CCNA 42 to 60 Flashcards
NTP
Network Time Protocol, used to set the same time across your network, if the time isn’t the same on your devices you will have issues with your devices, i.e log files stating the wrong time. Certificates are also time stamped, they will time out/ expire if the time has drifted too far
Time is provided by NTP server (this server can be inside your network or a Stratum Zero)
ACL
Access Control List-
ACL Extended=
ACL Net Interface=
ACL Global NAT=
Dynamic NAT
Dynamic NAT can be defined as mapping of a private IP address to a public IP address from a group of public IP addresses called as NAT pool. Dynamic NAT establishes a one-to-one mapping between a private IP address to a public IP address.
*once to communication is completed the IP is recycled
Static NAT/PAT
Manually tell the router which private address will work with which public address and port number.
The table will have the private address and the public address and port recorded in a NAT table. When return traffic comes in the source and port is looked up in the table
one to one
Socket
Combination of IP address and port
NAT Overload or Port Address Translation (PAT)
Uses the public IP assigned to the routers interface (or another IP address assigned for NAT overload) combined with a port number to create a unique address to communicate off the private network.
TCP Ports to know FTP 21 SSH 22 Telnet 23 HTTP 80 SMTP 25 POP3 110 IMAP 143 HTTPS 443
UDP
DNS 53
NAT
Network Address Translator, allows private IPs access to a public domain.
Inside=You own the address
Outside= someone else owns the address
Local= private address
Global= public address
Inside Local= inside the network and private
Outside Global= outside the network and public
Inside Global= Ip you own that is used off of your network (NAT)
Outside local= ip the belongs to another network that is private
Stratum Clock
Atomic based clock that provides the time (Stratum 0)
UTC
Coordinated Universal Time, where time starts
stratum number
If you are getting your time from a stratum 3 clock, you become a stratum 4 clock
DHCP
Dynamic Host Configuration Protocol, give IP addresses dynamically
Client: ability for a device to request an address. (auto gens a 169.254.x.x address if it doesn’t here back from the DHCP server)
Server: where the IPs are managed from
Relay: will forward DHCP requests to the Server if the client is unable to reach it and then relays back the response. (replays as a unicast)
Set up relay of your trunked device
ASCII
is a 7-bit character set containing 128 characters. It contains the numbers from 0-9, the upper and lower case English letters from A to Z, and some special characters.
abbreviated from American Standard Code for Information Interchange, is a character encoding standard for electronic communication. ASCII codes represent text in computers, telecommunications equipment, and other devices.
SNMP
Monitoring protocol ; Simple Network Management Protocol; Polls data (activity) from devices on a certain interval. A common poll interval in 60 seconds.(clear text)
v1:
v2c: can monitor, however has very limited authentication (r/o, r/w) can be used to change settings on your device if it is not locked down. (clear text)
v3: increased security; access levels- view, groups, user. Views can be assigned to groups and then users to the group.
OID/MIB
Object identifiers, all of the things you can identify using SNMP (temps, run time, up down).
Management Information Base; data base of OIDs
Syslog
syslog format (date, time, message)
0 Emergency—emerg = System is unusable
Ex: Drive failure
1 Alert—aler t= Should be corrected immediately
Ex: Loss of the primary ISP connection.
2 Critical—crit =Critical conditions
Ex: A failure in the system’s primary application.
3 Error—err = Error conditions
Ex: An interface has gone down
4 Warning—warning = May indicate that an error will occur if action is not taken.
Ex: A non-root file system has only 2GB remaining.
5 Notice—notice = Events that are unusual, but not error conditions.
Ex: Someone just logged in
6 Informational—info = Normal operational messages that require no action.
Ex:An application has started, paused or ended successfully.
7 Debug—debug = Information useful to developers for debugging the application.
QoS
Traffic discrimination (which traffic is most important):
Classify Traffic: What interface, or ACL the traffic is on can be used to give priority.
Marking: (layer 2 )CoS class of service marking which will give a priority level to frame.
(Layer 3) ToS- type of service marking which will give a priority level to frame. EX: DSCP
Queuing: default is “first in, first out” queue can be changed to priority which will move desired traffic to the front of the line.
Shoot: (WRED) waited random early detention, picks off excess traffic.
Policing: putting anti QoS on traffic can be used to slow traffic / limit traffic (traffic you don’t want)
Shaping: traffic you want, limit traffic after a certain bandwidth
If there is no congestion, there is no need for QoS
NBAR
Network based application recognition
NBAR intelligently classifies and allows you to enforce QoS policy on today’s mission-critical applications.
Low latency Queuing
PQ-CBWFQ—cisco proprietary that stops traffic starvation. in QoS priority, it allows you to put a data cap on the traffic.
PQ( priority queuing)
CB (Class based)
WF(waiting fair)
FTP-TFTP
Used to copy files:
FTP- TCP communication (secure/ authentication), port 20/ 21, faster–
TFTP- UDP (unsecure/ no authentication), port 69
CIA
Confidentiality of Data
Integrity of Data
Availability of Data
What can cause vulnerability in a network?
Bugs, flaws in hardware or software
Bad or lacking configuration
legacy systems
Broken Processes
Unpatched systems
ARP Spoofing
Lying to the network about the gateway lay 2 addresses
CDP Flooding
Floods fake CDP messages
What is and exploit ?
Way or method that can be used to take advantage of a vulnerability
Mitigation
action of redoing to severity, or seriousness of a threat
Steps/ places to look: Increase awareness--Applications, Network infrastructure-- Training users--- Testing--- test after training, send out fake phishing emails and ask users to report
DAI
Dynamic ARP inspection, insures the validity of an ARP request
Security Policy
Access Control- physical access and logical access control
Change management policy- policy that give guidance on how, when changes can be made so that they do not cause harm or vulnerability
Mobile Policy
Baseline Policy
AUP- acceptable use policy (signed annually)
Password Policies
Data Retention (emails and documents, how long to keep data and when to get rid of it)
Incident Reporting Policy- how to report an incident
Vulnerability and Risk Assessment Policies—
Social Engineering
Phishing–
Spear Phishing–
Pretexting–
Tailgating–
Physical Security
Man trap, guard, who has access to switches ? access hards, temperature sensors, UPS, laptop/ computer locks
Password Policy
Educate users of what the policy is
Enforce the policy —
Characteristics in policy:
Length- 7 plus
Complexity- upper, lowercase, special characters
Max Age- change every 45 days
History- user can’t reuse last ten passwords
Minimum age: user can’t change password more than once in a day
This can be enforced in AD for example
2FA/MFA
When you use at least two methods to authenticate users identity.
Cat A —One thing a user knows, (pin or password)
Cat B —Something that the user has, (card, key fob or app of phone, security token)
Cat C — Something that the user “is” (finger print, face rec, voice rec, eye rec
What is the difference between the aux port and the console port?
Both aux and console ports can let you into the router or switch, the console port however is active while booting up. The console port function is useful for password reset and other reboot function.
In order to get beyond the user mode on the aux port, you need an enable secret set. You will need to do this from the console port.
AAA
Authentication, authorization and accounting—
Authentication (Verifying who is accessing)
–Can have a server with passwords and access levels (active directory) connected to switches and routers for access.
Authorization (What can a person do– access level)
Accounting (who does/ did what–logs)
TACACS +
Cisco standard— works better with Cisco devices
Encrypted communication, used TCP
protocol used when the AAA clients communicate with the server (active directory)
Terminal Access Controller Access Control System
RADIUS
Industry standard, used UDP and does not encrypt the full session. does encrypt passwords
Remote Authentication Dial-in User Service
protocol used when the AAA clients communicate with the server (active directory)
Implicit Deny
When traffic is not matched on an ACL it is automatically denied
StandardACL
only matches source IPs and or source IP range
Expended ACL
can match source and destination IPs as well as port numbers
Port Security
Cannot be a dynamic port, max Mac for port is ONE out of the box. When you hit the max, the port is error shut down.
CAM Table overflow attack
An attack, also known as Mac flooding that floods the CAM table with fake MAC addresses and consumes the switches memory
