Network Assurance Flashcards
CAPWAP ports
5246-5247
CAPWAP - Control Channel Traffic Port
5246
CAPWAP - Data Channel Traffic Port
5247
TFTP Port
69
What Port can AP’s use to transfer data files
TFTP - Port 69
What port is used by mobility communications
16666-16667
Mobility Communications Port - 16666
Encrypted
Mobility COmmunications Port - 16667
Not encrypted
NETCONF SSH Subsystem Port
830
What type of credentials are configured on Access Points to ensure those credentials are avalaible everywhere?
Global Credentials
Can you override global credentials for a specific Cisco IOS AP?
Yes
Cisco AP DHCP Option
43
Cisco AP DNS option
cisco-capwap-controller
What broadcast address does a Cisco AP use to find a WLC?
255.255.255.255
How does (order) an AP learn about WLC@s
- DHCP option 43 (good for global companies where offices and controllers are on different continents).
- DNS entry for cisco-capwap-controller (good for local businesses - can also be used to find where brand new APs join) If you use CAPWAP, make sure there is a DNS entry for cisco-capwap-controller.
- Management IP addresses of controllers the LAP remembers previously.
- A Layer 3 broadcast on the subnet.
- Statically configured information.
- Controllers present in the mobility group of the WLC the AP last joined.
“DHCP option 43 is used by large companies to localize the information by the DHCP. This method is used by large enterprises that have a single DNS suffix. For example….” give an example
Cisco owns buildings in Europe, Australia, and the United States. In order to ensure that the LAPs only join controllers locally, Cisco cannot use a DNS entry and must use DHCP option 43 information to tell the LAPs what the management IP address of their local controller is.
Who created CAPWAP
IETF
CAPWAP is based
Lightweight Access Point Protocol (LWAPP) but adds additional security with Datagram Transport Layer Security (DTLS)
CAPWAP IPv4 Protocol Number
17 - uses UDP ports 5246 (control) and 5247 (data)
In an AP Split MAC architecture the following are examples of use cases performed by what?
802.11 authentication
802.11 association and re-association (mobility)
802.11 frame translation and bridging
802.1X/EAP/RADIUS processing
Termination of 802.11 traffic on a wired interface, except in the case of FlexConnect APs (discussed later in this guide)
The AP itself
What certificate does AP’s use for certificates when forming initial DTLS tunnels?
Manufacturing Installed Certificate (MIC)
Installed by cisco when shipped
What type of security archtiecture facilitates this VPN?
FlexConnect
What message types facilitate an inter-subnet WLC controller roam?
Mobiliy
In a Cisco WLC with full Mobility setup - does a inter-subnet controller roam result in a client IP address change?
No - WLC setup an “ANchor” original and “Foreign” entry in both WLC CLient Databases
User keeps original IP and “Foreign” client database tunnels traffic to anchor database
Cisco preferred redundancy model for WLC’s
N+1
Do backup WLC’s require liences
YEs
WHat port do WLC’s use to perform Stateful Switchover Wireless Controller Redundancy
REdundancy port
If a port says lineprotocol down (monitoring) - what does this mean
Port is a SPAN destination port
What Layer 3 switching technology must be enabled for Netflow to export records?
CEF
Does a version incomatibility affect showing local Netflow stats?
No
Is Netflow Version 9 backward compatible with other versions?
No
Are all netflow versions backwards compatible
Yes - apart from 9
What three (transport) protocols can a SYSLOG message be sent using
TCP
UDP
BEEPS
Syslog - what port is when when connecting via TLS
6514
If BPDU Guard is enabled, do root ports get err-disabled when a BPDU is received?
No
What enviroment is CIsco OfficeExtend used for? What is it?
AP’s used to extend corporate WLAN into users home
With Cisco OfficeExtend what protocol is used to provide securty between office and home?
DTLS
What command would enable the feature circled in red in SNMP?
service sequence-numbers
To configure a client to use a particualr key with a server what command should be used
ntp server <server_ip> key <key_id></key_id></server_ip>
In NTP what command is used to define the authentication key?
ntp authentication-key <number> md5 <key></key></number>
Specifies one or more keys that a time source must provide in its NTP packets in order for the device to synchronize to it
ntp trusted-key
What enables NTP authentication?
ntp authentication command
Difference ntp authentication-key and ntp trusted-key
ntp authentication-key used to define keys that are presented
ntp trusted-keys are used to define keys that are accepted
Syslog - TLS Port and Protocol
TCP 6514
Syslog - DTLS Port and Protocol
UDP 6514
