Module 7: Configuring Campus Switches to Support Voice
When migrating to a VoIP network, all network requirements, including power and capacity planning, must be examined. In addition, congestion avoidance techniques should be implemented. This module will highlight the basic issues and define initial steps to take to ensure that the VoIP implementation works correctly.
Lesson 1: Planning for Implementation of Voice in a Campus Network
IP telephony services are often provided over the campus infrastructure. To have data and voice application traffic harmoniously coexist, mechanisms must be set in place to differentiate traffic and to offer priority processing to delay sensitive voice traffic. Quality of service (QoS)
policies mark and qualify traffic as it traverses the campus switch blocks. Specific VLANs keep voice traffic separate from other data to ensure that it is carried through the network with special handling and with minimal delay. Specific design and implementation considerations should be made at all campus switches supporting VoIP.
The lesson includes these topics:
Explaining Converged Network Benefits
Describing VoIP Network Components
Explaining Traffic Characteristics of Voice and Data
Describing VoIP Call Flow
Explaining Auxiliary VLANs
Describing QoS
Explaining the Importance of High Availability for VoIP
Explaining Power Requirements in Support of VoIP
Lesson 2: Accommodating Voice Traffic on Campus Switches
VoIP traffic and data will share the same infrastructure. To avoid congestion and subsequent intermittent VoIP communications, QoS must be configured as close to the end device as possible. To accomplish this, QoS trust boundaries must be configured. Several options are available to accomplish this task. This module will provide a brief overview of those options.
The lesson includes these topics:
QoS and Voice Traffic in the Campus Model
LAN-Based Classification and Marking
Describing QoS Trust Boundaries
Configuring a Switch for Attachment of a Cisco IP Phone
Describing Basic Switch Commands to Support Attachment of a Cisco IP Phone
What Is Cisco AutoQoS VoIP?
Configuring Cisco AutoQoS VoIP on a Cisco Catalyst Switch
The lesson includes this activity:
Lab 7-1: Configuring IP Telephony Support
Module 8: Minimizing Service Loss and Data Theft in a Campus Network
This module defines the potential vulnerabilities within a network related to VLANs. After the vulnerabilities are identified, solutions for each vulnerability are discussed, and configuration commands are defined. The module also discusses port security for denial of MAC spoofing, MAC flooding, and using PVLANs and VACLs to control VLAN traffic. VLAN hopping,
DHCP spoofing, ARP spoofing, and STP attacks are also explained. The learner will also learn about potential problems, resulting solutions, the method to secure the switch access with use
of vty ACLs, and implementing SSH for secure Telnet access.
Lesson 1: Understanding Switch Security Issues
Basic security measures should be taken to guard against a host of attacks that can be launched
at a switch and its ports. Specific measures can be taken to guard against MAC flooding, which
is a common Layer 2 malicious activity.
The lesson includes these topics:
Overview of Switch Security Concerns
Describing Unauthorized Access by Rogue Devices
Switch Attack Categories
Describing a MAC Flooding Attack
Describing Port Security
Configuring Port Security on a Switch
Port Security with Sticky MAC Addresses
Authentication, Authorization, and Accounting
Authentication and Authorization Methods
802.1x Port-Based Authentication
Lesson 2: Protecting Against VLAN Attacks
On networks using trunking protocols, there is a possibility of rogue traffic “hopping” from one
VLAN to another, thereby creating security vulnerabilities. These VLAN hopping attacks are best mitigated by close control of trunk links.
Private VLANs (PVLANs) can be configured to establish security regions within a single
VLAN without subnetting, and VLAN access control lists (VACLs) can be used to filter traffic within a VLAN.
The lesson includes these topics:
Explaining VLAN Hopping
Mitigating VLAN Hopping
VLAN Access Control Lists
Configuring VACLs
Explaining PVLANs
Configuring PVLANs
Lesson 3: Protecting Against Spoof Attacks
DHCP, MAC, and Address Resolution Protocol (ARP) spoofing are all methods used to gain unauthorized access to a network or to redirect traffic for malicious purposes. DHCP snooping, port security, and dynamic ARP inspection (DAI) can be configured to guard against these
threats.
The lesson includes these topics:
Describing a DHCP Spoof Attack
Describing DHCP Snooping
Configuring DHCP Snooping
Describing ARP Spoofing
Describing DAI
Describing Commands to Configure DAI
Protecting Against ARP Spoofing Attacks
Lesson 4: Describing STP Security Mechanisms
After STP operations are stable in a switched network, the administrator may want to guard against rogue switches being attached to the network because these switches may take on the
role of the root or backup root bridge. Bridge protocol data unit (BPDU) guard, BPDU filtering, and root guard are features that attempt to contain the points at which switches and root bridges
can be attached to the network.
The lesson includes these topics:
Protecting the Operation of STP
Describing BPDU Guard Configuration
Describing BPDU Filtering Configuration
Describing Root Guard
Describing Root Guard Configuration Commands
Lesson 5: Preventing STP Forwarding Loops
Spanning tree operations can be severely disrupted by links that pass traffic in one direction and not in the other direction. The Cisco Catalyst platform provides features to guard against this condition. Unidirectional Link Detection (UDLD) and loop guard
protect the network from anomalous conditions that result from unidirectional link conditions.
The lesson includes these topics:
Describing UDLD
Describing Loop Guard
Configuring UDLD and Loop Guard
Preventing STP Failures Caused by Unidirectional Links
Lesson 6: Securing Network Switches
The devices on any network must be secured. A number of vulnerabilities can be reduced by setting passwords on physical and virtual ports, disabling unneeded services, forcing the encryption of sessions, and enabling logging at the device level.
The lesson includes these topics:
Describing Vulnerabilities in the CDP
Describing Vulnerabilities in the Telnet Protocol
Describing Vulnerabilities in the SSH
Describing vty ACLs
Describing Commands to Apply ACLs to vty
Best Practices: Switch Security Considerations
The lesson includes these activities:
Case Study 8-1: Applying Security Practices to Secure Devices in the Campus
Case Study 8-2: Using Security Tools to Secure Devices in the Campus
Lab 8-3: Applying Security Tools
Module 1: BSCI Network Requirements
Learners should be able to describe the converged network requirements of various network and networked applications within the Cisco network architectures.
Lesson 1: Describing Network Requirements
This lesson describes the converged network requirements of various network and networked applications within the Cisco network architectures.
Module 2: Configuring EIGRP
Learners should be able to implement and verify EIGRP operations.
Lesson 1: Introducing EIGRP
This lesson describes how EIGRP selects routes between routers in diverse, large-
scale internetworks.
The lesson includes these topics:
Overview
EIGRP Capabilities and Attributes
Underlying Processes and Technologies
EIGRP Operation
EIGRP Metric
Calculating the EIGRP Metric
Integrating the EIGRP and IGRP Routes
Summary
Lesson 2: Implementing and Verifying EIGRP
This lesson describes how to implement EIGRP routing.
The lesson includes these topics:
Overview
Configuring Basic EIGRP
Using a Wildcard Mask in EIGRP
Configuring the ip default-network Command
Verify EIGRP IP Routes
Verify EIGRP IP Operations
Summary
Lesson 3: Configuring Advanced EIGRP Options
This lesson describes how to configure advanced EIGRP features for scalable networks.
The lesson includes these topics:
Overview
Route Summarization
Configuring Manual Route Summarization
Load Balancing Across Equal Paths
Configuring Load Balancing Across Unequal-Cost Paths
EIGRP Bandwidth Use Across WAN Links
Configuring EIGRP Bandwidth Use Across WAN Links
Summary
Lesson 4: Configuring EIGRP Authentication
This lesson describes how to implement authentication in an EIGRP network.
The lesson includes these topics:
Overview
Router Authentication
MD5 Authentication
Configuring MD5 Authentication
Troubleshooting MD5 Authentication
Summary
Lesson 5: Using EIGRP in an Enterprise Network
This lesson presents how to describe, recognize, and correct common EIGRP issues and problems.
The lesson includes these topics:
Overview
Scalability in Large Networks
EIGRP Queries
EIGRP Stubs
SIA Connections
Preventing SIA Connections
Graceful Shutdown
Summary
The lesson includes these activities:
Lab 2-0: Basic Configuration
Lab 2-1: Configuring and Tuning EIGRP
|
