame map ip 172.12.123.1 221 broadcast
R3(config)#int s0
R3(config-if)#ip address 172.12.13.3 255.255.255.0
R3(config-if)#encap frame
R3(config-if)#frame map ip 172.12.13.1 321 broadcast
R3(config-if)#frame map ip 172.12.123.2 321 broadcast
A frame map statement always names the REMOTE IP address and the LOCAL DLCI. Don't forget the broadcast option!
Show frame map shows us that all the static mappings on R1 are up and running. Note the "static" output, which indicates these mappings are a result of using the frame map command. Pings are not shown, but all three routers can ping each other at this point.
R1#show frame map
Serial0 (up): ip 172.12.123.2 dlci 122(0x7A,0x1CA0), static,
broadcast, CISCO, status defined, active
Serial0 (up): ip 172.12.13.3 dlci 123(0x7B,0x1CB0), static,
broadcast, CISCO, status defined, active
After the 172.12.13.0 /24 network is added to R1 and R3’s RIP configuration, R2 and R3 now have each other's loopback network in their RIP routing tables.
R2#show ip route rip
1.0.0.0/32 is subnetted, 1 subnets
R 1.1.1.1 [120/1] via 172.12.123.1, 00:00:20, Serial0
3.0.0.0/32 is subnetted, 1 subnets
R 3.3.3.3 [120/1] via 172.12.123.1, 00:00:22, Serial0
R3#show ip route rip
1.0.0.0/32 is subnetted, 1 subnets
R 1.1.1.1 [120/1] via 172.12.13.1, 00:00:20, Serial0
2.0.0.0/32 is subnetted, 1 subnets
R 2.2.2.2 [120/1] via 172.12.13.1, 00:00:22, Serial0
While turning split horizon off is one way to achieve total IP connectivity, doing so can have other unintended results. The use of subinterfaces is a more effective way of allowing the spokes to see the hub's loopback network.
One reason for the use of subinterfaces is to circumvent the rule of split horizon. You recall from your CCNA studies that split horizon dictates that a route cannot be advertised out the same interface upon which it was learned in the first place. In the following example, R1 is the hub and R2 and R3 are the spokes. All three routers are using their physical interfaces for frame relay connectivity, and they are also running RIPv2 172.12.123.0 /24. Each router is also advertising a loopback interface, using the router number for each octet.
R1(config)#int s0
R1(config-if)#ip address 172.12.123.1 255.255.255.0
R1(config-if)#no frame inverse
R1(config-if)#frame map ip 172.12.123.2 122 broadcast
R1(config-if)#frame map ip 172.12.123.3 123 broadcast
R1(config-if)#no shut
R2(config)#int s0
R2(config-if)#encap frame
R2(config-if)#no frame inver
R2(config-if)#frame map ip 172.12.123.1 221 broadcast
R2(config-if)#frame map ip 172.12.123.3 221 broadcast
R2(config-if)#ip address 172.12.123.2 255.255.255.0
R3(config)#int s0
R3(config-if)#encap frame
R3(config-if)#no frame inver
R3(config-if)#frame map ip 172.12.123.1 321 broadcast
R3(config-if)#frame map ip 172.12.123.2 321 broadcast
R3(config-if)#ip address 172.12.123.3 255.255.255.0
R1#show ip route rip
2.0.0.0/32 is subnetted, 1 subnets
R 2.2.2.2 [120/1] via 172.12.123.2, 00:00:20, Serial0
3.0.0.0/32 is subnetted, 1 subnets
R 3.3.3.3 [120/1] via 172.12.123.3, 00:00:22, Serial0
R2#show ip route rip
1.0.0.0/32 is subnetted, 1 subnets
R 1.1.1.1 [120/1] via 172.12.123.1, 00:00:06, Serial0
R3#show ip route rip
1.0.0.0/32 is subnetted, 1 subnets
R 1.1.1.1 [120/1] via 172.12.123.1, 00:00:04, Serial0
The hub router R1 has a route to both loopbacks, but neither spoke has a route to the other spoke's loopback. That's because split horizon prevents R1 from advertising a network via Serial0 if the route was learned on Serial0 to begin with.
We've got two options here, one of which is to disable spilt horizon on the interface. While doing so will have the desired effect in our little network, disabling split horizon is not a good idea and should be avoided whenever possible. We’re not going to do it in this lab, but here is the syntax to do so:
R1(config)#interface serial0
R1(config-if)#no ip split-horizon
A better solution is to configure subinterfaces on R1. The IP addressing will have to be revisited, but that's no problem here. R1 and R2 will use 172.12.123.0 /24 to communicate, while R1 and R3 will use 172.12.13.0 /24. R3's serial0 interface will need to be renumbered, so let's look at all three router configurations:
R1(config)#interface serial0
R1(config-if)#encap frame
R1(config-if)#no frame inverse-arp
R1(config-if)#no ip address
R1(config-if)#interface serial0.12 multipoint
R1(config-subif)#ip address 172.12.123.1 255.255.255.0
R1(config-subif)#frame map ip 172.12.123.2 122 broadcast
R1(config-subif)#interface serial0.31 point-to-point
R1(config-subif)#ip address 172.12.13.1 255.255.255.0
R1(config-subif)#frame interface-dlci 123
R2(config)#int s0
R2(config-if)#ip address 172.12.123.2 255.255.255.0
R2(config-if)#encap frame
R2(config-if)#frame map ip 172.12.13.3 221 broadcast
R2(config-if)#frame map ip 172.12.123.1 221 broadcast
R3(config)#int s0
R3(config-if)#ip address 172.12.13.3 255.255.255.0
R3(config-if)#encap frame
R3(config-if)#frame map ip 172.12.13.1 321 broadcast
R3(config-if)#frame map ip 172.12.123.2 321 broadcast
A frame map statement always names the REMOTE IP address and the LOCAL DLCI. Don't forget the broadcast option!
Show frame map shows us that all the static mappings on R1 are up and running. Note the "static" output, which indicates these mappings are a result of using the frame map command. Pings are not shown, but all three routers can ping each other at this point.
R1#show frame map
Serial0 (up): ip 172.12.123.2 dlci 122(0x7A,0x1CA0), static,
broadcast, CISCO, status defined, active
Serial0 (up): ip 172.12.13.3 dlci 123(0x7B,0x1CB0), static,
broadcast, CISCO, status defined, active
After the 172.12.13.0 /24 network is added to R1 and R3’s RIP configuration, R2 and R3 now have each other's loopback network in their RIP routing tables.
R2#show ip route rip
1.0.0.0/32 is subnetted, 1 subnets
R 1.1.1.1 [120/1] via 172.12.123.1, 00:00:20, Serial0
3.0.0.0/32 is subnetted, 1 subnets
R 3.3.3.3 [120/1] via 172.12.123.1, 00:00:22, Serial0
R3#show ip route rip
1.0.0.0/32 is subnetted, 1 subnets
R 1.1.1.1 [120/1] via 172.12.13.1, 00:00:20, Serial0
2.0.0.0/32 is subnetted, 1 subnets
R 2.2.2.2 [120/1] via 172.12.13.1, 00:00:22, Serial0
While turning split horizon off is one way to achieve total IP connectivity, doing so can have other unintended results. The use of subinterfaces is a more effective way of allowing the spokes to see the hub's loopback network.
Cisco CCNA / CCNP Certification Exam: Creating A Study Plan
Whether you're just starting to think about passing the CCNA or CCNP exams, or you've been on the certification track for a while, you've got to have a plan for success. If you wanted to drive your car from Florida to California, you'd create a plan to get there. You'd get a map and decide how far you wanted to drive per day, and maybe even make some hotel reservations in advance. You certainly wouldn't get in your car, just drive it randomly down the nearest highway, and hope you ended up in California, would you?
Certainly not. Earning your CCNA certification is the same way. It's not enough to just study a few minutes "when you feel like it", or tell yourself that you'll start studying for the exams "when I get such-and-such done". The perfect time to start on the road to Cisco certification is not tomorrow, and it's not next week. It's today.
You're much better off with one hour of solid study than three hours of interrupted, unfocused study. Here are a few ways to go about getting the kind of quality study time that will get you to the CCNA or CCNP (or any Cisco certification, for that matter!).
Schedule your study time, and regard this study time as you would an appointment with a client. If you were to meet a customer at 10:00 to discuss a network install, would you just decide not to show up and watch television instead? Not if you wanted the job. The same goes for your study time. That's an appointment with the most important customer of all - YOU.
Turn your cell, iPod, TV, instant messenger, and all other electronic collars off for the duration of your study time. I know those of us in information technology don't like to say this, but we can actually exist without being in touch with the world for a little while. You may even get to like it! Having uninterrupted study time is key to CCNA and CCNP exam success.
Finally, schedule your exam before you start studying. Contrary to what many people think, "deadline" is not a dirty word. We do our best work when we have a deadline and a schedule to keep. Make out your study schedule, schedule your exam, and get to work just as you would a network project for a customer. The project you're working on is your career and your life, and by following these simple steps you can make it a highly successful project - by passing your CCNA and CCNP exam!
Certainly not. Earning your CCNA certification is the same way. It's not enough to just study a few minutes "when you feel like it", or tell yourself that you'll start studying for the exams "when I get such-and-such done". The perfect time to start on the road to Cisco certification is not tomorrow, and it's not next week. It's today.
You're much better off with one hour of solid study than three hours of interrupted, unfocused study. Here are a few ways to go about getting the kind of quality study time that will get you to the CCNA or CCNP (or any Cisco certification, for that matter!).
Schedule your study time, and regard this study time as you would an appointment with a client. If you were to meet a customer at 10:00 to discuss a network install, would you just decide not to show up and watch television instead? Not if you wanted the job. The same goes for your study time. That's an appointment with the most important customer of all - YOU.
Turn your cell, iPod, TV, instant messenger, and all other electronic collars off for the duration of your study time. I know those of us in information technology don't like to say this, but we can actually exist without being in touch with the world for a little while. You may even get to like it! Having uninterrupted study time is key to CCNA and CCNP exam success.
Finally, schedule your exam before you start studying. Contrary to what many people think, "deadline" is not a dirty word. We do our best work when we have a deadline and a schedule to keep. Make out your study schedule, schedule your exam, and get to work just as you would a network project for a customer. The project you're working on is your career and your life, and by following these simple steps you can make it a highly successful project - by passing your CCNA and CCNP exam!
Cabling your home for computer network - still a requirement?
Cabling your home for computer network - still a requirement?
With proliferation of wireless networking and communication equipment it is oh-so-tempting to cut the cord and save a significant sum of money in the process. But is everything that a regular computer networking user needs can be done using just wireless network? Let’s take a look at some pros and contras:
1. One important advantage of having a cabled network is the available bandwidth or simply speed. At the present point in time the speed of connection via a simple and inexpensive CAT5E cable can be 1000Mbit/sec, whereas the best that IEEE802.11g (one of the many flavors of Wi-Fi) can offer is only 54Mbit/sec. It may not seem so significant if you think you are only browsing Internet, and the DSL speed available to you is 1.5Mbit/sec. However, if you need to print via your network connection on a remote printer, you should realize that the print jobs, depending on the amount of graphic data in them, can easily reach dozens and even hundreds megabytes. Since 1Byte=8bit one 100MByte print job will take 15 seconds (and in reality this time can be much longer) to transmit via a Wi-Fi wireless connection, and this time shrinks to mere 1 sec or less on wired 1000MBit/s Ethernet connection. Same principal applies to transferring files, backing up files on other computers in the network etc.
2. It is not possible today and with all probability will not be possible in the future to transmit power needed for your networking device via the wireless link. Unless, of course, you would be willing to be subjected to very high levels of microwave radiation. Thus a device that was marketed to you as “un-tethered” will in fact be very much tethered via the power cord or will have to be re-charged every so often. The power requirements are increasingly important for devices that are expected to be always online, such as phone sets. Therefore it is best to have it connected via a cable that can deliver both power and the communication signal at the same time.
3. Wireless communications are very much proprietary and require whole gamut of conversion equipment to transmit multi-media signals. The same CAT5E cable can without any modification support phone, computer network, balanced line level audio signal, baseband video signal as well as host of other, more specialized, control applications’ signals. With inexpensive adapters called “baluns” the same cable can carry significant number of channels of broadband television or carry a baseband video, such as security camera output, through great distances. All of those applications, except the computer network of course, will require specialized expensive conversion equipment if they needed to be transmitted via a Wi-Fi link.
4. The cost benefit of not running wires around the house is not as simple as issue as it seems. Having installed a wireless network at home you have only eliminated the need to wire for a single application – computer network. A modern home, however, requires all kinds of wiring to run even without regard to computers. The power and phones are obvious examples, as well as thermostats and security systems. Pre-wired speakers are common and most homes today have intercom systems as a desirable option, and those also require extensive wiring. It is very likely that the same contractor running the intercom or security cables is qualified to run computer cables – CAT5E or better. If you are building a home, you should definitely check if computer cabling option is available in your new home, and our advice is to go ahead and purchase it before the walls close. It is going to be a pretty involved and expensive procedure to install the cables later. As an added cost benefit of a wired computer network you will find that all modern computers ship with wired Ethernet network interface card included, and the latest models ship with 1000MBit/sec cards that are essentially free for the computer’s owner.
There are multiple sources of information available on proper planning and design of a residential cabling for voice, data, audio, video and other applications. One of the best sources is the TIA/EIA-570B standard, most resent release of which has been published in 2004. The standard outlines recommended types of the cables, principals of cable distribution in a single- and multi-dwelling units as well as recommended amount of cables to be installed based on the size of the house.
In conclusion, cutting the wire seems like a step forward, some sort of liberation of computer from the bonds of the infrastructure. I would caution the reader, however, to take a more balanced and informed approach before joining the wireless revolution. There are still (and will remain in foreseen future) sound reasons to include properly designed cabling system into the list of your dream home options.
With proliferation of wireless networking and communication equipment it is oh-so-tempting to cut the cord and save a significant sum of money in the process. But is everything that a regular computer networking user needs can be done using just wireless network? Let’s take a look at some pros and contras:
1. One important advantage of having a cabled network is the available bandwidth or simply speed. At the present point in time the speed of connection via a simple and inexpensive CAT5E cable can be 1000Mbit/sec, whereas the best that IEEE802.11g (one of the many flavors of Wi-Fi) can offer is only 54Mbit/sec. It may not seem so significant if you think you are only browsing Internet, and the DSL speed available to you is 1.5Mbit/sec. However, if you need to print via your network connection on a remote printer, you should realize that the print jobs, depending on the amount of graphic data in them, can easily reach dozens and even hundreds megabytes. Since 1Byte=8bit one 100MByte print job will take 15 seconds (and in reality this time can be much longer) to transmit via a Wi-Fi wireless connection, and this time shrinks to mere 1 sec or less on wired 1000MBit/s Ethernet connection. Same principal applies to transferring files, backing up files on other computers in the network etc.
2. It is not possible today and with all probability will not be possible in the future to transmit power needed for your networking device via the wireless link. Unless, of course, you would be willing to be subjected to very high levels of microwave radiation. Thus a device that was marketed to you as “un-tethered” will in fact be very much tethered via the power cord or will have to be re-charged every so often. The power requirements are increasingly important for devices that are expected to be always online, such as phone sets. Therefore it is best to have it connected via a cable that can deliver both power and the communication signal at the same time.
3. Wireless communications are very much proprietary and require whole gamut of conversion equipment to transmit multi-media signals. The same CAT5E cable can without any modification support phone, computer network, balanced line level audio signal, baseband video signal as well as host of other, more specialized, control applications’ signals. With inexpensive adapters called “baluns” the same cable can carry significant number of channels of broadband television or carry a baseband video, such as security camera output, through great distances. All of those applications, except the computer network of course, will require specialized expensive conversion equipment if they needed to be transmitted via a Wi-Fi link.
4. The cost benefit of not running wires around the house is not as simple as issue as it seems. Having installed a wireless network at home you have only eliminated the need to wire for a single application – computer network. A modern home, however, requires all kinds of wiring to run even without regard to computers. The power and phones are obvious examples, as well as thermostats and security systems. Pre-wired speakers are common and most homes today have intercom systems as a desirable option, and those also require extensive wiring. It is very likely that the same contractor running the intercom or security cables is qualified to run computer cables – CAT5E or better. If you are building a home, you should definitely check if computer cabling option is available in your new home, and our advice is to go ahead and purchase it before the walls close. It is going to be a pretty involved and expensive procedure to install the cables later. As an added cost benefit of a wired computer network you will find that all modern computers ship with wired Ethernet network interface card included, and the latest models ship with 1000MBit/sec cards that are essentially free for the computer’s owner.
There are multiple sources of information available on proper planning and design of a residential cabling for voice, data, audio, video and other applications. One of the best sources is the TIA/EIA-570B standard, most resent release of which has been published in 2004. The standard outlines recommended types of the cables, principals of cable distribution in a single- and multi-dwelling units as well as recommended amount of cables to be installed based on the size of the house.
In conclusion, cutting the wire seems like a step forward, some sort of liberation of computer from the bonds of the infrastructure. I would caution the reader, however, to take a more balanced and informed approach before joining the wireless revolution. There are still (and will remain in foreseen future) sound reasons to include properly designed cabling system into the list of your dream home options.
Subscribe to:
Posts (Atom)
