CCNA 200-301 Official Cert Guide, Volume 2, 1st Edition © 2020

Introduction xxvii

PART I IP ACCESS CONTROL LISTS 3

CHAPTER 1

Introduction to TCP/IP Transport and Applications 4
“Do I Know This Already?” Quiz 4
Foundation Topics 6
TCP/IP Layer 4 Protocols: TCP and UDP 6
    Transmission Control Protocol 7
    Multiplexing Using TCP Port Numbers 7
    Popular TCP/IP Applications 10
    Connection Establishment and Termination 12
    Error Recovery and Reliability 13
    Flow Control Using Windowing 15
User Datagram Protocol 16
TCP/IP Applications 16
    Uniform Resource Identifiers 17
    Finding the Web Server Using DNS 18
    Transferring Files with HTTP 20
    How the Receiving Host Identifies the Correct Receiving Application 21
Chapter Review 22

CHAPTER 2

Basic IPv4 Access Control Lists 24
“Do I Know This Already?” Quiz 24
Foundation Topics 26
IPv4 Access Control List Basics 26
    ACL Location and Direction 26
    Matching Packets 27
    Taking Action When a Match Occurs 28
    Types of IP ACLs 28
Standard Numbered IPv4 ACLs 29
    List Logic with IP ACLs 29
    Matching Logic and Command Syntax 31
        Matching the Exact IP Address 31
        Matching a Subset of the Address with Wildcards 31
        Binary Wildcard Masks 33
        Finding the Right Wildcard Mask to Match a Subnet 33
        Matching Any/All Addresses 34
    Implementing Standard IP ACLs 34
        Standard Numbered ACL Example 1 35
        Standard Numbered ACL Example 2 36
    Troubleshooting and Verification Tips 38
Practice Applying Standard IP ACLs 39
    Practice Building access-list Commands 39
    Reverse Engineering from ACL to Address Range 40
Chapter Review 41

CHAPTER 3

Advanced IPv4 Access Control Lists 44
“Do I Know This Already?” Quiz 44
Foundation Topics 46
Extended Numbered IP Access Control Lists 46
    Matching the Protocol, Source IP, and Destination IP 46
    Matching TCP and UDP Port Numbers 48
    Extended IP ACL Configuration 51
        Extended IP Access Lists: Example 1 51
        Extended IP Access Lists: Example 2 53
    Practice Building access-list Commands 54
Named ACLs and ACL Editing 54
    Named IP Access Lists 54
    Editing ACLs Using Sequence Numbers 56
    Numbered ACL Configuration Versus Named ACL Configuration 58
    ACL Implementation Considerations 59
    Additional Reading on ACLs 60
Chapter Review 61

PART I REVIEW 64

PART II SECURITY SERVICES 67

CHAPTER 4

Security Architectures 68
“Do I Know This Already?” Quiz 68
Foundation Topics 70
Security Terminology 70
Common Security Threats 72
    Attacks That Spoof Addresses 72
        Denial-of-Service Attacks 73
        Reflection and Amplification Attacks 75
        Man-in-the-Middle Attacks 76
        Address Spoofing Attack Summary 77
    Reconnaissance Attacks 77
    Buffer Overflow Attacks 78
    Malware 78
    Human Vulnerabilities 79
    Password Vulnerabilities 80
        Password Alternatives 80
Controlling and Monitoring User Access 82
Developing a Security Program to Educate Users 83
Chapter Review 84

CHAPTER 5

Securing Network Devices 86
“Do I Know This Already?” Quiz 86
Foundation Topics 88
Securing IOS Passwords 88
    Encrypting Older IOS Passwords with service password-encryption 89
    Encoding the Enable Passwords with Hashes 90
    Interactions Between Enable Password and Enable Secret 90
    Making the Enable Secret Truly Secret with a Hash 91
    Improved Hashes for Cisco’s Enable Secret 92
    Encoding the Passwords for Local Usernames 94
    Controlling Password Attacks with ACLs 95
Firewalls and Intrusion Prevention Systems 95
    Traditional Firewalls 96
        Security Zones 97
    Intrusion Prevention Systems (IPS) 99
    Cisco Next-Generation Firewalls 100
    Cisco Next-Generation IPS 102
Chapter Review 103

CHAPTER 6

Implementing Switch Port Security 106
“Do I Know This Already?” Quiz 106
Foundation Topics 108
Port Security Concepts and Configuration 108
    Configuring Port Security 109
    Verifying Port Security 112
    Port Security MAC Addresses 113
Port Security Violation Modes 114
    Port Security Shutdown Mode 115
    Port Security Protect and Restrict Modes 117
Chapter Review 119

CHAPTER 7

Implementing DHCP 122
“Do I Know This Already?” Quiz 122
Foundation Topics 124
Dynamic Host Configuration Protocol 124
    DHCP Concepts 125
        Supporting DHCP for Remote Subnets with DHCP Relay 126
        Information Stored at the DHCP Server 128
    Configuring DHCP Features on Routers and Switches 129
        Configuring DHCP Relay 130
        Configuring a Switch as DHCP Client 130
        Configuring a Router as DHCP Client 132
    Identifying Host IPv4 Settings 133
        Host Settings for IPv4 133
        Host IP Settings on Windows 134
        Host IP Settings on macOS 136
        Host IP Settings on Linux 138
Chapter Review 140

CHAPTER 8

DHCP Snooping and ARP Inspection 144
“Do I Know This Already?” Quiz 144
Foundation Topics 146
DHCP Snooping 146
    DHCP Snooping Concepts 146
        A Sample Attack: A Spurious DHCP Server 147
        DHCP Snooping Logic 148
        Filtering DISCOVER Messages Based on MAC Address 150
        Filtering Messages that Release IP Addresses 150
    DHCP Snooping Configuration 152
        Configuring DHCP Snooping on a Layer 2 Switch 152
        Limiting DHCP Message Rates 154
        DHCP Snooping Configuration Summary 155
Dynamic ARP Inspection 156
    DAI Concepts 156
        Review of Normal IP ARP 156
        Gratuitous ARP as an Attack Vector 157
        Dynamic ARP Inspection Logic 158
    Dynamic ARP Inspection Configuration 160
        Configuring ARP Inspection on a Layer 2 Switch 160
        Limiting DAI Message Rates 163
        Configuring Optional DAI Message Checks 164
        IP ARP Inspection Configuration Summary 165
Chapter Review 166

PART II REVIEW 168

PART III IP SERVICES 171

CHAPTER 9

Device Management Protocols 172
“Do I Know This Already?” Quiz 172
Foundation Topics 174
System Message Logging (Syslog) 174
    Sending Messages in Real Time to Current Users 174
    Storing Log Messages for Later Review 175
    Log Message Format 176
    Log Message Severity Levels 177
    Configuring and Verifying System Logging 178
    The debug Command and Log Messages 180
Network Time Protocol (NTP) 181
    Setting the Time and Timezone 182
    Basic NTP Configuration 183
    NTP Reference Clock and Stratum 185
    Redundant NTP Configuration 186
    NTP Using a Loopback Interface for Better Availability 188
Analyzing Topology Using CDP and LLDP 190
    Examining Information Learned by CDP 190
    Configuring and Verifying CDP 193
    Examining Information Learned by LLDP 194
    Configuring and Verifying LLDP 197
Chapter Review 199

CHAPTER 10

Network Address Translation 202
“Do I Know This Already?” Quiz 202
Foundation Topics 204
Perspectives on IPv4 Address Scalability 204
    CIDR 205
    Private Addressing 206
Network Address Translation Concepts 207
    Static NAT 208
    Dynamic NAT 210
    Overloading NAT with Port Address Translation 211
NAT Configuration and Troubleshooting 213
    Static NAT Configuration 213
    Dynamic NAT Configuration 215
    Dynamic NAT Verification 217
    NAT Overload (PAT) Configuration 219
    NAT Troubleshooting 222
Chapter Review 223

CHAPTER 11

Quality of Service (QoS) 226
“Do I Know This Already?” Quiz 226
Foundation Topics 228
Introduction to QoS 228
    QoS: Managing Bandwidth, Delay, Jitter, and Loss 228
    Types of Traffic 229
        Data Applications 229
    Voice and Video Applications 230
    QoS as Mentioned in This Book 232
    QoS on Switches and Routers 233
Classification and Marking 233
    Classification Basics 233
    Matching (Classification) Basics 234
    Classification on Routers with ACLs and NBAR 235
    Marking IP DSCP and Ethernet CoS 236
        Marking the IP Header 237
        Marking the Ethernet 802.1Q Header 237
        Other Marking Fields 238
    Defining Trust Boundaries 238
    DiffServ Suggested Marking Values 239
        Expedited Forwarding (EF) 240
        Assured Forwarding (AF) 240
        Class Selector (CS) 241
        Guidelines for DSCP Marking Values 241
Queuing 242
    Round-Robin Scheduling (Prioritization) 243
    Low Latency Queuing 243
    A Prioritization Strategy for Data, Voice, and Video 245
Shaping and Policing 245
    Policing 246
        Where to Use Policing 246
    Shaping 248
        Setting a Good Shaping Time Interval for Voice and Video 249
Congestion Avoidance 250
    TCP Windowing Basics 250
    Congestion Avoidance Tools 251
Chapter Review 252

CHAPTER 12

Miscellaneous IP Services 254
“Do I Know This Already?” Quiz 254
Foundation Topics 256
First Hop Redundancy Protocol 256
    The Need for Redundancy in Networks 257
    The Need for a First Hop Redundancy Protocol 259
    The Three Solutions for First-Hop Redundancy 260
    HSRP Concepts 261
        HSRP Failover 261
        HSRP Load Balancing 262
Simple Network Management Protocol 263
    SNMP Variable Reading and Writing: SNMP Get and Set 264
    SNMP Notifications: Traps and Informs 265
    The Management Information Base 266
    Securing SNMP 267
FTP and TFTP 268
    Managing Cisco IOS Images with FTP/TFTP 268
        The IOS File System 268
        Upgrading IOS Images 270
        Copying a New IOS Image to a Local IOS File System Using TFTP 271
        Verifying IOS Code Integrity with MD5 273
        Copying Images with FTP 273
    The FTP and TFTP Protocols 275
        FTP Protocol Basics 275
        FTP Active and Passive Modes 276
        FTP over TLS (FTP Secure) 278
    TFTP Protocol Basics 279
Chapter Review 280

PART III REVIEW 284

PART IV NETWORK ARCHITECTURE 287

CHAPTER 13

LAN Architecture 288
“Do I Know This Already?” Quiz 288
Foundation Topics 290
Analyzing Campus LAN Topologies 290
    Two-Tier Campus Design (Collapsed Core) 290
        The Two-Tier Campus Design 290
        Topology Terminology Seen Within a Two-Tier Design 291
    Three-Tier Campus Design (Core) 293
    Topology Design Terminology 295
Small Office/Home Office 295
Power over Ethernet (PoE) 297
    PoE Basics 297
    PoE Operation 298
    PoE and LAN Design 299
Chapter Review 300

CHAPTER 14

WAN Architecture 302
“Do I Know This Already?” Quiz 302
Foundation Topics 304
Metro Ethernet 304
    Metro Ethernet Physical Design and Topology 305
    Ethernet WAN Services and Topologies 306
        Ethernet Line Service (Point-to-Point) 307
        Ethernet LAN Service (Full Mesh) 308
        Ethernet Tree Service (Hub and Spoke) 309
    Layer 3 Design Using Metro Ethernet 309
        Layer 3 Design with E-Line Service 309
        Layer 3 Design with E-LAN Service 311
Multiprotocol Label Switching (MPLS) 311
    MPLS VPN Physical Design and Topology 313
    MPLS and Quality of Service 314
    Layer 3 with MPLS VPN 315
Internet VPNs 317
    Internet Access 317
        Digital Subscriber Line 318
        Cable Internet 319
        Wireless WAN (3G, 4G, LTE, 5G) 320
        Fiber (Ethernet) Internet Access 321
    Internet VPN Fundamentals 321
        Site-to-Site VPNs with IPsec 322
        Remote Access VPNs with TLS 324
    VPN Comparisons 326
Chapter Review 326

CHAPTER 15

Cloud Architecture 328
“Do I Know This Already?” Quiz 328
Foundation Topics 330
Server Virtualization 330
    Cisco Server Hardware 330
    Server Virtualization Basics 331
    Networking with Virtual Switches on a Virtualized Host 333
    The Physical Data Center Network 334
    Workflow with a Virtualized Data Center 335
Cloud Computing Services 336
    Private Cloud (On-Premise) 337
    Public Cloud 338
    Cloud and the “As a Service” Model 339
    Infrastructure as a Service 339
    Software as a Service 341
    (Development) Platform as a Service 341
WAN Traffic Paths to Reach Cloud Services 342
    Enterprise WAN Connections to Public Cloud 342
        Accessing Public Cloud Services Using the Internet 342
        Pros and Cons with Connecting to Public Cloud with Internet 343
        Private WAN and Internet VPN Access to Public Cloud 344
        Pros and Cons of Connecting to Cloud with Private WANs 345
        Intercloud Exchanges 346
        Summarizing the Pros and Cons of Public Cloud WAN Options 346
A Scenario: Branch Offices and the Public Cloud 347
    Migrating Traffic Flows When Migrating to Email SaaS 347
    Branch Offices with Internet and Private WAN 349
Chapter Review 350

PART IV REVIEW 352

PART V NETWORK AUTOMATION 355

CHAPTER 16

Introduction to Controller-Based Networking 356
“Do I Know This Already?” Quiz 357
Foundation Topics 358
SDN and Controller-Based Networks 358
    The Data, Control, and Management Planes 358
        The Data Plane 359
        The Control Plane 360
        The Management Plane 361
        Cisco Switch Data Plane Internals 361
    Controllers and Software-Defined Architecture 362
        Controllers and Centralized Control 363
        The Southbound Interface 364
        The Northbound Interface 365
    Software Defined Architecture Summary 367
Examples of Network Programmability and SDN 367
    OpenDaylight and OpenFlow 367
        The OpenDaylight Controller 368
        The Cisco Open SDN Controller (OSC) 369
    Cisco Application Centric Infrastructure (ACI) 369
        ACI Physical Design: Spine and Leaf 370
        ACI Operating Model with Intent-Based Networking 371
    Cisco APIC Enterprise Module 373
        APIC-EM Basics 373
        APIC-EM Replacement 374
    Summary of the SDN Examples 375
Comparing Traditional Versus Controller-Based Networks 375
    How Automation Impacts Network Management 376
    Comparing Traditional Networks with Controller-Based Networks 378
Chapter Review 379

CHAPTER 17

Cisco Software-Defined Access (SDA) 382
“Do I Know This Already?” Quiz 383
Foundation Topics 384
SDA Fabric, Underlay, and Overlay 384
    The SDA Underlay 386
        Using Existing Gear for the SDA Underlay 386
        Using New Gear for the SDA Underlay 387
    The SDA Overlay 390
        VXLAN Tunnels in the Overlay (Data Plane) 390
        LISP for Overlay Discovery and Location (Control Plane) 392
DNA Center and SDA Operation 395
    Cisco DNA Center 395
    Cisco DNA Center and Scalable Groups 396
        Issues with Traditional IP-Based Security 397
        SDA Security Based on User Groups 398
DNA Center as a Network Management Platform 400
    DNA Center Similarities to Traditional Management 401
    DNA Center Differences with Traditional Management 402
Chapter Review 403

CHAPTER 18

Understanding REST and JSON 406
“Do I Know This Already?” Quiz 406
Foundation Topics 408
REST-Based APIs 408
    REST-Based (RESTful) APIs 408
        Client/Server Architecture 409
        Stateless Operation 410
        Cacheable (or Not) 410
    Background: Data and Variables 410
        Simple Variables 410
        List and Dictionary Variables 411
    REST APIs and HTTP 413
        Software CRUD Actions and HTTP Verbs 413
        Using URIs with HTTP to Specify the Resource 414
    Example of REST API Call to DNA Center 417
Data Serialization and JSON 418
    The Need for a Data Model with APIs 419
    Data Serialization Languages 421
        JSON 421
        XML 421
        YAML 422
        Summary of Data Serialization 423
    Interpreting JSON 423
        Interpreting JSON Key:Value Pairs 423
        Interpreting JSON Objects and Arrays 424
        Minified and Beautified JSON 426
Chapter Review 427

CHAPTER 19

Understanding Ansible, Puppet, and Chef 428
“Do I Know This Already?” Quiz 428
Foundation Topics 430
Device Configuration Challenges and Solutions 430
    Configuration Drift 430
    Centralized Configuration Files and Version Control 431
    Configuration Monitoring and Enforcement 433
    Configuration Provisioning 434
        Configuration Templates and Variables 435
        Files That Control Configuration Automation 437
Ansible, Puppet, and Chef Basics 438
    Ansible 438
    Puppet 440
    Chef 441
    Summary of Configuration Management Tools 442
Chapter Review 442

PART V REVIEW 444

PART VI FINAL REVIEW 447

CHAPTER 20

Final Review 448
Advice About the Exam Event 448
    Exam Event: Learn About Question Types 448
    Exam Event: Think About Your Time Budget 450
    Exam Event: A Sample Time-Check Method 451
    Exam Event: One Week Away 451
    Exam Event: 24 Hours Before the Exam 452
    Exam Event: The Last 30 Minutes 452
    Exam Event: Reserve the Hour After the Exam 453
Exam Review 454
    Exam Review: Take Practice Exams 454
        Using the Practice CCNA Exams 455
        Exam Review: Advice on How to Answer Exam Questions 456
        Exam Review: Additional Exams with the Premium Edition 457
    Exam Review: Find Knowledge Gaps 458
    Exam Review: Practice Hands-On CLI Skills 460
        CCNA Exam Topics with CLI Skill Requirements 460
    Exam Review: Self-Assessment Pitfalls 462
    Exam Review: Adjustments for Your Second Attempt 463
    Exam Review: Other Study Tasks 464
Final Thoughts 464

PART VII APPENDIXES 467

Appendix A

Numeric Reference Tables 469

Appendix B

CCNA 200-301, Volume 2 Exam Updates 476

Appendix C

Answers to the “Do I Know This Already?” Quizzes 478
Glossary 494

Online Appendixes

Appendix D

Topics from Previous Editions

Appendix E

Practice for Chapter 2: Basic IPv4 Access Control Lists

Appendix F

Previous Edition ICND1 Chapter 35: Managing IOS Files

Appendix G

Exam Topics Cross-Reference

Appendix H

Study Planner

9781587147135 TOC 10/18/2019