Lammle questions Flashcards
Enable Rapid Spanning Tree. Config
Switch(config)#spanning-tree mode rapid-pvst
How do we know a spanning-tree network has converged?
All switch and bridge ports are assigned as either root or designated ports. When all bridges/switches have transitioned to either forwarding/blocking state.
What are the two types of EtherChannels? What modes enable each?
Two types of EtherChannel: Cisco proprietary PAgP and the IEEE’s LACP.
For PAgP, use auto or desirable mode, and with LACP use passive or active
What can you do to provide two switches higher bandwidth than the default configuration is already providing?
Place the links in the same EtherChannel bundle. Up to 8 ports between switches.
What would put switch interfaces into EtherChannel port number 1, using LACP?
Switch(config)#interface port-channel 1
Switch(config-if)#channel-group 1 mode active
What two commands would guarantee your switch to be the root bridge for VLAN 30?
spanning-tree vlan 30 priority 0
spanning-tree vlan 30 root primary
Difference between TACACS+ and RADIUS
TACACS+ is Cisco proprietary (uses TCP also, port 49) (all AAA packets encrypted too) (multiprotocol support) (for devi ce administration)
RADIUS is an open standard (uses UDP also, port 1646/6, 1812/3) (only passwords encrypted) (authentication and authorization is combined) (for network access)
Difference between SNMP v2 and v3
SNMP v2 sends passwords as clear-text (also UDP). SNMP v3 can authenticate and encrypt
SNMP v3 three security modes and definitions
noAuthNoPriv: username authentication but no encryption
authNoPriv: MD5 or SHA (Secure Hash Algorithm) authentication but no encryption
authPriv: MD5 or SHA authentication and encryption
Enable AAA on a router
aaa new-model
in global config mode
What mitigates access layer threats?
Port security, DHCP snooping, dynamic ARP inspection, and identity-based networking
What does DHCP snooping do?
DHCP snooping validates DHCP messages, builds and maintains the DHCP snooping binding database, and rate-limits DHCP traffic for trusted and untrusted sources.
What are the HSRP (Hot Standby Router Protocol) states?
INIT, Learn, Listen, Speak, Standby, Active
HSRPv1 and HSRPv2 attributes
Group #:
Virtual MAC address:
Multicast Address:
Port:
HSRP v1 Group #: 0-255 Virtual MAC address: 0000.0c07.acxx Multicast Address: 224.0.0.2 Port: UDP port 1985
HSRP v2 Group #: 0-4095 Virtual MAC address: 0000.0c9f.fxxx Multicast Address: 224.0.0.102 Port: UDP port 1985
You want to configure RADIUS so your network devices have external authentication, but you also need to make sure you can fall back to local authentication. Which command will you use?
aaa authentication login default group MyRadiusGroup local
What is Dynamic ARP Inspection (DAI)?
A security feature that verifies address resolution protocol (ARP) requests and responses in a network
Requires DHCP snooping for MAC-to-IP bindings
Three roles for IEEE 802.1x standard
Client, authenticator, and authentication server
What tables does EIGRP maintain in RAM
Neighbor, topology, and routing
What do you do when troubleshooting EIGRP adjacency?
Interfaces between the devices are down.
The two routers have mismatching EIGRP autonomous system numbers.
Proper interfaces are not enabled for the EIGRP process.
An interface is configured as passive.
K values are mismatched.
EIGRP authentication is misconfigured
What must match for two OSPF routers to become neighbors?
Area ID, stub area flag, authentication password if using one
How is the default router-id chosen in OSPF
Cisco chooses the router ID by using the highest IP address of all configured loopback interfaces. If no loopback interfaces are configured with addresses, OSPF will choose the highest IP address of all active physical interfaces
In OSPF, Hellos are sent to what IP address?
224.0.0.5
Updates addressed to 224.0.0.6 are destined for which type of OSPF router?
224.0.0.6 is used on broadcast networks to reach the DR and BDR
What must match for OSPF routers to create an adjacency?
Also, what other items might prevent adjacency?
The hello and dead timers must match, they must both be configured into the same area as well as being in the same subnet.
Also, if authentication is configured, that info must match as well.
Check if an ACL is set and if a passive interface is configured
Every OSPF router must use a different RID.
What is the relationship with OSPFv3, IPv4, and RID
If you have IPv4 configured on the router, it is not mandatory that you configure the RID.
If you don’t have IPv4 configured on the router, it is mandatory that you configure the RID.
32-bit RID (router ID)
Which command will show all the LSAs known by a router? OSPF
show ip ospf database
Troubleshooting steps for OSPF
- Make sure interfaces are operational and enabled for OSPF
- Verify Hello and Dead Timers
- Make sure interfaces are in the same area
- Make sure no passive interfaces are configured
What is the default port mode of Cisco switches?
What needs to be done to trunk between switches
Auto. Need to switch one to either on or desirable
Which command will display the CHAP authentication process as it occurs between two routers in the network?
debug ppp authentication
R1(config-router)# neighbor 10.10.200.1 remote-as 6200
What is 10.10.200.1?
What is 6200?
IP Address of neighbor
AS # of the remote router
What are some GRE characteristics?
- GRE uses a protocol-type field in the GRE header so any layer 3 protocol can be used through the tunnel
- GRE is stateless and has no flow control
- GRE offers no security
- GRE creates additional overhead for tunneled packets—at least 24 bytes.
What does it mean when you receive a flapping message when you configure your GRE tunnel?
It means you have used your tunnel interface address instead of the tunnel destination address
What command will show you the IP addresses and tunnel source and destination addresses of the interfaces?
show interface tunnel 0
What do you need to configure to use frame relay?
DLCI
Difference between VPN and GRE tunnel
If you are looking to provide a secure method of connecting remote users to resources stored within a central location, you should probably implement a VPN. However, if you need to pass traffic over an otherwise incompatible network, a GRE tunnel should be implemented.
Which two technologies are examples of layer 2 MPLS VPN technologies?
Virtual Private Lan Switch (VPLS) and Virtual Private Wire Service (VPWS) are two technologies that provide layer 2 MPLS VPN’s
What are one-way requirements for voice traffic?
One-way requirements include latency < 150 ms, jitter <30 ms, and loss < 1%, and bandwidth needs to be 30 to 128 Kbps.
On which SDN architecture layer does Cisco APIC-EM reside?
Control
What is a trust boundary and what are some examples of trust boundaries?
A trust boundary is where packets are classified and marked. IP phones and the boundary between the ISP and enterprise networks are common examples of trust boundaries.
What is the traditional Data Plane?
It is responsible for forwarding frames and packets from ingress to egress interfaces using protocols. Needs the control plane for good info.
What is the traditional Control Plane?
For managing and controlling any forwarding table the data plane uses. Routing protocols are managed by control plane.
What is the SDN Data Plane?
Contains network elements, meaning any physical or virtual device that deals with traffic
What is the SDN Control Plane?
Software solution, provides centralized control of the router and switches that populate the data plane
What is the SDN Application Plane?
Contains applications that communicate their network requirements towards the controller using APIs
What are Southbound APIs?
List the southbound API standards
They are used for communication between controllers and network elements.
OpenFlow, NETCONF, onePK, OpFlex
What are Northbound APIs?
Used for communication between SDN applications and controllers
What are trust boundaries?
Point where packet marking (which identify traffic such as voice, data, or video) can be created, removes, or rewritten.
What are the three ways of classifying traffic?
Marking, Addressing, and Application signatures
What is NBAR?
Provides deep-packet inspection on layer 4 to 7 on a packet
Explain the difference between Policers and Shapers in terms of where to deploy them, TCP resends, and jitter/delay
Policers: deploy them on the ingress if possible, more TCP resends (since theres a higher drop probability), and no jitter/delay
Shapers: deploy on the egress side, fewer TCP resends than policers, and introduces jitter/delay
What is VTP pruning?
A way to preserve bandwidth, only sending the broadcast to trunk links that must actually have the info
