VLAN Access Map

VLAN Access Map gives you the ability to control traffic between users in the same VLAN. It is configured in the same way as a route map is configured. If you have VLAN 100 of which subnet is 192.168.100.0/24, and you want to deny access from host 192.168.100.10 to host 192.168.100.20. Here is how you configure your switch.

First, you create the VLAN map. In the global configuration mode, enter the command “vlan access-map” the syntax of the command is

Vlan access-map WORD NUMBER

WORD: the name of the access-map
NUMBER: the sequence number of the statement. You can later insert another statements with sequence number lower or higher than your current one.

After you enter the “vlan access-map” command, you will be in the access-map configuration level. Here, you can specify what to match and the action is, just like a route-map.

If you enter the command match and hit the question mark, you will be listed by two options, ip and mac. You guessed it, you can permit or deny access based on ip address or the mac address. We need to create an access-list, either ip access-list or mac access-list, that match the criteria of what we need to be matched. We will create the access-list later, but here we will configure the access-map to match ip access-list numbered 101. and the action is to drop (the action is either drop or forward. Drop for deny and forward for permit) the packet.

Match ip address 101

Action drop

For this scenario, you will want to match the ip of source 192.168.100.10 and destination 192.168.100.20. Therefore, we will create an ip access-list numbered 101 as what it is the access-list number we have configured in the access-map. Exit the access-map configuration and enter access-list command.

Access-list 101 permit ip host 192.168.100.10 host 192.168.100.20

The last thing to do is to apply to which vlan does the access-map applies to. To do this, we use the command “vlan filter” at the global configuration mode. The syntax is

Vlan filter WORD vlan-list NUMBER

WORD: the name of the access-map
NUMBER: the number of the vlan you want the access-map to be applied to. You could use a number for the vlan or a vlan list for more than one vlan.

EtherChannel

EtherChannel is a way to combine some phsycal link to be one logical link.


EtherChannel cisco, layer 2 (switch)

EtherChannel doesn't really aggregate the max speed of the link. if a logical link consists of four 100mps link, the max speed for a single communication is not 400mbps. it is still 100mbps. cisco has an algorithm for determining which path a traffic will use, it could be configure to depends on:

• soure MAC address


• destination MAC address


• source and destination MAC address


• source IP


• destination IP


• source and destination IP


• source port


• destination port


• source and destination port

how we configure this usually depends on what the other end of the EtherChannel is.


every link participating in an EtherChannel must have the same configuration (same vlan / trunk, etc)


there are two EtherChannel protocols,

• Link Aggregation Control Protocol (LACP), defined by IEEE. used when connecting to non cisco devices


• Port Aggregation Control Protocol (PAgP), cisco-proprietary. used when connecting to cisco devices.

each of the protocol have 2 modes, LACP -> passive, active. PAgP -> auto, desirable. each of the mode show how the configured interface will negotiating the EtherChannel (you may think of these modes as the modes in trunk negotiation)



configuring etherchannel is different in CatOS and in IOS. to establish EtherChannel in IOS first you create a virtual etherChannel interface (interface Port-channel number) and configure this interface (vlan/trunk, etc). then you configure the physical interface that will be part of the virtual etherchannel interface ('channel-group number mode desirable|auto' enter this command at interface configuration level). remember that all of the physical interface must have identical configuration.

configuration in IOS


while in CatOS

set port name 3/1 Link #1 in Channel
set port name 3/2 Link #2 in Channel
set port name 3/3 Link #3 in Channel
set port name 3/4 Link #4 in Channel

set vlan 20 3/1-4

set port channel 3/1-4 mode desirable

Serial PPP

Computer make use of relatively short parallel connections between interior components, but use a serial bus to convert signals for most external communications

Serial : sends information accross one wire, one data bit at a time. the 9-pin serial connector on most PCs uses two loops of wire, one in each direction for data communication, plus additional wires to control the flow of information.
Parallel : sends the bits over more wire simultaneosly. 25-pin parallel on your PC, eight data-carrying wires to carry 8 bits simultaneously.


theoritically parallel is faster 8 times than serial connections, in reality there are some problems with parallel connection such as:
Clock Skew : all the bits in parallel connections don't leave the transmitter and received at the receiver at the same time. some bits get there later. the receiver must wait until the bits have arrived and synchronize itself with the transmitter.
Cross Talk : because paralles use more wires, there is much probability of having a corrupted data through cross talks.


three key serial communication standard:
RS-232 - uses 9 pins. RJ-45 conform to the RS-232 standard.
RS-232 pins:
pin 1 - Data Carrier Detect (DCD)
pin 2 - Receive pin (RxD). used to carries data from the serial device to the computer
pin 3 - Transmit pin (TxD). used to carries data from the computer to the serial device
pin 4 - Data Terminal Ready (DTR) indicates the modem that the computer is ready
pin 5 - ground
pin 6 - Data Set Ready (DTS) indicates that the dataset is on
pin 7 - Request to Send (RTS) requests clearance to send data to a modem
pin 8 - Clear to Send (CTS) acknoledge the RTS signal of the computer.
pin 9 - Ring Indicater (RI) receipt of a telephone ring signal
V.35 - typically used for modem-to-multiplexer communication. ITU standard for high-speed, synchronous data exchange combines the bandwidth of several telephone circuits. in US V.35 is the interface standard used by most routers and DSUs that connect to T1 carriers.
HSSI - High-Speed Serial Interface (HSSI) support transmission rates up to 52Mb/s. commonly used for connecting routers on LANs with WANs over high-speed lines such as T3 lines.


TDM. slices time into smaller intervals so that the link carries the bits from multiple input sources.
T1/E1 and ISDN telephone lines are common example of synchronous TDM

Statistical time-division multiplexing (STDM). channels compete for free slot (int TDM when a channel has nothing to send then the slot is empty, wasting resources). STDM requires each transmission to carry identification information.
SONET is an example of STDM


Telco (24 Ds0 is multiplexed int one Ds1/T1)
Ds0 - 64 kb/s
Ds1 - 1.544 mb/s (24 DS0)
Ds2 - 6.312 mb/s (96 Ds0, 2T1c - T1c = 2 T1)
Ds3 - 45 Mb/s (7 T2)

*******
DTE-DCE
*******
DTE : end of CPE, usually a router
DCE : end of the WAN provider's side. usually a modem or CSU/DSU. the device that convert user data received from DTE to the form acceptable to the WAN. responsible for providing clocking signal.


there are times when you want to connect two DTE devices (such as routers, computers, terminals or printers) directly without the DCE. a special cable called null modem eliminates the needs of a DCE. with a null modem connection, Tx and Rx lines are crosslinked (crosslinked at the DCE cable). remember that one of the device must provide the clocking signal, one of the device must be the DCE (DCE is the device with the female interface connector).

Universal Asynchronous Receiver/Transmitter (UART) is a chip on a PC motherboard that converts the parallel stream bits to the serial stream bits and vice-versa to support communication with external device such as modem. because mose data flow in a PC is in parallel form.

cisco has introduced a smart serial cable (serial interfaces on most cisco routers). smart serial interface is smaller (thinner) which has 26-pin than the DB-60 connector.


*****************
WAN Encapsulation
*****************
on each wan connection, data is encapsulated. the encapsulation depends on the technology used for wan connection
HDLC - the default encapsulation for point-to-point, dedicated links and circuit-swicthed connections when the link uses two cisco devices.
PPP - provides router-to-router and host-to-host networkc connections over synchronous and asynchronous circuits. PPP can work with several layer 3 protocol (IP, IPX) and has some authentication mechanism (CHAP, PAP).
SLIP - Standard Line Internet Protocol. standard point-to-point protocol for serial connections using TCP/IP. SLIP has been largely replaced by PPP.
X.25 - uses LAPB (Link Access Procedure, Balanced) encapsulation.
Frame Relay - industry standard form packet switched wan connection. successor of X.25
ATM - international standard for cell relay. data is sent on fixed length. ATM takes advanages of high-speed transmission, such as E2, SONET and T3.


HDLC - bit-oriented synchronous data link layer protocol developed by the ISO (current standard for HDLC is ISO 13239). HDLC defines layer 2 framing standard that allows flow control and error control through the use of acknowledgements (sequence number).
-------------------------------------------------------------------
When you want to transmit frames over synchronous or asynchronous links, you must remember that those links have no mechanism to mark the beginnings or ends of frames. HDLC uses a frame delimiter, or flag, to mark the beginning and the end of each frame.
You use Cisco HDLC as a point-to-point protocol on leased lines between two Cisco devices. If you are connecting to a non-Cisco device, use synchronous PPP.
-------------------------------------------------------------------

Vlan Trunking Protocol

advantages of VTP:
-dynamic trunk configuration when vlans are added to the network
-dynamic reporting of added vlans across a network

Terminology
vtp domain : switches in the same vtp domain share the same vlan configuration details using vtp advertisements. a router defines the boundary of a domain
vtp modes : a switch can be configured in one of the three modes:
-Server, vtp servers advertise vlan configuration to other vtp-enabled switches in the same domain. VTP SERVERS STORE THE VLAN CONFIGURATION IN NVRAM. at the server is where the vlan can be created, deleted or renamed.
-Client, function the same way as servers, but clients could not create, delete or rename vlans. clients also only store the vlan configuration while the switch on.
-Transparent, transparent switches don't participate in vtp. transparent switches don't store vlans advertised by servers. however, they do advertise / forward vtp advertisement that they receive. vlans can be created, renamed or deleted and local only to that switch.
vtp pruning : VTP-pruning restricts packets from passing to an interfce to a switch that doesn't have the same vlan as the packets come frome. this can save some bandwidth
vtp revision number : each switch running VTP keep track of a revision number. the revision number is a 32-bit and starts from 0. the revision number will determine wether the information received is more recent than the current one or not. everytime a change occure, the revision number is incremented. (a domain name change doesn't increment the revision number but reset it to 0)

VTP Default Settings
version = 1 (vtp has 3 version 1, 2, 3. only one version allowed in a domain)
domain name = null (means no domain)
mode = server
config revision = 0
vlans = 1

when a VTP first starts, by default there are 5 vlans created in a switch.

when a VTP server switch is given a domain name, it will propagate the domain name to all switches for us.

you can reset the revision number of a switch by changin its domain name.

the command "show vtp status" will give you information about the running vtp in the switch. such as the domain name, version number, vtp mode, revision number, vlans information, etc.

the command "show vtp counters" will show you information about how many each information is sent or received.

VTP ONLY COMMUNICATES ON TRUNK PORT

VTP ONLY LEARNS ABOUT NORMAL-RANGE VLANs (vlan ids of 1 to 1005)

VTP DOMAIN NAMES ARE CASE SENSITIVE

VLAN CREATED BEFORE ENABLING VTP WILL BE REMOVED

************
VTP messages
************
VTP messages are encapsulated within an ethernet frame which then encapsulated in trunking protocol (either 802.1Q or ISL). the vtp message (header and message) is at the data portion of the frame. VTP ADVERTISEMENTS ARE SENT PERIODICALLY. VTP sends advertisement to a reserved multicast address which is 01-00-0C-CC-CC-CC.

VTP header - fields and size varies but always contains domain name, domain name length, version, message type, revision number.

VTP message - VTP domain name, md5 digest, updater identity and timestamp message was sent.
for each vlan, the message contains:
-VLAN ID
-VLAN name
-VLAN type
-VLAN state
-additional VLAN configuration information

Type of advertisements
Inside each message there's a field that tells which type the message is.

Summary advertisments :

• are sent every 5 minutes by VTP server or client to inform other switches in the domain of the current revision number and also the domain name.
  
• sent immediately after a change occur.
  
• there is a followers field that indicates that this summary is followed by subset advertisement. code for this type is 0x01.
  
• 
  

Subset advertisements :
contain vlan information. triggered by:

• creating / deleting a vlan
  
• suspanding / activating a vlan
  
• changing the name of a vlan
  
• changing the MTU of the vlan
  

it may take some subset advertisements to fully update the vlan configuration. there is a seq-number field that tells the sequence of packets, starts with 1. the code for this type is 0x02.


Request advertisements :
a request is sent to a VTP server if:

• domain name has been changed.
  
• the switch received a summary with revision number higher than its own.
  
• a subset advertisement is missed for some reasons.
  
• the switch has been reset.
  

when a VTP server received a request, it reponds by sending a summary advertisement and then a subset advertisement. the type for this message is 0x03.


***********
VTP pruning
***********
when vtp pruning is enabled on a switch, it reconfigures the trunk link based on which ports are configured with which vlans.

essentialy, if you want to enable pruning in your network, configuring the vtp pruning at the vtp servers is enough.

vtp pruning only prunes vlan pruning-eligle. vlans 2 - 1001 are pruning-eligible by default. vlan pruning-eligibles can be changed.

pruning cannot be done to vlans which pruning-ineligible. those vlans are 1 and 1002-1005

*****************
VTP configuration
*****************
To be noticed when configuring VTP servers:

• confirm that default settings are present.
  
• always reset the configuration revision number.
  
• configure at least 2 vtp servers in the network. because only on servers we can configure vlans, if one down we still have the other one.
  
• if you set a password for vtp information, ensure that all switches is configured with the same password. switches without password or wrong password reject VTP advertisements.
  
• BY DEFAULT A CISCO SWITCH DOESN'T IMPLEMENT ANY PASSWORD.
  
• create vlan after you've enabled VTP on the vtp server, because vlan created before vtp enabled, are removed.
  
• ensure all switches run the same vtp protocol version.
  

To be noticed when configuring vtp clients:

• confirm that default settings are present.
  
• verify vtp status. confirm that vlans has been updated and revision number is changed.
  
• configure access port, you still need to assign ports to existing VLANs.
  
• 
  

(at global configuration)
Configure VTP Domain

vtp domain word

Configure VTP mode

vtp mode word

Configure password

vtp password password

Configure version

vtp version number

word : a string
password : a string used as a password


*********
Common error in configuring VTP

• protocol version mismatch. vtp version is incompatbile with different version.
  
• password mismatch / not set on every switch.
  
• different domain name. to solve this only configure domain name on VTP servers, because VTP servers will propagate the domain name to all other switches.
  

REMEMBER, BECAUSE BOTH VTP SERVERS AND CLIENTS SEND SUMMARY ADVERTISEMENT, BOTH CAN HAVE ITS VLAN CONFIGURATION RUINED WHEN A SERVER / CLIENT RECEIVED A SUMMARY ADVERTISEMENT WITH HIGHER REVISION NUMBER, IT WILL REQUEST FOR VLAN INFORMATION (SUBSET ADVERTISEMENTS) AND CONFIGURE ITS OWN VLAN CONFIGURATION (NO MATTER IF THE SENDING SWITCHES IS A CLEINT AND THE REQUESTING IS A SERVER). ALWAYS RESET THE REVISION NUMBER OF A SWITCH BEFORE ADDING IT TO THE NETWORK.

Frame Relay

Frame Relay is a network technology that runs on layer 2. Frame Relay is a NBMA (Non-Broadcast Multiple Access) network. Frame Relay usually used as an option for WAN connection.

***********
Topologies
***********
when connecting more than two sites, a topology must be chosen to create the connection between each sites. the Frame Relay topologies are star, full-mesh and partial-mesh.

Star (hub and spoke)
a central site acts as a hub and other remote sites act as spokes. each remote site has an access link to the central site.

Full Mesh
full mesh topology connects every site to every other.

*****
DLCI
*****
DLCI is the identifier of each VC in frame relay. DLCI is 10-bits long and there for can hold up to 1024 (0 - 1023). some DLCI number are reserved and cannot be used. those are

0 : LMI (ANSI, ITU)
1-15 : reserved for future use
992-1007 : CLLM
1008-1022 : reserved for future use (ANSI, ITU)
1019-1020 : multicasting (cisco)
1023 : LMI (cisco)


DLCI is local significance which means that it's only unique to the local. at other hop, the same DLCI number can be used to identify different VC.


************
Inverse ARP
************
ARP is used to find out the layer 2 address from a layer 3 address available. inverse ARP does the opposite.

used primarily in frame relay and ATM.

on cisco routers, inverse ARP is on by default.

Inverse ARP works as much like ARP. the frame relay router will sends an inverse ARP requests on its PVC to dscover the layer 3 adress of the remote device connected to the frame relay network.

to clear dynamically created frame relay maps that are created using inverse ARP, use the command

clear frame-relay inarp

****
LMI
****
Local Management Interface, a protocol developed by Cisco, digital equipment corporation (DEC), Northern Telecom and StrataCom. enable the DTE to communicate with the DCE and acquire information about the status of the network.

LMI is basically a keepalive mechanism. every 10 seconds or so, the end device polls the network, either requesting a dumb sequenced response or channel status information. if the network does not respong width the requested information, the user device may consider the connection to be down.

there are 3 LMI types:
- cisco
- Ansi
- Q933a (ITU standard)
starting from 11.2 IOS version, the LMI is autosensed. if it happen to manually configure the lmi type, do it with the command

frame-relay lmi-type [cisco | ansi | q933a]

if you configure the lmi type manually, you need to set the keepalive interval too. if the keepalive interval is mismatch too big. the switch can declare that the router is dead. configure the keepalive interval with the command "keepalive second". default keepalive is 10 seconds on cisco serial interface.


******************
Address Mapping
******************
dynamic mapping, dynamic mapping in frame relay is achieved from the combination of LMI and inverse ARP. LMI will acquire the active DLCI for each data link, so the router knows what DLCI that's exist. then the router will send inverse ARP request for each DLCI to acquire the corresponding network layer address.

static mapping, you can enter a static mapping for a DLCI on cisco routers. enter the command (at interface level configuration)

frame-relay map protocol protocol-address dlci [broadcast] [ietf | cisco]

protocol-address : layer 3 address
dlci : DLCI number associated for the layer 3 address
ietf : use this keyword instead of cisco when connecting a non-cisco device

you cannot use both dynamic mapping and static mapping for the same dlci and protocol. you can disable the inverse ARP protocol for an interface by entering the command

no frame-relay inverse-arp

*************
Subinterface
*************
used in frame relay to enable forwarding routing updates through a physical interface which has multiple connections (split horizon rule).

point-to-point subinterface
establish one PVC connection to another physical interface / subinterface on a remote router. acts as a point-to-point connection. has a single DLCI, each point-to-point subinterface is on its own subnet. typically, there is a seperate subnet for each point-to-point subinterface. solve the split horizon issue.

multipoint subinterface
establich multiple PVC. acts as a NBMA network. doesn't solve the split horizon issue. all the participating interface are in the same subnet.

REMEMBER
when you use the subinterface, usuall you must assign the subinterface with a DLCI number to differentiate it from the physical interface (LMI does not know about subinterfaces).

do not assign network address to the physical interface. if the physical interface has an address, frames are not received by the local subinterfaces. the required command for the physical interface is to specify the encapsulation to be used (ALL SUBINTERFACES WILL BE USING THE SAME ENCAPSULATION AS SPECIFIED AT THE PHYSICAL INTERFACE ENCAPSULATION).


*************
Flow Control
*************
frame relay switched use the FECN and BECN bit to control the flow of frames going through the network

SW1 ----------------------------------------- SW2

assume that congestion occure at the link between SW1 and SW2.

FECN bit is set for every frame going from SW1 to SW2.
BECN bit is set for every frame coming to SW1 from SW2 and is leaving on another interface.

DTE can set the DE (Discard Eligible) flag to 1. usually less important frames are marked with the DE 1. this is used to avoid more critical data to be discarded should congestion happened.


**************************
Configuring Frame Relay
**************************

needed configuration for frame-relay to work
- encapsulation frame-relay
- assign ip address to the interface

Cisco routers autosense the LMI type used. recall that there are three LMI types: Cisco, ANSI Annex D and Q933-A Annex A. the default LMI type for cisco routers is cisco.

you can configure subinterfaces with the command

interface serial number.sub-number multipoint | point-to-point

number = the physical port number
sub-number = subinterface number. to make troubleshooting easier, use the DLCI as the subinterface number.
multipoint | point-to-point = specify the type of the subinterface


to assign a subinterface its DLCI use the following command

frame-relay interface-dlci dlci-number

dlci-number = the number of the DLCI you wished to be associated with the subinterface.

Switch:Basic

CSMA/CD
Carrier Sense : before transmitting, each device sense the media if there's another data being transmitted.
Multiple Access : in ethernet, the distance between devices maybe too long that one device couldn't detect the data sent from another and both device may transmit data at the same time.
Collision Detection : when a collision is detected, by unnormal amlitude. devices run a random backoff time and start transmitting again.

Full-duplex switches do not use CSMA/CD, because full-duplex communication has their own Tx and Rx line. this is not the case if the line is half-duplex (see autonegotiation).


Ethernet uses CRC as its checksum


Auto-MDIX
with auto-MDIX enabled, you can use either straight-through or crossover to connect devices to the switch.
The auto-MDIX feature is enabled by default on switches running Cisco IOS Release 12.2(18)SE or later. For releases between Cisco IOS Release 12.1(14)EA1 and 12.2(18)SE, the auto-MDIX feature is disabled by default.

propagation delay => the time needed for a packet to travel through the media from the source to the destination. (about 0.556 microseconds per 100 m for Cat 5 UTP.)

latency => the overall time needed for a packet to travel from its source to the destination. source of latency can come from three sources, 1. the time the NIC needs to put voltage pulses on the wire, 2. the propagation delay, 3. the time for the devices on the way to process the packets.


Switch Packet Forwarding methods
Store-and-Forward : the switch first store the data in the buffer until the full frame receive before forwarding it. (Cisco switches use this mechanism). when the frame is in the buffer, the switch will check for error with CRC. store-and-forward is needed for QoS analysis where frame classification for traffic prioritization is necessary.
Cut-through : the switch acts upon the data as soon as the data is received. the switch only buffers the destination address for CAM table lookup and then forward the packets. this mehcanism doesn't do error checking. there are two types of cut-through, fast-forward -> forward the frame only by seeing the first 6 bytes (Destination address) and fragment-free -> stores the first 64 bytes, The reason fragment-free switching stores only the first 64 bytes of the frame is that most network errors and collisions occur during the first 64 bytes.


layer 3 switching : as layer 2 lan performs switching by analyzing the MAC address correspondends to which port, layer 3 switching analyze the IP address is associated to which interface.
Routers perform additional Layer 3 services that Layer 3 switches are not capable of performing. Routers are also capable of performing packet forwarding tasks not found on Layer 3 switches, such as establishing remote access connections to remote networks and devices. Dedicated routers are more flexible in their support of WAN interface cards (WIC), making them the preferred, and sometimes only, choice for connecting to a WAN. Layer 3 switches can provide basic routing functions in a LAN and reduce the need for dedicated routers.


*******
Booting
*******
The boot loader finds the Cisco IOS image on the switch by first looking in a directory that has the same name as the image file (excluding the .bin extension). If it does not find it there, the boot loader software searches each subdirectory before continuing the search in the original directory.

IOS initializes the interface using the Cisco IOS commands found in the operating system configuration file named config.text, stored in the switch flash memory

The boot loader also provides access into the switch if the operating system cannot be used. The boot loader has a command-line facility that provides access to the files stored on Flash memory before the operating system is loaded. From the boot loader command line you can enter commands to format the flash file system, reinstall the operating system software image, or recover from a lost or forgotten password.

When the switch is on, the POST begins. During POST, the LEDs blink while a series of tests determine that the switch is functioning properly. When the POST has completed, the SYST LED rapidly blinks green. If the switch fails POST, the SYST LED turns amber. When a switch fails the POST test, it is necessary to repair the switch.



you can show the last 10 command that you've entered by entering the command "show history". you can change the size of history commands by entering "terminal history size 50" at the privileEXEC mode.


********************
Configuring a switch
********************
to remotely access a switch you must assign the switch an IP address.

good practice is not to use VLAN 1 as the management vlan.

you need to configure a default-gateway to the switch, so it can forward packets to other LAN from the command prompt of the switch. to do this enter the command
ip default-gateway gateway-address
gateway-address : the ip address of the router

configure duplex and speed
duplex auto
speed auto

network adminstrator can manage the CAM table. enter "show mac-address-tabe" to see what's inside the CAM table. you can configure the aging time of the MAC address learned from receiving port (default is 300secs) and you can also assign a static MAC address to a specific port (static MAC addresses don't aged out by time) by entering
mac-address-table static vlan (1-4096, ALL)interface interface-id

: static MAC address you wich to assign
(1-4096, ALL) : vlan number
interface-id : interface type and number

you can copy your running-configuration to the flash (as a backup, so that you can save more than one configuration by entering the command
copy running-configuration flash:filename
filename : the name of the file you wish. example, config.bak1

then you can delete the files saved in flash by entering the following command
delete flash:filename

you can also erase the startup-configuration in nvram by entering
erase nvram
erase startup-configuration

***************
Switch security
***************

you can set password to line connection (console, vty) on a switch by entering "password the-password" at the line level configuration and by entering "login" you enable the authentication process. (however the password can be seen by vewing the running-configuration file)

you can set password needed to access the privilegeEXEC mode by entering one of the two commands
enable password password
enable secret password
but, if you use the "enable password" command, the password is not encrypted and can be viewed in the running-configuration file. when you enter both command the password from "enable secret" is the one that's used.

you can apply access-list to the line connection similar applying access-list to interfaces by entering "access-class". the difference is that interface use the "access-group" command.

vty lines (you may have up to 16 vty lines, 0 - 15) are telnet by default you can change it to SSH (there are some version of SSH, use SSHv2 because it use stronger encryption than SSHv1) enter "transport input ssh" at the line configuration level. you can also enter "transport input all" to enable telnet and ssh connection.

SSH communication use DES, 3DES (algorithm used usually specified by client). and needs RSA keys which involve public key and private key. SSH server should provide public key to make a switch serves a public key enter "crpyto key generate rsa" at global configuration level

to overcome the issue of viewing the password in the configuration file. you can use the encrypted password service by entering "service password-encryption" at global configuration level. the encryption that's used is called type 7, this is a weak encryption and there are tools to crack password encrypted with this encryption.

to recover password (if you accidentally happen to forget your password) you need to get access to the switch from console, actually the step is booting the switch and enter the helper mode, rename the config.text file so the switch doesn't load the configuration, after you're inside rename the config.text back. and change your old password.


you can set banner on line connection, "banner login" will be shown before the username and password prompt is presented.


***********************
Common Security Attacks
***********************
-MAC flooding
-fake DHCP server (spoofed gateway)
-CDP attack, from CDP attacker can inspect the version of the device and search for vulnerabilities.
-Telnet attacks - Brute force, DoS (vulnerability at telnet server).


*************
Port Security
*************
allow you to strict which MAC addresses are able to connect using the port to the switch.
3 ways to configure port security
- static secure MAC addresses: you specify the MAC addresses allowed to connect to the port. mac addresses configured this way are stored in the address table and the running-configuration on the switch. enter the command "switchport port-securit mac-address theAddress" at the interface configuration level.
- dynamic secure MAC addresses: MAC addresses are learned dynamically and stored only in the address table. MAC addresses are removed when the switch restarts. enter the command "switchport port-security" at the interface configuration level.
- Sticky secure MAC addresses: MAC addresses are learned dynamically and saved in the running-configuration. enter "switchport port-security mac-address sticky" at the interface configuration level.

enter "switchport port-security maximum number" at the interface configuration level to set the maximum number of MAC address learned to the interface.

violation occurs when
-maximum MAC addresses (default maximum mac address learned is 1) learned is reached and new MAC address attempts to access the interface.
-the same MAC address has been learned / configured on a secure interface and is seen on another secure interface in the same VLAN.

change violation modes by entering "switchport port-security violation [protect | restrict | shutdown]"
security violation modes
- protect: frames from unknown source addresses are dropped. you're not notified of the violations occured.
- restrict: frames are dropped, syslog message is logged, violation counter increments.
- shutdown: frames are dropped, syslog message created, port is shutdowned, violation counter increments. (this is the default mode)


"show port-security interface interface-id" to see port security status on that interface
"show port-security address" to see the secure MAC addresses table


a good practice is to shutdown unused port. you can use the "interface range" command to shutdown a range of ports.