Module 6.2 Flashcards
Series of commands that control whether a device forwards or drops packets based on information found in the packet header
Access Control List (ACL)
- They limit network traffic to increase network performance.
- They provide traffic flow control.
- They provide a basic level of security for network access.
- They filter traffic based on traffic type
- They screen hosts to permit or deny access to network services.
ACL
Two types of Cisco IPv4 ACLs are
Standard and Extended
Used to permit or deny traffic only from source IPv4 addresses. The destination of the packet and the ports involved are not evaluated.
Standard ACLs
filter IPv4 packets based on several attributes that include:
- Protocol type
- Source IPv4 address
- Destination IPv4 address
- Source TCP or UDP ports
- Destination TCP or UDP ports
- Optional protocol type information for finer control
Extended ACLs
Can be created using either a number or a name to identify the ACL and its list of statements.
Standard and extended
Allows administrators to manage end devices such as servers, workstations, routers, switches, and security appliances, on an IP network.
Simple Network Management Protocol (SNMP)
SNMP system consists of two elements
- SNMP manager that runs SNMP management software
- SNMP agents which are the nodes being monitored and managed
A database on the agents that stores data and operational statistics about the device.
Management Information Base
part of a network management system (NMS).
SNMP manager
can collect information from an SNMP agent by using the “get” action and can change configurations on an agent by using the “set” action.
SNMP manager
can forward information directly to a network manager by using “traps”.
SNMP agents
Provides data to enable network and security monitoring, network planning, traffic analysis to include identification of network bottlenecks, and IP accounting for billing purposes
NetFlow
NetFlow technology distinguishes packet flows using a combination of seven fields:
- Source IP address
- Destination IP address
- Source port number
- Destination port number
- Layer 3 protocol type
- Type of Service (ToS) marking
- Input logical interface
Because network switches can isolate traffic, traffic sniffers or other network monitors, such as IDS, cannot access all the traffic on a network segment.
Packet analyzer (packet sniffer or traffic sniffer) limitation
A feature that allows a switch to make duplicate copies of traffic passing through a switch, and then send it out a port with a network monitor attached. The original traffic is forwarded in the usual manner.
Port mirroring
The most common method of accessing system messages.
Syslog protocol
The syslog logging service provides three primary functions:
- The ability to gather logging information for monitoring and troubleshooting
- The ability to select the type of logging information that is captured
- The ability to specify the destination of captured syslog messages
Important to synchronize the time across all devices on the network. When the time is not synchronized between devices, it will be impossible to determine the order of the events that have occurred in different parts of the network.
Network Time Protocol (NTP)
Allows routers on the network to synchronize their time settings with an NTP server.
NTP protocol
NTP networks use a hierarchical system of time sources. Each level in this hierarchical system.
stratum
NTP servers are arranged in three levels known as strata:
Stratum 0
Stratum 1
Stratum 2 and lower strata
An NTP network gets the time from authoritative time sources. These authoritative time sources, also referred to as devices, are high-precision timekeeping devices assumed to be accurate and with little or no delay associated with them
Stratum 0
Devices are directly connected to the authoritative time sources. They act as the primary network time standard.
Stratum 1
Are connected to stratum 1 devices through network connections. Synchronize their time using the NTP packets from stratum 1 servers. They could also act as servers for stratum 3 devices.
Stratum 2 and lower strata
Three independent security functions provided by the AAA architectural framework are
authentication, authorization, and accounting.
- Users and administrators must prove that they are who they say they are.
- Can be established using username and password combinations, challenge and response questions, token cards, and other methods.
- AAA provides a centralized way to control access to the network.
Authentication
- After the user is authenticated, services determine which resources the user can access and which operations the user is allowed to perform.
Authorization
- Records what the user does, including what is accessed, the amount of time the resource is accessed, and any changes that were made.
- Keeps track of how network resources are used.
Accounting
A private network that is created over a public network, usually
the internet. Uses virtual connections that are routed through the internet from the organization to the remote site.
VPN
